CVE-2022-0778-POC

CVE-2022-0778 のためのシンプルなリモートトリガーPOC 理由 私たちのサーバー実装が CVE-2022-0778 に対して脆弱であるかどうかをリモートで検証しようとした際、非常に煩雑であることがわかりました。BNnodsqrt の解析バグをトリガーする悪意ある証明書を作成する手順は 以前から存在していました が、主な問題は、ほとんどのクライアント実装が TLS ハンドシェイクで使用するためにクライアント証明書を解析しようとすることです。その結果、 実装が脆弱な場合、バグがトリガーされ、クライアントは CPU を 100% 使用して停止します。...

CVE-2026-89485

A flaw was found in the lockd component of the Linux kernel. This use-after-free vulnerability occurs in the nlmtraversefiles function when a file's memory is prematurely released while an iterator still holds a pointer to it. A remote attacker could potentially exploit this to cause system...

CVE-2026-89758

A flaw was found in the Linux kernel's memory management subsystem. When an HMM-based Graphics Processing Unit GPU driver migrates a Transparent Huge Page THP to device memory, it can leave a device-private Page Middle Directory PMD entry. If a user-space application then attempts to manage this...

CVE-2026-80930

A flaw was found in the Linux kernel's TPM I2C Nuvoton driver. The i2cnuvotonwaitforstat function enables an interrupt IRQ but fails to disable it if the wait operation times out or is interrupted. This oversight can lead to an unbalanced IRQ state, potentially causing system instability or...

autodeauth

autodeauth ローカルネットワークを自動的にdeauthするツール/サービス Raspberry Pi OS および Kali Linux で動作確認済み セットアップ root@kitploit: $ chmod +x setup.sh $ sudo ./setup.sh This can be changed by editing /etc/systemd/system/autodeauth.service ? Enter your WiFi interface to use with the autodeauth service: wlan0 Installed!, you...

CVE-2026-89537

A flaw was found in the Linux kernel's SUNRPC implementation, specifically within the gsskrb5verifymicv2 function. A remote malicious Network File System NFS server could provide a specially crafted, short Kerberos Message Integrity Code MIC token. This could lead to the kernel reading past an...

CVE-2026-89686

A flaw was found in the Linux kernel's Network File System Daemon nfsd for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service DoS. This occurs when the nfsd4alloclayoutstateid function accesses a file pointer without proper locking...

CVE-2026-80936

A flaw was found in the Linux kernel's mt7925 Wi-Fi driver. During multi-link power-save setup, the mlopmwork is queued with a delay but not properly cancelled when the device is stopped. This can lead to the work item attempting to access a deallocated workqueue, resulting in a kernel warning an...

wifijammer

wifijammer 範囲内のすべてのWi-Fiクライアントとアクセスポイントを継続的に妨害します。このスクリプトの有効性は、使用するワイヤレスカードに依存します。Alfaカードは、アクセスポイントが密集したエリアで約1ブロック程度の範囲を効果的に妨害できるようです。より効果的なターゲット指定のために、オプションで細かい設定が可能です。 必要条件 : Python 2.7, python-scapy, インジェクション対応のワイヤレスカード 使い方 シンプルな使い方 root@kitploit: python wifijammer...

ipv6tools

IPv6Tools The IPv6Tools framework is a robust set of modules and plugins that allow a user to audit an IPv6 enabled network. The built-in modules support enumeration of IPv6 features such as ICMPv6 and Multicast Listener Discovery MLD. In addition, the framework also supports enumeration of Upper...

CVE-2026-89527

A flaw was found in the Linux kernel's svcrdma module. This vulnerability occurs when a listener creation fails, leading to an improper release of a network namespace reference. This resource leak can be exploited by a local attacker, potentially causing a denial of service DoS by exhausting syst...

CVE-2026-89512

A flaw was found in the Linux kernel's remoteproc SCP component. This vulnerability involves a device reference leak, where the system fails to properly release a reference to a device during a driver data lookup. This occurs specifically before the driver has been fully bound. A local attacker...

slowloris

slowloris.py - Simple slowloris in Python What is Slowloris? Slowloris is basically an HTTP Denial of Service attack that affects threaded servers. It works like this: 1. We start making lots of HTTP requests. 2. We send headers periodically every 15 seconds to keep the connections open. 3. We...

slowloris

slowloris.py - Pythonで書かれたシンプルなSlowloris Slowlorisとは？ Slowlorisは基本的に、スレッド型サーバーに影響を与えるHTTPサービス拒否攻撃です。仕組みは次のとおりです。 1. 大量のHTTPリクエストを開始します。 2. 接続を維持するために、定期的（約15秒ごと）にヘッダーを送信します。 3. サーバーが閉じない限り、接続を閉じません。サーバーが接続を閉じた場合は、新しい接続を作成して同じことを続けます。 これにより、サーバーのスレッドプールが枯渇し、サーバーは他の人に応答できなくなります。 引用...

morpheus

Morpheus - automated ettercap TCP/IP Hijacking tool root@kitploit: Version release: v2.2 - STABLE Author: pedro ubuntu r00t-3xp10it Codename: oneiroi phobetor The mithologic dream greek god Distros Supported: Linux Ubuntu, Kali, Debian, BackBox, Parrot OS Suspicious-Shell-Activity© SSA RedTeam...

CVE-2026-89497

A flaw was found in the Linux kernel's Orange File System orangefs client. The orangefspreparecdmarray function incorrectly calculates the buffer size for client debug keywords when an entry starts with a space. This can lead to a buffer overflow, allowing data to be written beyond the intended...

CVE-2026-80955

A flaw was found in the Linux kernel's dm-pcache component. This vulnerability, a use-after-free, occurs within the ksetreplay function when a stale key's segment generation is accessed after it has been freed. This could allow a local attacker to potentially cause a system crash or lead to other...

POC-CVE-2025-48988-CVE-2025-48976

CVE-2025-48988 & CVE-2025-48976 概要 このプロジェクトは、Tomcat 10.1.41 と Jakarta Servlet を使用して、シンプルなファイルアップロードエンドポイントを実行します。 このエクスプロイトは、デフォルトで、50 のワーカーから、1000 のパートとパートあたり 50 のヘッダーを持つ 1000 の並列化されたマルチパートリクエストを実行します。 POC の実行 Docker コンテナをビルドして実行します: docker build -t poc-cve-2025-48988 . docker run -p 8080:8080...

CVE-2026-89759

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleakscan scans every task stack under one rcureadlock with no reschedule point, which can trip the...

CVE-2026-89744

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnodeforeachchildnode When iterate over children of a fwnode that has a secondary fwnode, fwnodegetnextchildnode can enter an infinite loop if the secondary fwnode has more than one child...