cleanldap

CleanLdap BOF to perform stealthy LDAP queries over AD WS Arguments Just going to cut to the chase, here are the args and what they mean: root@kitploit: Z: DC Hostname "dc01.example.com" Z: LDAP query "objectClass=" Z: Comma separated list of LDAP attributes "samaccountname,distinguishedName,cn" ...

dnsteal

dnsteal v 2.0 This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. Below are a couple of different images showing examples of multiple file transfer and single verbose file transfer: Support for multiple files Gzip compression supported...

s3enum

s3enum s3enum 是一个快速且隐秘的 Amazon S3 存储桶枚举工具。它利用 DNS 而非 HTTP，这意味着请求不会被记录在 S3 服务器访问日志中。 它最初于 2016 年构建，用于 针对 GitHub 的漏洞赏金狩猎。 安装 root@kitploit: go install github.com/koenrh/s3enum@latest 用法 你需要指定目标的基础名称（例如 hackerone）、一个单词列表和一个后缀列表。候选存储桶名称通过将目标名称与每个单词组合（使用 -、、...

twittor

Twittor 一个基于Python的隐蔽后门，使用Twitter（直接消息）作为命令与控制服务器。 该项目受 Gcat 启发，后者使用Gmail账户实现相同功能。 设置 要使其工作，你需要： 一个Twitter账户（使用专用账户！不要使用个人账户！ ） 在Twitter上注册一个应用，权限级别设为读取、写入和直接消息 。 安装依赖： root@kitploit: $ pip install -r requirements.txt 此仓库包含两个文件： twittor.py：客户端 implant.py：实际部署的后门 在两个文件中，编辑访问令牌部分，并添加你之前生成的令牌：...

nopowershell

NoPowerShell NoPowerShell es una herramienta implementada en C que permite ejecutar comandos similares a los de PowerShell permaneciendo invisible a cualquier mecanismo de registro de PowerShell. Este binario compatible con .NET Framework 2 puede cargarse en Cobalt Strike para ejecutar comandos e...

dnsteal

dnsteal v 2.0 这是一个伪造的DNS服务器，允许你通过DNS请求从受害机器上隐秘地提取文件。 以下是展示多文件传输和单文件详细传输示例的不同图片： 支持多文件 支持Gzip压缩 现在支持自定义子域名、每个子域名中的字节数以及文件名的长度 见下方帮助： 如果你不理解帮助内容，只需使用默认选项运行程序！ root@kitploit: python dnsteal.py 127.0.0.1 -z -v 这个命令会发送每个子域名45字节，查询中包含4个子域名。最后15字节保留给文件名。 root@kitploit: python dnsteal.py 127.0.0.1 -z -v ...

ntqueueapcthreadex-ntdll-gadget-injection

🧪 NtQueueApcThreadEx NTDLL Gadget Injection Introducción Esta novedosa forma de usar NtQueueApcThreadEx abusando de los parámetros ApcRoutine y SystemArgument0-3 pasando un gadget pop r32; ret aleatorio puede usarse para inyección de código sigilosa. Dentro de este PoC, el gadget en este caso se...

gcat

Gcat Un backdoor furtif basé sur Python utilisant Gmail comme serveur de commande et contrôle Ce projet s'inspire du code PoC original de Benjamin Donnelly Ceci est un code de preuve de concept... ... qui a été publié pour que les organisations testent leurs défenses contre ce type d'attaques. Po...

Malicious code in abi-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afc61427f74a028242a032b9436c09c43b1df60fef5688aa5389ef107e899259 The package advertises ABI encoding but on require schedules a 37-second timer that decodes test/fixtures/keypairs.dat base64-encoded stealer, staged...

Customization under Fire: Plugin Poisoning in Text-To-Image Ecosystem

The prosperity of text-to-image T2I models has fostered a vibrant share-and-play ecosystem centered on Low-Rank Adaptation LoRA plugins, which allow users to customize and share model capabilities with ease. This democratization, however, comes with a hidden but severe security risk. Malicious...

POISE: Position-Aware Undetectable Skill Injection on LLM Agents

Agent skills provide a lightweight mechanism for extending general-purpose agents, but their open format exposes them to skill-poisoning attacks. A practically dangerous injection must stay invisible: if executing the payload derails the user's legitimate task, the resulting failure signal invite...

Undermining the trust boundary: Investigating a stealthy intrusion through third-party compromise

In this article 1. Abuse of trusted relationships as an attack delivery mechanism 2. Methods, tools, and access strategies 3. Campaign conclusion 4. Microsoft Defender detection and hunting guidance In recent years, many sophisticated intrusions have increasingly avoided using noisy exploits,...

Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities

TrendAI™ Research breaks down Quasar Linux QLNX, a previously undocumented sophisticated Linux RAT with low detection rates. In this blog, we examine a full-featured Linux threat incorporating a rootkit, a PAM backdoor, credential harvesting, and more, revealing how this malware enables stealthy...

Active HanGhost Loader Campaign Targets Enterprise Payment and Logistics Workflows

Active HanGhost Loader campaign targets enterprise payment and logistics workflows with fileless attacks, multi-stage execution, and stealthy malware delivery...

Hiding in the Tunnels: Unmasking the New Stealthy BPFDoor Variants

This is Rapid7's whitepaper discussing BPFDoor variants. Advanced persistent threats APTs are locked in a continuous arms race with network defenders. As static indicators of compromise IoCs for the notorious BPFDoor malware became widely deployed by security vendors, the threat actors went back ...

Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments

In this article 1. Cookie-controlled execution behavior 2. Observed variants of cookie-controlled PHP web shells 3. Mitigation and protection guidance 4. Microsoft Defender XDR detections 5. Microsoft Security Copilot prompts 6. Microsoft Defender XDR threat analytics 7. MITRE ATT&CK™ Techniques...

Trojan'S Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance

Trojan's Whisper: Stealthy Manipulation Of OpenClaw Through Injected Bootstrapped Guidance...

Stealthy Poisoning Attacks Bypass Defenses in Regression Settings

Regression models are widely used in industrial processes, engineering and in natural and physical sciences, yet their robustness to poisoning has received less attention. When it has, studies often assume unrealistic threat models and are thus less useful in practice. In this paper, we propose a...

ReasoningBomb: A Stealthy Denial-Of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models

Large reasoning models LRMs extend large language models with explicit multi-step reasoning traces, but this capability introduces a new class of prompt-induced inference-time denial-of-service PI-DoS attacks that exploit the high computational cost of reasoning. We first formalize inference cost...

Low Rank Comes with Low Security: Gradient Assembly Poisoning Attacks against Distributed LoRA-Based LLM Systems

Low-Rank Adaptation LoRA has become a popular solution for fine-tuning large language models LLMs in federated settings, dramatically reducing update costs by introducing trainable low-rank matrices. However, when integrated with frameworks like FedIT, LoRA introduces a critical vulnerability:...