copyfail-alpine

This is a more minimal port of Copy Fail LPE CVE-2026-31431 which patches the first few bytes of /etc/passwd so that su-ing to root requires no password. This reduces the total size of the original exploit and makes it more portable. Distributions like Alpine use busybox/musl instead of a...

Dirty-Pipe-Oneshot

Dirty-Pipe-Oneshot Compiled version of CVE-2022-0847 aka Dirty Pipe. Just one shot to root them all :D just comple the cve-2022-0847.c file root@kitploit: gcc cve-2022-0847.c -o getroot then execute it on the victim & get root :D root@kitploit: ./getroot /etc/passwd 1 ootz: Happy Rooting 🎭...

CVE-2022-0847_DirtyPipeExploit

What is this This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite root's password field in /etc/passwd and restore after popping a root shell. Side Note: I do not claim any credit for finding this vulnerability or writing the proof of concept. This exploit is merely...

CVE-2022-0847

DIRTY PIPE CVE-2022-0847 This is a kernel vulnerability that allows overwriting of data in arbitrary read-only files, which can therefore lead to privilege escalation since an unprivileged process can write into a privileged process. All credits go to 🥇Max Kellermann for finding the vulnerability...

CVE-2024-48990

CVE-2024-48990 Exploit for CVE-2024-48990 Local Privilege Escalation in needrestart 3.8 Background Read https://blog.qualys.com/vulnerabilities-threat-research/2024/11/19/qualys-tru-uncovers-five-local-privilege-escalation-vulnerabilities-in-needrestart. Qualys does a great job explaining it. TLD...

dirtyPipe-automaticRoot

Dirty Pipe automatic root exploit CVE-2022-0847 Dependencies: Python 3.10 or above How to use: Automatic root: root@kitploit: $ python3.10 dirtyPipe.py -a + hjacking super user in /etc/passwd + dropipng shell Write a no write permission, immutable or read-only mounted file: root@kitploit: $...

cve_2022_0847_shellcode

cve20220847shellcode Description This repository contains a Python script genshellcode.py, based on pwntools, to generate a shellcode implementing CVE-2022-0847. The shellcode is based on this Poc: antx. I analyzed the code of the PoC and its execution with strace to catch all the system calls...

CVE-2024-0582

Introduction This exploit implements a Dirty Cred attack method to gain unauthorized write access to /etc/passwd. Unlike many similar exploits that create numerous pages or aggressively spray file descriptors, this approach takes a more targeted route to corrupt the necessary kernel structures...

CVE-2021-41773-PoC

CVE-2021-41773-PoC PoC for CVE-2021-41773 with docker to demonstrate Run Just run ./poc.sh. Make sure you have working docker and docker-compose root@kitploit: $ ./poc.sh Creating network "cve-2021-41773-pocdefault" with the default driver Creating cve-2021-41773-pocweb1 ... done...

CVE-2021-41773-PoC

CVE-2021-41773 Proof of Concept Quick and dirty proof of concept for checking if hosts vulnerable to CVE-2021-41773 root@kitploit: python3 full.py hosts.txt Where hosts.txt contains your targets: root@kitploit: domain.com blah.com 192.168.1.1 It'll print out if the host is vulnerable or not...

CVE-2024-24919

CVE-2024-24919 An Vulnerability detection and Exploitation tool for CVE-2024-24919 Installation: root@kitploit: git clone https://github.com/RevoltSecurities/CVE-2024-24919 pip install -r requirements.txt python3 exploit.py --help Usage: root@kitploit: python3 exploit.py -h / / / / / / / / | |//...

CVE-2024-23897

Usage root@kitploit: python poc.py usage: python poc.py http://127.0.0.1:8888/ /etc/passwd...

shellshock_crawler

Prerequisite 1. sudo pip install shell 2. install google python search. https://github.com/MarioVilas/google Run I use google to search first 1000 sites and try to get the /etc/passwd After tesing, there are many many many host that can be rooted!!!! By the way, this is only a proto, it has false...

CVE-2019-11510

CVE-2019-11510 Pulse Secure SSL VPN の任意ファイル読み取り CVE-2019-11510 のエクスプロイト 単一のドメイン、またはドメインのリストを使用できます。ドメインの前に https:// を含める必要があります。 使用法 : cat targetlist.txt | bash CVE-2019-11510.sh / bash CVE-2019-11510.sh -d https://vpn.target.com/ エクスプロイトを検証して /etc/passwd をダウンロードするだけの場合は、次を使用します : cat...

CVE-2021-41773-PoC

CVE-2021-41773-PoC PoC for CVE-2021-41773 with docker to demonstrate Run Just run ./poc.sh. Make sure you have working docker and docker-compose root@kitploit: $ ./poc.sh Creating network "cve-2021-41773-pocdefault" with the default driver Creating cve-2021-41773-pocweb1 ... done...

CVE-2022-0847

CVE-2022-0847 Dirty Pipe 脆弱性 教育目的のみ root@kitploit: ┌──vagrant㉿kali- └─$ ls -al /etc/passwd -rw-r--r-- 1 root root 3124 Mar 8 08:47 /etc/passwd ┌──vagrant㉿kali- └─$ head -n 1 /etc/passwd root:x:0:0:root:/root:/usr/bin/zsh ┌──vagrant㉿kali- └─$ echo foo /etc/passwd zsh: permission denied: /etc/passw...

nmap-CVE-2023-23333-exploit

nmap-CVE-2023-23333-exploit Nmap NSE スクリプトを使用して、Solarwinds CVE-2023-23333 の脆弱性を悪用し、リモートシステムから /etc/passwd をダンプします。 スクリプトを solar-CVE-2023-23333.nse というファイルに保存します。スクリプトを実行するには、Nmap の --script-args オプションを使用して出力ファイルのパスを指定します: nmap -p --script solar-CVE-2023-23333.nse --script-args...

CVE-2024-4956

CVE-2024-4956 : Nexus Repository Manager 3 Dork: Shodan:http.html:"Nexus Repository" Hunter:product.name="Nexus Repository" FOFA:app="Nexus-Repository-Manager" Poc : root@kitploit: GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: localhost:8081...

CVE-2016-5195

CVE-2016-5195 CVE-2016-5195（Dirty COW）の個人用POCおよびエクスプロイト 使用方法 POC: 任意のファイルへの書き込み このCVEのシンプルなPOCです。以下のようにファイルpoc.cをコンパイルします。 root@kitploit: $ gcc poc.c -o poc -static -lpthread 以下のように実行します。 root@kitploit: ./poc コピー先ファイル コピー元ファイル...

CVE-2019-5418-Scanner

CVE-2019-5418-Scanner CVE-2019-5418 に対して脆弱な Ruby エンドポイントを特定するためのマルチスレッド Golang スキャナ 使用方法 root@kitploit: Usage of ./CVE-2019-5418-Scanner: -auth string Perform a scan using a auth token i.e Basic YmFzZTY0VG9rZW5WYWx1ZQ== default "nope" -http Use HTTP over HTTPS -insecure Ignore SSL/TLS Errors -log...