acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation root@kitploit: pip install...

CVE-2024-1212

CVE-2024-1212 - Progress Kemp LoadMaster 未认证命令注入 这是一个针对 CVE-2024-1212 的漏洞利用脚本，该漏洞是 Progress Kemp LoadMaster 中的一个未认证命令注入漏洞 。 漏洞概述 CVE-2024-1212 影响 Progress Kemp LoadMaster ，允许未认证攻击者 通过向 /access/set 端点发送精心构造的 HTTP 请求在系统上执行任意命令。 功能特性 未认证远程命令执行（RCE） 随机化 User-Agent 头以规避基本检测 支持代理，用于 Burp/ZAP 拦截（-p）...

redis-exploitation

redis-exploitation CONFIG SET（仅供教育目的） 构建 root@kitploit: $ docker build -t victim . 运行 root@kitploit: $ docker run -d --name victim victim 攻击 root@kitploit: $ docker exec -it victim bash root@kitploit: root@34ea33cb2eb2 / ls /var/spool/cron/ root@34ea33cb2eb2 / redis-cli 127.0.0.1:6379 config set...

CVE-2022-24491

CVE-2022-24491 用于CVE-2022-24491的Zeek检测器： https://vulners.com/cve/CVE-2022-24491 该检测器在观察到portmap set和dump时（即利用CVE-2022-24491时执行的操作）将生成一个告警。 示例： root@kitploit: separator \x09 setseparator , emptyfield empty unsetfield - path notice open 2022-04-13-20-55-55 fields ts uid id.origh id.origp id.resph...

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie RFC6265 §5.3 step 6 and no public suffix check. A malicious or compromised server can therefore...

CVE-2026-69214

Http4s , a Scala library for HTTP services, is affected through its CookieJar client middleware . Prior to 0.23.35 and 1.0.0-M47 , the middleware stores a response cookie's Domain attribute without validating that it domain-matches the supplying host or rejecting public suffixes. A malicious or c...

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

CVE-2026-69211

Http4s is a Scala library for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , the ResponseCookie.render method writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from u...

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

安全公告：未经验证的响应头值导致的 HTTP 响应拆分（rouille） 分配的 CVE ID： CVE-2026-66746 摘要 rouille 在将响应头值写入客户端时，不会检查其中是否包含 回车符或换行符。因此，应用程序若将受攻击者影响的文本 放入响应头值，就会在线路上发出额外的响应头，甚至是 整整第二个 HTTP 响应。 rouille 的两个特性使该漏洞在普通代码中也能触达。Request::getparam 会进行百分号解码，因此查询字符串中的 %0d%0a 会变成真正的 CRLF。 而 session::session 会将客户端自己的 Cookie 值复制到...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Added a missing error check to scarlett2usbsetconfig. The scarlett2usbsetconfig function calls scarlett2usbget, but did not check the result. If this function fails, an error is returned instead of continuing wit...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: enable basic endpoint checking The catcprobe function fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usbsndbulkpipeusbdev, 1 and usbrcvbulkpipeusbdev, 1 for TX/RX...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: fpga: Prevent integer overflow in dflfeatureioctlsetirq The multiplication hdr.count sizeofs32 can cause integer overflow on 32-bit systems, leading to memory corruption. Use arraysize to fix this issue...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fixed a race condition between namespace cleanup and garbage collection for the list:set type. Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and garbage collection of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipvs: fixed the NULL pointer dereference in the route error path of ipv4 null-ptr-deref. The IPv4 code path in ipvsgetoutrt calls dstlinkfailure, without ensuring that skb-dev is set. This leads to a NULL pointer dereference in...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: exec: Fix for the issue involving the comparison between permission checks and setuid/gid usage When opening a file for execution using dofilpopen, permission checks are performed based on the file’s metadata at that moment. If t...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Do not allow SETID to refer to another table. When performing lookups for sets within the same batch using their IDs, a set from a different table can be used. However, when the table is removed, a reference ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: device-dax: The pgoff alignment in daxsetmapping should use ALIGNDOWN instead of ALIGN. Otherwise, vmf-address, which is not aligned with faultsize, will be aligned to the next alignment, which can lead to memory failures due ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Unconditionally sets set-nelems before inserting an element. In the event that the set is full, a new element is inserted and then removed without waiting for the RCU grace period. Meanwhile, the RCU reader m...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Do not finalize the CSA in IBSS mode if the state is disconnected. When we are not connected to a channel, sending the “switch” announcement doesn’t make any sense. The BSS list is empty in that case. This causes...