tricorne

Tricorne A Fedora Remix for offensive security. "My treasure? If you want it, I'll let you have it. Seek it out! I left everything at that place!" Gol D. Roger The short version Kali owns Debian. BlackArch owns Arch. Parrot owns the "security-focused desktop" niche. No one owns RPM-world offensiv...

go-rpmdb

go-rpmdb 一个用于枚举 RPM 数据库 Packages 文件中软件包的库（无绑定）。 root@kitploit: package main import "fmt" "log" rpmdb "github.com/knqyf263/go-rpmdb/pkg" func main if err := run; err != nil log.Fatalerr func run error db, err := rpmdb.Open"./Packages" if err != nil return err pkgList, err := db.ListPackages if err...

CVE-2024-22026

CVE-2024-22026 影响 Ivanti EPMM "MobileIron Core" 的 CVE-2024-22026 漏洞利用 POC CVE-2024-22026 是 Ivanti EPMM（原 MobileIron）服务器版本 12.1.0.0、12.0.0.0 和 11.12.0.1 之前的一个本地权限提升漏洞。该漏洞允许本地攻击者通过利用软件更新过程，从远程 URL 安装恶意 RPM 包，从而获得系统的 root 访问权限。 阅读完整博文以获取详细技术信息：利用 CVE-2024-22026：获取 Ivanti EPMM（MobileIron Core）的 root ...

CVE-2026-41651

🚨 CVE-2026-41651 — Pack2TheRoot PackageKit の権限昇格の脆弱性 TOCTOU レースコンディション 📌 概要 CVE-2026-41651 は、さまざまな Linux ディストリビューションで使用されている PackageKit システムサービスに影響を及ぼすローカル権限昇格の脆弱性です。 この脆弱性は、Time-of-Check to Time-of-Use TOCTOU レースコンディション によって引き起こされ、パッケージインストールのワークフローを操作して root への権限昇格を実現するために悪用される可能性があります。 ⚠️ 影響...

trivy-repo

trivy-repo deb/rpm repository for Trivy Debian/Ubuntu root@kitploit: $ sudo apt-get install wget apt-transport-https gnupg $ wget -qO - https://get.trivy.dev/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg /dev/null $ echo "deb signed-by=/usr/share/keyrings/trivy.gpg...

polkit-0.96-CVE-2021-4034

polkit-0.96-CVE-2021-4034 centos 7.x 已经有了 修复CVE-2021-4034 漏洞的RPM包，但没找到 centos 6.x的 自己参考 源代码 制作、打包 rpm redhat 已经修复 6.x，但没找到下载的地方 https://access.redhat.com/errata/RHSA-2022:0269 修复漏洞 root@kitploit: 下载 polkit-0.96-11.1.el6.x8664.rpm 升级 rpm -Uhv polkit-0.96-11.1.el6.x8664.rpm 测试漏洞是否修复 sh...

CVE_kernellinux_jsh

CVEkernellinuxjsh — kernelsec Framework Autor: jshDevs · Versión: 0.1.0-scaffold · Licencia: MIT Framework modular en Bash para auditar y remediar CVEs críticos del kernel Linux en distribuciones RPM-based AlmaLinux 8/9, Rocky Linux 8/9, CentOS Stream 8/9/10. CVEs cubiertos...

CVE-2015-7547

CVE-2015-7547 glibc 脆弱性テストスクリプト これは、glibc の脆弱性 CVE-2015-7547 をテストするためのシェルスクリプトを提供します。Red Hat Enterprise Linux / RHEL / CentOS 5/6/7 のような rpm ベースのシステム向けに書かれています。他のディストリビューションの検出は今後追加される可能性があります。 解決方法 1. bin/test-glibc.sh を実行して、システムが脆弱かどうかを確認してください。 2. glibc パッケージを更新してください。 3...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

EUVD-2026-70108

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837

A command injection vulnerability was identified in rpm , specifically in the gettarspec function used by rpmbuild -t*. The root cause is an unescaped tarball path or filename that, when containing shell metacharacters, allows an attacker to inject arbitrary commands. This is particularly relevan...

CVE-2026-84837 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

tippa-my-tongue

Tippa My Tongue Tippa My Tongue 是一个利用 CVE-2022-1388 和 CVE-2022-41800 在 F5 BIG-IP 产品上建立 root 反向 Shell 的漏洞利用工具。大多数 CVE-2022-1388 利用工具通过 /mgmt/tm/util/bash 实现代码执行。然而，本工具使用了 /mgmt/shared/iapp/rpm-spec-creator，随后再使用 /mgmt/shared/iapp/build-package。这一方法最早由 Ron Bowes 在 AttackerKB 的这篇 分析文章...

CVE-2026-64561-Kernel-Fix

中文 | English 中文 升级 Linux Kernel 修复 CVE-2026-64561 教程 声明： 本文仅记录本人服务器环境下的修复过程，并非安全专业分析。如有不当之处，欢迎指正。 一、简介 本文档提供两种方式将 Linux Kernel 升级，用于修复 CVE-2026-64561 ：ELRepo RPM 安装（推荐）和源码编译。 项目| 说明 ---|--- CVE 编号| CVE-2026-64561 漏洞组件| Linux Kernel KVM/x86 修复方式| 升级 Linux Kernel（ELRepo RPM 或源码编译） 三、升级方法...

CVE-2026-84233

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

CVE-2026-84233 Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

CVE-2026-84233

rpm is vulnerable to command execution via macro expansion in rpmuncompress -x. A local attacker can supply a specially crafted .gem filename containing RPM macro syntax ; when a user or automated workflow invokes rpmuncompress -x on that file, the macro expansion occurs during command constructi...

EUVD-2026-69249

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...