CVE-2025-66034-htb-ctf

CVE-2025-66034-htb-ctf VariaType 可变字体生成器漏洞利用工具 此仓库包含针对 Hack The Box 上 VariaType 机器的专用漏洞利用工具。该漏洞利用利用了 fontTools 库或 Web 应用程序处理 .designspace XML 文件和元数据插值时的漏洞，以实现远程代码执行 RCE 。 📝 描述 该漏洞存在于字体生成过程中。通过构造恶意的 designspace 文件，我们可以将 PHP 反向 shell 载荷注入到字体的元数据中（特别是 字段）。当服务器处理这些文件以生成可变字体时，它会将输出写入用户定义的路径，从而允许我们将 .p...

PHP-REVERSE-SHELL

PHP リバースシェル 強力かつステルス性 これは、倫理的なハッキングや侵入テスト向けに設計された、強力かつステルス性の高い PHP リバースシェルです。 マシンへの信頼性が高く静かな接続を確立します。 ⚠️ 免責事項 この PHP リバースシェルは、教育目的および許可された侵入テストの目的にのみ使用するために開発されています。 開発者は、この reverseshell を使用して行われたいかなる誤用、損害、または違法行為についても責任を負いません。...

CVE-2016-16113-POC

Get RCE - Bludit CMS 漏洞利用工具 root@kitploit: | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| 一个自动化利用工具，结合了 CVE-2019-17240 （认证绕过）和 CVE-2019-16113 （任意文件上传），可在易受攻击的 Bludit CMS 安装上实现远程代码执行。 ⚠️ 法律免责声明 仅限授权的安全测试...

CVE-2015-6967

CVE-2015-6967 python exploit.py --url http://xx.xx.xx.xx --username admin --password nibbles --payload phprevshell.php 将 phprevshell.php 第 7 行的 $ip 更改 nc -lvnp 1234...

Modified-CVE-2015-3306-Exploit

Modified-CVE-2015-3306-Exploit 如何使用 1. 创建一个 PHP 反向 shell 2. 启动服务器以在同一目录中托管 shell python3 -m http.server 3. 启动 netcat 监听器在本地选择的端口，例如：nc -nlvp port of choice 4. 运行以下提供的漏洞利用示例 python3 modifiedCVE20153306.py --host remote host --port most likely port 21 --path /var/www or /var/www/html --shell name o...

php_reverse_shell

此存储库没有 README。...

php-reverse-shell

php-reverse-shell...

MySQL-Fu.rb

MySQL-Fu.rb MySQL-Fu 是我编写的一个基于 Ruby 的 MySQL 客户端脚本。 它能完成普通 MySQL 客户端可能会做的大部分事情：SQL Shell、更新/删除/Drop 数据库/表、添加/删除用户、转储数据库/表并支持 gzip 压缩选项...... 另外还有一些额外选项 能让渗透测试更轻松一些。 包含多个内置的 PHP 命令 Shell 选项，以及 Pentestmonkey 的 PHP 反向 Shell；此外，还提供多种文件写入和读取选项（所有读取的文件都会在本地记录日志，供后续离线分析）；另外还包含 Kingcope 的 CVE-2012-5613...

CVE-2023-4220-Proof-of-concept

CVE-2023-4220-概念验证 Chamilo LMS 未授权大文件上传漏洞，可导致远程代码执行 此代码专为 HackTheBox CTF PERMX 制作和使用 Chamilo LMS v1.11.24 及更早版本中的大文件上传功能 /main/inc/lib/javascript/bigupload/inc/bigUpload.php 存在未授权文件上传漏洞，允许向服务器上传任意文件，从而允许我们上传 PHP 反向 shell 该脚本通过创建 PHP shell 文件、将其上传到服务器并启动 netcat 监听器，从而获取反向 shell 用法: python exploit....

📄 Monsta FTP 2.11 Remote File Injection

This Metasploit module exploits a vulnerability in Monsta FTP version 2.11 and enables remote file injection by creating a malicious FTP server. The application builds this server to upload a malicious PHP file reverse shell. After the file is uploaded, the module immediately verifies the...

CVE-2025-34506

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed...

CVE-2025-34506

WBCE CMS is affected: version 1.6.3 and earlier are vulnerable to authenticated remote code execution via uploading a malicious module. The flaw arises when an administrator can upload a ZIP module containing embedded PHP reverse shell code, enabling remote system access when installed. Exploitat...

PT-2025-50767

Name of the Vulnerable Software and Affected Versions WBCE CMS versions prior to 1.6.3 WBCE CMS version 1.6.3 Description WBCE CMS versions 1.6.3 and earlier have a flaw that permits administrators to execute code remotely by uploading malicious modules. An attacker can create a ZIP module...

CVE-2022-36667

Garage Management System 1.0 is vulnerable to the Remote Code Execution RCE due to the lack of filtering from the file upload function. The vulnerability exist during adding parts and from the upload function, the attacker can upload PHP Reverse Shell straight away to gain RCE...

Exploit for Unrestricted Upload of File with Dangerous Type in Limesurvey

CVE-2021-44967 Exploit Title: LimeSurvey 5.2.4 - Authen...

Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck

CVE-2023-50564 PoC This repository contains a Proof of Con...

Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics

CVE-2022-24637 Open Web Analytics 1.7.3 - Remote Code Executio...

CVE-2022-36667

Garage Management System 1.0 is vulnerable to the Remote Code Execution RCE due to the lack of filtering from the file upload function. The vulnerability exist during adding parts and from the upload function, the attacker can upload PHP Reverse Shell straight away to gain RCE...

CVE-2022-36667

Garage Management System 1.0 is vulnerable to the Remote Code Execution RCE due to the lack of filtering from the file upload function. The vulnerability exist during adding parts and from the upload function, the attacker can upload PHP Reverse Shell straight away to gain RCE...

Design/Logic Flaw

Garage Management System 1.0 is vulnerable to the Remote Code Execution RCE due to the lack of filtering from the file upload function. The vulnerability exist during adding parts and from the upload function, the attacker can upload PHP Reverse Shell straight away to gain RCE...