CVE-2020-0668

CVE-2020-0668 powershell 实现，利用printconfig.dll来提权 evil dll可以自己定义，我这里的dll会执行c:\programdata\setup.bat文件 Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0668 https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop TODO： ​ 1.利用RASPLAP服务提权...

CVE-2024-32019-PoC

CVE-2024-32019-PoC 通过"ndsudo"进行权限提升的Bash脚本（Netdata本地利用） 受影响版本 Netdata = v1.45.0, = v1.44.0-60, v1.45.0-169 漏洞描述 ndsudo 工具运行一组受限的外部命令，但搜索路径由"PATH"环境变量提供。通过将"PATH"环境变量更改为我们有权限的路径，我们可以控制 ndsudo 查找命令的位置，并创建一个包含恶意代码的命令。 概念验证 此漏洞利用基于假设目标机器和攻击者机器位于同一网络。 先决条件 攻击者机器 端口 4444 上的监听器 托管恶意 nvme 二进制文件的 Web 服务器...

Dockerized-CVE-2019-14287

Dockerized CVE-2019-14287 Containerized and deployable use of the CVE-2019-14287 vuln. View README.md for more. This CVE affects all versions of sudo under 1.8.28 where a sudo user can escalate to root by referencing its user ID. This Dockerfile allows this CVE to be built, where it can be used f...

Windows-Privilege-Escalation-Notes

Escalada de Privilegios en Windows La sala preferible es https://tryhackme.com/room/windows10privesc, pero puedes usar lo que quieras. Algunos recursos, https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/...

2022-LPE-UAF

2022-LPE-UAF Código POC no probado Investigadores de seguridad descubrieron 3 vulnerabilidades en el kernel de Linux que podrían permitir a un atacante local elevar privilegios y potencialmente ejecutar código malicioso. El código de prueba de concepto está disponible públicamente, lo que aumenta...

CVE-2014-0196

CVE-2014-0196 Linux内核（至3.14.3版本）的drivers/tty/ntty.c文件中的nttywrite函数在"LECHO & !OPOST"情况下未正确管理tty驱动程序访问，这使得本地用户能够通过触发涉及长字符串读写操作的竞争条件，导致拒绝服务（内存损坏和系统崩溃）或获取权限。...

CVE-2026-87759

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-77752

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

CVE-2026-77705

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

JuicyPotatoNG

JuicyPotatoNG Solo otra escalada de privilegios local de Windows desde cuenta de servicio a System. Detalles completos en -- https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/ Uso root@kitploit: JuicyPotatoNG by decoderit & splintercode Argumentos obligatorios: -t...

DEFCON-CICD-pipelines-workshop

CI/CD : ¿El nuevo Eldorado? Resumen Los pipelines de CI/CD se están convirtiendo cada vez más en parte de la infraestructura estándar dentro de los equipos de desarrollo, con el auge de nuevos enfoques como la Infraestructura como Código, el nivel de sensibilidad de dichos pipelines está aumentan...

SharpEfsPotato

SharpEfsPotato Escalada local de privilegios desde SeImpersonatePrivilege usando EfsRpc. Construido a partir de SweetPotato por @EthicalChaos y SharpSystemTriggers/SharpEfsTrigger por @cube0x0. Uso root@kitploit: C:\tempSharpEfsPotato.exe -h SharpEfsPotato by @bugch3ck Local privilege escalation...

CVE-2026-87759

The Add User Autocomplete WordPress plugin before 1.2 fails to perform a capability or nonce check before creating a pending site-membership invitation that carries a caller-supplied role. This allows any authenticated user (e.g., a subscriber) to grant themselves the administrator role on a mult...

EUVD-2026-76798

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-87759 Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-85681 WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site'...

CVE-2026-85681

The WP Component WordPress plugin (through 2.2.4 ) lacks capability or nonce checks on an action exposed to unauthenticated users. Both the option name and option value are taken directly from the request, allowing unauthenticated attackers to overwrite any site option . On a single-site installa...

CVE-2026-77752

Temporary Login Without Password is a WordPress plugin for managing temporary user access. Versions 1.5 through 1.9.8 fail to verify that a user requesting a temporary login already holds network super admin rights before granting those rights to the new or existing account. In a multisite networ...

EUVD-2026-76811

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

CVE-2026-77752 Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...