ATutor-Instructor-Backup-Arbitrary-File

ATutor-Instructor-Backup-Exploit Exploit Title: ATutor 2.2.4 'Backup' Remote Command Execution CVE-2019-12170 Google Dork: inurl:/ATutor/login.php Date: 5/13/2019 Exploit Author: liquidsky Joseph McPeters Vendor Homepage: https://atutor.github.io/ Software Link:...

CVE-2018-2628

CVE-2018-2628 A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Detailed Steps to Reproduce CVE-2018-2628: 0x01 Run the following command on the JRMPListener host: wget https://jitpack.io/com/github/frohoff/ysoserial/master/ysoserial-master.jar java...

F5-CVE-2022-1388-Exploit

F5-CVE-2022-1388-Exploit Exploit and Check Script for CVE 2022-1388 Usage Check against single host python3 CVE-2022-1388.py -v true -u targeturl Attack host and test command python CVE20221388.py -a true -u targeturl -c command Attack list of hosts python CVE20221388.py -s true -f file...

CVE-2024-29824

CVE-2024-29824: Ivanti EPM SQL Injection Remote Code Execution Vulnerability Proof of concept exploit to blindly execute commands on vulnerable Ivanti EPM appliances. Blog Post Deep dive and indicators of compromise here:...

CVE-2022-30525

CVE-2022-30525 Zyxel Firewall Unauthenticated Remote Command Injection Vulnerability Affected Components USG FLEX 100, 100W, 200, 500, 700 USG20-VPN, USG20W-VPN ATP 100, 200, 500, 700, 800 Firmware Versions ZLD5.00 thru ZLD5.21 Patch 1 ZLD5.10 thru ZLD5.21 Patch 1 ZLD5.10 thru ZLD5.21 Patch help...

CVE-2024-27130

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ QNAP QTS...

spring4shell-CVE-2022-22965

Simple Spring4Shell POC Check if endpoint is vulnerable python spring4shell.py -u http://192.168.110.117:8080/helloworld/greeting --check Exploit vulnerable endpoint python spring4shell.py -u http://192.168.110.117:8080/helloworld/greeting -f shell.jsp --exploit Execute command on uploaded webshe...

CVE-2021-22205

CVE-2021-22205 GitLab fails to properly verify image files passed to the file parser, leading to command execution. An attacker can craft malicious requests to exploit this vulnerability and execute arbitrary commands on the target system, ultimately taking control of the GitLab server. Since mos...

capa

Website | Download | Web Interface capa detects capabilities in executable files. You run it against a PE, ELF, .NET module, shellcode file, or a sandbox report and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing...

CVE-2025-24813-apache-tomcat

CVE-2025-24813 Nuclei Template CVE-2025–24813 nuclei -l list.txt -t CVE-2025–24813.yaml execute shell http://target.com/updates.jsp?cmd=whoami...

mylg

myLG, Herramienta de Diagnóstico de Red en Línea de Comandos myLG es una utilidad de software de código abierto que combina las funciones de diferentes sondas de red en una sola herramienta de diagnóstico de red. Características Vidrios de red populares ping/trace/bgp: Telia, Level3, NTT, Cogent,...

c2s

C2S Servidor de comando y control en Slack ¿Qué es C2S? C2S te permite construir un servidor de comando y control simple usando solo y únicamente Slack, sin ningún servidor extra ni nada más. Instalación pip3 install requests El resto de la instalación se centra en la configuración del workspace ...

GL.iNet-Multiple-Vulnerabilities

GL.iNet Multiple Vulnerabilities This repository contains the exploits of the following vulnerabilities: CVE-2023-46454: In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality...

PAN-OS-CVE-2024-3400-Command-Injection-Investigation

Investigating a PAN-OS CVE-2024-3400 Command Injection Attempt Overview This project documents the investigation of a CVE-2024-3400 command injection attempt targeting a PAN-OS GlobalProtect service. The goal was to determine: whether this is a real attack whether command execution occurred wheth...

pwdgenerator

pwdgenerator Customized password dictionary generator Based on bit4woo's passmaker project～ 🙏 Usage, download release Command line: ./pwdgenerator -h Simple usage ./pwdgenerator -d baidu.com -min 6 -max 10 Customized password dictionary generator How to use download release command line:...

SQLC2

SQLC2 SQLC2 es un script de PowerShell para implementar y gestionar un sistema de comando y control que utiliza SQL Server como servidor de control y agente. En esencia, SQLC2 es solo un script de PowerShell, un script TSQL y unas pocas tablas en una instancia de SQL Server que realiza un...

CVE-2024-40711-Exp

Usages .\ysoserial.exe -f BinaryFormatter -g Veeam -c localhostServer -vi targetIP -vp 6170 -vg DataSet -vc "cmd /c mspaint.exe" Usage: ysoserial.exe options Options: --vi, --targetveeamip=VALUE The target Veeam Backup and reaplication IP address --vp, --targetveeamport=VALUE The target Veeam...

SMShell

SMShell PoC for an SMS-based shell. Send commands and receive responses over SMS from mobile broadband capable computers. This tool came as an insipiration during a research on eSIM security implications led by Markus Vervier, presented at Offensivecon 2023 Disclaimer This is not a complete C2 bu...

custom-bytecode-analyzer

custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage usage: java -jar cba-cli.jar OPTIONS -a...

custom-bytecode-analyzer

custom-bytecode-analyzer Analizador de bytecode de Java personalizable mediante reglas JSON. Es una herramienta de línea de comandos que recibe una ruta que contiene uno o más archivos Jar o War, los analiza utilizando las reglas proporcionadas y genera informes HTML con los resultados. Uso usage...