CVE-2021-41773-PoC

CVE-2021-41773-PoC PoC for CVE-2021-41773 with docker to demonstrate Run Just run ./poc.sh. Make sure you have working docker and docker-compose root@kitploit: $ ./poc.sh Creating network "cve-2021-41773-pocdefault" with the default driver Creating cve-2021-41773-pocweb1 ... done...

CVE-2021-41773-PoC

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 This script test Apache HTTP Server 2.4.49 Usage: CVE-2021-41773.py options Only for one IP: python CVE-2021-41773.py IPaddress Option -f For IP list in file Example: python CVE-2021-41773.py -f...

DirtyPipe

Dirty Pipe 漏洞利用：CVE-2022-0847 Dirty Pipe 漏洞（CVE-2022-0847）是 Linux 内核中的一个重大缺陷。本仓库提供了广泛使用的漏洞利用代码的改编版本，使其更加用户友好且模块化。 关于该漏洞的精彩解析，可参阅 HackTheBox 博客。Max Kellermann 原始且更详细的解释可参见他的博客。 此改编版本被拆分为不同方法，以提升模块化程度并便于修改。值得注意的是，新增了 --root 选项，可修改 /etc/passwd 文件，从而以密码 el3ph@nt! 获取 root 访问权限。 静态编译漏洞利用程序：...

CVE-2022-0847_DirtyPipeExploit

What is this This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite root's password field in /etc/passwd and restore after popping a root shell. Side Note: I do not claim any credit for finding this vulnerability or writing the proof of concept. This exploit is merely...

CVE-2019-11510

CVE-2019-11510 用于 Pulse Secure SSL VPN 任意文件读取的漏洞利用工具（CVE-2019-11510） 你可以使用单个域名，也可以使用域名列表。域名前必须包含 https://。 用法：cat targetlist.txt | bash CVE-2019-11510.sh / bash CVE-2019-11510.sh -d https://vpn.target.com/ 如果你只想验证漏洞并下载 /etc/passwd，请使用： cat targetlist.txt | bash CVE-2019-11510.sh --only-etc-passwd...

DirtyPipe-BSI

Dirty...What? This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite the root password field in /etc/passwd and restore it after obtaining a root shell. Note: I claim no credit for finding this vulnerability or writing the proof of concept. This exploit is simply a...

cve_2022_0847_shellcode

cve20220847shellcode Description This repository contains a Python script genshellcode.py, based on pwntools, to generate a shellcode implementing CVE-2022-0847. The shellcode is based on this Poc: antx. I analyzed the code of the PoC and its execution with strace to catch all the system calls...

CVE-2016-5195

dirtycow 此漏洞利用以 dirtycow 漏洞的 pokemon 利用方法为基础，并自动生成新的 passwd 行。 运行该二进制文件时，系统会提示用户输入新密码。 原始 /etc/passwd 文件随后会被备份到 /tmp/passwd.bak，并用生成的行覆盖 root 账户。 运行此漏洞利用后，您应该可以使用新创建的用户登录。 要使用此漏洞利用，请根据您的需要修改用户值。 默认创建的用户是 firefart。 原始漏洞利用（dirtycow 的 ptracepokedata“pokemon”方法）：...

CVE-2016-5195

CVE-2016-5195 my personal POC and EXPLOIT of CVE-2016-5195 dirty COW Usage POC: write files arbitrarily Just a simply POC of this CVE, compile the file poc.c as follow: root@kitploit: $ gcc poc.c -o poc -static -lpthread You shall run it as follow: root@kitploit: ./poc destinationfile fakefile Yo...

nmap-CVE-2023-23333-exploit

nmap-CVE-2023-23333-exploit Nmap NSE script to dump /etc/passwd from remote system using Solarwinds CVE-2023-23333 vulnerability Save the script into a file named solar-CVE-2023-23333.nse. To run the script, you can use Nmap's --script-args option to provide the output file path: nmap -p --script...

dirtyPipe-automaticRoot

Exploit automático de root de Dirty Pipe CVE-2022-0847 Dependencias: Python 3.10 o superior Cómo usar: Root automático: root@kitploit: $ python3.10 dirtyPipe.py -a + hjacking super user in /etc/passwd + dropipng shell Escribir en un archivo sin permiso de escritura, inmutable o montado como solo...

CVE-2024-4956

CVE-2024-4956 : Nexus Repository Manager 3 搜索语法： Shodan:http.html:"Nexus Repository" Hunter:product.name="Nexus Repository" FOFA:app="Nexus-Repository-Manager" Poc : root@kitploit: GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: localhost:8081...

CVE-2019-5418-Scanner

CVE-2019-5418-Scanner A multi-threaded Golang scanner to identify Ruby endpoints vulnerable to CVE-2019-5418 Usage root@kitploit: Usage of ./CVE-2019-5418-Scanner: -auth string Perform a scan using a auth token i.e Basic YmFzZTY0VG9rZW5WYWx1ZQ== default "nope" -http Use HTTP over HTTPS -insecure...

cve-2021-41773-and-cve-2021-42013

cve-2021-41773 and cve-2021-42013 cve-2021-41773 and cve-2021-42013 batch verification Python script Runtime environment: python3 Usage: python3 poc.py url.txt url.txt contains the URLs to be tested, and URLs with vulnerabilities will be written to success.txt The verification content is very...

CVE-2024-24919

CVE-2024-24919 Uso Uso: ./CVE-2024-24919.sh -i -p -f Especificando una IP con -i root@kitploit: ./CVE-2024-24919.sh -i 190.XXX.XXX.XXX Verificar múltiples IPs con -f root@kitploit: ./CVE-2024-24919.sh -f uniq.txt Ejemplo de archivo root@kitploit: 192.168.0.1 192.168.0.2 192.168.0.3 ... 192.168.0....

CVE-2025-27591-Below

CVE-2025-27591-Below 📌 Description This is a proof-of-concept PoC exploit for CVE-2025-27591 , a local privilege escalation vulnerability in the below system monitor tool. The issue arises from unsafe handling of log files /var/log/below/errorroot.log when executed with elevated privileges. By...

CVE-2025-27591

CVE-2025-27591 - 通过 below 实现权限提升 该仓库包含针对 CVE-2025-27591 的利用代码，这是 Linux 监控工具 Below 中的一个权限提升漏洞。 🛠️ 漏洞详情 CVE ：CVE-2025-27591 CVSS 评分 ：7.8（高危） 受影响工具 ：below（v0.9.0 之前版本） 漏洞描述 ：Below 以 root 身份创建了全局可写的目录和日志文件（/var/log/below/errorroot.log），允许低权限用户进行符号链接攻击。 发现时间 ：2025 年 1 月 公布时间 ：2025 年 3 月 12 日 来源...

CVE-2022-0847

root@kitploit: gcc exploit.c -o exploit -std=c99 ./exploit Usage: ./exp TARGETFILE OFFSET DATA In the /etc/passwd file, find the offset of the normal user's uid, change the uid to 0, then log in again to get root privileges. root@kitploit: Scope of Impact Linux Kernel version = 5.8 Linux Kernel...

CVE-2024-48990

CVE-2024-48990 针对 CVE-2024-48990 的漏洞利用（needrestart 0 else print"\n",os.getpid; libc.ptrace0, 0, 0, 0; os.exec...

CVE-2022-0847-DirtyPipe-Exploit

What is this This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite root's password field in /etc/passwd and restore after popping a root shell. Side Note: I do not claim any credit for finding this vulnerability or writing the proof of concept. This exploit is merely...