UniversalDVC

远程桌面服务通用动态虚拟通道连接器 UDVC 终端服务（或远程桌面服务）为想要深入探索的用户提供了许多隐藏功能。其中一项服务是动态虚拟通道，它使我们能够在开放的 RDP 连接上进行通信，而无需打开新的套接字、连接或防火墙端口。这些通道可用于向活跃网络设备隐藏数据、绕过防火墙、通过网络实现设备驱动程序，或仅仅帮助渗透测试人员传输数据。其可能性是无限的。 本项目创建的实际原因是 XFLTReaT。它可用于在隔离网络之上构建“VPN”，并最终允许通过跳板机进行测试，而无需请求防火墙更改。简而言之，它让渗透测试人员的工作更轻松。 工作原理 你需要在用于连接 RDP...

CVE-2025-29775

SAMLStorm CVE-2025-29775 实验环境 这是一个用于演示影响Node.js中xml-crypto库和SAML实现的SAMLStorm漏洞CVE-2025-29775的实验环境。注意：这并不是对漏洞的真正利用，只是用于演示漏洞可能工作方式的复现。 组件 服务提供者SP ：一个使用@node-saml/node-saml的易受攻击的SAML服务提供者 身份提供者IdP ：一个简单的模拟SAML身份提供者 利用工具 ：一个用于演示该漏洞的Web界面 设置 1. 确保已安装Node.js 2. 运行设置脚本： root@kitploit: python start-lab.p...

initroot

initroot：摩托罗拉引导加载程序内核命令行注入安全启动与设备锁定绕过 CVE-2016-10277 作者：Roee Hay / Aleph Research, HCL Technologies 第一阶段漏洞利用：临时越狱 该漏洞利用可在设备上获得临时的无限制 root 访问权限。 例如，在 cedric 上（部分消息已移除以提高可读性）： root@kitploit: $ cd ./tethered/cedric $ ./initroot-tethered.sh Welcome to initroot-cedric-tethered ... bootloader bootloade...

vbulletin5-rce

vbulletin5 rce漏洞检测工具 0x00 概述 201909 vbulletion55.0.0-5.5.4爆出rce漏洞（CVE-2019-16759），利用文件ajax/render/widgetphp和post参数widgetConfigcode可直接远程代码执行。 20200811，网上爆出CVE-2019-16759补丁可被绕过，利用ajax/render/widgettabbedcontainertabpanel和构造post参数subWidgets0configcode可直接远程代码执行。 本工具支持单url检测，cmdshell，get web...

Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBiz

Exploit CVE-2023-49070 y CVE-2023-51467 Apache OFBiz 18.12.10 Vulnerabilidad de omisión de autenticación en Apache OFBiz Este código de exploit ha sido desarrollado únicamente con fines educativos y para mejorar las prácticas de ciberseguridad. Cualquier uso con fines ilícitos es responsabilidad...

CVE-2020-0728

CVE-2020-0728 详情 TrustedInstaller.exe 服务以 NTAUTHORITY\SYSTEM 身份运行，并托管 Sxs Store 类（3C6859CE-230B-48A4-BE6C-932C0C202048）COM 服务以及 ISxsStore 接口。 此服务的访问权限（O:BAG:BAD:A;;CCDCLC;;;PSA;;CCDC;;;SYA;;CCDC;;;BAA;;CCDC;;;IUA;;CCDC;;;SU）授予本地系统上任何用户访问权限。 ISxsStore 接口暴露了 4 个方法： root@kitploit:...

CVE-2026-76059

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by a protection mechanism failure (CWE-693) in its static code security scanner. An attacker who can submit custom component source code can bypass the scanner by crafting an annotated class-body assignment that resolves to a dangerous c...

CVE-2026-76059 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...

CVE-2019-19634

CVE-2019-19634 - class.upload.php = 2.0.4 任意文件上传 作者 - Jinny Ramsmark 受影响供应商 - Verot.net 受影响产品 - class.upload.php = 2.0.4 测试环境：全新安装的 Ubuntu 14.04，PHP5 和 Apache 特别发现 Debian/Ubuntu 存在漏洞，因为它们将 pht 扩展名以及其他扩展名添加到了可用的 PHP 处理器中。在这种情况下，class.upload.php 没有将 pht 扩展名加入黑名单。 此 CVE 与 CVE-2019-19576 直接相关 描述...

UAC_bypass_windows_store

UACbypasswindowsstore Windows 应用商店（WSReset.exe）中的 Windows 10 LPE（UAC 绕过） uacbypassmod.c exe 完全自动化。你无需运行 UAC.bat。 注册表方法：https://github.com/sailay1996/FilelessUACbypassWSReset https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html @404death...

CVE-2026-45770

Suricata versions 8.0.0 through 8.0.5 (exclusive) are affected by a Lua sandbox bypass. A Lua rule that registers an excessive number of flow variables can corrupt Lua detection state , potentially escaping Suricata's restricted Lua sandbox. The attack requires a crafted Lua script/rule to be loa...

CVE-2026-45770

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua...

EUVD-2026-75797

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua...

CVE-2026-45770 Suricata lua: excessive flow variable registration can bypass sandbox

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua...

CVE-2020-1472-ZeroLogon-Demo-Detection-Mitigation

CVE-2020-1472 ZeroLogon 检测与缓解演示 本项目演示了严重 Windows 漏洞 CVE-2020-1472（又称 ZeroLogon ）的检测与缓解。该漏洞允许攻击者在未经身份验证的情况下获得管理员访问权限。本项目是作为学校网络安全项目的一部分开发的。PoC 代码归功于 Tom Tervoort Secura，Suricata 规则集归功于 Proofpoint Emerging Threats。 关键组件： 使用 PoC 脚本测试域控制器的漏洞 通过 Windows 事件日志 监控入侵指标 使用自定义规则部署 Suricata IDS 应用 Windows 更新...

CVE-2017-5689-Checker

CVE-2017-5689-Checker 这是一个针对 CVE-2017-5689 漏洞的自动检查与利用工具。 该漏洞涉及绕过 Intel AMT 面板的身份验证。 文章：https://habr.com/ru/post/328232 我们的 Telegram = t.me/anarchysquad Shodan 搜索语法： root@kitploit: port: "16992" intel 附注：使用 Sh0dan-Search 收集 IP 地址。 安装： root@kitploit: apt install python apt install git git clone...

CVE-2026-81941

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary operating system command execution when an authenticated non-administrative user constructs a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_CO...

CVE-2026-81268

IBM Langflow OSS 1.0.0–1.11.5 is vulnerable to authentication bypass and insufficient session expiration due to two distinct flaws. First, MCP HTTP API credential resolvers fail to apply the AUTO_LOGIN API-key guard that standard endpoints enforce, causing unauthenticated requests to MCP endpoint...

CVE-2026-81268 Langflow is vulnerable to authentication bypass and insufficient session expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation...

CVE-2026-45767

Suricata (network IDS/IPS/NSM engine) versions prior to 7.0.16 and 8.0.5 contain a vulnerability in the datasets feature where the save command's protection against absolute filenames can be bypassed when combined with the load command. A malicious rule could potentially overwrite any file on the...