procrustes

Procrustes A bash script that automates the exfiltration of data over dns in case we have a blind command execution on a server where all outbound connections except DNS are blocked. The script currently supports sh, bash and powershell and is compatible with exec style command execution e.g...

CVE-2019-15107

CVE-2019-15107 Python 漏洞利用程序 CVE-2019-15107 针对 webmin 致谢 基于 Metasploit 模块 https://www.exploit-db.com/exploits/47230 原始安全公告：https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html...

CVE-2018-2628

CVE-2018-2628 0x01 Nessus Scan 0x02 K8 Tools GetShell 0x03 CMD Query Use-Method: python cve-2018-2628.py set url :http://xx.xx.xx.xx:8001/beawlsinternal/wlscmd.jsp cmd : whoami win-xxx8cb989qh\administrator cmd : net user \WIN-XXX8CB989QH 的用户帐户...

CVE-2023-30990

CVE-2023-30990 exploits See our blog post for details: https://blog.silentsignal.eu/2025/09/04/Exploit-development-for-IBM-i/ The Python scripts require the ebcdic module: pip install ebcdic DRDA S38CMD method python3 ddm.py "" DRDA SQL method python3 ddm-bypass-test.py "" Simple bindshell with...

FollinaXploit

Follina Exploiter CLI Tool MSDT Vulnerability CVE-2022-30190 A Command Line based python tool for exploit Zero-Day vulnerability in MSDT Microsoft Support Diagnostic Tool also know as 'Follina' CVE-2022-30190. Info : New Microsoft Office zero-day used in attacks to execute PowerShell Made In...

CVE-2025-24893-POC

CVE-2025-24893 Install bun: curl -fsSL https://bun.com/install | bash To install dependencies: bun install To run: bun run CVE-2025-24893.ts This project was created using bun init in bun v1.2.19. Bun is a fast all-in-one JavaScript runtime. How to use: Usage: bun CVE-2025-24893.ts options Option...

CVE-2023-32315-Openfire-Bypass

CVE-2023-32315 0x01 Obtain the returned JSESSIONID and csrftoken, construct a request packet to add a user replace JSESSIONID, csrftoken cd CVE-2023-32315-Openfire-Bypass/scanall go mod tidy go run main.go -u http://openfire.com:9090 0x02 Plugin compilation and installation mvn clean package or...

CVE-2018-14667_Lab_POC

CVE-2018-14667-Lab LAB PREREQUISITES Demo App From : http://downloads.jboss.org/richfaces/releases/3.3.X/3.3.4.Final/richfaces-examples-3.3.4.Final.zip Jboss 5.1.0.GA from JBOSS download archive : https://repository.jboss.org/sourceforge/ Jdk-6u45-linux-x64 from JAVA archive :...

CVE-2022-35914-poc

CVE-2022-35914 PoC 参考 https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr 用法 pip install -r requirements.txt ./CVE-2022-35914.py -h usage: CVE-2022-35914.py -h -u URL -c CMD -f HOOK --check --user-agent USERAGENT CVE-2022-35914 - GLPI - Command injection using a third-par...

SharpStrike

SharpStrike SharpStrike es una herramienta de post-explotación escrita en C que utiliza CIM o WMI para consultar sistemas remotos. Puede usar credenciales proporcionadas o la sesión del usuario actual. Nota: Algunos comandos usarán PowerShell en combinación con WMI, indicados con en el comando...

CVE-2024-4577

CVE-2024-4577: Critical Vulnerability in PHP's CGI Configurations A severe security flaw exists in PHP's CGI mode that allows attackers to run arbitrary commands by manipulating URL parameters. Impacted Versions PHP versions before 7.4.29 and 8.0.19 on Windows running php-cgi. Attack Methodology...

NUUO Camera <=20250203 - OS Command Injection

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. id: CVE-2025-1338 info: name: NUUO Camera =20250203 - OS Command Injection author: Ark...

DocsGPT - Unauthenticated Remote Code Execution

A vulnerability, that could result in Remote Code Execution RCE, has been found in DocsGPT. Due to improper parsing of JSON data using eval an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.This issue affects DocsGPT- from 0.8.1 through 0.12.0. id:...

Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code

Langflow = 1.2.x exposes POST /api/v1/validate/code without any authentication. The endpoint calls validatecode which execs user-supplied Python code. Default-argument expressions in Python execute at function-definition time, allowing arbitrary OS command execution without authentication. id:...

TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection

TOTOLINK EX1800T V9.1.0cu.2112B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges. id: CVE-2024-34257 info: name: TOTOLINK EX1800T TOTOLINK EX1800T - Command Injecti...

WAVLINK WN579X3 - Remote Command Execution

Remote Command Execution vulnerability in WAVLINK WN579X3 routers via pingIp parameter in /cgi-bin/adm.cgi. id: CVE-2023-3380 info: name: WAVLINK WN579X3 - Remote Command Execution author: pussycat0x severity: critical description: | Remote Command Execution vulnerability in WAVLINK WN579X3 route...

TOTOLINK Realtek SD Routers - Remote Command Injection

TOTOLINK Realtek SDK based routers may allow an authenticated attacker to execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0,...

JEHC-BPM - Remote Code Execute

A Remote Command Execution vulnerability in the component /server/executeExec of JEHC-BPM = v2.0.1 allows attackers to execute arbitrary code. The vulnerability exists due to insufficient authorization checks in the executeExec endpoint which allows direct command execution. id: CVE-2025-45854...

Telesquare TLR-2005KSH - Remote Command Execution

Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through...

GeoServer jsonArrayContains CQL Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single...