Webmin-1.580---file-show.cgi-Manual-Remote-Command-Execution-Non-Metasploit-

Webmin 1.580 RCE 実行ガイド Webmin 1.580 の /file/show.cgi コンポーネントを介して、認証済みリモートコード実行 RCE を実行するためのクイックリファレンスです。 1. 攻撃マシン リスナー ペイロードを実行する前に、ローカルマシンでこのコマンドを実行して受信接続を待ち受けます: root@kitploit: rlwrap nc -lnvp 4444 2. ターゲットへのエクスプロイトペイロード 次の URL をブラウザのアドレスバーに直接貼り付けてください 事前に Webmin ダッシュボードにログインしていることを確認してください:...

pypykatz

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord pypykatz Mimikatz implementation in pure Python. At least a part of it : Runs on all OS...

CVE-2026-11417-AWS-CDK-RCE

Supply Chain Command Injection in AWS CDK's NodejsFunction CVE-2026-11417 Author: Hesham Ashraf @HeshamASH Date: June 10, 2026 Severity: High CVSSv3.1: 7.3, CVSSv4: 7.0 CWE: CWE-78 — Improper Neutralization of Special Elements used in an OS Command OS Command Injection Affected Package: aws-cdk-l...

CVE-2019-16172

CVE-2019-16172 The CVE-2019-16172 Scanner is designed to check LimeSurvey instances for the stored XSS vulnerability. CVE Descriptions CVE-2019-16172 Description: CVE-2019-16172 is a stored XSS vulnerability found in LimeSurvey versions prior to 3.17. The vulnerability arises due to improper...

CVE-2022-36804-POC

CVE-2022-36804-POC 🕷️ Bitbucket CVE-2022-36804 ejecución remota de comandos sin autenticación Explotación Encuentra repositorios visibles públicamente - example.com/repos?visibility=public...

CVE-2017-8291

Python PIL/Pillow Ejecución Remota de Comandos GhostButt / CVE-2017-8291 中文版本Chinese version Python PIL Pillow es una popular biblioteca de procesamiento de imágenes para Python. Soporta varios formatos de imagen y proporciona potentes capacidades de manipulación de imágenes. El módulo de...

CVE-2015-3306-Python-PoC

CVE-2015-3306-Python-PoC This was converted with tweaks from a metasploit module as an exercise for OSCP studying and exploit development. It originally came from searching for random remote command execution modules with searchsploit. I anaylzed the metasploit code and converted it to python...

CVE-2023-27163

Prueba de Concepto de SSRF en Request-Baskets CVE-2023-27163 Este repositorio contiene una Prueba de Concepto PoC para CVE-2023-27163, una vulnerabilidad de Server-Side Request Forgery SSRF descubierta en request-baskets hasta la versión 1.2.1. Esta vulnerabilidad permite a los atacantes acceder ...

azazel

Azazel V 0.1 The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin. -- 1 Enoch 2:8 Azazel is a userland rootkit based off of the original LDPRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily...

Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code

Langflow = 1.2.x exposes POST /api/v1/validate/code without any authentication. The endpoint calls validatecode which execs user-supplied Python code. Default-argument expressions in Python execute at function-definition time, allowing arbitrary OS command execution without authentication. id:...

ruflo MCP Bridge - Unauthenticated RCE via terminal_execute

ruflo MCP bridge 3.16.3 in its default docker-compose deployment exposes POST /mcp with no authentication and binds to all interfaces 0.0.0.0:3001. The executeTool function has no server-side deny list for dangerous tools, allowing an unauthenticated attacker to invoke tools/call with...

FISSURE

FISSURE - The RF Framework 频率无关的基于SDR的信号理解与逆向工程 概述视频 FISSURE 操作概述 | FISSURE 概述（幻灯片） ---|--- 简介 FISSURE 是一个 开源射频框架 ，支持 操作部署 以及 研究与教育 。 对于 操作人员 ，它提供了可快速部署的工具包，用于信号检测、分类、协议发现、模糊测试、漏洞分析以及实时集成到 TAK。 对于 教育者和研究人员 ，它降低了 SDR 和逆向工程的入门门槛，提供了一个用于学习、实验和发布新方法的共享环境。 FISSURE 通过将软件、库和参考材料集中到一个一致的框架中，简化了复杂的 SDR...

SpringBootVulExploit

Spring Boot Vulnerability Exploit Check List Spring Boot 相关漏洞学习资料，利用方法和技巧合集，黑盒安全评估 check list 声明 ⚠️ 本项目所有内容仅作为安全研究和授权测试使用, 相关人员对因误用和滥用该项目造成的一切损害概不负责 目录 Spring Boot Vulnerability Exploit Check List 零：路由和版本 0x01：路由知识 0x02：版本知识 组件版本的相互依赖关系： Spring Cloud 与 Spring Boot 版本之间的依赖关系： Spring Cloud...

CVE-2019-25024

CVE-2019-25024 OpenRepeater ORP / Unauthenticated Command Injection Advisories: MITRE CVE: https://vulners.com/cve/CVE-2019-25024 US NIST: https://nvd.nist.gov/vuln/detail/CVE-2019-25024 Tenable: https://www.tenable.com/cve/CVE-2019-25024 VulDB: https://vuldb.com/?id.170172 Ubuntu:...

ssj

SSJ - Your everyday Linux distribution gone Super Saiyan. Introduction SSJ is a silly little script that makes use of Docker installed on your everyday Linux distribution Ubuntu, Debian, etc. and magically arms it with hundreds of penetration testing and forensic tools. Technical Details SSJ pull...

patch-openssl-CVE-2014-0160

patch-openssl-CVE-2014-0160 Parchea openssl heartbleed con ansible Uso : root@kitploit: pip install ansible ansible-playbook -i yourinventoryfile patch-openssl-CVE-2014-0160.yml yourinventoryfile solo necesita contener tu lista de servidores : root@kitploit: 192.168.0.10 webserver1.example.com...

jdwp-shellifier

Script de explotación de JDWP ¿Qué es? Este script de explotación está pensado para ser utilizado por pentesters contra un servicio JDWP activo, con el fin de obtener ejecución remota de código. ¿Cómo funciona? Bien, de forma bastante estándar, el script solo requiere un intérprete de Python 2:...

mininode

Mininode Mininode is a CLI tool to reduce the attack surface of the Node.js applications by using static analysis of source code. It supports two modes of reduction 1 coarse, 2 fine. Mininode constructs the dependency graph modules and functions used of the application starting from main file, i....

CVE-2026-15410

cve-id ⚡ Uso Sencillo Utilice este proyecto únicamente en entornos seguros y autorizados, como: Máquinas virtuales locales Contenedores Docker Entornos de laboratorio aislados Entornos de pruebas de penetración autorizadas Ejemplo de configuración: root@kitploit: git clone cd Project use python...

system_bt_AOSP10_r33_CVE-2022-20229

Pila Bluetooth Fluoride Compilación y ejecución en AOSP Simplemente compile AOSP - Fluoride está allí por defecto. Compilación y ejecución en Linux Instrucciones para Ubuntu, probado en 14.04 con Clang 3.5.0 y 16.10 con Clang 3.8.0 Descargar fuente root@kitploit: mkdir /fluoride cd /fluoride git...