RogueWinRM

RogueWinRM RogueWinRM 是一个本地权限提升漏洞利用工具，允许从服务账户（具有 SeImpersonatePrivilege 权限）提升到本地系统账户，前提是 WinRM 服务未运行（Win10 默认未运行，但 Windows Server 2019 并非如此 ）。 简而言之，它会在 5985 端口监听传入连接，伪装成一个真正的 WinRM 服务。 它仅是一个最小的 Web 服务器，会尝试与任何试图连接该端口的服务协商 NTLM 身份验证。 然后，BITS 服务（以 Local System...

CVE-2023-29343

CVE-2023-29343 This is PoC for arbitrary file write bug in Sysmon version 14.14 After last patch Sysmon would check if Archive directory exists and if it exists it would check if archive directory is owned by NT AUTHORITY\SYSTEM and access is only granted to NT AUTHORITY\SYSTEM. If both condition...

CVE-2019-13272-Local-Privilege-Escalation

This repository does not have a README...

CVE-2023-4911

CVE-2023-4911 - Looney Tunables This is a atm very rough proof of concept for CVE-2023-4911. So far I've only verified it works on Ubuntu 22.10 kinetic. Current version of the exploit contains a fair amount of "magic" offsets. If you have suggestions on how to improve the heap shaping, feel free ...

windows-smb-vulnerability-framework-cve-2025-33073

Windows SMB 客户端漏洞研究框架 作者： cyberseallll 创建时间： 2025 概述 我开发了这个研究框架，用于分析和理解 CVE-2025-33073，这是一个严重的 Windows SMB 客户端权限提升漏洞。该实现为漏洞研究和受控测试环境提供了全面的工具。 漏洞详情 CVE-2025-33073 是一个可通过网络访问的权限提升漏洞，影响 Windows SMB 客户端实现。该漏洞源于 SMB 协议栈中不正确的访问控制机制。 技术规格 CVSS 评分 ：8.8（高危） 漏洞类型 ：CWE-284（访问控制不当） 攻击向量 ：网络 影响 ：权限提升 用户交互 ：无...

CVE-2021-24356

CVE-2021-24356 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - 購読者 + 任意のプラグインインストール 説明 プラグインのAJAXアクションに対する機能チェックの欠如と不十分なnonceチェックにより、認証されたユーザーが脆弱なサイトに任意のプラグインをインストールできるようになりました。 使用方法 root@kitploit: $ python3 CVE-2021-24356.py --url http://wordpress.lan --username user --password useruser1...

CVE-2022-0847-DirtyPipe-Exploits

CVE-2022-0847-DirtyPipe-Exploits This repository offers a comprehensive collection of exploits and documentation specifically designed for penetration testers and red team professionals. It serves as a valuable resource for those aiming to exploit the Linux Dirty Pipe vulnerability effectively...

copyfail

CVE-2026-31431 — “Copy Fail” 安全检测脚本 一个针对 Copy Fail Linux 内核本地权限提升漏洞的只读检测脚本。 不含漏洞利用代码。不打开 AFALG 套接字。除 /etc/modprobe.d 外不写入任何文件（仅当您手动应用缓解措施时）。 背景 Copy Fail （CVE-2026-31431）是 Linux 内核 algifaead 模块中的一个逻辑缺陷——该模块属于 AFALG 用户空间加密 API。该漏洞由 Theori / Xint Code 于 2026 年 4 月 29 日 披露。 一个 732 字节的 Python...

CVE-2018-18387

CVE-2018-18387 playSMS = 1.4.2 - Privilege escalation TMHC TEAM found a vulnerability that lead to a priviledge escalation through playSMS/web/init.php that can lead to a complete system compromise. The attacker need to get access on the box where playSMS is installed and be able to edit playSMS...

