watchTowr-vs-SonicWall-PreAuth-RCE-Chain

SonicWall SMA 100 预认证 RCE 链 PoC SonicWall SMA 100 预认证 RCE 链的 PoC（CVE-2023-44221、CVE-2024-38475） 有关技术细节，请参阅我们的博客文章 https://github.com/user-attachments/assets/b157b39c-d7bd-4385-af7a-e465f8fd4a41 PoC 实战演示 python watchTowr-vs-SonicWall-PreAuth-RCE-Chain.py -t https://192.168.8.153/ -c ifconfig / | |...

CVE-2024-21413-POC

CVE-2024-21413 - POC 使用方法： python CVE-2024-21413.py -host example.com -port 25 -from [email protected] -recipient [email protected] -url xx.xx.xx.xx/path/to/shared/file/r0tb1t.rtf !NOTE r00tb1t : 是来自攻击者机器（xx.xx.xx.xx）的共享测试文件（本例中为Word文件）。 为确保符合SPF、DKIM和DMARC，请使用合法的$IP和域名。...

watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428

CVE-2025-4427 和 CVE-2025-4428 Ivanti EPMM 漏洞链 Ivanti EPMM 预认证 RCE 漏洞链 1day 检测工件生成工具 检测演示 $ python3 watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428.py -H https://192.168.1.100 / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // || \ ||| | \ / // || / / /...

CVE-2025-48734

CVE-2025-48734：Apache Commons BeanUtils – 枚举 declaringClass 信息泄露与 RCE 链 仅用于教育和授权的安全研究目的。 该仓库提供了一个受控的实验室环境，用于重现 Apache Commons BeanUtils 中的 CVE-2025-48734 漏洞，并探索攻击者在特定条件下如何升级到远程代码执行（RCE）。 📖 漏洞描述 CVE-2025-48734 影响 Apache Commons BeanUtils 1.11.0 之前的版本（以及 2.x 分支 2.0.0-M2 之前的版本）。问题在于 PropertyUtilsBea...

DoubleStar

. . \ | | | / // | | | \ / \ | | | \ | | / \ \ \ \ \ | | | /| \ | |\ / / \ | | / | | / / / / |/ | /|/ / / || /| | / / / / / Windows 8.1 IE/Firefox RCE - 沙箱逃逸 - SYSTEM EoP 漏洞利用链 | Remote PAC | || ^ | HTTPS RPC/ALPC RPC/ALPC | firefox.exe | ---------- | svchost.exe | ----------- | spoolsv.exe | || ...

watchTowr-vs-SysAid-PreAuth-RCE-Chain

SysAid 预授权 RCE 链 PoC SysAid 预授权 RCE 链的 PoC（CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778） 技术细节请参阅我们的博客文章 https://github.com/user-attachments/assets/03245fab-915d-43b6-8e91-f0a18251af49 PoC 实战 python watchTowr-vs-SysAid-PreAuth-RCE-Chain.py -t http://192.168.201.217:8080/ -l...

RestrictedPython guard hooks can be shadowed via positional-only arguments

Impact RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattrobj, name, item access becomes getitemobj, key, writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy. Argument-na...

CVE-2026-72826

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

CVE-2026-72826 Grav before 1.0.13 Scope Bypass via createApiKey

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

TerraMaster TOS 4.2.15 Remote Code Execution Exploit

This Metasploit module is a Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected. This module requires Metasploit: https://metasploit.com/download...