HackGit

PurplePanda This tool fetches resources from different cloud/saas applications focusing on permissions in order to identify privilege escalation paths and dangerous permissions in the cloud/saas configurations. Note that PurplePanda searches both privileges escalation paths within a platform and across platforms. The name comes from the animal Red Panda. This panda eats peas, just like Purple Panda, which can ingest API keys/tokens found by these PEASS. The color was changed to purple because this tool is meant mainly for Purple Teams (because it can be highly useful for both Blue and Red Teams). https://github.com/carlospolop/PurplePanda #redteam

​​DeathSleep A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementing page protection changes during no execution. https://github.com/janoglezcampos/DeathSleep

​​SysWhispers2 SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported and example generated files available in the example-output/ folder. https://github.com/jthuraisamy/SysWhispers2

​​cs-get-last-error Obtain error messages from GetLastError codes directly inside the Cobalt Strike client without the help of Google search, net helpmsg, or Microsoft Error Lookup Tool. The error messages are included in the aggressor script, and no interaction with the beacon is required. The aggressor script is automatically generated and updated from the windows-lasterror-json files. https://github.com/Henkru/cs-get-last-error #cobalt

​​Privacy Sexy Enforce privacy & security best-practices on Windows and macOS, because privacy is sexy 🍑🍆 Online version does not require to run any software on your computer. Offline version has more functions such as running the scripts directly. Features: ▫️ Rich: Hundreds of scripts that aims to give you control of your data. ▫️ Free: Both free as in "beer" and free as in "speech". ▫️ Transparent. Have full visibility into what the tweaks do as you enable them. ▫️ Reversible. Revert if something feels wrong. ▫️ Accessible. No need to run any compiled software on your computer with web version. ▫️ Open. What you see as code in this repository is what you get. The application itself, its infrastructure and deployments are open-source and automated thanks to bump-everywhere. ▫️ Tested. A lot of tests. Automated and manual. Community-testing and verification. Stability improvements comes before new features. ▫️ Extensible. Effortlessly extend scripts with a custom designed templating language. ▫️ Portable and simple. Every script is independently executable without cross-dependencies. Get started: 🌍 Online: https://privacy.sexy. 🖥 Offline: Check releases page, or download directly for: Windows, macOS, Linux. https://github.com/undergroundwires/privacy.sexy

​​Blizzard Jailbreak An Open-Source, fully working iOS 9.0 to 9.3.6, 32-Bit Jailbreak. This jailbreak is aimed at the beginner Jailbreak Developers who want to learn how to build #iOS #Jailbreaks. The code is kept simple with only the necessary components being added, while keeping a functional jailbreak. https://github.com/GeoSn0w/Blizzard-Jailbreak-9

​​magicNetdfs Abused RPC method allows privileged processes to access malicious pipes for exploitation https://github.com/crisprss/magicNetdefs

​​GEF A set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis and exploit development. Application developers will also benefit from it, as GEF lifts a great part of regular GDB obscurity, avoiding repeating traditional commands, or bringing out the relevant information from the debugging runtime. https://github.com/hugsy/gef #reversing

weaverOA-rce-poc https://github.com/xiaoheihei741/fanweiOA-rce-poc #poc #RCE

​​Windows Backdoor A Hidden and Undetectable Remote Access Tool written in C++ and Server in Python3 This program utilizes the standard winsock library for sending and receiving data back and forth between the server and client. The server can manage multiple connections at once with the use of multi-threading having an easy time switching to other remote machines simply in order to control it from a command line view. Constants in Client Program: ▫️ server: Specify server's IP address here ▫️ startup: If enabled, copies itself to the targets startup folder upon runtime. ▫️ timeout: Restarts client if no data is received after a specified period of time (default: 5 minutes) https://github.com/anonlo-rw/Windows-Backdoor #redteam #backdoor

GPD MicroPC Is a Multi-interface Productivity Tool I really like this small palm-sized laptop. The specs are great for the size : 1280×720 6″ (not touch) Screen, quad core Intel processor, Intel GPU, 8GB RAM, 256GB M2 SSD Drive. Moreover it have all the ports you can dream for IT/SysAdmin usage : Ethernet, HDMI, USB C, 3xUSB A, and even the good old RS232 serial port ? You also have a microSD slot, Bluetooth and WiFi. The Keyboard is small, but fit great for typing with your thumbs, and have backlight, you also have a pad with 3 buttons. It come with Windows 10 Pro installed, but it’s compatible enough to run Linux, Kali Linux (they have an ubuntu ready to install). The case can take some abuse : it’s made of anti-shock aviation level ABS synthetic resin. Great for hardware hacking... Buy online: 🛒 https://ali.ski/o-OdN #pc #mini #laptop

​​CVE-2022-26138 Confluence Hardcoded Password PoC https://github.com/z92g/CVE-2022-26138 #cve #poc

​​CVE-2022-26712: The POC for SIP-Bypass Is Even Tweetable I found some new attack surfaces in the macOS PackageKit.framework, and successfully disclosed 15+ critical SIP-Bypass vulnerabilities. Apple has addressed 12 of them with CVE assigned so far. There are still some reports in the Apple’s processing queue. All of them are interesting logic issues, and of course each has a successful exploit demonstration. Here, CVE-2022-26712 is a very simple one, which was patched in macOS 12.4. However, I found another way to exploit it again, finally Apple addressed it as CVE-2022-32826 in macOS 12.5. https://jhftss.github.io/CVE-2022-26712-The-POC-For-SIP-Bypass-Is-Even-Tweetable #cve #exploit

​​CVE-2022-33891 The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1. https://github.com/AmoloHT/CVE-2022-33891 #cve

​​RunAsWinTcb RunAsWinTcb uses an userland exploit to run a DLL with a protection level of WinTcb-Light. https://github.com/tastypepperoni/RunAsWinTcb Overview of the vulnerability and the capabilites of an exploit can be found here: https://tastypepperoni.medium.com/running-exploit-as-protected-process-ligh-from-userland-f4c7dfe63387 #exploit #dll

​​Wget-Root If the wget binary has the SUID bit set, It does not drop the elevated privileges and may be abused to access the file system. It may be used to do privileged writes or write files outside a restricted file system. This script automates the rewriting of the passwd file of the victims machine https://github.com/CopernicusPY/wget-root

​​SwiftnessX A cross-platform note-taking & target-tracking app for penetration testers built on ElectronJS. https://github.com/ehrishirajsharma/SwiftnessX #redteam

​​PerunsFart Running PerunsFart tech, to patch the hooked ntdll with a ntdll read from a suspended process, thus unhooking ur syscalls. https://gitlab.com/ORCA000/perunsfart Research: https://blog.sektor7.net/#!res/2021/perunsfart.md

​​IAM-Deescalate Helps mitigate privilege escalation risk in AWS identity and access management (IAM) https://github.com/PaloAltoNetworks/IAM-Deescalate #blueteam

​​MassMap MassMap automates port scanning of large target IP addresses and/or CIDR notations by combining Masscan's speed, and Nmap's detailed scanning features. https://github.com/capt-meelo/MassMap Research: https://captmeelo.com/pentest/2019/07/29/port-scanning.html