vulhub

Vulhub 是一个开源的、即开即用的漏洞靶场环境集合。无需 Docker 基础，只需一条命令即可快速启动用于安全研究、学习或演示的漏洞环境。 快速开始 安装 Docker （以 Ubuntu 24.04 为例）： curl -s https://get.docker.com/ | sh systemctl start docker 其他操作系统请参考 Docker 官方文档。 虽然所有 Vulhub 环境都基于 Docker compose 制作，但你不再需要安装独立的 docker-compose，而是使用 Docker 自带的 compose 命令来启动 Vulhub 环境。...

Cve-2023-28432-

Cve-2023-28432 通过vulhub的复现过程实现了，基本的批量检测。比较垃圾但是勉强能用vulhub链接（https://github.com/vulhub/vulhub/tree/master/minio/CVE-2023-28432） 使用说明 新建 tagerts.txt 放入minIO API 端口的链接。直接运行程序即可，结果会输出在result.txt中...

CVE-2018-20062

CVE-2018-20062 thinkphp 5.0.23 适用于vulhub thinkphp 漏洞 本人太菜了 后期慢慢优化，往大佬勿喷...

CVE-2025-24813-vulhub

CVE-2025-24813-vulhub CVE-2025-24813的vulhub环境的POC脚本 因为有很多小伙伴对该漏洞的利用感觉到疑惑，所以写了这个脚本，帮助大家进行在vulhub中的漏洞利用。 详情查看：vulhub/tomcat/CVE-2025-24813...

Apache httpd <=2.4.29 - Arbitrary File Upload

Apache httpd 2.4.0 to 2.4.29 is susceptible to arbitrary file upload vulnerabilities via the expression specified in , which could match '$' to a newline character in a malicious filename rather than matching only the end of the filename. This could be exploited in environments where uploads of...

GitList < 0.6.0 Remote Code Execution

klaussilveira GitList version = 0.6 contains a passing incorrectly sanitized input via the searchTree function that can result in remote code execution. id: CVE-2018-1000533 info: name: GitList 0.6.0 Remote Code Execution author: pikpikcu severity: critical description: klaussilveira GitList...

Ruby On Rails - Local File Inclusion

Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server. id: CVE-2018-3760 info: name: Ruby On Rails - Local File Inclusio...

Apache Flink 1.5.1 - Local File Inclusion

Apache Flink 1.5.1 is vulnerable to local file inclusion because of a REST handler that allows file uploads to an arbitrary location on the local file system through a maliciously modified HTTP HEADER. id: CVE-2020-17518 info: name: Apache Flink 1.5.1 - Local File Inclusion author: pdteam severit...

Gogs (Go Git Service) 0.11.66 - Remote Code Execution

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. id: CVE-2018-18925 info: name: Go...

POC_CVE-2023-21839

CVE-2023-21839 依据特殊需求将@4ra1n 大佬的GO版本翻译成了Python，再此感谢！ 免责声明 本程序应仅用于授权的安全测试与研究目的，请使用者遵照网络安全法合理使用。 使用者使用该工具出现任何非法攻击等违法行为，与作者无关。 使用 vulhub 复现：链接 / /\ //\ | \ / \ | / | / | // \ / / \ \ / /\ | | | | | | \ | |/ \ | \ | / / \ V //|/ /| || / / |/ /| | | , | / // ||/|/ |||// // usage:...

St2-057

St2-057 在线靶机环境，Enjoy！ 0x01 搭建环境docker https://github.com/vulhub/vulhub/tree/master/struts2/s2-048 docker-compose up -d 0x02 搭建st2-057漏洞环境 docker exec -i -t 88fd8d560155 /bin/bash 后台启动进入docker 根据公告 https://struts.apache.org/releases.html Release Release Date Vulnerability Version Notes Struts 2.5....

Kibana - Local File Inclusion

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with...

Log4Shell-Vulnerability-Replication

CVE-2021-44228 Log4Shell 漏洞完整复现记录 本记录基于 Vulhub 提供的 Apache Solr 8.11.0 靶场，完整复现了 Log4j2 JNDI 注入漏洞，成功通过 DNSLog 和本地 LDAP 监听验证漏洞存在性。 一、实验环境 - 操作系统：Windows 11 + WSL2 Ubuntu - 容器平台：Docker Desktop 4.76 - 靶场来源：Vulhub vulhub/log4j/CVE-2021-44228 - 目标服务：Apache Solr 8.11.0（含 log4j-core 2.14.1） -...

Spring Security OAuth2 Remote Command Execution

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

Apache APISIX - Insufficiently Protected Credentials

Apache APISIX 1.2, 1.3, 1.4, and 1.5 is susceptible to insufficiently protected credentials. An attacker can enable the Admin API and delete the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. id: CVE-2020-13945 info: name: Apache...

Embedthis GoAhead <3.6.5 - Remote Code Execution

description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. id: CVE-2017-17562 info: name: Embedthis GoAhead 3.6.5 - Remote Code Execution author: geeknik severity: high description: | description: Embedthis GoAhead before...

Sub-folderFetcher

子文件夹获取器 🐣 一个用于从GitHub下载特定Vulhub仓库文件夹（kibana/CVE-2018-17246）的脚本。 🚀 环境要求 curl unzip 🛠️ 使用方法 chmod +x subfetcher.sh ./subfetcher.sh...

Apache Tomcat Servers - Remote Code Execution

Apache Tomcat servers 7.0.0 to 79 are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to t...

vulhub-apache

此存储库没有 README。...

CVE-2024-9264

CVE-2024-9264 参考文档 https://github.com/vulhub/vulhub/tree/master/grafana/CVE-2024-9264 1. 漏洞概要 项目| 内容 ---|--- CVE| CVE-2024-9264 目标| Grafana SQL Expressions 影响| 本地文件包含LFI、远程代码执行RCE 严重程度| 严重 CVSS 9.9 攻击条件| 经过身份验证的用户管理员权限 攻击方式| 滥用 SQL Expression 功能执行 DuckDB SQL Grafana...