ipxe

iPXE network bootloader iPXE is the leading open source network boot firmware. It provides a full PXE implementation enhanced with additional features such as: boot from a web server via HTTP or HTTPS, boot from an iSCSI, FCoE, or AoE SAN, control the boot process with a script, create interactiv...

CS4239-Spring4Shell-POC

CS4239-Spring4Shell-POC Proof of concept for CVE-2022-22965 Spring4Shell for CS4239 G410 report. Adapted from this PoC to demonstrate unpatched & patched behavior. Running the demo There are 2 example programs dockerized in this repository with identical source code. One uses a vulnerable version...

rp2350_hacking_challenge

RP2350 Hacking Challenge Welcome to the Raspberry Pi RP2350 hacking challenge and bug bounty! Watch our quick explainer video: Update Jan 14th 2025 Congatulations to the 4 winners! Read about them allhere. A huge thank you to Thomas Roth and the team at Hextree.io for helping us develop and launc...

log4j-vulnerability

Log4Shell CVE-2021-44228 is a zero-day vulnerability in Log4j Log4J Vulnerability Discovered: 24th November 2021 Patched: 6th December 2021 Attack Demo Click below for youtube video Sample application This sample application is spring boot application, and is using log4j as a logging framework, a...

dubiousdisk

dubious disk - the porygon-z that's super effective against secure boot! CVE-2022-30203, CVE-2023-21560, CVE-2023-28269, CVE-2023-28249, and more... Overly permissive code in the Windows boot environment allows for overwriting arbitrary memory, and therefore, arbitrary code execution. Exploitro...

boot-jackson-cve

Reproduction of CVE-2020-36518 in Spring Boot 2.5.10 Execute: ./mvnw clean verify It will fail with: ERROR Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check default on project jackson-demo: ERROR ERROR One or more dependencies were identified with vulnerabilities that have a CVS...

Magisk

This is not an officially supported Google product Introduction Magisk is a suite of open source software for customizing Android, supporting devices higher than Android 7.0. Some highlight features: MagiskSU : Provide root access for applications Magisk Modules : Modify read-only partitions by...

log4shellpoc

Simple Spring Boot application vulnerable to CVE-2021-44228 Log4Shell This proof-of-concept application for CVE-2021-44228 a.k.a log4shell is a part of my writeup. For the complete exploit details, refer to the writeup. Instructions Run: docker run --rm -p 8080:8080 --name log4shell-poc-app...

linux-insides

linux-insides A book-in-progress about the Linux kernel and its insides. Introduction • Chapter status • Requirements • Translations • Contributing • Author Introduction linux-insides is a book-in-progress about the Linux kernel and its insides. The goal of this project is simple - to share...

log4j-polkit-poc

log4j CVE-2021-44228 + polkit CVE-2021-4034 Vulnerable instance for the log4j apache exploit and privilege escalation using polkit The vulnable spring-boot-application.jar was extracted from this docker image The malicious JNDI server was downloaded from here and referenced in this article. PoC...

secureboot_objects

Secure Boot Objects This repository is used to hold the secure boot objects recommended by Microsoft. For documentation visit our Wiki! Versioning This repository follows semantic versioning .., which is a versioning scheme that conveys meaning about the underlying changes. Version Components Maj...

Log4shell

Log4J lab Description This is a lab for playing around with the Log4J CVE-2021-44228 Springboot app + Log4J 2.6.1 Usage docker build . -t mylog && docker run --rm -p 8081:8080 --name mylog-app mylog...

cve-2022-22980

spring-data-mongodb-cve-2022-22980-exp A mediocre vulnerability, just making a note. 1. Start Redis, port 27017 2. Start the project, SpringBoot starts on port 6666 3. GET /v1/user/get?username=Tjava.lang.Runtime.getRuntime.exec'open+-a+calculator.app' HTTP/1.1 Host: localhost:6666 Accept-Encodin...

CVE-2023-1454

CVE-2023-1454 jmreport/qurestSql Unauthorized SQL Injection Batch Scan POC Jeecg-Boot is a rapid development platform based on Spring Boot and Jeecg-Boot-Plus. The latest jeecg-boot 3.5.0 has been exposed to multiple SQL injection vulnerabilities. Description Original tool URL The original tool h...

test_avb_key

On Almost Signing Android Builds Introduction An error sometimes encountered by NCC Group consultants is signing Android builds with known private keys. This leaves the device manufacturers and in turn their users vulnerable, even on devices where secure boot is enabled. This blog post has two...

Log4J-Log4Shell-CVE-2021-44228-Spring-Boot-Test-Service

CVE-2021-44228 Spring Boot Test Service This is a dirty hack spring boot hello world proejct to test your tooling/payloads/detection capabilities locally before you hit production targets with them. The configured Log4j version is 2.13.0 Building the docker image bash build.sh Running the docker...

virt-firmware

Tools for ovmf / armvirt firmware volumes This is a small collection of tools for edk2 firmware images. They support decoding and printing the content of firmware volumes. Variable stores OVMFVARS.fd can be modified, for example to enroll secure boot certificates. virt-fw-dump Decodes and prints...

chipicopwn

chipicopwn Bootloader exploit for Google Nest Hub 2nd Gen elaine requirements Google Nest Hub 2nd Gen Raspberry Pi Pico Powered USB hub or USB Y cable pico-sdk see Getting Started guide for installation instructions supported version factory firmware 2020/12 - U-Boot 2019.01-gbfc19012ea-dirty Dec...

CVE-2020-0443

CVE-2020-0443 This is a proof of concept app that exploits CVE-2020-0443 to brick any Android device. After running the app and rebooting, the device will keep repeating the boot animation. A patch for this vulnerability was released in the November 2020 Android security bulletin. Devices bricked...

memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...