SSH-KILLv2

What about SSH-KILLv2 Script Attack iPhone if ssh service open, many users use "Open SSH" in jailbroken devices to transfer files between laptop / PC & iPhone to make their life easier but the issue here "Open SSH " tweak use the default password "alpine" and many users don't change it if they...

poet

poet A simple POst-Exploitation Tool. overview The client program runs on the target machine and is configured with an IP address the server to connect to and a frequency to connect at. If the server isn't running when the client tries to connect, the client quietly sleeps and tries again at the...

hook

Hook Hook exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there is a builtin low privileged user named status that this script...

GC2-sheet

GC2 GC2 Google Command and Control is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint List and exfiltrate files using Google Drive or Microsoft SharePoint Document. Why This project has been developed t...

cve-2017-0065

Exploiting Edge's read:// urlhandler Introduction This exploit was reported to Microsoft and I was acknowledged for doing so. The exploit has been patched on March 14th 2017 under names cve-2017-0065 and MS17-007 and will not work if related patches are applied. Sourcecode is provided for...

PSRansom

PSRansom PSRansom is a PowerShell Ransomware Simulator with C2 Server capabilities. This tool helps you simulate encryption process of a generic ransomware in any system on any system with PowerShell installed on it. Thanks to the integrated C2 server, you can exfiltrate files and receive client...

pwnlift

pwnlift Named in homage to pwndrop, pwnlift is a simple dotnet server application for uploading files from a desktop without the use of a C2. Useful if you have a console access to a machine and need to take files offline for analysis such as Code Integrity Policy files. Building Build the projec...

PULSE-C2

PULSE C2 Framework HTTPS Command & Control infrastructure with web dashboard for remote Windows agent management. ⚠️ Educational Use Only - Illegal use = your responsibility. Features HTTPS C2 server with TLS encryption Flask Real-time web dashboard XOR + Base64 encrypted protocol SQLite database...

CVE-2024-34693

CVE-2024-34693 Exploit This repository contains a sophisticated Python script to exploit the CVE-2024-34693 vulnerability in Apache Superset. The script sets up a rogue MySQL server and creates a malicious MariaDB connection to exfiltrate the content of a specified file from the target system...

shepard

SHEPARD BITS This is a persistance tool using Windows Background Intelligent Transfer Service BITS. Functionality File Download, File Exfiltration, File Download + Persistent Execution Usage Run shepard.exe as Administrator with the following command line arguments: -d : regular file download to ...

BetterBackdoor

BetterBackdoor A backdoor is a tool used to gain remote access to a machine. Typically, backdoor utilities such as NetCat have two main functions: to pipe remote input into cmd or bash and output the response. This is useful, but it is also limited. BetterBackdoor overcomes these limitations by...

CVE-2020-11579

CVE-2020-11579 Introduction PHPKB 9.0 Enterprise Edition MySQL database is affected by an unauthenticated arbitrary file disclosure via a malicious MySQL Server. A remote attacker can read any file on a remote victim host with web-server privileges e.g. www-data, via a single HTTP GET request. Re...

CVE-2021-42560

CVE-2021-42560: Unsafe XML Parsing in MITRE Caldera The Debrief plugin in Caldera versions =2.9.0 receives base64 encoded "SVG" parameters when generating a PDF. These SVG are parsed in an unsafe manner and can be leveraged for XXE attacks e.g. File Exfiltration, Server-Side Request Forgery, Out ...

wordpress-cve-2021-29447

WordPress CVE-2021-29447 exploit Exploit WordPress Media Library XML authenticated External Entity Injection XXE to exfiltrate files. Patched in WordPress 5.7.1. Required valid WordPress credentials to interact with Media Library. Usage python3 wordpress-cve-2021-29447.py -l http://LOCALIP:PORT -...

DumpSMBShare

A python script to dump files and folders remotely from a Windows SMB share. Features Only list shares with --list-shares. Select only files with given extensions with --extensions or all files. Choose the local folder to dump to with --dump-dir. Select base folder to search from in the share wit...

ntfsDump

ntfsDump Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures. Similar to https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1 Reference:https://www.codeproject.com/Articles/81456/An-NTFS-Parser-Lib...

cve-2025-66723

CVE-2025-66723: inMusic Brands Engine DJ =3.0.0 through =3.0.0, 4.3.4, on all platforms macOS, Windows. Specifically tested versions found affected/vulnerable, macOS and Windows: 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.3.0, 3.4.0, 4.0.0, 4.0.1, 4.1.0, 4.2.0, 4.2.1, 4.3.0 Specifically tested versions...

cve-2022-31749

CVE-2022-31749 by 1vere$k Simple PoC-checker for CVE-2022-31749 by 1vere$k. It exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there...

Malicious-MCP

Malicious MCP This is a proof-of-concept project that allows you to deploy an MCP server that "disguises" itself as any other MCP server. This MCP acts as an MCP 'Proxy', and simply forwards all incoming requests to an upstream MCP server. What is an MCP? An MCP Server is a program that expose...

CVE-2023-25355-25356

Exploit and credits The exploit was found by [email protected] and is presented both in two amazing pieces: full disclosure article DEFCON31 slides A repo to automate even more this vulnerability has been published by Alex Linov: https://github.com/AlexLinov/sipXcom-RCE Objective The...