sn0int

sn0int sn0int pronounced /snoɪnt/ is a semi-automatic OSINT framework and package manager. It's used by IT security professionals, bug bounty hunters, law enforcement agencies and in security awareness trainings to gather intelligence about a given target or about yourself. sn0int is enumerating...

CVE-2026-41285-OpenBSD-v6daemons-go-brrr

CVE-2026-41285: One Packet Kills IPv6 on OpenBSD One crafted ICMPv6 packet from the local network permanently hangs slaacd and/or rad. IPv6 SLAAC address autoconfiguration dies until someone manually restarts the daemon. No auth, no privileges, 18 bytes of ICMPv6 payload. | ---|--- CVE|...

team-teso

team-teso The TESO-CVS was giften to THC at THC's 10th anniversary party in 2005 Berlin. It is published here for educational purposes only. ENJOY. Some artifacts were never hosted on the CVS and are lost in time: TESO's ssh exploit Many ohh so many! OpenBSD exploits including the world's first...

TriforceOpenBSDFuzzer

TriforceOpenBSDSyscallFuzzer 20160825 https://github.com/nccgroup/TriforceOpenBSDFuzzer Jesse Hertz [email protected] Tim Newsham [email protected] This is a collection of files used to perform system call fuzzing of OpenBSD amd64 using TriforceAFL i.e. AFL and QEMU. To use it you will...

exploit_mitigations

Exploitation Mitigations The goal is to list exploitation mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability is easily exploitable or not depending on exploitation mitigations in place. An example is the...

local-exploits

Local Exploits Various local exploits CVE-2020-8793 opensmptd-makemap-lpe - Fedora 31 OpenSMTPD makemap local root exploit. Code mostly taken from Qualys advisory 2020-02-24 for CVE-2020-8793. opensmtpd: Reading of arbitrary file by unprivileged attacker can result in information disclosure or...

CVE-2020-7247

CVE-2020-7247 Proof Of Concept Exploit for CVE-2020-7247 Remote Execution on OpenSMTPD 6.6.2 OpenSMTPD 6.6.2 https://www.cvedetails.com/cve/CVE-2020-7247 tested on: OpenBSD 6.6 credits to Marco Ivaldi [email protected] for payload Usage remote $ go run CVE-2020-7247.go -u 192.168.0.2 -p 25 -...

naxsi

Project Status This is a project status update regarding Naxsi. As you may have noticed, the development of Naxsi has been stopped and the repository will be archived for historical reasons. This means that no new updates or bug fixes will be released for this version. However, if you wish to...

Openbsd-Privilege-Escalation

Openbsd-Privilege-Escalation A Script that automates the process of escalating privileges on openbsd system CVE-2019-19520 by exploiting the xlock binary and againing it's sgid and escalating to the root user by CVE-2019-19522 exploiting the privileges of auth group and adding keys to the Skey or...

openbsd_ov1

OpenBSD TCP/IP overflow Tested with latest OpenBSD 7.2 Details: int ipdooptionsstruct mbuf m, struct ifnet ifp ... for ; cnt 0; cnt -= optlen, cp += optlen opt = cpIPOPTOPTVAL; if opt == IPOPTEOL break; if opt == IPOPTNOP optlen = 1; else if cnt cnt code = &cpIPOPTOLEN - uchar ip; goto bad; switc...

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and...

Astra Linux – Vulnerability in Linux

A issue was discovered in the kernel of OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can exploit this to inject arbitrary network packets, regardless of the network configuration...

CVE-2020-7247

CVE-2020-7247 This vulnerability exists in OpenBSD’s mail server OpenSMTPD’s “smtpmailaddr” function, and affects OpenBSD version 6.6. This allows an attacker to execute arbitrary shell commands like “sleep 66” as root user How to use? python3 getShell.py If you need a reverse shell then run it...

exploit_mitigations

Mitigaciones de explotación El objetivo es listar las mitigaciones de explotación añadidas a lo largo del tiempo en varios sistemas operativos, software, librerías o hardware. Resulta útil saber si una vulnerabilidad determinada es fácilmente explotable o no según las mitigaciones de explotación...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: The PMK parameter is now passed as binary data, rather than hexadecimal data. It appears that the hexadecimal passphrase mechanism does not work on newer chips/firmwares e.g., BCM4387. There was actually...

CVE-2026-103547

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can...

CVE-2026-103547

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can...

CVE-2026-103547

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can...

CVE-2026-103547

The ldapd service in OpenBSD 7.8 (before errata 057) and 7.9 (before errata 021) contains a vulnerability where delegated BSD authentication results are incorrectly correlated using only the LDAP child process client file descriptor and LDAP message ID. This allows a remote attacker who can reach...

EUVD-2026-90259

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can...