CVE-2022-0185

CVE-2022-0185 本仓库包含针对 CVE-2022-0185 的演示利用程序。这里有两个版本。 非 kctf 版本（FUSE 版本）专门针对内核版本为 5.11.0-44 的 Ubuntu。它不会直接返回 root shell，而是将 /bin/bash 设置为 suid，从而轻松实现权限提升。调整 singlestart 和 modprobepath 偏移量后，应该能使其适用于大多数内核版本为 5.7 或更高版本的 Ubuntu；对于 5.1 到 5.7 之间的版本，需要像 kctf 版本那样改进 spray 技术。该利用策略依赖于 FUSE 和 SYSVIPC...

CVE-2022-0185

CVE-2022-0185 该仓库包含针对CVE-2022-0185的演示利用代码。这里有两个版本。 非kctf版本（fuse版本）专门针对内核版本5.11.0-44的Ubuntu系统。它不会直接返回root shell，而是将/bin/bash设置为SUID，从而轻松实现权限提升。调整singlestart和modprobepath偏移量，应能使其适用于大多数内核版本5.7或更高的其他Ubuntu版本；对于5.1至5.7之间的版本，需要像kctf版本那样改进喷溅（spray）方法。该利用策略依赖FUSE和SYSVIPC弹性对象来实现任意写入。...

CVE-2026-93264

A flaw was found in the Linux kernel's Elastic Fabric Adapter EFA driver within the Remote Direct Memory Access RDMA subsystem. This vulnerability allows a local user to cause a denial of service DoS or memory corruption by registering a memory region with a specific page count. Due to an incorre...

SOC-Analyst-Portfolio

🛡️ Allen Ace SOC Analyst | Threat Hunter | Detection Engineer Detect • Investigate • Respond • Defend Welcome This portfolio documents my hands-on cybersecurity journey through practical investigations, enterprise lab environments, detection engineering, digital forensics, malware analysis, threat...

detectree

Detectree Detectree es una herramienta de visualización de datos para equipos azules. Proporciona una representación gráfica de los datos de detección, lo que permite a un analista generar opiniones casi instantáneas sobre la naturaleza de la actividad subyacente y comprender relaciones complejas...

cve-2021-22146

cve-2021-22146 我在一次内部渗透测试中发现了一个 Elastic ECE 的漏洞。Elasticdump 是一个针对 CVE-2021-22146 的 PoC，用于从 7.10.0 到 7.13.3 版本的 Elastic ECE 中导出数据库。 https://www.exploit-db.com/exploits/50152 合作者：Mario Díaz Caldera...

edrEvasionWorkshop

edrEvasionWorkshop 工作坊材料，主题为“逐步恶意软件开发：从加载器到内核规避EDR”，已在 DEF CON 34和 BSidesLV 2026上展示。 本工作坊探讨自定义恶意软件开发、EDR架构与规避、C2定制以及内核级技术，以Elastic Defend 作为目标EDR。 逐步恶意软件开发：从加载器到内核规避EDR 来自DEF CON 34 和BSidesLV 2026 的工作坊材料。 材料涵盖的主题包括： EDR架构 APC注入 Fiber 模块踩踏（Module Stomping） 调用栈欺骗 间接系统调用 使用Havoc进行C2定制 内核级攻击...

intel471-threat-hunting-cve-2023-46604

Intel 471 威胁狩猎工作坊 – CVE-2023-46604 调查 概述 本仓库记录了我首次上手体验 Intel 471 以 CVE-2023-46604 为重点的「情报驱动威胁狩猎工作坊」的经历。 通过这个实操工作坊，我调查了攻击者如何利用一个严重的 Apache ActiveMQ 漏洞，使用 Elastic SIEM 分析了漏洞利用后的行为，并应用情报驱动的威胁狩猎方法来识别恶意持久化机制。 展示的技能 威胁狩猎 Elastic SIEM 调查 漏洞情报 Windows 事件分析 LOLBIN 检测 sc.exe 服务持久化分析 事件 ID 7045 检测 蓝队运营...

Elasticsearch 7.10.0-7.13.3 - Information Disclosure

ElasticSsarch 7.10.0 to 7.13.3 is susceptible to information disclosure. A user with the ability to submit arbitrary queries can submit a malformed query that results in an error message containing previously used portions of a data buffer. This buffer can contain sensitive information such as...

