TaskHound

Windows 特権スケジュールタスク発見ツール （楽しみと利益のため） TaskHound は、特権アカウントと保存された資格情報で実行される Windows スケジュールタスクを検索します。SMB 経由でタスクを列挙し、XML を解析し、BloodHound 統合を通じて高価値の攻撃機会を特定します。 背景や詳細な説明については、関連するブログ記事をご覧ください: Part 1 および Part 2。 主な機能 クイックスタートbash Install git clone https://github.com/1r0BIT/TaskHound.git cd TaskHound...

SharpStay

SharpStay - .NET 지속성 빌드 컴파일하려면 Visual Studio 프로젝트를 열고 릴리스용으로 컴파일하세요. 옵션 상승된 레지스트리 키 상승된 UserInit 레지스트리 키 상승된 예약 작업 상승된 서비스 생성 상승된 WMI 이벤트 구독 비상승 InitMprLogonScript 레지스트리 키 비상승 예약 작업 COM 핸들러 하이재킹 비상승 정션 폴더 기타 예약 작업 동작 추가 기타 시작 디렉터리 기타 새 LNK 기타 백도어 LNK 기타 작업 이름 기타 예약 작업 나열 기타 실행 중인 서비스 나열 기타 예약 작업...

NorkNork

NorkNork - Empire 지속성 페이로드를 식별하는 도구 https://www.n00py.io/2017/01/removing-backdoors-powershell-empire-edition/ 정보: 이 스크립트는 Windows 시스템에서 PowerShell Empire 지속성 페이로드를 식별하기 위해 설계되었습니다. 현재 다음 지속성 방법에 대한 검사를 지원합니다: 예약된 작업 자동 실행 WMI 구독 보안 지원 공급자 접근성 센터 백도어 컴퓨터 계정 암호 비활성화 설치: 이 스크립트는 Python 2.7로 실행하거나...

WMIExec

WMIexec WMI 프로토콜을 통해 다양한 방식으로 명령 실행을 수행하는 Python 스크립트 세트입니다. 블로그 게시물 https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/ 사용법 wmiexecscheduledjob.py 원격 WMI 인스턴스에 인증하고 예약 작업을 통해 명령을 실행하는 Python 스크립트입니다. 스크립트 실행 방법: root@kitploit: python3 wmiexecscheduledjob.py -i -u -p ...

SharpPolarBear

SharpPolarBear 이는 SandboxEscaper가 여기https://github.com/SandboxEscaper/polarbearrepo에 게시한 익스플로잇 중 하나의 무기화된 버전입니다. 대부분의 코드는 rasta-mouse의 CollectorService 저장소https://github.com/rasta-mouse/CollectorService에서 가져왔습니다. 원래 SandboxEscaper의 C++ 코드에서 CVE-2019-0841 코드를 C으로 변경하고 몇 가지 검사를 추가했습니다. 또한 필요한...

CVE-2026-3502-Scanner---TrueConf-Vulnerability-Detection-Tool

🔍 CVE-2026-3502 スキャナー - TrueConf 脆弱性検出ツール ⚠️ 警告 教育目的および許可されたテストのみを対象としています。 📋 説明 CVE-2026-3502 用の検出ツールです。更新確認なしで TrueConf サーバーをスキャンし、脆弱な Windows クライアント（≤8.5.3.884）を検出し、TrueChaos の IOC（PowerISO、レジストリの永続化、スケジュールされたタスク）を検索します。 📦 インストール root@kitploit: git clone...

cve-2025-5781_FreePBX

cve-2025-5781FreePBX 2025年8月、FreePBX Endpointモジュールに重大な脆弱性が開示されました。CVE-2025–57819は、認証されていない攻撃者がEndpointモジュールのSQLインジェクションを悪用し、データベース操作とスケジュールタスク実行の連鎖を通じて、リモートコード実行を達成することを可能にします。...

CVE-2026-86177

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-86177 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-86177

Pterodactyl Panel versions before 1.14.1 fail to validate action-specific permissions when creating scheduled tasks. A subuser holding only the schedule.update permission can create and immediately trigger scheduled tasks that execute arbitrary game-server console commands , control server power ...

CVE-2026-86177 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

EUVD-2026-71976

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

PT-2026-86401

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-73533

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-73532

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

CVE-2026-73532

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

EUVD-2026-58112

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-73533

CVE-2026-73533 affects Ninja Tables Pro 5.2.11. The vulnerability is an embedded malicious code issue introduced via a tampered plugin build served through a decommissioned update server. A rogue file, app/Library/updater/NinjaTableDataSync.php, creates a backdoor REST API endpoint and drops pers...

CVE-2026-73533: Embedded Malicious Code

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

PT-2026-71689

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a require once directive added to fluentformpro.php...