CVE-2020-17008

CVE-2020-17008 splWOW64 Elevation of Privilege C:\Windows\splwow64.exe Poc From: https://bugs.chromium.org/p/project-zero/issues/detail?id=2096 0x01 set splwow64poc.exe Low cd splwow64poc\x64\Release icacls splwow64poc.exe /setintegritylevel L /setintegritylevel CIOI级别将完整性 ACE 显式...

CVE-2020-9496

CVE-2020-9496 XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 Install requirements $ pip install -r requirements.txt $ wget https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar -O...

CVE-2022-24491

CVE-2022-24491 A Zeek detector for CVE-2022-24491: https://vulners.com/cve/CVE-2022-24491 This detector will generate a notice if it sees a portmap set and dump, an action performed when exploiting CVE-2022-24491. Example: separator \x09 setseparator , emptyfield empty unsetfield - path notice op...

CVE-2024-38077-check

CVE-2024-38077check Detect whether the target has CVE-2024-38077 vulnerability based on port 135. The target machine's firewall must not restrict port 135. If the target has RDL service enabled, it is affected by this vulnerability. If the target server has updated the patch, an attempt to connec...

xmlrpc-common-deserialization

xmlrpc-common deserialization vulnerability This note is a technical note to detail the root cause and the associated exploit. You can find the initial disclosure here. The associated CVE is CVE-2019-17570. Description xmlrpc-common forms a shared code base between xmlrpc-client and xmlrpc-server...

WPTaskScheduler_CVE-2024-49039

WPTaskScheduler Persistence & CVE-2024-49039, as one of Attack Surface within Task Scheduler. WPTaskScheduler.dll is a component of Task Scheduler, since win 10 1507. This is likely a backdoor tool used for persistence, which was analyzed by security researchers, who found that able to bypass...

CVE-2020-1066-EXP

Reference This vulnerability belongs to the Windows CardSpace service that does not properly handle symbolic link objects, leading to a local privilege escalation via arbitrary file replacement. Disclaimer The author's PoC is for research purposes only. If readers use this PoC for other activitie...

CVE-2026-48484

The pyLoad download manager is vulnerable to a Denial of Service (DoS) due to a lack of input size validation. Specifically, the rpc function in api_blueprint.py processes multipart/form-data uploads by using file.read() to load the entire file into memory before further processing. Because no si...

CVE-2022-26809

CVE description CVE-2022-26809 - weakness in a core Windows component RPC earned a CVSS score of 9.8 not without a reason, as the attack does not require authentication and can be executed remotely over a network, and can result in remote code execution RCE with the privileges of the RPC service,...

CVE-2023-20887

CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight unauthenticated RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ Summary...

CVE-2023-28229

CVE-2023-28229 Windows CNG KeyIso RPC EoP/SBX Discovered by: @k0shl Reference: https://whereisk0shl.top/post/isolate-me-from-sandbox-explore-elevation-of-privilege-of-cng-key-isolation If compilation fails, rename rpc.h to something else because I didn't realise rpc.h is a standard include in...

pentest-a2p2v-core

README Automated Attack Path Planning and Validation A2P2V is a planning and cyber-attack tool that provides the capability for users to determine a set of ranked attack sequences given a specific attacker goal. The aim of the tool is to simplify process so that non-security experts can generate...

teatime

Teatime - 블록체인 RPC 공격 프레임워크 .. image:: https://img.shields.io/pypi/v/teatime.svg :target: https://pypi.python.org/pypi/teatime .. image:: https://img.shields.io/travis/dmuhs/teatime.svg :target: https://travis-ci.com/dmuhs/teatime .. image::...

smbtakeover

smbtakeover Windows에서 드라이버를 로드하거나 LSASS에 모듈을 로드하거나 대상 머신을 재부팅하지 않고 445/tcp를 바인딩 해제하고 다시 바인딩하는 기술입니다. C2를 통해 운영하는 동안 SMB 기반 NTLM 릴레이의 부담을 덜기 위해 구현되었습니다. 이 기술에 대한 기술적 분석은 x33fcon에서 진행된 Relay Your Heart Away: An OPSEC Concious Approach to 445 Takeover 프레젠테이션에서 자세히 논의됩니다. PoC는 Python과 BOF 형식으로 작성되었습니...

Hadoop-Yarn-ResourceManager-RCE

취약점 영향 Hadoop yarn ResourceManager에 인가되지 않은 접근 취약점이 있었습니다. 이 취약점은 Hadoop의 핵심 구성 요소인 Hadoop yarn에 존재했습니다. Hadoop yarn은 기본적으로 RPC 서비스를 공개적으로 개방했기 때문에, 원격 공격자가 이 인가되지 않은 취약점을 악용하여 RPC 서비스를 통해 임의의 명령을 실행하고 대상 서버를 제어할 수 있었습니다. 이 취약점은 위험도가 높고 피해가 크며, 상세 정보가 이미 공개되어 공격자에 의해 악용되었으므로, Apache Hadoop을 사용하는 ...

WordpressPingbackPortScanner

WordpressPingbackPortScanner Wordpressは、他のブログ記事にリンクするためのいわゆるPingback APIを公開しています。 この機能を利用すると、このサーバーを介して社内ネットワークやインターネット上の他のホストをスキャンできます。 また、この機能を一種の分散ポートスキャンにも利用できます。 このAPIを公開している複数のWordpressブログを使って、単一のホストをスキャンできます。 この問題はWordpress 3.5.1で修正されました。それより古いバージョンは、 XML-RPCインターフェースが有効な場合、脆弱です。...

EXPLOIT-CVE-2026-8832

EXPLOIT CVE-2026-8832 An exploitation tool to test for Remote Code Execution RCE vulnerabilities in the WordPress plugin WPCode Lite Insert Headers and Footers v2.3.5. This vulnerability stems from registering the Custom Post Type CPT wpcode without defining a custom capabilitytype. This oversigh...

Kage

Kage Kage ka-geh is a tool inspired by AhMyth designed for Metasploit RPC Server to interact with meterpreter sessions and generate payloads. For now it only supports windows/meterpreter & android/meterpreter. Getting Started Please follow these instructions to get a copy of Kage running on your...

isf

Industrial Exploitation Framework ISFIndustrial Exploitation Framework is a exploitation framework based on Python, it's similar to metasploit framework. ISF is based on open source project routersploit. Read this in other languages:English, 简体中文, Disclaimer Usage of ISF for attacking targets...

Perfusion

Perfusion On Windows 7 , Windows Server 2008R2 , Windows 8 , and Windows Server 2012 , the registry key of the RpcEptMapper and DnsCache 7/2008R2 only services is configured with weak permissions. Any local user can create a Performance subkey and then leverage the Windows Performance Counters to...