cve-2024-32002-poc-aw

CVE-2024-32002 PRC AW 一个针对 CVE-2024-32002 的 POC，演示了对 .git 目录的任意写入。 请参阅相关的子模块仓库：cve-2024-32002-submodule-aw 本仓库包含的内容 一个指向 .git 目录的符号链接，其名称是任意的。 一个定义恶意子模块的 .gitmodules 文件。 如何重新创建此仓库 此仓库是在 Linux（具体来说是 WSL2）上创建的。这一点很重要，恶意仓库只能在大小写敏感的文件系统上创建。 1. 创建一个符号链接，全部使用小写字符 root@kitploit: ln -s .git submodule 注：...

CVE-2024-31771

CVE-2024-31771 TotalAV 任意文件写入 TotalAV 版本 6.0.x https://github.com/restdone/CVE-2024-31771/assets/42227817/ffe0c2ec-4ea6-4c29-852f-456b2e62f5b1 时间线： 2024年2月13日：发现 6.0.740 存在漏洞并向 TotalAV 报告。 2024年2月15日：TotalAV 确认并复现了该问题。 2024年2月19日：TotalAV 正在与另一家供应商协调，该供应商表示正在处理。 2024年3月18日 - 4月19日：请求更新，未收到 TotalAV...

CVE-2024-44258

CVE-2024-44258：ManagedConfiguration框架中的符号链接漏洞 摘要 CVE-2024-44258 揭示了 Apple 设备 ManagedConfiguration 框架 和 profiled 守护进程 中的一个符号链接漏洞。当恢复精心制作的备份时，迁移过程未能验证目标文件夹是否为符号链接，导致未经授权的文件迁移到受限区域。 CVE ID CVE-2024-44258 已分配给此问题。CVE 是公开披露安全漏洞的唯一标识符。 影响： 恢复恶意制作的备份文件可能导致受保护系统文件被修改。 描述： 此问题已通过对受影响组件中的符号链接处理进行改进而得到解决。...

CVE-2025-81110-PoC

CVE-2025-81110-PoC Gogs中PutContents API对符号链接处理不当，导致本地代码执行。 本仓库包含针对Gogs 0.13.0之前版本中一个严重漏洞的专业级利用程序。该利用程序利用了一个逻辑缺陷：Gogs API在更新仓库内容时未能验证文件类型。通过注入指向服务器端Git钩子（pre-receive）的符号链接，认证用户可以恶意脚本覆盖钩子的内容。随后的Git推送操作将触发该脚本在运行Gogs服务的用户（通常是root）上下文中执行。 符号链接注入：攻击者推送指向内部仓库钩子（例如...

CVE-2025-55188-7z-exploit

CVE-2025-55188-7z-exploit PoC de escritura arbitraria de archivos mediante enlaces simbólicos en 7-Zip CVE-2025-55188 Descripción Esta prueba de concepto demuestra CVE-2025-55188 , una vulnerabilidad en versiones de 7-Zip anteriores a la 25.01. El fallo se produce porque 7-Zip no maneja...

CVE-2025-60710

CVE-2025-60710 Este es un PoC para la vulnerabilidad de escalada de privilegios local en la tarea programada \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration. Cuando se inicia esta tarea programada, el proceso taskhostw.exe intentará abrir el directorio...

CVE-2023-40028

CVE-2023-40028 PoC 漏洞利用 Ghost CMS 符号链接上传漏洞导致任意文件读取 POC 图片 漏洞详情 CVE-2023-40028 是 Ghost CMS 5.59.1 之前版本中的一个漏洞，认证用户可以上传符号链接（symlink），从而导致在主机系统上任意读取文件。攻击者可以利用 Ghost CMS 的上传功能放置指向敏感文件的符号链接来利用该漏洞。符号链接上传后，攻击者可以通过向服务器发送特制的 HTTP 请求来访问目标文件。 Exploit 用法 root@kitploit: git clone...

CVE-2026-84584

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox...

EUVD-2026-77860

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox...

CVE-2026-84584

CVE-2026-84584 is a sandbox escape vulnerability in macOS Golden Gate 27 caused by improper handling of symlinks . The flaw may allow an application to break out of its sandbox , potentially gaining access to resources or data outside its intended containment boundary. The issue was addressed thr...

CVE-2024-21626

CVE-2024-21626 Para una explicación detallada de esta vulnerabilidad, consulte mi artículo. Explotación Explotación mediante la ejecución de un contenedor No es necesario construir una imagen personalizada, solo ejecute un contenedor con el parámetro -w: root@kitploit: docker run -w /proc/self/fd...

rsync: rsync: Unauthorized File Access via Symlink Module Root

A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks...

rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary...

rsync: rsync: Directory escape via TOCTOU race condition in rrsync

A time-of-check to time-of-use TOCTOU race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

rsync: rsync: Arbitrary file write via path traversal in --relative mode

A path traversal vulnerability in rsync's --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory...

rsync: rsync: Arbitrary file write via path traversal in --relative mode

A path traversal vulnerability in rsync's --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory...

rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...