CVE-2020-11097-POC

Hacer fallar FreeRDP usando el POC de CVE-2020-11097 inicia el servidor con python3 test.py conecta al servidor con el siguiente comando xfreerdp /v:127.0.0.1:3389 /u:user /p:pass /gt:127.0.0.1 /log-level:DEBUG...

gmailc2

gmailc2 A Fully Undetectable C2 Server That Communicates Via Google SMTP to evade Antivirus Protections and Network Traffic Restrictions Note: This RAT communicates Via Gmail SMTP or u can use any other smtps as well but Gmail SMTP is valid because most of the companies block unknown traffic so...

gmailc2

gmailc2 완전 탐지 불가능한 C2 서버로, Google SMTP를 통해 통신하여 안티바이러스 보호 및 네트워크 트래픽 제한을 우회합니다. 참고: 이 RAT는 Gmail SMTP를 통해 통신합니다 또는 다른 SMTP를 사용할 수도 있음. 그러나 Gmail SMTP가 유효한 이유는 대부분의 회사에서 알 수 없는 트래픽을 차단하기 때문에 Gmail 트래픽은 유효하며 어디서나 허용됩니다. 경고: 1. VirusTotal.com에 페이로드를 업로드하지 마십시오. 이 도구는 시간이 지나면 작동하지 않습니다. 2. VirusTotal...

CVE-2026-67404

A flaw was found in rabbitmq-server. When the OAuth2 plugin fetches JWKS and no CA bundle is available, TLS verification silently falls back to verifynone. A man-in-the-middle attacker can forge the JWKS response, causing the broker to accept arbitrary JWTs. Mitigation Mitigation for this issue i...

cracklord

Cracklord http://jmmcatee.github.io/cracklord/ What Is It? CrackLord is a system designed to provide a scalable, pluggable, and distributed system for both password cracking as well as any other jobs needing lots of computing resources. Better said, CrackLord is a way to load balance the resource...

ruler

Introduction Ruler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol. The main aim is abuse the client-side Outlook features and gain a shell remotely. The full low-down on how Ruler was implemented and some background regardin...

dirsearch

DirSearch This software is a Go implementation of the original dirsearch tool written by Mauro Soria. DirSearch is the very first tool I write in Go, mostly to play and experiment with Go's concurrency model, channels, and so forth : Purpose DirSearch takes an input URL -url parameter and a...

pivotnacci

pivotnacci Pivot into the internal network by deploying HTTP agents. Pivotnacci allows you to create a socks server which communicates with HTTP agents. The architecture looks like the following: This tool was inspired by the great reGeorg. However, it includes some improvements: Support for...

AirStrike

Airstrike Herramienta que automatiza el descifrado de credenciales Wi-Fi WPA-2 usando arquitectura cliente-servidor Requisitos Airstrike utiliza la arquitectura Hashcat Brain, el conjunto aircrack-ng, la utilidad entr y algunos scripts auxiliares. Puedes usar el script install.sh para descargar...

CVE-2017-16567

CVE-2017-16567 1. Título del exploit: Logitech Media Server: Cross Site Scripting persistente XSS 2. Shodan Dork: Buscar Logitech Media Server 3. Fecha: 11/03/2017 4. Autor del exploit: Dewank Pant 5. Página web del proveedor: www.logitech.com 6. Versión: 7.9.0 7. Probado en: Windows 10, Linux PO...

CVE-2025-55182-exploit

CVE-2025-55182 Exploit This repository contains a simple exploit for CVE-2025-55182 , a critical remote code execution vulnerability in React Server Components. Vulnerability Overview CVE-2025-55182 is an unauthenticated remote code execution vulnerability in React Server Components CVSS 10.0. Th...

cve-2025-66478_rce_vulnerable

Modern Blog with shadcn/ui A modern and elegant blog built with Next.js 16, React 19, shadcn/ui and Tailwind CSS. IMPORTANT: Next JS VULNERABLE project created solely for educational, testing and exploitation purposes, NOT RECOMMENDED FOR PRODUCTION DEPLOYMENT, ONLY FOR LOCAL OR CONTROLLED...

LibSSH-exploit

LibSSH-exploit CVE-2018-10933 Servidores ssh vulnerables - libssh anterior a 0.8.4 Envía un mensaje de usuario autorizado que permite RCE Uso: ''' Libsshexploit.py '''...

CVE-2026-107613

A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties for...

CVE-2026-107614

An integer underflow in WinCursorShapeUtils::trimTransparent in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI...

CVE-2026-107615

An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init and ThemeLib load screenhooks32.dll / screenhooks64.dll with LoadLibrary using a bare fi...

CVE-2026-107612

Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global...

Zerologon_CVE-2020-1472

ZerologonCVE-2020-1472 Objetivo Esta investigación de vulnerabilidades tenía como objetivo establecer un entorno controlado para simular un Zerologon en Windows Server 2016 a través de Kali Linux con fines de detección y mitigación. El enfoque principal era realizar una prueba de penetración de...

react-rsc-cve-2025-55182-lab

Laboratorio CVE-2025-55182 — RCE en React Server Components Laboratorio educativo que demuestra CVE-2025-55182 — una vulnerabilidad crítica CVSS 10.0 de ejecución remota de código en React Server Components causada por contaminación de prototipos en el deserializador del protocolo Flight. Aviso...

CVE-2025-55182

Caza de CVE-2025-55182 Uso de inteligencia de fuentes abiertas para identificar dispositivos vulnerables Motor de búsqueda Shodan Ve a Shodan. En la barra de búsqueda, introduce la siguiente consulta para encontrar dispositivos que ejecutan la versión vulnerable del framework Next.js:...