EDRUnChoker

EDRUnChoker 无文件WMI修复方案，用于EDRChoker，抵御QoS滥用（pacer.sys），该滥用将EDR代理的网络带宽限制到接近零。 在root\subscription中注册一个永久订阅（磁盘上无文件）。一个5秒定时器运行嵌入的VBScript，该脚本使用WbemContextPolicyStore枚举 ActiveStore和GPO:localhost 上的QoS策略——普通的WMI ExecQuery会遗漏由New-NetQosPolicy/EDRChoker创建的ActiveStore策略——并移除针对已知安全产品或激进速率（≤1 Mbps）的恶意应用路径限流。...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

PowerLurk

PowerLurk PowerLurk 是一个用于构建恶意 WMI 事件订阅的 PowerShell 工具集。其目标是在渗透测试或红队行动期间更轻松地触发 WMI 事件。更多详细信息请参阅我的文章 利用 WMI 事件监控用户：PowerLurk 介绍 ：https://pentestarmoury.com/2016/07/13/151/ 要使用 PowerLurk，您需要将 PowerLurk.ps1 模块导入到您的 PowerShell 实例中。可以通过以下几种方式完成： 本地导入 PS powershell.exe -NoP -Exec ByPass -C Import-Module...

Gpt-Agreement-Payment

简体中文 | English Gpt-Agreement-Payment ChatGPT Plus / Team 订阅协议的端到端重放工具：从抓包逆出 Stripe Checkout → PayPal / GoPay / QRIS → ChatGPT manual-approval → Codex OAuth + PKCE 整条链路，并实现成可运行客户端。附带从零实现的 hCaptcha 视觉求解器、PayPal 风控早退分支、和一组真实运行采集的反欺诈机制实证数据。 作者自营 API 中转站 Logo| 名称| 介绍| 官网 ---|---|---|--- | lukyface...

CVE-2026-96566

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-79618

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

CVE-2026-79618

The WP User Frontend WordPress plugin, prior to version 4.3.12 , fails to enforce subscription-purchase requirements in one of its post-creation handlers. This Missing Authorization (CWE-862) flaw allows authenticated users with subscriber-level access and above to create and, depending on specif...

Quiksand-CVE-2023-24012

DDS Security Test ROS 2 DDS 安全研究测试环境，基于 ROS 2 Foxy。 项目简介 本项目演示了 ROS 2 SROS2 安全框架中的一个权限绕过漏洞。通过修改签名的权限文件，攻击者可以让节点订阅本不该订阅的话题。 环境要求 Docker 快速开始 构建镜像 docker build -t dds-test . 运行 PoC docker run -it dds-test ./poc.sh PoC 脚本说明 poc.sh 脚本执行以下步骤： 1. 创建密钥库 - 使用 ros2 security 工具生成 talker 和 listener 的密钥和证书 2...

wnfexec

Overview WnfExec is a C proof of concept library that injects shellcode into a process by hijacking a WNF subscription callback then triggering a state change. There's nothing novel here and was built based on the research of others. My intent was to solidfy the concept in my head, document the...

CVE-2025-6792

Exploit: Suscripción no autorizada a canales de Pusher Escuchas clandestinas 1 Obtener credenciales de Pusher desde la consola del navegador console.log window.wpguppyscriptsvars.pusherKey, window.wpguppyscriptsvars.pusherCluster ; 2 Suscribirse al canal privado de una víctima Prueba de escuchas ...

SharpStay

SharpStay - .NET 持久化 构建 打开 Visual Studio 项目并编译为发布版本。 选项 提权注册表项 提权 UserInit 注册表项 提权计划任务 提权创建服务 提权 WMI 事件订阅 非提权 InitMprLogonScript 注册表项 非提权计划任务 COM 处理程序劫持 非提权 Junction 文件夹 杂项：添加计划任务操作 杂项：启动目录 杂项：新建 LNK 杂项：后门 LNK 杂项：任务名称 杂项：列出计划任务 杂项：列出运行中的服务 杂项：获取计划任务 COM 处理程序 Sharpstay.exe action=ElevatedRegistryK...

Stormspotter

Stormspotter 创建 Azure 订阅中资源的“攻击图”。它使红队和渗透测试人员能够可视化租户内的攻击面和横向移动机会，并助力防御方快速定位安全事件并确定响应工作的优先级。 安装 使用 Docker 大多数用户可能会发现通过 Docker 安装 Stormspotter 更容易。这是推荐的方法。 git clone https://github.com/Azure/Stormspotter docker-compose up docker-compose 文件将创建三个容器： Stormspotter 前端 Stormspotter 后端 Neo4j v4...

Popup Builder Plugin - SQL Injection and Cross-Site Scripting

The Popup Builder WordPress plugin before 4.1.1 is vulnerable to SQL Injection and Reflected XSS via the sgpb-subscription-popup-id parameter. id: CVE-2022-0479 info: name: Popup Builder Plugin - SQL Injection and Cross-Site Scripting author: ritikchaddha severity: critical description: | The Pop...

OffensiveCSharp

OffensiveCSharp 这是我为行动创建的C工具和POC（概念验证）集合。每个项目设计为不依赖外部库。在Visual Studio中打开每个项目的.SLN文件，并以"Release"模式编译。 项目| 描述| 最低.NET版本 ---|---|--- AbandonedCOMKeys| 枚举废弃的COM键（特别是InprocServer32）。可用于持久化，因为在某些情况下，你可以写入缺失的位置并使用rundll32.exe -sta CLSID进行调用。技术参考自@bohops的这篇文章| 4.0 COMHunter|...

PT-2026-104143

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

LiquidSnake

Liquid Snake Liquid Snake 是一个旨在对 Windows 系统进行横向移动而不接触磁盘的程序。 该工具依赖 WMI 事件订阅来在内存中执行 .NET 程序集，该 .NET 程序集将在命名管道上监听 shellcode，然后使用线程劫持 shellcode 注入的一个变种来执行它。 下面的图表（希望如此）阐明了数据流程： 致谢 MDSec - WMI Event Subscription - 该工具只是该博客文章中描述的概念的一个实现，代码也依赖于 Dominic 的 WMI 持久化 C PoC pwndizzle - thread-hijack.cs - 为 C...

CVE-2026-103921

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

Malicious code in @kelvdra/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @bottino/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...