SharpRelay

使用方法 この攻撃を機能させるための唯一の要件は、ローカル管理者 権限を持つビーコン、またはドライバをロードできるビーコンを持つことです。SharpRelayを使用した攻撃は以下のように動作します： 署名済み のWinDivertドライバを侵害されたホストの任意のフォルダにアップロードします。 SharpRelayを実行して、ポート445に着信するパケットの宛先ポートを変更し、別のポート（例：8445）にリダイレクトします。 ビーコンからCobalt Strikeのrportfwdコマンドを実行して、侵害されたホストのポート8445を自チームサーバーのポート445に転送します。...

PrivExchange

PrivExchange POC tools accompanying the blog Abusing Exchange: One API call away from Domain Admin. Requirements These tools require impacket. You can install it from pip with pip install impacket, but it is recommended to use the latest version from GitHub. privexchange.py This tool simply logs ...

OpenRelayMagic

OpenRelayMagic root@kitploit: ╔═╗┌─┐┌─┐┌┐┌╦═╗┌─┐┬ ┌─┐┬ ┬╔╦╗┌─┐┌─┐┬┌─┐ ║ ║├─┘├┤ │││╠╦╝├┤ │ ├─┤└┬┘║║║├─┤│ ┬││ ╚═╝┴ └─┘┘└┘╩╚═└─┘┴─┘┴ ┴ ┴ ╩ ╩┴ ┴└─┘┴└─┘ Tool to test for vulnerable open relays on SMTP servers Features Check single target/ domain list Port 587 and 465 Implemented Multithreaded...

CVE-2026-91143

goproxy through version 15.3 fails to enforce HTTP basic authentication on CONNECT tunnel requests. An unauthenticated attacker on the network can issue a CONNECT request to establish a tunnel through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and ...

CVE-2026-65352

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

EUVD-2026-78003

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

CVE-2026-65355 is an information disclosure vulnerability in Apple Private Relay , where improper state management allowed a website to determine a user's real IP address even with Private Relay enabled. The issue is rated CVSS 4.3 (Medium) with required user interaction and low confidentiality i...

CVE-2026-65352

CVE-2026-65352 is an information disclosure flaw in Apple's Private Relay feature, where a website may be able to determine a user's IP address even with Private Relay enabled. The issue was addressed with improved state management . Fixed versions: iOS 26.6.1 , iPadOS 26.6.1 , macOS Tahoe 26.6.2...

EUVD-2026-77988

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65352

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2022-29593

CVE-2022-29593 - Authentication Bypass by Capture Replay Dingtian-DT-R002 Title Authentication Bypass by Capture-replay Published: Version: 1.0 Vendor: Shenzhen Dingtian Technologies Co.,Ltd Product: 2 Channel Relay Board/Relay Card Version affected: Firmware V3.1.276A Product - Dingtian DTR004 A...

bleeding_onions

BleedingOnions Tracking the Exit and Guard relays edges of the Tor network for CVE-2014-0160. https://encrypted.redteam.net/bleedingonions/ Special thanks to: Stem, a python controller library for Tor https://stem.torproject.org/. Steffen Ullrich's perl script to check for CVE-2014-0160...

eaphammer

by Gabriel Ryan s0lst1c3 Current release: v1.14.1 Supports Python 3.9+. Overview EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on...

CVE-2023-23397_EXPLOIT

CVE-2023-23397 MS Outlook Vulnerability Exploitation CVE-2023-23397 is a vulnerability in Microsoft Outlook that allows an attacker to potentially exfiltrate user authentication details. The vulnerability stems from the ability of an attacker to specify a Universal Naming Convention UNC path in t...

cve-2023-23397

CVE-2023-23397 This script allows to create TNEF-encoded Outlook e-mails with CVE-2023-23397 exploit payload and send them via pure SMTP - no need in COM objects or EWS. I could not get IPM.Schedule.Meeting.Request message class to work properly it generates both meeting and the reminder but does...

ACEDcup

ACEDcup La herramienta ACEDcup es un generador de payloads para el ataque de deserialización binaria de Java ACED Para Apache Commons FileUpload ver = 1.3 CVE-2013-2186 y Oracle JDK ver 7u40 El ataque funciona incluso con versiones más recientes de la librería o de Java. Podemos subir cualquier...

credssp

credssp This is a poc code for exploiting CVE-2018-0886. It should be used for educational purposes only. It relies on a fork of the rdpy projecthttps://github.com/preempt/rdpy, allowing also credssp relay. Written by Eyal Karni, Preempt [email protected] Build Instructions Linux If you are...

CVE-2025-68624

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server...