CVE-2025-27580

CVE-2025-27580: Toma de Cuentas No Autenticada en NIH BRICS NIH BRICS también conocido como Biomedical Research Informatics Computing System hasta la versión 14.0.0-67 genera tokens predecibles que dependen del nombre de usuario, la hora y la cadena fija 7Dl9dj- y, por lo tanto, permite que...

scour

Scour - AWS Detection Framework This tool is used to emulate attack patterns inside of the AWS Controlplane. Each attack is tagged with a specific UA for the blue team to signal off of. Status This is still an active work in progress. Lots of Bugs Not ready for production Where to file issues :...

Exploit-CVE-2023-38646-Metabase

Exploit CVE-2023-38646 Metabase before 0.46.6.1 open source and before 1.46.6.1 Enterprise Exploit for the Remote Code Execution RCE vulnerability identified in Metabase versions before 0.46.6.1 open source and 1.46.6.1 Enterprise. The vulnerability allows attackers to execute arbitrary commands ...

SkyWrapper

Overview SkyWrapper is an open-source project which analyzes behaviors of temporary tokens created in a given AWS account. The tool is aiming to find suspicious creation forms and uses of temporary tokens to detect malicious activity in the account. The tool analyzes the AWS account, and creating...

Priv2Admin

The idea is to "translate" Windows OS privileges to a path leading to: 1. administrator, 2. integrity and/or confidentiality threat, 3. availability threat, 4. just a mess. Privileges are listed and explained at: https://learn.microsoft.com/en-us/windows/win32/secauthz/privilege-constants If the...

CVE-2022-41544

CVE-2022-41544 Exploit Script This repository contains a script to exploit CVE-2022-41544 vulnerability in GetSimple CMS. The script performs several steps to check for vulnerabilities, leak API keys, set cookies, obtain CSRF tokens, upload a shell, and trigger the shell. Changes and Improvements...

java-insecure-random-cve-2021-27568

java-insecure-random-cve-2021-27568 Demo of CVE-2021-27568: Insecure randomness in token generation...

tangalanga

Tangalanga Zoom 会议扫描器。 该扫描器会随机检查会议 ID，并在可用时返回信息。 安装 首先查看是否有适合当前日期的预编译版本：https://github.com/elcuervo/tangalanga/releases。 这些版本已包含可用的 token。 或者，您可以在 Releases 页面找到 Windows、Linux 和 Mac 版本：https://github.com/elcuervo/tangalanga/releases。 下载、解压即可使用。 用法 以下是所有可用的参数： root@kitploit: tangalanga ...

tangalanga

Tangalanga Zoom Conference scanner. This scanner will check for a random meeting id and return information if available. Install First try to see if there's any prebaked version for the date: https://github.com/elcuervo/tangalanga/releases. This versions already have a token ready to use. Either...

CVE-2023-38646

CVE-2023-38646 Metabase Pre-Auth RCE 11/26/2023 Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are...

EUVD-2026-68882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2019-0803

CVE-2019-0803 PoC de elevación de privilegios de Win32k Captura de pantalla Referencia robar token de seguridad https://github.com/mwrlabs/CVE-2016-7255...

CVE-2024-27632

CVE-2024-27632 Vulnerability Details Overview In Savane v3.12 and prior, the Unix timestamp is used as a seed in the Pseudo-Random Number Generator PRNG used to generate Cross-Site Request Forgery CSRF protection tokens formid. As a result, an attacker may be able to independently generate the sa...

CVE-2021-21551

CVE-2021-21551 Exploit to SYSTEM for CVE-2021-21551 SpoolPrinter Privesc using SeImpersonatePrivileges was made thanks to @ForrestOrr https://github.com/forrest-orr/DoubleStar/tree/main/Payloads/Source/Stage3SpoolPotato I basically just tossed the exploit function in his code and altered it ever ...

elevationstation

提权站（Elevation Station） 窃取和复制 SYSTEM 令牌，娱乐与盈利！我们复制东西，制作双胞胎副本，然后骑走。 你用 Metasploit 的 getsystem 和 SysInternals PSEXEC 获取过系统权限，对吧？那么，这里有一个类似的独立版本……但至少目前没有杀毒软件的问题 😸 此工具还能让你成为 TrustedInstaller ，类似于 Process Hacker/System Informer 的功能。此功能非常新，于 2023 年 8 月 12 日添加至最新代码版本和二进制版本！ 💵💲...

salt-rce-scanner-CVE-2020-11651-CVE-2020-11652

1 What is it? Scanning tool to test for SaltStack vulnerabilities CVE-2020-11651 & CVE-2020-11652. The vulnerabilities allow an attacker who can connect to the "request server" port to bypass all authentication and authorization controls and publish arbitrary control messages, read and write file...

AzureRT

AzureRT 一个Powershell模块，实现了从攻击角度与Azure和Azure AD交互的各种cmdlet。 提供了一些有用的实用工具，用于处理基于访问令牌的身份验证、在Az与AzureAD及az cli接口之间切换，以及易于使用的预构建攻击，例如基于Runbook的命令执行等。 最有价值的Cmdlet 本工具集包含多种cmdlet。本节重点介绍最重要且最有用的部分。 典型的红队/审计工作流程，从窃取的凭据开始，可以总结如下： root@kitploit: 窃取凭据 - 认证到Azure/AzureAD - 判断凭据是否有效 - 找出能利用它们做什么...

Rusty-Playground

Rusty-Playground 🦀 Una colección de programas en Rust que muestran algunas técnicas de seguridad ofensiva y evasión Herramienta| Descripción| Referencias ---|---|--- ClipboardMon| Monitoriza el portapapeles para detectar cambios y registra su contenido o copia archivos según los cambios...

CVE-2024-21338

CVE-2024-21338 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled. Compiling Use Microsoft Visual Studio with the C++ package to successfully compile the PoC on both Release and Debug modes. Post Original blog post:...

sign-saboteur

SignSaboteur SignSaboteur is a Burp Suite extension for editing, signing, verifying, and attacking signed tokens. It supports different types of tokens: Django TimestampSigner, ItsDangerous Signer, Express cookie-session middleware, OAuth2 Proxy, Tornado’s signed cookies, Ruby Rails Signed cookie...