CVE-2023-36874_BOF

CVE-2023-36874 Windows Error Reporting LPE BOF Introduction This is a mature and operational CobaltStrike BOF implementation of Filip Dragovic's @filipdragovic CVE-2023-36874 Windows Error Reporting LPE exploit. He did the heavy lifting in terms of creating a working exploit by reversing the...

powerob

Powerob An on-the-fly Powershell script obfuscator meant for red team engagements. Built out of necessity. This only obfuscates functions and removes found in PowerShell scripts. Roadmap includes bfuscating variables. Pull requests and collaborative welcomed. About This was built out of the need ...

BackupOperatorToolkit

BackupOperatorToolkit Usage The BackupOperatorToolkit BOT has 4 different mode that allows you to escalate from Backup Operator to Domain Admin. Use "runas.exe /netonly /user:domain.dk\backupoperator powershell.exe" before running the tool. Service Mode The SERVICE mode creates a service on the...

traitor

Traitor Automatically exploit low-hanging fruit to pop a root shell. Linux privilege escalation made easy! Traitor packages up a bunch of methods to exploit local misconfigurations and vulnerabilities in order to pop a root shell: Nearly all of GTFOBins Writeable docker.sock CVE-2022-0847 Dirty...

traitor

Traitor Explota automáticamente objetivos fáciles para obtener una shell root. ¡Escalada de privilegios en Linux hecha fácil! Traitor agrupa un montón de métodos para explotar malas configuraciones y vulnerabilidades locales con el fin de obtener una shell root: Casi todos los GTFOBins docker.soc...

CVE-2026-31431-poc

Copy Fail 命令 PoC 包装器 一个针对 Copy Fail / CVE-2026-31431 的小型修改版概念验证包装器，允许从终端传入自定义命令，而不是始终启动交互式 root shell，以便在非交互式环境（如 Web shell）中运行。 本项目基于公开的 Copy Fail 研究和 PoC。 ⚠️ 免责声明 本仓库仅用于教育、研究和防御性验证目的 。 只能在您拥有或获得明确测试许可的系统上运行此代码。 此 PoC 可能会破坏目标二进制文件（如 /usr/bin/su）的内存页缓存。 请勿 在生产系统上运行此代码。 背景 Copy Fail ，编号为...

CVE-2024-28000

CVE-2024-28000 PoC This repository contains tools for exploiting the CVE-2024-28000 vulnerability affecting WordPress sites using the LiteSpeed Cache plugin. The included scripts automate the detection of exposed debug.log files and the exploitation of a privilege escalation vulnerability that...

Android-Privilege-Escalation-Remote-Access-Vulnerability-CVE-2015-1805

Android-Privilege-Escalation-Remote-Access-Vulnerability-CVE-2015-1805 inject a root exploit as a silent installation to perform a malicious task on the device. Vulnerability AndroRAT does not focus on targeting a specific user but rather works to acquire the confidence of the entire network...

SkyArk

SkyArk is a cloud security project with two main scanning modules: 1. AzureStealth - Scans Azure environments 2. AWStealth - Scan AWS environments These two scanning modules will discover the most privileged entities in the target AWS and Azure. The Main Goal - Discover The Most Privileged Cloud...

copy-fail-fix

copy-fail-fix 针对 CVE-2026-31431（“Copy Fail”） 的各发行版缓解脚本——这是一个影响 Linux 内核 algifaead 的本地权限提升漏洞，几乎影响自 2017 年以来发布的所有发行版。 每个脚本要么从发行版软件仓库安装已修补的内核（如果可用），要么在不可用时将存在漏洞的 algifaead 内核模块加入黑名单，从而在您重启到已修复内核之前关闭漏洞利用路径。 快速上手 为您的发行版选择对应脚本，审计后以 root 身份运行。 root@kitploit: Ubuntu sudo bash scripts/ubuntu.sh Debian sud...

container-cve-2021-22555

Reproducer for CVE-2021-22555 as a container First, this rolls in the exploit code from here as a handy pre-built container: https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555 Pre-built container: quay.io/cgwalters/cve-2021-22555 Mitigation: seccomp profiles A stron...