CVE-2018-16509

CVE-2018-16509 Ghostscript contiene múltiples vulnerabilidades de omisión del sandbox -dSAFER Ejecución root@kitploit: $ docker run -d --name cve-2018-16509 -p 9000:9000 cve-2018-16509...

CVE-2019-16098

CVE-2019-16098 Micro-Star MSI Afterburner 4.6.2.15658 中的驱动程序（即 RTCore64.sys 和 RTCore32.sys）允许任何经过身份验证的用户读写任意内存、I/O 端口和 MSR。此漏洞可用于权限提升、高权限下的代码执行以及信息泄露。这些经签名的驱动程序还可用于绕过 Microsoft 驱动程序签名策略，部署恶意代码。 更多更新，请访问 CVE-2019-16098 警告 ：硬编码的 Windows 10 x64 Version 1903 偏移量！ root@kitploit: Microsoft Windows...

Insanity-Framework

Insanity-Framework 此项目现已关闭 - 欢迎继续开发 版权所有 2017 Insanity Framework IF 2.0 结束 编写者： Alisson Moretto - 4w4k3 特别感谢 Thomas Perkins - Ekultek Insanity Payload 通过加密代码并在内存中解密来工作，从而避免可能的 AV 特征检测，同时具备足够长的等待时间以绕过正在运行的沙盒。 注意：Insanity payload 在连接时可能会有一分钟的延迟，这对于绕过大多数杀毒软件和沙盒是必要的。 Twitter: @4w4k3Official 免责声明：...

APOLOGEE

🌀 APOLOGEE - 西门子现场面板扫描器 APOLOGEE 是一个 Python 脚本和 Metasploit 模块，用于枚举西门子 APOGEE PXC BACnet 自动化控制器（所有 V3.5 之前的版本）和 TALON TC BACnet 自动化控制器（所有 V3.5 之前的版本）上的隐藏目录。该漏洞利用 CVSS 7.5 分，允许攻击者通过备用路径或通道绕过身份验证，访问 Web 服务器中的隐藏目录。此存储库利用 CVE-2017-9947。 什么是西门子现场面板？...

ezviz_lan_rce

ezvizlanrce This repository contains the slides and PoC videos for the talk SADProtocol goes to Hollywood which was presented at DEF CON 31 Hardware Hacking Village. You can also find the docker image to build binaries that run on the camera and the proof of concept exploits for CVE-2023-34551 an...

CVE-2023-22515

红队工具-Confluence未授权添加管理员用户CVE-2023-22515漏洞利用工具 漏洞影响范围 root@kitploit: 8.0.0 = Confluence Data Center and Confluence Server = 8.0.4 8.1.0 = Confluence Data Center and Confluence Server = 8.1.4 8.2.0 = Confluence Data Center and Confluence Server = 8.2.3 8.3.0 = Confluence Data Center and Confluence...

EDRception

Ver: https://malwaretech.com/2023/12/silly-edr-bypasses-and-where-to-find-them.html...

exploiting-cve-2017-5123

利用 CVE-2017-5123 简介 本仓库是对发表在 MISC Magazine 96 上的文章的补充。 我们成功地在启用了 SMEP/SMAP 和 KASLR 的虚拟机上，以可靠的方式提升了权限。但应注意，系统会处于不稳定状态，极有可能发生 oops。 本仓库内容 在 configs/ 文件夹中，你可以找到 Linux 内核和 Busybox 的配置文件，每个文件与默认配置略有不同。 binaries/ 文件夹包含所有预构建的二进制文件，你需要它们来复现我们的测试环境，例如一个完整的 rootfs，可直接用于 QEMU。 linux-stable 是一个指向存在漏洞的 Linux...

byeintegrity-uac

ByeIntegrity — Windows UAC 绕过 绕过用户帐户控制 UAC 以获取提升的（管理员）权限，从而以高完整性级别运行任何程序。 要求 管理员帐户 UAC 通知级别设置为默认或更低 2021 年更新 我决定更新 ByeIntegrity，使其更快、更轻量且更可靠。这是一次重大改版，因此我在 VS 解决方案中创建了一个名为“ByeIntegrity2021”的新项目，这是该攻击的更新版本。当然，原始版本仍然存在。有关新版本的更多信息，请展开下面的详细信息。 更新信息 新版本现在能够劫持 NIC，而无需依赖已安装到 NIC...

CVE-2022-40684-metasploit-scanner

CVE-2022-40684-metasploit-scanner An authentication bypass using an alternate path or channel in Fortinet product preparation POC root@kitploit: git clone https://github.com/TaroballzChen/CVE-2022-40684-metasploit-scanner cd CVE-2022-40684-metasploit-scanner mkdir -p...

writeup-cve-2019-19194

Writeup CVE-2019-19194 This is a writeup and theoretical Proof-of-Concept of CVE-2019-19194. ⚠️ This CVE was found by https://asset-group.github.io/disclosures/sweyntooth/ Table of Content Summary Vulnerable software and version Overview Protocol Stack and Architecture Pairing Procedure Proof of...

CVE-2024-46658

CVE-2024-46658 Syrotech SY-GOPON-8OLT-L3 v1.6.0240629 命令注入漏洞 用法 1- 编辑脚本中的 URL。 2- 编辑脚本中的 CookieLogin 值。 3- 运行脚本，它将允许你执行命令。 漏洞详情 GET /cgi/home.php?fun=system&page=shellCMDExec&isajax=1&runtab=1&cmdExec=1&command=ping%208.8.8.8%20-c%204%0aid&random=1725991418844 HTTP/1.1 正常情况下，管理面板中只允许执行 ping 命令。...

CVE-2026-79395

An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...

PT-2026-89741

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

PT-2026-89875

NetBSD contains an information disclosure vulnerability in mm open within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK KMEM process flag. Attackers can...

EUVD-2026-76192

An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...

openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21810-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...

Linux Distros Unpatched Vulnerability : CVE-2026-88018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with...

PT-2026-89772

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...

PT-2026-89862

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...