exploit_linux_kernel4.13

This repo contains an old poc that combines three CVEs CVE-2017-14954, CVE-2017-18344, CVE-2017-5123. The poc is a Local Privilege Escalation for Linux Kernel 4.13 tested on Ubuntu. The exploit uses an info leak CVE-2017-14954 to bypass KASLR, an arbitrary read CVE-2017-18344 to read the kernel...

cve-2026-23111-poc

CVE-2026-23111 For more details, see notes.md Description CVE Description from NIST An inverted logical check in nftmapcatchallactivate causes nftchain-use reference count to not be restored when a DELSET operation is aborted. This allows triggering UAF, and can be abused to obtain local privileg...

StackRot

StackRot CVE-2023-3269: Linux kernel privilege escalation vulnerability GitHub-CI-verified exploit A flaw was found in the handling of stack expansion in the Linux kernel 6.1 through 6.4, aka "Stack Rot". The maple tree, responsible for managing virtual memory areas, can undergo node replacement...

Lfi-Space

🪐 LFI-SPACE TOOL 🪐 Written by TMRSWRR Version 1.0.0 All in one tools for LFI VULN FINDER -LFI DORK FINDER Instagram: TMRSWRR 📷 Screenshots 📷 👇 💫 How to use 💫 👇...

RogueWinRM

RogueWinRM RogueWinRM is a local privilege escalation exploit that allows to escalate from a Service account with SeImpersonatePrivilege to Local System account if WinRM service is not running default on Win10 but NOT on Windows Server 2019. Briefly, it will listen for incoming connection on port...

CVE-2021-1732

CVE-2021-1732 CVE-2021-1732 Microsoft Windows 10 Local Privilege Escalation Vulnerability Research and PoC/Exploit Development Affected Systems and Application Versions Windows Server, version 20H2 Server Core Installation Windows 10 Version 20H2 for ARM64‑based Systems Windows 10 Version 20H2 fo...

Metabase_CVE-2021-41277

MetabaseCVE-2021-41277 Description Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs...

sentrysearch

SentrySearch Semantic search over video footage. Type what you're looking for, get a trimmed clip back. !IMPORTANT Official source: github.com/ssrajadh/sentrysearch is the only official home of SentrySearch. Other sites republishing or mirroring this project are not affiliated with or endorsed by...

CVE-2021-4034

CVE-2021-4034 PolKit Local Privilege Escalation Analysis toc Vulnerability Overview Vulnerability ID: CVE-2021-4034 Vulnerability Score: Affected Product: linux PolKit pkexec Affected Versions: Versions from 2009 to present current 0.105 Reference http://its.dlut.edu.cn/info/1054/78309.htm Exploi...

DirtySlide

DirtySlide Unprivileged → root macOS LPE. An 8-byte OOB read/write into kernel memory adjacent to a dyld shared-cache page, from a missing in-page bounds check in the v5 slide walk vmsharedregionslidepagev5, reachable via syscall 536. Patched in macOS 26.5.2 25F84, xnu-12377.121.10. Vulnerable...

CVE-2020-13884

Exploit Title: Citrix Workspace app before 1912 for Windows - Privilege Escalation 2 Date: 2020-06-07 Author: Andrew Hess Software Link: https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-windows/workspace-app-for-windows-1911.html/ Bulletin:...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for : a Linux kernel local privilege escalation that chains an with to overwrite the page cache of a SUID-root binary...

OA-tongda-RCE

OA-tongda-RCE | Office Anywhere Web-based Intelligent Office System Backend Getshell No Authentication Required 1. Arbitrary file upload vulnerability /ispirit/im/upload.php 2. Local file inclusion vulnerability /ispirit/interface/gateway.php Command Execution Bypass: root@kitploit: exec"cmd /c...

nibble

Nibble is a CLI tool for local network scanning that focuses on speed and ease of use. Select a network interface, and it scans your local subnet. Lists hosts, hardware manufacturer, open ports and their services. ⚡ Lightning fast, scans using lightweight threads 🔒 Safe, does not need admin acces...

LFI-aiohttp-CVE-2024-23334-PoC

LFI-aiohttp-CVE-2024-23334-PoC A Bash script to automate Local File Inclusion LFI attacks on vulnerable aiohttp servers, specifically targeting CVE-2024-23334. This exploit allows for unauthorized access to arbitrary files on systems running affected versions of aiohttp with improperly configured...

explain-my-curl

explain-my-curl explain-my-curl is a local-first CLI for understanding what a curl command is doing across DNS, TLS, and HTTP. This repository currently includes: A CLI command to parse and explain a curl input A starter TUI for interactive exploration Execution telemetry for DNS, TCP connect, TL...

CVE-2018-8120

CVE-2018-8120 CVE-2018-8120 Windows LPE exploit Tested support: Win7 x32, Win7 x64, Win2008 x32, Win2008 R2 x32, Win2008 R2 Datacenter x64, Win2008 Enterprise x64 WinXP x32, Win2003 x32, Win2003 x64 The original exp does not support xp, 2003. This code adds support for these two systems based on...

bore

bore A modern, simple TCP tunnel in Rust that exposes local ports to a remote server, bypassing standard NAT connection firewalls. That's all it does: no more, and no less. root@kitploit: Installation requires Rust, see alternatives below cargo install bore-cli On your local machine bore local 80...

LFI-to-RCE-SE-Suite-2.0

Remote Code Execution in SoftExpert Excellence Suite 2.0 - CVE-2023-30330 Authenticated Local File Inclusion to Remote Code Execution on SoftExpert Excellence Suite EQM. CVE-2023-30330 SE Suite 2.x versions before 2.1.3 Tested on versions: 2.0.15.31 and 2.0.15.115 LFI PoC...

cve-search

cve-search cve-search is a tool to import CVE Common Vulnerabilities and Exposures and CPE Common Platform Enumeration into a MongoDB to facilitate search and processing of CVEs. The main objective of the software is to avoid doing direct and public lookups into the public CVE databases. Local...