dirty_sock

dirtysock: Linux Privilege Escalation via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available for research and education. F...

CVE-2024-47176

CUPS Browsd daemon which is by default running as root if allowed in Linux/Unix systems, allow remote connections from any device on the network to create a new printer. Start the python post server and then send the request to add the printer you will se a connection to your http server as root ...

firmwalker

firmwalker A simple bash script for searching the extracted or mounted firmware file system. It will search through the extracted or mounted firmware file system for things of interest such as: etc/shadow and etc/passwd list out the etc/ssl directory search for SSL related files such as .pem, .cr...

sisu

sisu ⚡ Your AWS, as a filesystem. This: root@kitploit: grep -l "AdministratorAccess" iam/users//policies.json Instead of this: root@kitploit: aws iam list-users --query 'Users.UserName' --output text | \ xargs -I sh -c 'aws iam list-attached-user-policies --user-name --query...

twiga

Twiga A tool that enumerates Android devices for information useful in understanding its internals and for exploit development. It supports android 4.2 to android 7.1.1 Requirements The most current ADB must be in your path and fully functional The report name must not have any whitespace...

magisk-renef

MagiskRenef 一个 Magisk / KernelSU / APatch 模块，用于自动打包并运行 renef——一个针对 Android 的动态插桩工具包。 灵感来源于 magisk-frida。 系统要求 已 Root 的 Android 设备（Magisk / KernelSU / KernelSU Next / APatch） 仅支持 ARM64 — renef 仅支持 ARM64 架构的 Android 推荐 Android 10 及以上系统 安装 1. 从 Releases 页面下载最新的 MagiskRenef-版本号.zip 2. 通过你的 Root...

suricata_exporter

Suricata Prometheus Exporter This is a Prometheus Exporter for Suricata using dump-counters via the unix socket to query metrics. Usage root@kitploit: $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket. default...

staekka

Stækka Metasploit - Extenting Metasploit This Msf plugin extends Metasploit for some missing features and modules allowing interaction with other/custom exploits/ways of getting shell access. The current focus here is Linux/Unix support. Core features TTY support: starting a shell from Metasploit...

Shell-Shock

Shell Shock Authors : [email protected] Maintainers : Department : DevOps Licenses : Overview Shell Shock : Privelege Escalation, Remote Code Execution Family of bugs in the Unix Bash Shell. Allow execution of arbitrary commands. Exploitation Vectors Payloads shellshock user agent =...

CVE-2021-25461

CVE-2021-25461 This is a repo with the Proof of Concept for the CVE discovered for the SAUSAGE Security Analysis of Unix domain Socket usAGE in Android paper that was accepted to EuroS&P 2022. I worked on this paper with Mounir Elgharabawy, the one who discovered the vuln and wrote the Proof of...

owt

Currently unstable will be updated eventually. Offensive Wifi Toolkit owt created by Brennan Mccown clu3bot This tool compiles some necessary tools for wifi auditing in a unix bash script with a user friendly interface. The goal of owt is to have the smallest file size possible while still...

gtfobins-cli

🚀 GTFOBins CLI Overview GTFOBins CLI is a command-line interface for GTFOBins, providing instant access to Unix binary exploitation techniques. This tool helps security professionals and system administrators identify and understand how legitimate Unix binaries can be misused to bypass security...

climber

Climber 自动化审计工具，用于检查UNIX/Linux系统中可能导致本地权限提升的错误配置。 依赖项 python = 2.7 python-crypto python-mako python-paramiko 注意事项 Climber需要Exscript，这是一个Python模块和一个模板处理器，用于通过Telnet或SSH等协议自动化网络连接。 https://github.com/knipknap/exscript 该模块已包含在Climber源代码中。 许可证 本程序是自由软件：您可以自由地重新分发和/或修改它，前提是遵循自由软件基金会发布的GNU General Publ...

hget

hget This project is my personal project to learn golang to build something useful. Build Status : Install root@kitploit: $ go get -d github.com/huydx/hget $ cd $GOPATH/src/github.com/huydx/hget $ make clean install Binary file will be built at ./bin/hget, you can copy to /usr/bin or /usr/local/b...

CryKeX

Properties: Cross-platform Minimalism Simplicity Interactivity Compatibility/Portability Application Independable Process Wrapping Process Injection Dependencies: Unix - should work on any Unix-based OS BASH - the whole script root privileges optional Limitations: AES and RSA keys only Fails most...

CryKeX

属性： 跨平台 极简主义 简洁 交互性 兼容性/可移植性 应用无关性 进程包装 进程注入 依赖： Unix - 应适用于任何基于Unix的操作系统 BASH - 整个脚本 root权限（可选） 限制： 仅支持AES和RSA密钥 对Firefox浏览器大多情况下失败 不适用于磁盘加密（LUKS）和PGP/GPG 需要适当的用户权限和内存授权 工作原理 你可能已经听说过甚至使用过我的 AES-REX 项目，它做的是类似的事情，但方式不同。AES-REX从寄存器中提取加密密钥，而CryKeX则从易失性内存（RAM）中提取。 关于DRAM中加密密钥的安全性，已有一些研究...

bashacks

bashacks What? bashacks is a collection of bash functions likely to be useful for programmers, security analysts, and general users who need low-level operations. In fact, there is nothing really new in bashacks; all functions are written using existing software in UNIX-like systems. However, it...

GHSA-VCC3-GHJQ-M6FR vulnerabilities

Vulnerabilities for packages: nextcloud-server, vitess, sqlpad...

CVE-2026-45822 vulnerabilities

Vulnerabilities for packages: nextcloud-server, vitess, sqlpad...

GHSA-F2R5-PQH9-R8F8 vulnerabilities

Vulnerabilities for packages: awx, redisinsight, wazuh-dashboard-fips, azurite, langfuse, lerna, wazuh-dashboard, kubeflow-centraldashboard, kibana, jitsucom-jitsu, opensearch-dashboards, prism, langfuse-fips, nextcloud-server, semaphore, librechat, opensearch-dashboards-fips...