SMBCompScan

SMBCompScan Scanner script to identify hosts vulnerable to CVE-2020-0796 Advisory Disclaimer This script can help to identify machines with the SMBv3 vulnerablity by checking for enabled compression. Still, it might return "vulnerable" for machines which have KB4551762 installed. Requirements Per...

THM-Vulnerability_Capstone-CVE-2018-16763

THM-VulnerabilityCapstone-CVE-2018-16763 A write up on the THM room Vulnerability Capstone & Exploit script for CVE-2018-16763. CREDITS I do not take credit for the discovery of this vulnerability. Thank you to the following people. Vulnerability Discovery: 0xd0ff9 TryHackMe Room & Author:...

ets5-password-recovery

ETS5 Password Recovery Tool Table of Contents Introduction Installation Requirements How does the password recovery work? How was the design flaw discovered? How can the risk be mitigated? Coordinated Vulnerability Disclosure License Change log Introduction Have you forgotten the password to one ...

Malicious code in 0nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54eee258f343282c30f3efc6b5effc8aac283b7b02421433c14dee3e14f27aa3 Package name 0nestjs targets developers mistyping nestjs. On npm install, the postinstall hook node index.js executes automatically and performs two...

MAL-2026-15908 Malicious code in 0nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54eee258f343282c30f3efc6b5effc8aac283b7b02421433c14dee3e14f27aa3 Package name 0nestjs targets developers mistyping nestjs. On npm install, the postinstall hook node index.js executes automatically and performs two...

externalip-webhook

externalip-webhook created to address CVE-2020-8554 Note: This chart is deprecated for kubernetes version 1.21 and unsupported starting with 1.22. To mitigate CVE-2020-8554, enable the DenyServiceExternalIPs admission controller on the cluster. externalip-webhook, is a validating webhook which...

CVE-2022-46169

CVE-2022-46169 This repository contains a Proof of Concept PoC for CVE-2022-46169 - Unauthenticated RCE on Cacti = 1.2.22 by chaining an Authentication Bypass and a Command Injection, described by Sonar in this blog post. The same vulnerabilities were also discovered by: Steven Seeley mrme of...

puppetlabs-cve20113872

CVE-2011-3872 Remediation Toolkit This module will help you permanently remediate the CVE-2011-3872 AltNames vulnerability. Usage Guides Please see the detailed usage guides at: README-detailed.markdown for remediating your site with Puppet README-ssh-only.markdown For remediating your site with...

CVE-2024-38077

CVE-2024-38077-EXP 基于伪代码后修复的代码。 有效范围 EXP：Windows Server 2025 POC：08-25 使用 root@kitploit: options: -h, --help show this help message and exit --targetip TARGETIP Target IP, eg: 192.168.120.1 --evilip EVILIP Evil IP, eg: 192.168.120.2 --evildllpath EVILDLLPATH Evil dll path, eg: \smb\evildll.dll...

CVE-2023-25610

CVE-2023-25610 FortiOS 管理界面中的堆内存下溢导致远程代码执行。 范围和限制 1. Fortinet 6.x 2. 基于 TLSv1.3，在其他 TLS 版本上可能存在差异 用法 python3 cve-2022-42475.py rhost rport lhost 'command' root@kitploit: python3 CVE-2023-25610.py 192.168.10.1 8443 10.10.1.1 'ls -la /' Listener EXP 使用 python 命令在端口 31337 上设置反弹 shell root@kitploit: ...

THM-Steel_Mountain-CVE-2014-6287

THM-SteelMountain-CVE-2014-6287 A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287 Credits I take no credit for the original discovery and exploitation of this vulnerability. Thank you to the following people! Discovery: Daniele Linguaglossa Metasploit Module...

07-Web-Application-Security

Cybersecurity Home Lab - Lab 7: Web Application Security O...

CVE-2023-4911

CVE-2023-4911-Looney-Tunables Looney Tunables 本地权限提升 CVE-2023-4911 演练（仅供教育用途） Links: IPPSEC 视频 Qualsys 博客文章 Qualsys 技术细节 漏洞利用 POC Python 脚本 GLIBC 源码 GLIBC tunables 文档 描述 什么是 ld.so？ 在计算机领域，动态链接器是操作系统的一部分，它在可执行文件执行时加载和链接 所需的共享库，通过将库的内容从持久存储复制到 RAM，填充跳转表并重定位指针。 例如，我们有一个程序使用 openssl 库来计算 md5 哈希： $ he...

CVE-2020-17530

CVE-2020-17530 Quick POC for CVE-2020-17530. In Apache Struts versions 2.0.0 - 2.5.25 a forced Object Graph Navigational Language OGNL evaluation on raw user input in tag attributes may lead to remote code execution RCE. root@kitploit: $ python CVE-2020-17530.py --help usage: CVE-2020-17530.py -h...

CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass

CVE-2019-6340 / SA-CORE-2019-003 Three scripts included to demonstrate how Drupal 8.6.9 is vulnerable to CVE-2019-6340: createnodeviarest.py - Example of normal authenticated node create with REST API doesnotcorrespond.py - Proving the request is processed even without authentication exploit.py -...

CVE-2019-16759

CVE-2019-16759 vBulletin 5.0 5.5.4 - 'widgetphp ' Unauthenticated Remote Code Execution Interactive-Like Command-Line Console for CVE-2019-16759 Usage: root@kitploit: python3 exploit.py Enter the Site with Http/Https and Get the Shell :p...

SecGen

tomcat 目次 1. 概要 2. モジュールの説明 - モジュールの機能と役立つ理由 3. セットアップ - tomcat導入の基本 セットアップ要件 tomcatを開始する 4. 使用方法 - 設定オプションとその他の機能 複数のバージョン、複数インスタンスのtomcatを実行したい WARファイルをデプロイしたい 構成の一部を削除したい 既存のConnectorまたはRealmを管理したい 5. リファレンス - モジュールの内部で何がどのように行われているかのぞいてみよう クラス 定義タイプ パラメータ tomcat...

CVE-2025-54424

CVE-2025-54424 CVE-2025-54424：1Panel 客户端证书绕过RCE漏洞 一体化工具 扫描+利用 漏洞简介 1Panel 是一个开源、现代化的 Linux 运维管理面板，提供图形化界面用于部署网站、管理服务器和运行服务。 受影响版本中，Agent 端 TLS 认证策略为 tls.RequireAnyClientCert，仅要求提供证书但不验证其可信性。攻击者可通过自签名证书绕过 TLS 校验，并伪造CN字段为panelclient，绕过应用层校验。最终攻击者可伪造证书进行未授权命令执行接口调用，导致远程命令执行漏洞。 影响版本...

CVE-2026-85451

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

CVE-2026-85439

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...