jvmtiAgentLoad-Exploit

jvmtiAgentLoad를 통한 임의 코드 실행 설명: jvmtiAgentLoad를 악용하기 위한 악성 JAR 생성 도구 및 코드 사용법: $ bash createjar.sh Usage: createjar.sh Supported TARGETOS options: linux|windows Linux 대상 다음 명령은 Linux 대상에서 사용할 수 있는 JARmal.jar를 생성합니다: bash createjar.sh linux 'id /tmp/jvmtiLoadAgenttest' Windows 대상 다음 명령은 Windows 대상...

ncentral-compromise-ioc-triage

N-central Compromise IoC Triage Read-only defensive hunting toolkit for post-exploitation artifacts associated with N-able N-central authentication bypass vulnerabilities CVE-2026-18556 and CVE-2026-18577. The PowerShell endpoint scanner flags indicators published by N-able and Huntress; it never...

CVE-2026-69098_exploit

CVE-2026-69098 — kotaemon の認証なしデシリアライゼーション RCE LLM 設定の接続チェックにおける安全でないデシリアライゼーションを介した、kotaemon（ が LLM spec を完全に上書きするため、ペイロードは実際の LLM プロバイダーに一切接触しません。 kotaemon の公式 Docker イメージは root で実行されるため、RCE は root として発動します。本稿執筆時点で上流の修正はあり...

Exploit for CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

The U.S. Cybersecurity and Infrastructure Security Agency CISA, on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 CVSS score: 9.8,...

DEMO-Proof-of-Concept-Temporal-Memory-Inconsistency-in-cldflt.sys-CVE-2025-62221

Technical Analysis and Proof-of-Concept: Temporal Memory Inconsistency in cldflt.sys CVE-2025-62221 DEMO Proof-of-Concept: Temporal Memory Inconsistency in cldflt.sys CVE-2025-62221 CVE-2025-62221: This repository provides a comprehensive technical analysis and a Proof-of-Concept PoC demonstratio...

Exploit for CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

r2rs

\ \ \ / / | / / /| /\ \ | | / | | / \ || /\ | / / / / / / react2rubyshell !IMPORTANT DISCLAIMER: The burden of responsibility for any actions taken with this script falls squarely on the individual executing it. Use this only against systems you own or have explicit permission to test...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

passgen

🔐 passgen — Generate passwords from the terminal A small Go CLI that generates secure random passwords with flexible character sets and exclusions. Uses crypto/rand for cryptographically secure randomness. If no charset flags are provided, all sets are enabled by default. Installation Go latest g...

CVE-2025-55182-Exploit-PoC-Scanner

CVE-2025-55182 - React Server Components RCE Exploit v2.0 A comprehensive security research tool for testing CVE-2025-55182 and CVE-2025-66478 vulnerabilities in React Server Components RSC and Next.js Server Actions. Vulnerability Overview Property| Value ---|--- CVE IDs| CVE-2025-55182,...

zenfone9-root

zenfone9-root — ブートローダーロックされた ASUS Zenfone 9 における一時的 root ブートローダーのロック解除ができない ASUS Zenfone 9 AI2202 で 一時的な root uid 0 を取得する ための研究用コードとメモ — ASUS が unlock ツールを廃止し、開発者オプションから OEM ロック解除トグルを削除し、現行ファームウェアでは fastboot oem unlock / flashing unlock を強硬に拒否するためである。 これはブートローダーのロック解除ではなく、何もフラッシュしない。これは ランタイム ro...

local-mcp

local-mcp Zero-dependency MCP server for local file operations. 13 filesystem tools + 3 meta-tools for progressive discovery — no SDKs, no frameworks, no npm install needed. MCP Protocol: 2024-11-05 · Transport: stdio + Streamable HTTP · Runtime: Node.js ≥ 22.0.0 Architecture local-mcp.mjs — 595...

ssh-honeypot-research

🍯 SSH Honeypot — Research & Threat Intelligence A medium-interaction Cowrie honeypot deployed on a rented public-internet Linux VPS, designed to attract, log and analyse real-world SSH brute-force traffic. Over an 8-day capture window the sensor recorded 37,477 sessions from 1,582 unique attacker...

cupshax

CUPSHax 최근 CUPS 익스플로잇에 대한 간단한 개념 증명PoC입니다. 코드를 훨씬 더 정리할 계획이었지만, 엠바고가 예상보다 훨씬 일찍 해제되어 코드가 다소 급하게 작성되었습니다. 모든 기술적 세부 사항은 솔직히 Evilsocket의 글을 읽는 것이 좋습니다. 이 익스플로잇은 공개 OpenPrinting CUPS 저장소에서 이 커밋을 발견한 후 작성되었습니다. 아마 더 깔끔한 주입 지점이 있을 것입니다. 이 PoC는 dns-sd 프린터 검색을 사용하므로, 대상이 브로드캐스트 메시지를 수신할 수 있어야 합니다. 즉, 동일...

CVEs

Rhino CVE Proof-of-Concept Exploits A collection of proof-of-concept exploit scripts written by the team at Rhino Security Labs for various CVEs. CVE-2026-46546: Frappe LMS Header Tag Injection Leading to Open Redirect CVE-2026-39405: Frappe LMS Path Traversal in SCORM Package Upload Leading to...

nginx-cve-2026-42945-poc

CVE-2026-42945 — NGINX Rewrite Module Heap Buffer Overflow → RCE RCE confirmed successful — via heap overflow + GDB process injection, execute arbitrary commands in NGINX / OpenResty worker processes. Quick Start One-click build NGINX image + execute RCE test ./run.sh nginx One-click build...

CVE-2026-50522

CVE-2026-50522 ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Create a virtual environment python...

magnolia-rce

익스플로잇 제목: Magnolia DX Core 6.3.8 - 명령 주입Command Injection 날짜: 05/16/2025 익스플로잇 작성자: tmrswrr 버전: 6.3.8 공급업체 홈페이지: https://docs.magnolia-cms.com/home/ 제품: https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.8/ 1. 관리자로 인증:...

Homework-of-Python

Homework-of-Python 제 블로그의 Python 코드입니다. pptppasswordhack.py 무차별 대입 공격Brute-force attack을 사용하여 PPTP VPN의 비밀번호를 얻습니다. 파일wordlist에서 비밀번호를 읽은 다음 pptpsetup을 사용하여 서버에 연결합니다. 시간 간격은 10초입니다. portscan.py 포트 스캔에 사용합니다. 타임아웃은 3초입니다. c++ 버전:...