log4j-checker

Log4j-Checker Este repositorio contiene scripts que pueden ayudar a identificar archivos .jar que pueden ser vulnerables a CVE-2021-44228, también conocido como Log4Shell. Comprobación de Hash de Log4Shell Este script buscará archivos .jar en el sistema de archivos a partir de una ruta específica...

CVE-2024-9796

CVE-2024-9796 WP-Advanced-Search 3.3.9.2 - 未认证SQL注入 描述 PoC SQL注入将转储WordPress用户和哈希。 免责声明： 此脚本仅供教育用途。 请勿用于非法目的。 如果使用，完全由您负责；我不对任何滥用负责。 关于该漏洞的更多信息 https://wpscan.com/vulnerability/2ddd6839-6bcb-4bb8-97e0-1516b8c2b99b/ 用法： root@kitploit: 成功尝试 python3 poc.py -i 127.0.0.1 ! 127.0.0.1 has been PWNed!...

EUVD-2026-77483

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

cve-2021-38314

CVE-2021-38314 Python 利用程序 详情 Gutenberg Template Library & Redux Framework 插件 = 4.2.11 为 WordPress 注册了多个 AJAX 操作，这些操作位于 redux-core/class-redux-core.php 的 includes 函数中，对未认证用户可用。这些操作对特定站点是唯一的，但具有确定性和可预测性，因为它们基于站点 URL 的 md5 哈希（盐值已知为 '-redux'）以及前一个哈希的 md5 哈希（盐值已知为 '-support'）。这些 AJAX...

CVE-2017-14262

SamsungNVRvul CVE-2017-14262 xfuturesec Co., Ltd 首先，获取 'admin' 账户的 MD5 哈希密码。 发送： GET http://192.168.1.14/cgi-bin/main-cgi?json="cmd":201,"szUserNameQry":"admin","szUserName":"","u32UserLoginHandle":0 HTTP/1.1 Host: 192.168.1.14 User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:55.0 Gecko/20100101...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fibmultipathhash and rt6multipathhash. Passing the 32 bit hash returned by skbgethash can lead to problems related to the fact that...

CVE-2024-28000

LiteSpeed Cache 权限提升 PoC - CVE-2024-28000 此仓库包含一个概念验证（PoC）脚本，用于利用 LiteSpeed Cache WordPress 插件中的一个权限提升漏洞。该漏洞被标识为 CVE-2024-28000 ，允许未经身份验证的用户通过暴力破解插件中使用的弱安全哈希，获得 WordPress 网站的管理员级访问权限。 漏洞概述 LiteSpeed Cache 插件的用户模拟功能由使用可预测值生成的弱安全哈希保护。攻击者可以通过暴力破解该安全哈希，并将其与目标用户 ID 一起传入 Cookie...

Log4JShell-Bytecode-Detector

🔍 Log4JShell 字节码检测器 Log4JShell 字节码检测器是一款开源工具，可帮助识别 jar 文件是否受严重漏洞 CVE-2021-44228 影响。该工具扫描 jar 文件，并将其中的类与一组预先计算好的易受攻击类的哈希值进行比对。这些哈希值已针对 Maven Central 上的工件预先计算。 重要更新：我们扩展了 Maven Central 上受影响工件列表。该列表包含 18,816 个工件。这些工件要么将 log4j-core 声明为依赖项，要么我们在其中识别出与受影响版本的 log4j-core 相匹配的 .class 文件。 📝 运行方法 1. 在发布页面下载...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ftrace: Clean up the handling of hash operations when registers fail. The following GPF errors occur when registerftracedirect fails: General protection fault, likely due to a non-canonical address \ 0x200000000000010: 0000 1...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: virtionet: Added a check for hashkeylength. A check for hashkeylength was added in virtnetprobe to avoid possible out-of-bounds errors when setting/read the hash key...

Astra Linux - Vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow deletion from sockmap/sockhash only if an update is permitted We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a mapdelete on a...

Astra Linux – Vulnerability in python-ipaddress

The Lib/ipaddress.py module in Python up to version 3.8.3 incorrectly calculates hash values for the IPv4Interface and IPv6Interface classes. This may allow a remote attacker to cause a denial of service if an application relies on the performance of a dictionary containing IPv4Interface or...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nfconntrack: A crash occurred when attempting to remove an uninitialized entry from the hash bucket list. A crash occurred while trying to remove the conntrack entry from the hash bucket list: Exception RIP:...

HashSiphon

HashSiphon NTLM hash extraction through HTTP-layer authentication proxying, zero SSPI calls from the attacker process. HashSiphon extracts the current user's NetNTLMv2 hash by manipulating HTTP authentication flows instead of calling SSPI APIs directly. It ships two variants: v1 routes NTLM auth...

CVE-2025-24071_PoC

CVE-2025-24071PoC CVE-2025-24071: 通过RAR/ZIP提取和.library-ms文件导致的NTLM哈希泄露 当从.rar存档中提取.library-ms文件时，Windows Explorer会自动发起SMB身份验证请求，导致NTLM哈希泄露。用户无需打开或执行该文件——只需提取就足以触发泄露。 博客文章: https://cti.monster/blog/2025/03/18/CVE-2025-24071.html 用法 root@kitploit: python poc.py enter file name: your file name enter...

postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the plperl component when returning a tied hash. This allows a function owner to execute arbitrary code as the operating system user running the database by providing a specially crafted function body. This could lead ...

CVE-2024-28000-Exploit-Lab

CVE-2024-28000 — Laboratorio LiteSpeed Cache de WordPress Reproducción autorizada en laboratorio local de CVE-2024-28000 , un problema de escalada de privilegios no autenticada que afecta a versiones vulnerables del plugin LiteSpeed Cache de WordPress. Alcance: Este repositorio documenta pruebas...

PT-2026-91243

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

CVE-2023-23397

CVE-2023-23397 Exploitation & Mitigation Demo 📌 Descripción general Este proyecto demuestra la detección, explotación y mitigación de CVE-2023-23397 , una vulnerabilidad crítica de retransmisión NTLM de cero clics en Microsoft Outlook para Windows. Explotada mediante invitaciones de calendario,...

CVE-2025-50154-Aggressor-Script

LNK Weaponizer - Cobalt Strike Aggressor 脚本 一个全面的 Cobalt Strike Aggressor 脚本，用于武器化并执行恶意 LNK 文件和 Library-MS 文件，以泄露 SMB NTLMv2-SSP 哈希。包含 CVE-2025-24054 绕过技术。 ⚠️ 免责声明 此工具仅用于教育和研究目的。作者对任何滥用此代码的行为不承担任何责任。仅在你拥有或明确获准测试的系统上使用。 捕获 NTLM 哈希 该脚本生成武器化的 .lnk 和 .library-ms 文件，当打开时会触发向操作者主机的 SMB 身份验证。 泄露的 NTLMv2...