Chamilo LMS <= 1.11.24 - Remote Code Execution

Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell. id: CVE-2023-422...

Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution

An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leadin...

CVE-2025-24813

🚨 CVE-2025-24813 – Apache Tomcat PUT JSP RCE Exploit This repository contains a complete proof-of-concept PoC for CVE-2025-24813 , a Remote Code Execution RCE vulnerability in Apache Tomcat using the HTTP PUT method to deploy a malicious JSP web shell. 🔥 This exploit demonstrates how an attacker...

Shelly

Shelly | Simple Backdoor Manager with Python based on weevely Shelly is a simple tool that is written using Python, which functions to remote a website Instalation : $ git clone https://github.com/tegal1337/Shelly $ cd Shelly $ python3 shell.py Requirements : sudo pip install -r requirements.txt...

zip-shotgun

ZIP Shotgun 用于测试 zip 文件上传功能（以及可能的 zip 文件提取）是否存在漏洞（即 Zip Slip）的实用脚本。 该脚本的思路来自 Silent Signal Techblog - 压缩文件上传与命令执行 以及 OWASP - 测试恶意文件上传 Snyk.io 有一份关于此漏洞的报告：Zip Slip 漏洞，以及一个包含多种语言存在漏洞的库的 GitHub 仓库：Snyk.io Zip Slip GitHub 仓库 还有来自 LiveOverflow 的一个精彩视频，对 Zip Slip 和 Zipperdown 漏洞进行了阐述：危险 .zip 漏洞？— Zip...

zip-shotgun

ZIP Shotgun Utility script to test zip file upload functionality and possible extraction of zip files for vulnerabilities aka Zip Slip. Idea for this script comes from this post on Silent Signal Techblog - Compressed File Upload And Command Execution and from OWASP - Test Upload of Malicious File...

Jatayu

JATAYU Shell PHP Autónomo Sigiloso CARACTERÍSTICAS Autenticación basada en cabeceras HTTP. 100% Indetectable. Cambiador de función Exec. Sin complicaciones. USO GET /test/jatayu.php?fn=1&&cmd=whoami Host : http://test.com Authtoken : bb3b1a1f-0447-42a6-955a-88681fb88499 FUNCIONES PARÁMETRO| FUNCI...

htshells

HTSHELLS - Web shells autocontenidos y otros ataques mediante archivos .htaccess. Los ataques se nombran de la siguiente manera: module.attack.htaccess y se agrupan por tipo de ataque en directorios. Elige el que necesites y cópialo a un archivo nuevo llamado .htaccess; revisa el archivo para ver...

CVE-2023-4220

RCE para Chamilo LMS CVE-2023-4220 utilizando una Web Shell Este proyecto automatiza la explotación de la vulnerabilidad de ejecución remota de código CVE-2023-4220 encontrada en Chamilo LMS. Utilizando una web shell, la herramienta facilita la explotación automatizada de la vulnerabilidad para...

CVE-2025-53770-Scanner

CVE-2025-53770 Scanner by DanSec A simple, effective reconnaissance tool to identify potential exposure to the critical SharePoint vulnerability CVE-2025-53770. !Warning This tool is intended for authorised testing purposes only. The author DanSec takes no responsibility for misuse or damage caus...

JSShell

JSShell 2.0 一个基于 JavaScript 的交互式多用户 Web Shell。最初是为了在实验和研究期间调试远程非主流浏览器而创建的。该工具可以轻松附加到 XSS（跨站脚本）负载中，以实现浏览器远程代码执行（类似于 BeEF 框架）。 2.0 版完全从头开始创建，引入了令人兴奋的新功能、稳定性和可维护性。 版本：2.0 作者 Daniel Abeles Shell 演示视频 特性 多客户端支持 循环 DOM 对象支持 预飞行脚本 命令队列与上下文 可通过插件扩展 可通过 标签注入 将命令输出转储到文件 Shell 分页 HTTPS 支持！ 安装与设置 配置文件 在...

weevely3

Weevely - Shell web armamentizado Descripción Weevely es un shell web diseñado para fines de post-explotación que puede extenderse a través de la red en tiempo de ejecución. Suba el agente PHP de weevely a un servidor web objetivo para obtener acceso remoto a un shell en él. Tiene más de 30 módul...

weevely3

Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...

drupalgeddon2-cli

drupalgeddon2-cli A command-line rewrite of the Drupalgeddon2 CVE-2018-7600 proof-of-concept, built as a study exercise while working through the Hack The Box Academy Attacking Common Applications module. !WARNING For authorised security testing and education only. Running this against systems yo...

CVE-2023-4220-exploit

CVE-2023-4220-exploit Unrestricted file upload in the large file upload functionality at /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS versions = 1.11.24 allows unauthenticated attackers to perform stored Cross-Site Scripting attacks and achieve remote code execution by...

ABPTTS

Un Camino Negro Hacia el Sol Tunelización TCP sobre HTTP para servidores de aplicaciones web https://www.blackhat.com/us-16/arsenal.htmla-black-path-toward-the-sun Ben Lincoln, NCC Group, 2016 ABPTTS utiliza un script cliente en Python y una página/paquete de servidor de aplicaciones web1 para...

wsh

wsh wsh pronounced woosh is a web shell generator and command line interface. This started off as just an http client since interacting with webshells is a pain. There's a form, to send a command you have to type in an input box and press a button. I wanted something that fits into my workflow...

p0wny-shell

p0wny@shell: -- Shell PHP de un solo archivo p0wny@shell: es un shell PHP muy básico de un solo archivo. Puede usarse para ejecutar rápidamente comandos en un servidor al hacer pentesting a una aplicación PHP. Úsalo con precaución: este script representa un riesgo de seguridad para el servidor...

CVE-2025-34040Exp

Seeyon OA has file upload leading to RCE CVE-2025-34040 Parameters options: -h, --help show this help message and exit -u URL, --url URL 请输入待检测的URL -f FILE, --file FILE 请输入一行一个URL的文件地址 -n FILENAME, --filename FILENAME 请输入文件名（默认为Hello.jsp）： -c CONTENT, --content CONTENT 请输入上传的文件内容（默认为HelloWord）：...

CVE-2025-52691-APT-PoC

CVE-2025-52691 PoC: SmarterMail Arbitrary File Upload RCE APT-Enhanced This is an enhanced proof-of-concept PoC exploit for CVE-2025-52691 , a critical vulnerability in SmarterTools SmarterMail email server software allowing unauthenticated arbitrary file uploads, potentially leading to remote co...