PowerLurk

PowerLurk PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. The goal is to make WMI events easier to fire off during a penetration test or red team engagement. Please see my post Creeping on Users with WMI Events: Introducing PowerLurk for more detailed information:...

CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation

🚨 CVE-2025-49706 – SharePoint Spoofing Vulnerability Under Active Exploitation By Aditya Bhatt – VAPT Specialist | Red Teamer 📌 TL;DR Microsoft SharePoint is under active threat. CVE‑2025‑49706, a spoofing vulnerability in SharePoint Server, has evolved from medium-severity to real-world...

EDRUnChoker

EDRUnChoker Fileless WMI remediation forEDRChoker counters QoS abuse pacer.sys that throttles EDR agents to near-zero network bandwidth. Registers a permanent subscription in root\subscription no files on disk. A 5-second timer runs embedded VBScript that enumerates QoS policies with...

Stormspotter

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work. Installation With...

Gpt-Agreement-Payment

简体中文 | English Gpt-Agreement-Payment End-to-end replay tool for ChatGPT Plus / Team subscription agreements: reverse-engineered from packet capture the entire chain Stripe Checkout → PayPal / GoPay / QRIS → ChatGPT manual-approval → Codex OAuth + PKCE and implemented as a runnable client. Include...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...

CVE-2022-RCE

CVE-2022-XXXX Reverse junk data injection CVE subscription tools exploitation tutorials Exploit POC RCE LOG4j deserialization JNDI Payload CVE-2022-20550 CVE-2022-20551 CVE-2022-20552 CVE-2022-20553 CVE-2022-20554 CVE-2022-20555 CVE-2022-20556 CVE-2022-20557 CVE-2022-20558 CVE-2022-20559...

Popup Builder Plugin - SQL Injection and Cross-Site Scripting

The Popup Builder WordPress plugin before 4.1.1 is vulnerable to SQL Injection and Reflected XSS via the sgpb-subscription-popup-id parameter. id: CVE-2022-0479 info: name: Popup Builder Plugin - SQL Injection and Cross-Site Scripting author: ritikchaddha severity: critical description: | The Pop...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

OffensiveCSharp

OffensiveCSharp This is a collection of C tooling and POCs I've created for use on operations. Each project is designed to use no external libraries. Open each project's .SLN in Visual Studio and compile as "Release". Project| Description| Minimum .NET Version ---|---|--- AbandonedCOMKeys|...

CVE-2025-6792

Exploit: Unauthorized Pusher Channel Subscription Eavesdropping 1 Obtain Pusher credentials from browser console console.log window.wpguppyscriptsvars.pusherKey, window.wpguppyscriptsvars.pusherCluster ; 2 Subscribe to a victim’s private channel Pusher Eavesdrop Test Listening on private-user-5...

Quiksand-CVE-2023-24012

DDS Security Test ROS 2 DDS security research test environment, based on ROS 2 Foxy. Project Introduction This project demonstrates a privilege escalation vulnerability in the ROS 2 SROS2 security framework. By modifying signed permission files, an attacker can cause a node to subscribe to topics...

wnfexec

Overview WnfExec is a C proof of concept library that injects shellcode into a process by hijacking a WNF subscription callback then triggering a state change. There's nothing novel here and was built based on the research of others. My intent was to solidfy the concept in my head, document the...

SharpStay

SharpStay - .NET Persistence Building To compile open Visual Studio project and compile for release. Options Elevated Registry Keys Elevated UserInit Registry Key Elevated Scheduled Task Elevated Create Service Elevated WMI Event Subscription Non-Elevated InitMprLogonScript Registry Key...

NPM: Electron: Frame subscription trusts GPU-supplied frame geometry

NPM: Electron: Frame subscription trusts GPU-supplied frame geometry vulnerability discovered by ? in WordPress npm electron versions 42.11.6...

CVE-2025-24587

CVE-2025-24587 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Email Subscription Popup Vulnerable version = 1.2.23 Component slug email-subscribe Component link https://wordpress.org/plugins/email-subscribe/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

CVE-2026-105938

Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles. Topic-level subscription operations, su...

EUVD-2026-107476

Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles. Topic-level subscription operations, su...

CVE-2026-105998 Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

CVE-2026-105998 Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...