CVE-2025-11001

Usage: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe Exploiting 7-zip The vulnerability is only exploitable on windows and has one major caveat.The bug can only be exploited when 7-Zip is ran with Admin privileges for this vulnerability to be succesfully exploited...

7zip-CVE-2025-11001

Usage: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe Exploiting 7-zip The vulnerability is only exploitable on windows and has one major caveat.The bug can only be exploited when 7-Zip is ran with Admin privileges for this vulnerability to be succesfully exploited...

CVE-2022-3294

Exploit Reference: https://github.com/kubernetes/kubernetes/issues/113757 https://github.com/kubernetes/kubernetes/issues/119640 https://github.com/kubernetes/sig-security/blob/main/sig-security-external-audit/security-audit-2021-2022/findings/Kubernetes%20v1.24%20Final%20Report.pdf Enumeration: ...

cve-2024-7646

CVE-2024-7646 Description In default, nginx.ingress.kubernetes.io/server-snippet is disabled, but due to this cve, nginx.ingress.kubernetes.io/auth-tls-verify-client can still insert custom snippets, or even lua code can be included. Fixed version ingress-nginx controller v1.11.2 - fixed by...

gcp_scanner

Disclaimer This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose. GCP Scanner This is a GCP resource scanner that can help determine what level of acces...

CVE-2025-11001

Usage: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe Exploiting 7-zip The vulnerability is only exploitable on windows and has one major caveat.The bug can only be exploited when 7-Zip is ran with Admin privileges for this vulnerability to be succesfully exploited...

RFCpwn

RFCpwn An SAP enumeration and exploitation toolkit using SAP RFC calls Twitter: @icryo This is a toolkit for demonstrating the impact of compromised service accounts. This PoC is not for use in production environments, no guarantee of stability or support. RFCpwn relies on the pyrfc and the...

StopDefender

StopDefender Stop Windows Defender programmatically creating a new token using TrustedInstaller and Windefend service accounts. One button stop action, no need for supply commandline options nor pid. Usefull for integration with Post Explotation frameworks. Blogpost...

pytmipe

PYTMIPE & TMIPE PYTMIPE PYthon library for Token Manipulation and Impersonation for Privilege Escalation is a Python 3 library for manipulating Windows tokens and managing impersonations in order to gain more privileges on Windows. TMIPE is the python 3 client which uses the pytmipe library...

patchy

Patchy Automated lateral movement and persistence by abusing GCP OS patch management based on my blog post. Patchy is made up of two main modes, lateral movement, and persistence. Persistence uses valid service account credentials to create a patch job or deployment. Lateral movement attempts to...

S4UTomato

S4UTomato Escalate Service Account To LocalSystem via Kerberos. Traditional Potatoes Friends familiar with the "Potato" series of privilege escalation should know that it can elevate service account privileges to local system privileges. The early exploitation techniques of "Potato" are almost...

PrintSpoofer

PrintSpoofer PrintSpoofer exploit that can be used to escalate service user permissions on Windows Server 2016, Server 2019, and Windows 10. To escalate privileges, the service account must have SeImpersonate privileges. To execute: PrintSpoofer.exe -i -c cmd With appropriate privileges this shou...

CVE-2026-112250

The BRAIN2 software (versions up to and including 3.09 ) contains a vulnerability where a Windows service account password may be written in cleartext to a setup log file. This occurs during the installation wizard when Microsoft SQL Server access is configured using Integrated Security and a spe...

CVE-2026-112250 Cleartext Storage of Windows Service Account Password in BRAIN2 Setup Log Files

A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using...

cve-2026-46391

CVE-2026-46391 - Credential Exposure via SSRF in @haxtheweb/open-apis Proof of concept for CVE-2026-46391. Triggers the SSRF vulnerability in the cacheAddress endpoint of @haxtheweb/open-apis and captures the service account credentials sent in the callback. Build go build -o cve-2026-46391 . Tes...

CVE-2026-21008-Kubernetes-Service-Account-Token-Mounted-in-HostPath

CVE-2026-21008 – Kubernetes Service Account Token Mounted in HostPath Program Code YAML + Python exploit vulnerable-pod.yaml - Pod that mounts /var/run/secrets/kubernetes.io/serviceaccount into a hostPath apiVersion: v1 kind: Pod metadata: name: sa-token-leak spec: containers: - name: app image:...

CVE-2024-36539

Here’s a README.md for a Proof of Concept PoC demonstrating the insecure permissions vulnerability in Contour v1.28.3: Proof of Concept PoC for Insecure Permissions Vulnerability in Contour v1.28.3 This repository contains a Proof of Concept PoC script demonstrating an insecure permissions...

JuicyPotatoNG

JuicyPotatoNG Just another Windows Local Privilege Escalation from Service Account to System. Full details at -- https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/ Usage JuicyPotatoNG by decoderit & splintercode Mandatory args: -t createprocess call:...

CVE-2026-115547

The Okta Access Gateway (OAG) Admin Console is vulnerable to Command Execution due to an input validation issue that allows the processing of specially formatted configuration values. An authenticated administrator can exploit this vulnerability to execute arbitrary system commands within the con...

PT-2026-121739

Name of the Vulnerable Software and Affected Versions Okta Access Gateway versions prior to 2026.10.2 Description An input validation issue in the Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can exploit this to execute system...