impersonate-rs

IRS Impersonate-RS 💡 IRS es una versión como librería de https://github.com/zblurx/impersonate-rs, zblurx Reimplementación de Defte Impersonate en Rust puro. Para obtener más información al respecto, consulta este blogpost. El enfoque de suplantación de tokens es un poco diferente al de Defte...

CVE-2016-10924

CVE-2016-10924 CVE-2016-10924 - Directory traversal vulnerability in WordPress ebook-download plugin1.2. PoC + PID Bruteforce in Python. Usage git clone https://github.com/rvizx/CVE-2016-10924 cd CVE-2016-10924 python pidbrute.py...

CVE-2021-3899_PoC

CVE-2021-3899 PoC Reproducción 0. Instala una versión anterior de apport: sudo apt-get install apport=2.20.11-0ubuntu27 cualquier versión apportstart: 597 errorlog'process was replaced after Apport started, ignoring' 598 sys.exit0 Pero este pid podría reutilizar...

nysm

nysm 一个隐秘的后渗透容器。 目录 1. 简介 2. 安装 2.1 依赖 2.2 Linux 头文件 2.3 构建 3. 使用 3.1 示例 4. 工作原理 4.1 概述 4.2 隐藏 eBPF 对象 4.3 隐藏 Auditd 日志 4.4 隐藏 PID 4.5 隐藏套接字 5. 局限性 简介 随着基于 eBPF 的攻防工具的流行——从凭证窃取器到能隐藏自身 PID 的 rootkit——一个问题浮现出来： 是否有可能让 eBPF 在自己眼中变得不可见？ 由此，我们创建了 nysm，一个 eBPF 隐秘容器，旨在让攻击工具避开系统管理员的视线，不仅隐藏...

dismember

🔪 Dismember Dismember is a command-line toolkit for Linux that can be used to scan the memory of all processes or particular ones for common secrets and custom regular expressions, among other things. It will eventually become a full /proc toolkit. Using the grep command, it can match a regular...

tugtainer-1.30.2-CVE-2026-55494-and-CVE-2026-62308-to-RCE

Tugtainer v1.30.2 RCE 该RCE通过滥用两个漏洞实现： CVE-2026-55494 CVE-2026-62308 简而言之，利用SSRF漏洞调用内部网络中一个未认证的服务，创建一个与tugtainer共享相同PID的docker，从而通过/proc/1/root访问tugtainer docker的文件系统，并且由于创建的docker具有root级别权限，技术上你就在tugtainer docker系统中拥有root权限。 设置 使用本仓库中提供的docker-compose.yml运行docker compose，或者复制粘贴以下内容： networks:...

docker_lightman_exploit

Docker Lightman Exploit Docker CVE-2022-37708. Este exploit se basa en cómo el sistema de archivos UNIX asigna UID y GID a los archivos que Docker comparte entre el Host que ejecuta Docker y el Cliente que se ejecuta dentro del Docker, así como en la naturaleza de cómo funciona la propiedad de lo...

CVE-2012-0056

Escalada local de privilegios en Linux mediante escritura en /proc/pid/mem de SUID Mempodipper Presentamos Mempodipper, un exploit para CVE-2012-0056. /proc/pid /mem es una interfaz para leer y escribir directamente en la memoria de un proceso, desplazándose por las mismas direcciones que el...

CVE-2019-5736-PoC

用法 PoC 针对受害者执行例如 docker exec sh 的场景创建。在运行漏洞利用之前，需要覆盖容器文件系统中的 sh 二进制文件： printf '!/proc/self/exe' /bin/sh 之后，当受害者执行 exec 命令时，主机文件系统中的 runc 二进制文件将被 exploit 中定义的代码覆盖。 示例 容器终端： root@cebad431c120:/ printf '!/proc/self/exe' /bin/sh root@cebad431c120:/ ./exp Waits until victim issues the exec command Fou...

truffleproc

truffleproc — caza secretos en la memoria de procesos Uso Ejecuta truffleproc.sh contra tu shell Bash actual p. ej., $$: $ ./truffleproc.sh $$ coredumping pid 6174 Reading symbols from od... Reading symbols from /usr/lib/systemd/systemd... Reading symbols from...

process-enumeration-stealth

🚴 process-enumeration-stealth ¿Qué es esto? Este es un PoC simple que te permite devolver una lista de PIDs que están usando actualmente NTFS, consultando el dispositivo base \ntfs\ el objeto base del sistema de archivos de Windows. Utilizar este método evita la necesidad de usar APIs típicas, co...

usbrip

usbrip inherited from "USB Ripper", not "USB R.I.P." is a simple forensics tool with command line interface that lets you keep track of USB device artifacts i.e., USB event history on Linux machines. Table of Contents: Description Quick Start Showcase System Log Structure Dependencies deb pip...

CVE-2018-6606

CVE-2018-6606 这用于终止任何PID。 已在Windows 10（64位，Flare VM）上测试。 需要管理员权限。 可能需要一些调整——参见resource.rc。 工具链 下载： https://github.com/brechtsanders/winlibsmingw/releases/download/15.2.0posix-13.0.0-ucrt-r6/winlibs-x8664-posix-seh-gcc-15.2.0-mingw-w64ucrt-13.0.0-r6.zip 设置： 解压到C:\mingw64 将C:\mingw64\bin添加到PATH 版本：...

asminject

asminject.py asminject.py es un fork muy modificado del proyecto dlinject de David Buchanan. Inyecta cargas útiles payloads de código ensamblador arbitrario o binarios precompilados directamente en procesos Linux x86-64, x86 y ARM32 mediante el acceso a /proc//mem en lugar de adjuntarse a través ...

CVE-2022-1227_Exploit

CVE-2022-1227Exploit 一个用于利用 CVE-2022-1227 的脚本。 背景 推荐使用 Ubuntu 20.10。 Podman TODO：添加此漏洞的原理说明 安装 Podman 按照官方文档中的说明操作： https://podman.io/getting-started/installationinstalling-on-linux 对于 Ubuntu 20.10，安装命令应为： sudo apt-get install podman=3.4.4+ds1-1ubuntu1 快速开始 简单利用 在本节中，我们尝试一个简单的 PoC，突破 PID 命名空间 的边界...

Rocky Linux 10.2 [CIQ] Security Update: mrtg / mrtg-debuginfo / mrtg-debugsource / mrtg-selinux (crlsa-2026_57596)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202657596 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-102371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the...

AlmaLinux 9.6 [TuxCare] Security Update: kbd / kbd-legacy / kbd-misc (ALMALINUX9.6:CLSA-2026:1788265535)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788265535 advisory. - openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the...

CVE-2026-102371

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

UBUNTU-CVE-2026-102371

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...