CVE-2021-41773-PoC

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 This script test Apache HTTP Server 2.4.49 Usage: CVE-2021-41773.py options Only for one IP: python CVE-2021-41773.py IPaddress Option -f For IP list in file Example: python CVE-2021-41773.py -f...

CVE-2022-0847

DIRTY PIPE CVE-2022-0847 This is a kernel vulnerability that allows overwriting of data in arbitrary read-only files, which can therefore lead to privilege escalation since an unprivileged process can write into a privileged process. All credits go to 🥇Max Kellermann for finding the vulnerability...

CVE-2022-0847_DirtyPipeExploit

What is this This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite root's password field in /etc/passwd and restore after popping a root shell. Side Note: I do not claim any credit for finding this vulnerability or writing the proof of concept. This exploit is merely...

nmap-CVE-2023-23333-exploit

nmap-CVE-2023-23333-exploit Nmap NSE script to dump /etc/passwd from remote system using Solarwinds CVE-2023-23333 vulnerability Save the script into a file named solar-CVE-2023-23333.nse. To run the script, you can use Nmap's --script-args option to provide the output file path: nmap -p --script...

idb

Idb idb is a tool to simplify some common tasks for iOS pentesting and research. Originally there was a command line version of the tool, but it is no longer under development so you should get the GUI version. idb has a new homepage athttp://www.idbtool.com All documentation and news are posted...

CVE-2019-5418-Scanner

CVE-2019-5418-Scanner A multi-threaded Golang scanner to identify Ruby endpoints vulnerable to CVE-2019-5418 Usage Usage of ./CVE-2019-5418-Scanner: -auth string Perform a scan using a auth token i.e Basic YmFzZTY0VG9rZW5WYWx1ZQ== default "nope" -http Use HTTP over HTTPS -insecure Ignore SSL/TLS...

CVE-2024-24919

CVE-2024-24919 nuclei template of CVE-2024-24919 This template will help detect the described vulnerability by checking if the system leaks the contents of the /etc/shadow file...

cve_2022_0847_shellcode

cve20220847shellcode Description This repository contains a Python script genshellcode.py, based on pwntools, to generate a shellcode implementing CVE-2022-0847. The shellcode is based on this Poc: antx. I analyzed the code of the PoC and its execution with strace to catch all the system calls...

cve_2026_31431

CVE-2026-31431 "Copy Fail" Toolkit Detector and proof-of-concept LPE for the Linux algifaead / authencesn page-cache scratch-write bug disclosed 2026-04-29. Disclosure writeup: https://xint.io/blog/copy-fail-linux-distributions Authorization Use only on hosts you own or are explicitly engaged to...

CVE-2024-48990

CVE-2024-48990 Exploit for CVE-2024-48990 Local Privilege Escalation in needrestart 3.8 Background Read https://blog.qualys.com/vulnerabilities-threat-research/2024/11/19/qualys-tru-uncovers-five-local-privilege-escalation-vulnerabilities-in-needrestart. Qualys does a great job explaining it. TLD...

CVE-2016-5195

CVE-2016-5195 my personal POC and EXPLOIT of CVE-2016-5195 dirty COW Usage POC: write files arbitrarily Just a simply POC of this CVE, compile the file poc.c as follow: $ gcc poc.c -o poc -static -lpthread You shall run it as follow: ./poc destinationfile fakefile You shall make sure the...

CVE-2019-5418

CVE-2019-5418 Test case Run : $ rails s PoC : Accept: ../../../../../../../../etc/passwd Req 1 - GET /shitblock HTTP/1.1 Host: REDACTED:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:65.0 Gecko/20100101 Firefox/65.0 Accept: diyarbakirguzelbaglardelalelorke ------ CATCH Content-Lengt...

cve-2021-45043

cve-2021-45043 HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang sLanguage parameter. initial post https://cyberguy0xd1.medium.com/my-cve-2021-45043-lfi-write-up-441dad30dd7f exploiting via burp GET /language/lang HTTP/1.1 Host:...

CVE-2022-0847

CVE-2022-0847 The Dirty Pipe Vulnerability For educational purposes only ┌──vagrant㉿kali- └─$ ls -al /etc/passwd -rw-r--r-- 1 root root 3124 Mar 8 08:47 /etc/passwd ┌──vagrant㉿kali- └─$ head -n 1 /etc/passwd root:x:0:0:root:/root:/usr/bin/zsh ┌──vagrant㉿kali- └─$ echo foo /etc/passwd zsh:...

Dirty-Pipe-Oneshot

Dirty-Pipe-Oneshot Compiled version of CVE-2022-0847 aka Dirty Pipe. Just one shot to root them all :D just comple the cve-2022-0847.c file gcc cve-2022-0847.c -o getroot then execute it on the victim & get root :D ./getroot /etc/passwd 1 ootz: Happy Rooting 🎭...

CVE-2021-41773-PoC

CVE-2021-41773-PoC PoC for CVE-2021-41773 with docker to demonstrate Run Just run ./poc.sh. Make sure you have working docker and docker-compose $ ./poc.sh Creating network "cve-2021-41773-pocdefault" with the default driver Creating cve-2021-41773-pocweb1 ... done root:x:0:0:root:/root:/bin/bash...

dirtyPipe-automaticRoot

Dirty Pipe automatic root exploit CVE-2022-0847 Dependencies: Python 3.10 or above How to use: Automatic root: $ python3.10 dirtyPipe.py -a + hjacking super user in /etc/passwd + dropipng shell Write a no write permission, immutable or read-only mounted file: $ python3.10 dirtyPipe.py -w FILE...

CiscoRV320Dump

CiscoRV320Dump CVE-2019-1653/CVE-2019-1652 Exploits For Dumping Cisco RV320 Configurations and getting RCE Implementations of the CVE-2019-1652 and CVE-2019-1653 exploits disclosed by Red Team Pentesting GmbH. I only tested these on an RV320, but according to the Cisco advisory, the RV325 is also...

Linux-Kernel-Copy-Fail-CVE-2026-31431-

Copy Fail CVE-2026-31431 Vulnerability Analysis and Response Practice This project analyzes the operational principle of the Linux Kernel Copy Fail CVE-2026-31431 vulnerability and compares the pre-patch and post-patch state using the non-destructive checker from the public PoC repository. It doe...

apache-vulnerable

Scan FOR APACHE versions "ZERO-DAY" Apache Version 2.4.49 and 2.4.50 CVE-2021-41773 and CVE-2021-42013 How to use : You Will need nuclei ! https://github.com/projectdiscovery/nuclei Check local nuclei install and verify template nuclei -t apache-vulnerable-versions.yaml -vv and nuclei -t...