onetwoseven-writeup

HTB OneTwoSeven — Full Walkthrough A complete, end-to-end walkthrough of OneTwoSeven , a retired HackTheBox Linux machine. The full chain: deterministic credential generation → symlink escape of an SFTP chroot → vim swap file recovery → SSH port-forwarding to a firewalled admin panel → bypass of...

vmware-exploitation

Explotación de VMware Una colección de enlaces relacionados con exploits de escape de VMware. Las pull requests son bienvenidas. Sigue a @andreyknvl en Twitter o a @[email protected] en Mastodon para recibir notificaciones de actualizaciones. Investigación 2024 "Encadenando N-days para...

MAL-015

MAL-015: Escape de Aislamiento 2 en Ansible Tower Las instalaciones de Ansible Tower en ciertas configuraciones de Rhel 7/8 son potencialmente vulnerables a los escapes de “Job Isolation” que permiten a un atacante escalar al usuario “awx” desde fuera del entorno aislado. Los siguientes...

bst

Binary String Toolkit Summary The Binary String Toolkit or BST for short is a rather simple utility to convert binary strings to various formats suitable for inclusions in source codes, such as those used to develop exploits and Proof of Concepts in the security field. Features Convert and dump...

V8-sbx-bypass-collection

Colección de escapes/bypasses/violaciones del sandbox de V8 y VR Una colección de enlaces relacionados con VR del sandbox de V8 y explotación Contenido IssueTracker Articles Papers & Slides Design documents IssueTracker 2023: "issue id: 40940619, Escape del sandbox de V8 debido a que las etiqueta...

CVE-2026-45197

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a...

CVE-2019-5736

CVE-2019-5736 Referencia: cve-2019-5736-poc 1. Editar el comando poc en stage2.cve 2. Construir la imagen docker docker build -t cve . 3. Ejecutar docker docker run -d cve /bin/bash -c "tail -f /dev/null" 4. Respaldar docker-runc cp /usr/bin/docker-runc /usr/bin/docker-runc.bak 5. docker exec -it...

CVE-2021-3156

Project Title Exploit generator for CVE-2021-3156 sudo Installation 1. Install dependencies ./install.sh 2. Run exploit generator: ./run.sh 3. If the system's sudo version is vulnerable, an exploit is generated for the installed version 4. The exploit is generated in exploit.c and the binary...

CVE-2019-5736-POC

通过 RunC 逃逸 Docker CVE-2019-5736 的概念验证代码 此 POC 主要基于 YuvalAvra 的 POC。 我不对本 POC 中使用的代码主张任何功劳。 有关此漏洞的更多信息以及如何利用它的演示，请参阅工作表。 工作表中的信息基于 Twistlock Labs 的博客文章。 使用方法 此 POC 能够修改主机系统上的二进制文件，因此建议在虚拟机中进行。 该 POC 会覆盖主机上的 runC，将其替换为用于设置持久远程桌面（使用 VNC）的代码 克隆仓库： root@kitploit: $ git clone...

PT-2026-86268

Name of the Vulnerable Software and Affected Versions ntop nDPI versions prior to 6.0 Description An out-of-bounds heap write exists in the ndpi json string escape function. This occurs because the function lacks an enforceable maximum length for the destination buffer when escaping characters fo...

Linux Distros Unpatched Vulnerability : CVE-2026-85047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-85042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-85048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary co...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2019-12735

CVE-2019-12735 Este CVE fue corregido después de neovim 0.3.6 y vim 8.1.1365 POC root@kitploit: vim demo1.txt Shell remota 1. Crea el archivo de texto malicioso: root@kitploit: gcc makedemo3.c -o makedemo3 ./makedemo3 2. Compila el cliente en otra sesión: root@kitploit: nc -vlp 9999 3. Abre el...

dirtypipe-container-breakout-poc

Escape de contenedor Dirty Pipe Movido a https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/dirtypipe-container-breakout...

CVE-2019-5736-PoC

CVE-2019-5736-PoC PoC para CVE-2019-5736 Creado con ayuda de @singe, @cablethief, y @feexd Probado en Ubuntu 18.04, Debian 9 y Arch Linux. Versiones de Docker 18.09.1-ce y 18.03.1-ce. Este PoC actualmente no funciona con Ubuntu 16.04 y CentOS. Ve a ver el código del exploit de Dragon Sector las...

insject

Insject insject es una herramienta para inspeccionar contenedores. Te permite ejecutar un comando arbitrario en un contenedor o en cualquier combinación de espacios de nombres namespaces de Linux. Soporta tres casos de uso principales: Modo LDPRELOAD usando libsetns.so LDPRELOAD=./libsetns.so...

Zapscape

La trilogía de escapes de KVM ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Escape de invitado a host en KVM/x86 Resumen Este documento describe la vulnerabilidad Zapscape CVE-2026-64561 , descubierta e informada por Hyunwoo Kim @v4bel. Es una...