CVE-2020-9283

Exploit for CVE-2020-9283 This project is inspired by the original POC found here github.com/mark-adams/exploits/CVE-2020-9283. I was curious as to how the Go SSH library was implemented so decided to implement the PoC using go. A short writeup can be found here...

OpenSSL-1_0_1g_CVE-2016-0702

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...

cve-2017-5638

CVE-2017-5638 Demo app of, yes, that data broker's security breach. Includes exploit code. Basic usage launch root@kitploit: mvn jetty:run Then go to http://localhost:8080/basic-struts/index.action. You should see the Welcome to Struts 2! message. Vulnerability scan root@kitploit: mvn site...

RustChain

Description This tool is a simple PoC of how to hide memory artifacts using a ROP chain in combination with hardware breakpoints. The ROP chain will change the main module memory page's protections to N/A while sleeping i.e. when the function Sleep is called. For more detailed information about...

CVE-2024-3121

CVE-2024-3121 - Remote Code Execution RCE in parisneo/lollms Discovered by: Syed Jan Muhammad Zaidi GitHub: dark-ninja10 CVE ID: CVE-2024-3121 Repository Affected: parisneo/lollms 🧨 Vulnerability Summary A Remote Code Execution RCE vulnerability exists in the createcondaenv function of the lollms...

MiniPlasma-Runner

MiniPlasma-Runner Modified version of Nightmare-Eclipse/MiniPlasma CVE-2020-17103 adapted for C2 usage. Original PoC runs from disk only. This version runs entirely from memory via execute-assembly, with a split-binary approach to avoid detection. Disclaimer This tool is provided for authorized...

CVE-2025-4138-4517-POC

CVE-2025-4138 / CVE-2025-4517 Python tarfile 过滤器绕过：利用 PATHMAX 符号链接逃逸 通过filter="data" / filter="tar" 提取实现任意文件写入 目录 概述 漏洞详情 工作原理 受影响版本 受影响代码模式 安装 使用方法 快速入门 — SSH 密钥注入 预设攻击 自定义目标 概念验证 — 安全验证 技术深度解析 PATHMAX 与 os.path.realpat...

Chimera

Chimera Unlea$ed Tool Background While DLL sideloading can be used for legitimate purposes, such as loading necessary libraries for a program to function, it can also be used for malicious purposes. Attackers can use DLL sideloading to execute arbitrary code on a target system, often by exploitin...

legba

legba 加入项目社区，尽在我们的服务器！ Legba 是一个多协议凭证暴力破解/密码喷洒和枚举工具，使用 Rust 和 Tokio 异步运行时构建，以实现更好的性能和稳定性，同时比同类工具消耗更少的资源。 主要特性 100% Rust - Legba 完全使用 Rust 编写，没有原生依赖，可以轻松编译为所有操作系统和架构。🦀 多协议 - 支持 HTTP、DNS、SSH、FTP、SMTP、RDP、VNC、SQL 数据库、NoSQL、LDAP、Kerberos、SAMBA、SNMP、STOMP、MQTT 及更多。 高性能 - 异步/并发架构，可自定义工作程序，实现最大速度。...

CVE-2024-3867

CVE-2024-3867 This repository shows u some information on this vulnerability, which were found by me. Here is the official description given: The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate...

CVE-2024-56924

CVE-2024-56924 Vulnerability Description A Cross-Site Request Forgery CSRF vulnerability exists in the code astro Internet Banking System version 2.0.0, which allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as administrators, without their knowledge...

CVE-2024-23897

CVE-2024-23897 Jenkins Arbitrary File Leak Vulnerability CVE-2024-23897 !CAUTION ⚠️ Disclaimer: IMPORTANT: This script is provided for educational, ethical testing, and lawful use ONLY. Do not use it on any system or network without explicit permission. Unauthorized access to computer systems and...

CVE-2020-8163

CVE-2020-8163 Enviroment and exploit to CVE-2020-8163 Blind remote code execution of user-provided local names in Rails 5.0.1 and 4.2.11.2 Create the enviroment 1. create docker container mapping port 4000 to 8001 root@kitploit: sudo docker run --rm -it -p 8001:4000 ruby:2.3 bash 2. update and...

dirtyfrag-arm64

dirtyfrag-arm64 arm64/aarch64 port of V4bel/dirtyfrag CVE-2026-43284, CVE-2026-43500. Tested on Ubuntu 24.04.4 LTS with linux-aws 6.17.0-1013-aws on AWS Graviton newest available as of this writing. Full writeup with AppArmor bypass analysis, hardening notes, and detection notes:...

CVE-2022-24637

CVE-2022-24637 Open Web Analytics OWA - Unauthenticated Remote Code Execution https://vulners.com/cve/CVE-2022-24637 Example root@kitploit: python3 exploit.py -u admin -p hacker http://target.org 10.10.11.12 4444...

CVE-2026-9090-Modbus-TCP-Write-to-Read-Only-Coils-via-Function-Code-Spoofing

CVE-2026-9090 – 通过功能码欺骗对只读线圈进行 Modbus TCP 写入 程序代码（使用 pymodbus 模拟的 Python） root@kitploit: modbusplcsim.py - Simulated Modbus PLC with read‑only coils from pymodbus.server.sync import StartTcpServer from pymodbus.device import ModbusDeviceIdentification from pymodbus.datastore import...

CVE-2022-24716

CVE-2022-24716 Arbitrary File Disclosure Vulnerability in Icinga Web 2 2.8.6, 2.9.6, 2.10 Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user,...

CVE-2025-8110

CVE-2025-8110 Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. How does this detection method work? Extracts the Gogs version from the footer of /user/login via regex Gogs Version: X.X.X and flags instances running version 0.13.3 or earlier as...

CVE-2020-8816

CVE-2020-8816 Pi-hole Remote Code Execution authenticated Version = 4.3.2 Usage python3 CVE-2020-8816.py -u http://10.10.10.10 -i 10.10.14.172 -p 1337 -pass admin Example More info https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/...

CVE-2020-0728

CVE-2020-0728 Details The TrustedInstaller.exe service is running as NTAUTHORITY\SYSTEM and is hosting the Sxs Store Class 3C6859CE-230B-48A4-BE6C-932C0C202048 COM service along with the interface ISxsStore. The access permissions...