An offensive postexploitation tool that will give you complete control over the Outlook desktop application and therefore to the emails configured in it. - amjcyber/pwnlook

https://tryhackme.com/r/room/postexploit

Executive Summary

An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability. "The attacker compromised an internet-reachable Marimo notebook via CVE-2026-39987, extracted two cloud credentials from the compromised

Cet article présente une analyse technique approfondie de PEEP, un toolkit de post-exploitation basé sur les navigateurs Chromium, découvert et analysé via la plateforme Extended Threat Intelligence (XTI) de SOCRadar. PEEP est un Remote Access Tool (RAT) déguisé en extension Chrome nommée "Smart Bookmarks" (version 1.3.0).

Malicious tools strive to blend into ordinary network traffic, but the new Miraak framework has gone further and transformed a cloud PostgreSQL database into a full-fledged channel for controlling infected computers. Blackpoint Cyber specialists uncovered the previously unknown toolset after the attackers themselves slipped up and left part of their infrastructure exposed on the internet. A Full Post-Exploitation Arsenal Miraak is designed to operate after an initial breach of a system, and it furnishes the operator with a broad array of capabilities.

BleepingComputer, publié le 5 août 2026. L'incident a été découvert par Huntress le 27 juillet 2026 après détection de vol de credentials sur un serveur hébergeant une base Oracle. Les attaquants ont exploité une vulnérabilité d'injection SQL dans un endpoint de moteur de recherche d'une application Java publique tournant sous Apache Tomcat.

This guide demonstrates multiple port forwarding and pivoting techniques used by penetration testers to reach a localhost‑bound Apache2 service (127.0.0.1:8080) on a compromised host. It explains SSH local forwarding, Ligolo‑ng/Ligolo‑MP, Chisel, Metasploit Meterpreter portfwd, and socat, and outlines mitigations to detect and prevent these post‑exploitation methods. #Apache2 #LigoloNg #Chisel #Metasploit #socat #LigoloMP

Impacket-secretsdump is a powerful agentless post‑exploitation tool from the Impacket framework (Fortra) that remotely extracts NTLM hashes, Kerberos keys, LSA secrets, SAM databases, and cached domain logon data without dropping an agent on the target. It supports DRSUAPI (DCSync), VSS snapshots, and offline hive parsing, offers multiple authentication methods (Kerberos tickets, Pass‑the‑Hash, AES keys), and includes filtering and output flags for targeted or full-domain dumps. #impacket-secretsdump #NTDSDIT

Threat actor groups have begun deploying language model-based agents to automate post-breach exploitation tasks following vulnerabilities in Marimo, marking a convergence of critical security threats.