CVE-2026-78582

Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...

CVE-2026-78582

Kibana is vulnerable to a Missing Authorization (CWE-862) flaw that allows an authenticated user with Synthetics privileges in a single space to permanently delete Synthetics monitors shared in other spaces where they lack access. If a monitor is associated with a private location, the operation ...

CVE-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data

Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...

EUVD-2026-87794

Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...

CVE-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data

Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...

elastic-search-email-extractor

邮箱提取器 这个 Go 程序旨在从一系列 Elastic Search 数据库中提取电子邮件地址。 它接收一个 URL 列表，并搜索每个 URL 的数据库以查找电子邮件地址。 安装 go install github.com/RandomRobbieBF/elastic-search-email-extractor@latest 用法 要运行该程序，你可以通过命令行参数提供 URL 列表： go run emailextractor.go http://111.111.111.111:9200 或者，你可以提供一个包含 URL 列表的文本文件，每行一个 URL： go run...

Kibana - Local File Inclusion

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with...

Kibana Timelion - Arbitrary Code Execution

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands...

CLEANSTART-2026-JX33746 Security fix for CVE-2025-54410 applied in: argo-workflows-fips 3.5.15-r1, consul-k8s-fips 1.5.9-r0, elastic-beats 8.18.1-r0, elastic-beats 9.2.8-r0, elastic-beats 9.3.3-r0, harbor-fips 2.11.2-r5, harbor-scanner-trivy 0.35.1-r0, harbor-scanner-trivy-fips 0.35.1-r0, kyverno-fips 1.12.7-r6, openbao-fips 2.2.2-r6, openbao-fips 2.3.2-r4, paranoia 0.2.1-r0, promxy 0.0.93-r1, rancher-agent 2.11.15-r1

