thc-tips-tricks-hacks-cheat-sheet

THC's favourite Tips, Tricks & Hacks Cheat Sheet https://thc.org/tips A collection of our favourite tricks. Many of those tricks are not from us. We merely collect them. We show the tricks 'as is' without any explanation why they work. You need to know Linux to understand how and why they work. G...

Supershell

Supershell is a C2 remote control platform accessed through WEB services. By establishing a reverse SSH tunnel, a fully interactive shell can be obtained, and it supports multi-platform architecture Payload Features • Platform • Architecture • Build • Document • Demo • Disclaimer • Thanks 简体中文 •...

minipwner

MiniPwner A script to configure a TP-Link MR3040 running OpenWRT into a simple, yet powerful penetration-testing "drop box". What is the "MiniPwner"? The MiniPwner is a penetration testing "drop box". It is designed as a small, simple but powerful device that can be inconspicuously plugged into a...

Stowaway

Stowaway Stowaway is a multi-hop proxy tool for security researchers and penetration testers. Stowaway lets you proxy external traffic through multiple hops into a target internal network, bypassing access restrictions, building a tree-like node topology, and managing it easily. Thanks for the...

TREVORproxy

TREVORproxy A SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses! See the accompanying Blog Post for a fun rant and some cool demos! Note: If you're looking to defend against this...

sshtunnel

|Tests| |AppVeyor| |readthedocs| |coveralls| |version| |pyversions| |license| Author : Pahaz Repo : https://github.com/pahaz/sshtunnel/ Inspired by https://github.com/jmagnusson/bgtunnel, which doesn't work on Windows. See also: https://github.com/paramiko/paramiko/blob/master/demos/forward.py...

tap

The TrustedSec Attack Platform TAP TAP - Remote penetration testing platform builder. Written by: David Kennedy @HackingDave Company: TrustedSec https://www.trustedsec.com Project page: https://github.com/trustedsec/tap A TrustedSec Project - Copyright 2020 Supported operating systems: Linux Ubun...

CVE-2026-116242

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither hostpkeydirectories nor sshconfigfile, so it always loaded the unencrypted private keys in /.ssh of the operating-system account running pgAdmin, read that account's /.ssh/config IdentityFile, User, HostName, ProxyCommand...

EUVD-2026-114383

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither hostpkeydirectories nor sshconfigfile, so it always loaded the unencrypted private keys in /.ssh of the operating-system account running pgAdmin, read that account's /.ssh/config IdentityFile, User, HostName, ProxyCommand...

CVE-2026-116242: pgadmin.org pgAdmin 4: pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file,…

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither hostpkeydirectories nor sshconfigfile, so it always loaded the unencrypted private keys in /.ssh of the operating-system account running pgAdmin, read that account's /.ssh/config IdentityFile, User, HostName, ProxyCommand...

EUVD-2026-109468

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's...

sish

sish Túnel SSH de código abierto para HTTPS, WSS, TCP, alias y SNI. Si te gusta la simplicidad del estilo de compartir de serveo/ngrok pero quieres usar SSH básico y gestionar tu propia infraestructura, sish está hecho para eso. No se requiere un cliente personalizado para los usuarios finales...

SUSE CVE-2026-73564

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...

CVE-2026-74232

Zbtlink L3V28 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmwa...

CVE-2026-53545

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into...

CVE-2026-53545 Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into...

CVE-2026-53545

Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing. Prior to 2.3.2 , the DELETE /ssh/tunnel/disconnect/:tunnelName endpoint in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into single-quoted pki...

CVE-2026-53545: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into...

PT-2026-78691

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2 Description An authenticated user can execute arbitrary commands on the source SSH host with the privileges of the connected SSH account. The issue occurs when the application interpolates endpointPort, sourcePor...

GO-2026-6103 frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow in github.com/fatedier/frp

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow in github.com/fatedier/frp...