SSH-Remote-Code-Execution

SSH 远程代码执行 SSH 零日漏洞 | 由 ClumsyLulz 与 Taylor Christian Newsome 制作 摘要 本仓库包含一个 C 程序，该程序接受输入参数并生成一个数据包，通过 SSH 协议发送到服务器。该程序分配一个缓冲区来保存数据，将其写入一个文件，并使用 system 函数构造命令行字符串，以启动到指定主机和端口的 SSH 连接。 已发现的问题 当前实现存在多个安全性和稳定性问题： 1. 缓冲区溢出 ：仅使用 malloc 分配了 28 字节，却写入了 29 字节，可能导致内存损坏或段错误。 2. 返回地址计算错误...

c-jwt-cracker

JWT cracker A multi-threaded JWT brute-force cracker written in C. If you are very lucky or have a huge computing power, this program should find the secret key of a JWT token, allowing you to forge valid tokens. This is for testing purposes only, do not put yourself in trouble : I used the Apple...

n00bRAT

n00bRAT v0.7 这是一个小型C程序，模拟最精简的HTTP服务器，用于指纹识别安全扫描器。它允许用户通过这个伪造的HTTPv0.1协议控制机器。 这个n00b服务器是在大学的《道德黑客》课程中作为RAT（远程访问木马）创建的。 它是什么/为什么存在/等等。 使用任何PDF阅读器阅读 n00bRAT报告 以获取信息 如何安装 方法1： a. 打开命令终端 b. 切换到n00bRAT目录 c. 执行以下命令：gcc -o http ABKn00bRAT.c 方法2： a. 打开命令终端 b. 切换到n00bRAT目录 c. 执行以下命令：make 如何使用 方法1： a...

SNP-Assignment

SNP-Assignment 利用工作：权限提升 CVE-2017-1000112 由于权限提升是攻击者视角中的里程碑，我尝试对本地权限提升做一些研究，这是整个权限提升单元的基础步骤。在我阅读一些文章时，2016 年和 2017 年是本地及远程权限提升报告数量最多的年份。于是，我尝试利用自己的知识，并借助互联网去利用一个漏洞，以理解这些漏洞利用是如何发生的——即使不是由专家攻击者所为。在 Linux 操作系统中，由于开源的特性，我能真正理解正在发生的事情，而且终端可以直接运行我们编写的任何 C 程序。我寻找了一个使用 C 程序的漏洞，并找到了一个只需运行该程序即可轻松获得 root...

deobf-Arxan-Deob-C

Arxan-Deob-C 一个简单的 C 程序，用于快速去混淆受 Arxan 保护的 Windows 可执行文件。 目前有点杂乱……请注意 : 我会清理它的。...

CVE-2025-41244

💻 逐步技术流程 编译程序 bash Compile the C code into an executable gcc -o /tmp/httpd /tmp/CVE-2025-41244.c Make it executable chmod +x /tmp/httpd 测试版本功能 bash Test the -v flag should print version and exit /tmp/httpd -v Test the -V flag should print detailed version and exit /tmp/httpd -V 步骤 4：运行漏洞利用代码 bash...

CVE-2026-40468

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below...

ACPM Multithreaded Minimal Transfer Stress Tester

This C program is a lightweight multi-threaded stress test designed to evaluate concurrent behavior of the acpmdoxfer interface under repeated small-size transfer operations across multiple threads sharing the same ACPM handle...

Cross Platform Webkit File Dropper

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cross Platform Webkit File Dropper', 'Description' = %q This module exploits a XSLT vulnerability in Webkit to drop ASCII or UTF-8 files to the...

CVE-2024-26614

In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the acceptqueue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19 PID: 21160 at...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the acceptqueue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19 PID: 21160 at...

CVE-2024-26614 tcp: make sure init the accept_queue's spinlocks once

In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the acceptqueue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19 PID: 21160 at...

CVE-2024-26614 tcp: make sure init the accept_queue's spinlocks once

In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the acceptqueue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19 PID: 21160 at...

CVE-2024-26614

CVE-2024-26614 is a Linux Kernel vulnerability describing a race/ordering issue in init of the accept_queue spinlocks, disclosed as a local denial-of-service condition triggered by a syz reproduction. The provided sources (Linux kernel submissions and vendor advisories) attribute a high impact (C...

CVE-2023-3842 Pointware EasyInventory Easy2W.exe unquoted search path

A vulnerability was found in Pointware EasyInventory 1.0.12.0 and classified as critical. This issue affects some unknown processing of the file C:\Program Files x86\EasyInventory\Easy2W.exe. The manipulation leads to unquoted search path. Attacking locally is a requirement. The identifier...

Redis Labs Redis 代码问题漏洞

Redis Labs Redis is an open source, network-enabled, memory-based, persistent logging, key-value Key-Value storage database written in ANSI C from Redis Labs, Inc. and provides APIs in multiple languages. Redis Labs Redis is vulnerable to a code issue that originates from unknown code in C:/Progr...

[SECURITY] Fedora 32 Update: adns-1.6.0-1.fc32

adns is a resolver library for C and C++ programs. In contrast with the existing interfaces, gethostbyname et al and libresolv, it has the following features: - It is reasonably easy to use for simple programs which just want to translate names to addresses, look up MX records, etc. - It can be...

Linux/ARM - execve /bin/dash Shellcode (32 bytes)

Title: Linux/ARM - execve /bin/dash Shellcode 32 bytes Category: Shellcode Tested: armv7l 32-bitRaspberry Pi 2 Model B OS: Raspbian Buster Lite Author: Anurag Srivastava Description: execve shellcode / Objdump pi@raspberrypi:/hex $ objdump -d ed1 ed1: file format elf32-littlearm Disassembly of...

freeFTPd 1.0.13 Unquoted Service Path

Exploit Title: freeFTPd v1.0.13 - 'freeFTPdService' Unquoted Service Path Exploit Author: boku Date: 2020-02-10 Vendor Homepage: http://www.freesshd.com Software Link: http://www.freesshd.com/freeFTPd.exe Version: 1.0.13 Tested On: Windows 10 32-bit C:\Users\nightelfwmic service get name, pathnam...

Linux/x86 - Execve() Alphanumeric Shellcode (66 bytes)

Title: Linux/x86 - Execve Alphanumeric Shellcode 66 bytes Shellcode Author: bolonobolo Tested on: Linux x86 execve.asm global start section .text start: ; int 0x80 ------------ push 0x30 pop eax xor al, 0x30 push eax pop edx dec eax xor ax, 0x4f73 xor ax, 0x3041 push eax push edx pop eax...