CVE-2025-54410 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZG24378 Security fix for CVE-2025-61727 applied in: apache-nifi 2.10.0-r4, aws-flb-firehose 1.7.2-r0, aws-flb-kinesis 1.10.3-r0, calico-fips 3.31.2-r1, cert-manager-cmctl-fips 2.4.0-r1, cert-manager-fips 1.18.2-r0, cert-manager-fips 1.19.1-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, chartmuseum-fips 0.15.0-r4, chartmuseum-fips 0.16.3-r3, cloudnative-pg-fips 1.24.4-r0, cloudnative-pg-fips 1.25.4-r0, cloudnative-pg-fips 1.26.2-r0, cni-plugin-flannel 1.6.0-r0, cni-plugins-fips 1.8.0-r0, configmap-reload 0.15.0-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.6-r0, consul-k8s-fips 1.9.1-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.41.1-r4, dex-fips 2.42.1-r4, dex-fips 2.43.1-r4, docker-fips 28.4.0-r0, druid-exporter-fips 0.10-r1, druid-exporter-fips 0.11-r2, eck-operator 3.2.0-r1, eks-distro-kube-apiserver-fips 1.34.2-r0, elastic-beats-fips 9.2.2-r0, external-dns 0.18.0-r0, external-dns-fips 0.20.0-r0, external-secrets 0.20.4-r0, flux-notification-controller-fips 1.5.0-r0, go-discover-fips 0_git20250325-r0, go-fips-1.25 1.25.6-r1, gomplate-fips 4.3.3-r3, harbor-registry 3.0.0.1-r2, harbor-registry-fips 2.6.2-r0, harbor-registry-fips 2.7.1-r0, harbor-registry-fips 2.8.3-r0, harbor-registry-fips 3.0.0-r1, helm-fips 3.17-4-r0, helm-fips 3.19.0-r1, helm-fips 4.0.1-r0, helm-operator-fips 1.39.0-r1, helm-operator-fips 1.41.1-r1, ip-masq-agent 2.12.6-r1, istio-operator-fips 1.25.5-r0, istio-operator-fips 1.26.7-r0, istio-operator-fips 1.27.4-r0, istio-operator-fips 1.28.1-r0, istio-operator-fips 1.4.10-r6, istio-pilot-discovery 1.28.1-r0, istio-pilot-discovery-fips 1.25.5-r0, istio-pilot-discovery-fips 1.26.7-r0, istio-pilot-discovery-fips 1.27.4-r0, istio-pilot-discovery-fips 1.28.1-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-operator 1.26.0-r0, k8ssandra-operator-fips 1.26.0-r0, k8ssandra-operator-fips 1.27.0-r0, k8ssandra-operator-fips 1.28.0-r0, k8ssandra-operator-fips 1.29.0-r0, kaniko-fips 1.24.0-r0, kapp-controller 0.59.0-r1, kapp-controller-fips 0.59.0-r1, kube-rbac-proxy-fips 0.17.1-r1, kube-rbac-proxy-fips 0.18.2-r2, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics 2.16.0-r3, kube-state-metrics-fips 2.14.0-r0, kube-state-metrics-fips 2.15.0-r0, kube-state-metrics-fips 2.17.0-r0, kubernetes 1.31.14-r1, kubernetes 1.32-10-r1, kubernetes 1.33.6-r0, kubernetes 1.34.2-r0, kubernetes-csi-external-resizer-fips 2.0.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-csi-node-driver-registrar-fips 2.15.0-r0, kubernetes-fips 1.31.14-r0, kubernetes-fips 1.32.10-r0, kubernetes-fips 1.32.2-r0, kubernetes-fips 1.33.6-r0, kured 1.20.0-r0, metallb-fips 0.14.9-r1, metrics-server 0.8.0-r0, metrics-server-fips 0.5.2-r1, metrics-server-fips 0.6.4-r1, metrics-server-fips 0.7.2-r3, metrics-server-fips 0.8.0-r5, minio-operator 7.1.1-r3, mongodb 8.2.1-r1, mongodb 8.2.6-r1, multus-cni-fips 4.0.2-r3, multus-cni-fips 4.1.4-r4, multus-cni-fips 4.2.3-r1, nginx-prometheus-exporter 1.5.1-r0, nginx-prometheus-exporter-fips 1.5.1-r0, nvidia-container-toolkit 1.19.0-r0, openbao-fips 2.4.4-r2, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, opentofu-fips 1.10.7-r0, opentofu-fips 1.7.10-r0, opentofu-fips 1.8.11-r0, opentofu-fips 1.9.4-r1, prometheus-fips 3.5.0-r4, prometheus-fips 3.9.0-r0, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.10.2-r0, prometheus-node-exporter-fips 1.7.0-r1, prometheus-node-exporter-fips 1.8.2-r1, prometheus-node-exporter-fips 1.9.1-r0, prometheus-operator-fips 0.85.0-r1, prometheus-operator-fips 0.86.2-r0, prometheus-operator-fips 0.87.0-r0, prometheus-redis-exporter-fips 1.77.0-r0, prometheus-redis-exporter-fips 1.78.0-r0, prometheus-redis-exporter-fips 1.79.0-r0, promxy 0.0.93-r1, rabbitmq-messaging-topology-operator 1.15.0-r1, restic 0.18.0-r0, runc 1.1.14-r0, smarter-device-manager-fips 1.20.12-r0, spark-operator 2.2.1-r0, spire-server-fips 1.13.3-r0, stakater-reloader-fips 1.1.0-r3, stakater-reloader-fips 1.2.1-r1, stakater-reloader-fips 1.3.0-r0, stakater-reloader-fips 1.4.10-r0, step-issuer-fips 0.9.11-r1, step-issuer-fips 0.9.9-r2, tekton-pipelines 1.5.0-r0, tekton-pipelines-fips 1.5.0-r0, tempo 2.9.0-r0, terragrunt-fips 0.90.2-r0, terragrunt-fips 0.91.5-r0, terragrunt-fips 0.92.1-r0, terragrunt-fips 0.93.13-r1, thanos-operator-fips 0.3.7-r0, trino 479-r0, velero 1.17.0-r1, velero-fips 1.14.1-r1, velero-fips 1.16.2, vertical-pod-autoscaler 1.5.1-r0, vertical-pod-autoscaler-fips 1.5.1-r0, volume-modifier-for-k8s 0.9.0-r0, volume-modifier-for-k8s-fips 0.9.0-r0, wave-fips 0.10.0-r0, wave-fips 0.9.0-r3

CVE-2025-61727 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2025-AM34484 Security fix for CVE-2025-25011 applied in: elastic-beats-fips 9.0.8-r0

Security vulnerability affects the elastic-beats-fips package. This issue is resolved in later releases. See references for vulnerability details...