bmc-tools

BMC-Tools Analizador de caché de mapas de bits de RDP. Entrada bmc-tools procesa archivos bcache.bmc y cache????.bin encontrados dentro de los perfiles de usuario de Windows. Uso root@kitploit: ./bmc-tools.py -h -s SRC -d DEST -c COUNT -v -o -b -w WIDTH Con el siguiente significado de los...

CVE-2026-0047-poc

CVE-2026-0047: Missing Permission Check in ActivityManagerService Heap of bitmaps stolen from every running app — zero permissions, zero user interaction. A missing enforceCallingOrSelfPermissionDUMP check in ActivityManagerService.dumpBitmapsProto allows any installed app to exfiltrate UI bitmap...

Embarcadero-Workaround

What is Embarcadero Workaround ? This is an unofficial "patch" for "Embarcadero VCL Library Stack/Heap Overflow" CVE-2014-0993 and CVE-2014-0994. Which Software versions does this workaround support? 32-bit software compiled with Delphi and C++ Builder where the "VCL library" was included, as lon...

RdpCacheStitcher

RdpCacheStitcher RdpCacheStitcher es una herramienta que ayuda a los analistas forenses a reconstruir imágenes útiles a partir de mapas de bits de la caché de RDP. Utilizando como entrada los mapas de bits de teselas de la caché RDP sin procesar extraídos por herramientas como, por ejemplo,...

CVE-2021-40444-docx-Generate

CVE-2021-40444 docx Generate docx generating to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution 1. create blink .docx file. 2. add "Bitmap Image" object in "Insert/Object" menu. 3. save and unzip docx. 4. modify word/rels/document.xml.rels 5. modify word/document.xml 6. zip...

CVE-2017-0038-EXP-C-JS

CVE-2017-0038-EXP-C-JS Detailed vulnerability analysis and exploit writing process have been published on Security Guest: http://bobao.360.cn/learning/detail/3644.html In the C Exploit, there is one missing printf to print the final color array. You can add it manually or directly use debug...

rdpy

RDPY Remote Desktop Protocol in twisted python. RDPY is a pure Python implementation of the Microsoft RDP Remote Desktop Protocol protocol client and server side. RDPY is built over the event driven network engine Twisted. RDPY support standard RDP security layer, RDP over SSL and NLA...

CVE-2021-40444-docx-Generate

CVE-2021-40444 docx Generate .docx generate to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution 1. creeate blank docx file. 2. add "Bitmap Iamge" object in "Inert/Object" menu. Add Object...

CVE-2021-40444

CVE-2021-40444 Usage Ensure to run setup.sh first as you will need few directories. Once you have run the script, you should be able to run gen.py with the example given:- root@kitploit: Usage python3 gen.py -d document/Sample.docx -p payload/payload.dll -i "http://10.10.10.10" -t...

Linux Distros Unpatched Vulnerability : CVE-2026-89558

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb md/md-bitmap: merge mdbitmapstartsync into bitmapoperations converted...

Linux Distros Unpatched Vulnerability : CVE-2026-89614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of th...

CVE-2026-89614

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more clusters than the volume actually has, can lead to an out-of-boun...

CVE-2026-89558

A flaw was found in the Linux kernel's md/raid10 RAID10 driver. This vulnerability occurs when a RAID10 array is in a degraded state and a device is being recovered while another mirror is still missing. Due to an inverted boolean value, the system incorrectly clears necessary bitmap bits, causin...

DEBIAN-CVE-2026-89653

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

CVE-2026-89653

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

CVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

DEBIAN-CVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

DEBIAN-CVE-2026-89558

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb "md/md-bitmap: merge mdbitmapstartsync into bitmapoperations" converted stilldegraded from int to bool, but inverted the assignment in the loop...

CVE-2026-89558

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb "md/md-bitmap: merge mdbitmapstartsync into bitmapoperations" converted stilldegraded from int to bool, but inverted the assignment in the loop...

CVE-2026-89653 ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...