Debuggable-App-Exploit

CVE-2024-31317 Debuggable App Exploit A Python-based exploit for CVE-2024-31317 Android Zygote Injection that makes any installed Android app debuggable by injecting malicious zygote arguments through the hiddenapiblacklistexemptions setting. Includes optional Frida gadget injection for runtime...

PHPStudy-Backdoor

PHPStudy-Backdoor Backdoor Vulnerability Reproduction phpstudy dll backdoor for v2016 and v2018 0x01 scan search for backdoor dll D:\Pentester\phpStudypython check.py === .\php\php-5.2.17\ext\phpxmlrpc.dll === @eval%s'%s'; %s;@eval%s'%s'; === .\php\php-5.4.45\ext\phpxmlrpc.dll === @eval%s'%s';...

poc-cve-2023-2868

CVE-2023-2868: Barracuda ESG Command Injection For full details, read our AttackerKB Analysis. Usage Set LHOST and RHOST variables to your listener. ruby poccve20232868.rb This will spawn a reverse shell...

CVE-2024-3400

CVE-2024-3400 CVE-2024-3400 Palo Alto OS Command Injection Vendor Description A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute...

Social-media-c2

Command and control servers in social media Script is a proof of concept how to control your machine by using social media platforms. Description and usage Script has following functions: history - ReTweet history, like photo on Instagram with 'history' in description or wrote 'history' to...

CVE-2026-33718

CVE-2026-33718 OpenHands is Vulnerable to Command Injection through its Git Diff Handler Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker...

SharpRDP

SharpRDP - Remote Desktop Protocol Console Application for Authenticated Command Execution Building To compile open the project in Visual Studio and build for release. Two DLLs will be output to the Release directory, you do not need those because the DLLs are in the assembly. If you do not want ...

CNVD-C-2019-48814-CNNVD-201904-961

CNVD-C-2019-48814和CNNVD-201904-961 Thanks to t00ls-ximcx0101 for providing the script CNVD-C-2019-48814 POC Summary Related links: Qingshui Chuanqi's Jianshu article: https://www.jianshu.com/p/c4982a845f55 Reposted by Security Ancestor: https://dwz.cn/2GQvbUae Due to environment factors, paths ma...

CVE-2020-2883

CVE-2020-2883 re write of: https://github.com/zhzyker/exphub/blob/master/weblogic/cve-2020-2883cmd.py my poc is python3 enjoy and happy hacking...

CVE-2023-4450-Attack

CVE-2023-4450-Attack An automated tool for attacking the CVE-2023-4450 vulnerability in JimuReport Introduction This tool is only for security testing, do not use it for illegal purposes! Usage java -jar CVE-2023-4450-Attack.jar Provides three functions: command execution, CMD/Behinder memory she...

CVE-2026-4631-cockpit-RCE

CVE-2026-4631 — Code Analysis Cockpit: Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection Field| Detail ---|--- CVE ID| CVE-2026-4631 GHSA| GHSA-m4gv-x78h-3427 Severity| Critical CVSS 9.8 Affected versions| Cockpit 327 – 359 Fixed in| Cockpit 360 CWE| CWE-78: OS Command...

xzf

Introduction xzf is a simple PoC demonstrating how EXIF data can be used for command and control. xzf GETs an image from a predetermined URL, then reads the software tag for an authentication string. If the string matches, xzf will execute anything contained within the ImageDescription tag. Usage...

metabigor

Metabigor - OSINT power without API key hassle What is Metabigor? Metabigor maps a target's infrastructure without asking you to register for a single API key. Network ranges, certificates, related domains, exposed ports, CDN vendors, and code leaks - all from free sources, all pipeable into each...

cpufetch

Simple yet fancy CPU architecture fetching tool cpufetch is a command-line tool written in C that displays the CPU information in a clean and beautiful way Table of contents 1. Support 2. Installation 2.1 Installing from a package 2.2 Building from source 2.3 Android 3. Examples 3.1 x8664 3.2...

DEBIAN-CVE-2026-116053

A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function sourcespecialcommandissafe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attac...

CVE-2026-116053

A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function sourcespecialcommandissafe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attac...

CVE-2017-6206

CVE-2017-6206 The DGS-1510 Websmart switch series firmware has been found to have security vulneratiblies. The vulnerabilities include unauthenticated command bypass and unauthenticated information disclosure. exploit.sh contains both PoC code and it will create a remote user at specified D-Link...

godoh

🕳 godoh A DNS-over-HTTPS Command & Control Proof of Concept introduction godoh is a proof of concept Command and Control framework, written in Golang, that uses DNS-over-HTTPS as a transport medium. Currently supported providers include Google, Cloudflare but also contains the ability to use...

CVE-2026-24061-POC

CVE-2026-24061-POC echo "cat /etc/passwd; id;" | python poc2.py TARGET 23 1. Connection Timeout Location: Line 25 in establishconnection method python self.connection.settimeout10 -- Adjustable connection timeout Purpose: Controls how long to wait for initial TCP connection to the target...

CVE-2026-34910-PoC

CVE-2026-34910 / CVE-2026-34909 — UniFi OS Unauthenticated RCE & File Read Unauthenticated Command Injection RCE CVE-2026-34910 + Path Traversal Arbitrary File Read CVE-2026-34909 in UniFi OS Server. CVSS 10.0 Critical each · CISA KEV listed · actively exploited by a Mirai-derived botnet azsxd...