Sploitus

Exploit for APT-Backpack

CVE-2019-11510CVE-2019-19781CVE-2020-5902CVE-2021-1497CVE-2021-20090CVE-2021-22006CVE-2021-22205CVE-2021-26084CVE-2021-26855CVE-2021-26857CVE-2021-26858CVE-2021-26865CVE-2021-36260CVE-2021-40444CVE-2021-40539CVE-2021-41773CVE-2021-42237CVE-2021-44228CVE-2022-1388CVE-2022-24112CVE-2022-26134

kitploit · 2026-08-24

Exploit Code

MARKDOWN64 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-34ZY-APT-BACKPACK
# APT-Backpack

CVE più comuni utilizzati dagli APT, RAT legittimi e altri strumenti usati dagli avversari

## CVE

  * CVE-2019-11510 (Pulse Connect Secure 8.2 8.3 9.0) **Lettura file non autenticata**
  * CVE-2019-19781 (Citrix ADC & Gateway) **Directory Traversal**
  * CVE-2020-5902 (F5 Big IP) **RCE**
  * CVE-2021-1497 (Cisco HyperFlex HX) **Iniezione comandi non autenticata**
  * CVE-2021-20090 (Buffalo WSR-2533DHP2 WSR-2533DHP3) **RCE non autenticato**
  * CVE-2021-22006 (Vmware vCenter Server) **Bypass autenticazione**
  * CVE-2021-22205 (GitLab CE/EE) **RCE**
  * CVE-2021-26084 (Atlassian Confluence) **RCE non autenticato**
  * CVE-2021-26855 (Microsoft Exchange Server) **RCE**
  * CVE-2021-26857 (Microsoft Exchange Server) **RCE**
  * CVE-2021-26858 (Microsoft Exchange Server) **RCE**
  * CVE-2021-26865 (Microsoft Exchange Server) **RCE**
  * CVE-2021-36260 (Hikvision) **Iniezione comandi**
  * CVE-2021-40539 (ManageEngine ADSelfService Plus) **Bypass API Auth** -> **RCE**
  * CVE-2021-41773 (Apache HTTP Server 2.4.49) **Path Traversal**
  * CVE-2021-42237 (Sitecore XP 7.5) **Deserializzazione** -> **RCE**
  * CVE-2021-44228 (Apache Log4j) **RCE**
  * CVE-2021-40444 (Microsoft Office) **RCE**
  * CVE-2022-1388 (F5 BIG-IP) **RCE**
  * CVE-2022-24112 (Apache APISIX 2.12.1) **RCE**
  * CVE-2022-26134 (Atlassian Confluence) **RCE**



## RAT Legittimi (Remote Administration Tools) e socket server

  * Client Ammyy admin v3 (Windows) (Questo è rilevato da molte difese)
  * Client Ngrok (Windows/Linux)



## Sfruttamento

  * Suite Sysinternals
  * PSTools



## Esfiltrazione

  * XXD statico (Windows)



## Phishing

  * Documento Office con avvisi (abilita contenuto)



## Reverse shell

  * Ncat OPENBSD



_Usalo correttamente, non sono responsabile per qualsiasi uso improprio di questo pacchetto_