sc2pe

sc2pe Semplice app dotnet Native AOT che usa AsmResolver per convertire shellcode in PE. Sono supportati sia shellcode a 32-bit che a 64-bit x86, x64 - il risultato è un PE a 32-bit o 64-bit. Le Release sono compilate sia per linux-x64 che per win-x64. Descrizione È compilato in formato Native AO...

ntdsdotsqlite

NTDS.Sqlite Diese Software kann entweder direkt als CLI-Werkzeug oder als Bibliothek verwendet werden, um aus einer NTDS.DIT-Datei eine SQLite-Datenbank zu erzeugen. Verschlüsselte Bits können entschlüsselt werden, wenn die zugehörige System-Hive mit angegeben wird. Installation python -m pip...

Terminator

Terminator Riproduzione della tecnica di Spyboy, che consiste nel terminare tutti i processi EDR/XDR/AV abusando del driver zam64.sys Spyboy vendeva il software Terminator al prezzo di $3,000 per maggiori dettagli il campione proviene da loldrivers utilizzo la versione compilata può essere trovat...

CVE-2026-61539

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Summary Xinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...

EUVD-2026-64146

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

CVE-2026-61539

Xinference (an inference API for open-source, speech, and multimodal models) versions 2.5.0 and earlier are vulnerable to remote code execution via unsafe use of Python's eval() in Llama3 tool-call parsing. An unauthenticated remote attacker can craft a prompt sent to /v1/chat/completions with a ...

CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

OffSec-Reporting

Relatórios OffSec usando SysReptor...

clairvoyance

🔮 clairvoyance Clairvoyance /klɛərˈvɔɪəns /; dal francese clair che significa chiaro e voyance che significa visione da Wikipedia. Panoramica clairvoyance crea una visualizzazione colorata della protezione delle pagine dell'intero spazio di indirizzi di un processo a 64 bit utente e kernel in...

Fuck-Etw

「⚙️」Bypass di ETW e Unhooking di Ntdll Bypassa l'Event Trace Windows ETW e rimuovi l'hook di ntdll. root@kitploit: |\ /| | \ /\ \ /|\ /| | /| || /| \ / /| / | | | | | | || | | / / | | | | | | | | | | | || | | | | | | | | | | | | | || | | \ \ | | | | || || | | | || /| / \ | /\ | | | | |/ /|/...

DocPlz

DocPlz Progetto di esfiltrazione di documenti per scopi ludici ed educativi https://github.com/TheD1rkMtr/DocPlz/assets/123980007/8026985e-e285-4a76-a1d7-f4c0fa3ad240...

CVE-2026-62675

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validateagentbundle does not reject a tools..callable dotted Python path...

CVE-2026-62675 Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validateagentbundle does not reject a tools..callable dotted Python path...

dsh2shell

dsh2shell Unauthenticated RCE PoC for expo...

spaces-finder

Spaces finder Spaces finder ist ein Tool, um DigitalOcean Spaces schnell zu durchsuchen und nach Beute zu suchen. Es ähnelt einem Subdomain-Bruteforcer, ist aber speziell für DigitalOcean Spaces entwickelt und bietet zusätzliche Funktionen, mit denen du nach interessanten Dateien grep-en und...

arp-dns-spoof

Installation auf Debian-basierten Linux-Distributionen Scapy installieren root@kitploit: % sudo apt-get install tcpdump graphviz imagemagick python-gnuplot python-crypto python-pyx % pip install scapy python-NetfilterQueue installieren root@kitploit: % sudo apt-get install build-essential...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webflux - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webflux package for Root:Maven. Multiple fixed versions available...

CVE-2026-77815

toabspath in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by ispathtrusted in scripts/iib/api.py while...