TaskHound

Windows 特権スケジュールタスク発見ツール （楽しみと利益のため） TaskHound は、特権アカウントと保存された資格情報で実行される Windows スケジュールタスクを検索します。SMB 経由でタスクを列挙し、XML を解析し、BloodHound 統合を通じて高価値の攻撃機会を特定します。 背景や詳細な説明については、関連するブログ記事をご覧ください: Part 1 および Part 2。 主な機能 クイックスタートbash Install git clone https://github.com/1r0BIT/TaskHound.git cd TaskHound...

cve-2025-5781_FreePBX

cve-2025-5781FreePBX 2025年8月，FreePBX Endpoint 模块被披露存在一个严重漏洞。CVE-2025–57819 允许未经身份验证的攻击者利用 Endpoint 模块中的 SQL 注入漏洞，并通过数据库操作与计划任务执行的连锁攻击，实现远程代码执行。...

WMIExec

WMIexec 一组Python脚本，通过WMI协议以不同方式执行命令。 博客文章 https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/ 使用方法 wmiexecscheduledjob.py 是一个Python脚本，通过计划任务认证到远程WMI实例并执行命令。 运行脚本： root@kitploit: python3 wmiexecscheduledjob.py -i -u -p -c wmiexecwin32process.py...

NorkNork

NorkNork - Empireの永続化ペイロードを特定するツール https://www.n00py.io/2017/01/removing-backdoors-powershell-empire-edition/ 概要: このスクリプトは、Windowsシステム上でPowershell Empireの永続化ペイロードを特定するために設計されました。 現在、以下の永続化方法のチェックをサポートしています： スケジュールタスク 自動実行 WMIサブスクリプション セキュリティサポートプロバイダ アクセスのしやすさセンターのバックドア マシンアカウントパスワード無効化 インストール:...

CVE-2026-86177

Pterodactyl Panel versions before 1.14.1 fail to validate action-specific permissions when creating scheduled tasks. A subuser holding only the schedule.update permission can create and immediately trigger scheduled tasks that execute arbitrary game-server console commands , control server power ...

EUVD-2026-71976

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

SharpStay

SharpStay - .NET 持久化 构建 打开 Visual Studio 项目并编译为发布版本。 选项 提权注册表项 提权 UserInit 注册表项 提权计划任务 提权创建服务 提权 WMI 事件订阅 非提权 InitMprLogonScript 注册表项 非提权计划任务 COM 处理程序劫持 非提权 Junction 文件夹 杂项：添加计划任务操作 杂项：启动目录 杂项：新建 LNK 杂项：后门 LNK 杂项：任务名称 杂项：列出计划任务 杂项：列出运行中的服务 杂项：获取计划任务 COM 处理程序 root@kitploit: Sharpstay.exe...

SharpPolarBear

SharpPolarBear Esta es una versión armada de uno de los exploits publicados por SandboxEscaper desde aquí https://github.com/SandboxEscaper/polarbearrepo. La mayor parte del código proviene del repositorio CollectorService de rasta-mouse https://github.com/rasta-mouse/CollectorService. Solo cambi...

CVE-2026-3502-Scanner---TrueConf-Vulnerability-Detection-Tool

🔍 CVE-2026-3502 扫描器 - TrueConf 漏洞检测工具 ⚠️ 警告 仅用于教育目的和授权测试。 📋 描述 用于 CVE-2026-3502 的检测工具。扫描未验证更新的 TrueConf 服务器，检测易受攻击的 Windows 客户端（≤8.5.3.884），并搜索 TrueChaos 的 IOC：PowerISO、注册表持久化和计划任务。 📦 安装 root@kitploit: git clone https://github.com/tu-usuario/CVE-2026-3502-Scanner.git cd CVE-2026-3502-Scanner pip...

CVE-2026-73533

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-73532

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

CVE-2026-73532

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

EUVD-2026-58112

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-73533

CVE-2026-73533 affects Ninja Tables Pro 5.2.11. The vulnerability is an embedded malicious code issue introduced via a tampered plugin build served through a decommissioned update server. A rogue file, app/Library/updater/NinjaTableDataSync.php, creates a backdoor REST API endpoint and drops pers...

PT-2026-71689

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a require once directive added to fluentformpro.php...

EUVD-2026-55022

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

EUVD-2026-54517

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

CVE-2026-6079

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

EUVD-2026-53174

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

VulnCheck KEV: CVE-2026-73533

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...