SharpStrike

SharpStrike SharpStrike is a post-exploitation tool written in C that uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with in the --show-commands command...

CVE-2024-10914__POC

CVE-2024-10914 - Proof of Concept Exploit for command injection vulnerability in the /cgi-bin/accountmgr.cgi endpoint. This vulnerability allows arbitrary command execution on the affected system through unsanitized parameters. Vulnerability Description CVE-2024-10914 is a command injection...

CVE-2025-52385

CVE-2025-52385 Software : Studio 3T v.2025.1.0 Vulnerability Report : Studio 3T Remote Command Execution Overview A critical vulnerability in Studio 3T version 2025.1.0 and earlier allows a remote attacker to execute arbitrary code via a crafted payload exploiting the childprocess module in the...

msdt-follina

MS-MSDT "Follina" Attack Vector John Hammond | May 30, 2022 Create a "Follina" MS-MSDT attack with a malicious Microsoft Word document and stage a payload with an HTTP server. Usage usage: follina.py -h --command COMMAND --output OUTPUT --interface INTERFACE --port PORT options: -h, --help show...

ssh-auditor

SSH Auditor Features ssh-auditor will automatically: Re-check all known hosts as new credentials are added. It will only check the new credentials. Queue a full credential scan on any new host discovered. Queue a full credential scan on any known host whose ssh version or key fingerprint changes...

SharpSphere

SharpSphere - Attacking vSphere Infrastructure Credit @jkcoote & @grzryc Full walk-through and examples available here. Version History 1.0 - Initial Release 2.0 - Added supported for pass-through authentication using SSPI. 2.1 - Added support for Linux target VMs with --linux, and added a...

CVE-2023-41892_poc

CVE-2023-41892poc Customized this for my own use pocnoauth.py Basic PHP one-liner webshell OS command execution via ?cmd= pocauth.py Simple key-based authentication added webshell SHA-256 hash comparison method Commands can only be executed if the correct key is provided Code modification require...

CVE-2025-24893

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Usage Connecting python3 poc.py Example With debug set to False default python3 poc.py http://127.0.0.1:8080 Targeting...

phpggc

PHPGGC: PHP Generic Gadget Chains PHPGGC is a library of unserialize payloads along with a tool to generate them, from command line or programmatically. When encountering an unserialize on a website you don't have the code of, or simply when trying to build an exploit, this tool allows you to...

CVE-2017-5638-Apache-Struts2

CVE-2017-5638 Apache Struts2 Example PoC Exploit PHP Code for CVE-2017-5638 Usage php exploit.php "http://127.0.0.1:8080/example/index.action" "command" USE AT YOUR OWN RISK...

CVE-2019-19781

CVE-2019-19781 Just a python3 CVE-2019-19781 exploit for Citrix behind a cache. This version accepts '', '|', '2&1'... etc USAGE python3 CVE-2019-19781.py citrix.example.org 'cat /etc/passwd' Todo Repeat if Age header in response. Continuous mode -c. Check mode Get /vpn/../vpns/cfg/smb.conf...

CVE-2017-1000117

CVE-2017-1000117 Malicious actors can craft "ssh://…" links to trick victims into accessing the malicious link when executing programs, thereby achieving command execution. This link can be placed in the .gitmodules file of a git project, so that when a victim performs git clone...

CVE-2022-25845-In-Spring

CVE-2022-25845-In-Spring Main Dependencies 1. jackson 2. commons-io Quick Reproduction 1. Import project into IntelliJ IDEA, build mvn install 2. Build and run Dockerfile docker build . 3. Run src/test/java/POC.java to execute the touch /tmp/pwned command Exploitation Guide Step1: Add...

CVE-2016-4437

CVE-2016-4437 Python POC to Exploit CVE-2016-4437 Apache Shiro Deserialization Vulnerability Due to Hardcoded Encryption Key Example Usage: ./CVE-2016-4437.py -c nslookup -u https://example.com/ -i ecsepnkqtxlishpynfdge01543e4vmx7v.oast.fun See comments and the code for more information...

CVE-2018-6574

CVE-2018-6574 Exploit for remote command execution in Golang go get command. Introduction When you go get a package, Go is designed to build and install the package without running any code from it. The intent is that you can safely get, build, and even install Go packages without trusting them a...

VcenterKiller

VcenterKiller -1. Note For those setting up a vulnerable environment locally, using vckiller to verify log4j will mostly fail, because under VMware's NAT mode, the outgoing network interface in the verification module will be determined as 127.0.0.1, causing the target's LDAP Server address to...

CVE-2025-24367-Cacti-Exploit

CVE-2025-24367-WebShell Exploit I have created this small script for CVE-2025-24367 - From Cacti, a script made to obtain a webshell thanks to the vulnerability in cacti version 1.2.28. Script usage: python CVE-2025-24367-Exploit.py --url "http://webEjemplo.htb/cacti/" --user "usuario" --password...

test_struts2_vulnerability_CVE-2017-5638

teststruts2vulnerabilityCVE-2017-5638inMACOSX test struts2 vulnerability CVE-2017-5638 in Mac OS X download test web app and run it in tomcat install tomcat brew install tomcat confirm where the tomcat installed ls -lF which catalina confirm tomcat home dir ls -lF...

CVE-2019-20197

Nagios XI Remote Command Execution Vulnerability CVE-2019-20197 POC: POST /nagiosxi/includes/components/scheduledreporting/schedulereport.php HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64; rv:49.0 Gecko/20100101 Firefox/49.0 Accept:...

CVE-2026-112944

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative...