gcp_scanner

Disclaimer This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose. GCP Scanner This is a GCP resource scanner that can help determine what level of acces...

7zip-CVE-2025-11001

Usage: root@kitploit: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe Exploiting 7-zip The vulnerability is only exploitable on windows and has one major caveat.The bug can only be exploited when 7-Zip is ran with Admin privileges for this vulnerability to be...

peirates

Peirates ¿Qué es Peirates? Peirates, una herramienta de penetración para Kubernetes, permite a un atacante escalar privilegios y moverse lateralmente a través de un clúster de Kubernetes. Automatiza técnicas conocidas para robar y recopilar tokens de cuentas de servicio, secretos, obtener ejecuci...

patchy

Patchy Automated lateral movement and persistence by abusing GCP OS patch management based on my blog post. Patchy is made up of two main modes, lateral movement, and persistence. Persistence uses valid service account credentials to create a patch job or deployment. Lateral movement attempts to...

juicy-potato

Juicy Potato abusando de los privilegios dorados Una versión azucarada deRottenPotatoNG, con un poco de jugo, es decir, otra herramienta de Elevación de Privilegios Local, desde una Cuenta de Servicio de Windows a NT AUTHORITY\SYSTEM Resumen RottenPotatoNG y sus variantes aprovechan la cadena de...

CVE-2025-11001

Usage: root@kitploit: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe Exploiting 7-zip The vulnerability is only exploitable on windows and has one major caveat.The bug can only be exploited when 7-Zip is ran with Admin privileges for this vulnerability to be...

pytmipe

PYTMIPE & TMIPE PYTMIPE PYthon library for Token Manipulation and Impersonation for Privilege Escalation is a Python 3 library for manipulating Windows tokens and managing impersonations in order to gain more privileges on Windows. TMIPE is the python 3 client which uses the pytmipe library...

S4UTomato

S4UTomato Escalate Service Account To LocalSystem via Kerberos. Traditional Potatoes Friends familiar with the "Potato" series of privilege escalation should know that it can elevate service account privileges to local system privileges. The early exploitation techniques of "Potato" are almost...

gcp_scanner

Descargo de responsabilidad Este proyecto no es un proyecto oficial de Google. No cuenta con el respaldo de Google y Google específicamente renuncia a todas las garantías sobre su calidad, comerciabilidad o idoneidad para un propósito particular. GCP Scanner Este es un escáner de recursos de GCP...

cve-2024-7646

CVE-2024-7646 Description In default, nginx.ingress.kubernetes.io/server-snippet is disabled, but due to this cve, nginx.ingress.kubernetes.io/auth-tls-verify-client can still insert custom snippets, or even lua code can be included. Fixed version ingress-nginx controller v1.11.2 - fixed by...

CVE-2022-3294

Exploit Reference: https://github.com/kubernetes/kubernetes/issues/113757 https://github.com/kubernetes/kubernetes/issues/119640 https://github.com/kubernetes/sig-security/blob/main/sig-security-external-audit/security-audit-2021-2022/findings/Kubernetes%20v1.24%20Final%20Report.pdf Enumeration: ...

RFCpwn

RFCpwn An SAP enumeration and exploitation toolkit using SAP RFC calls Twitter: @icryo This is a toolkit for demonstrating the impact of compromised service accounts. This PoC is not for use in production environments, no guarantee of stability or support. RFCpwn relies on the pyrfc and the...

CVE-2026-85983

CVE-2026-85983 is a local privilege escalation in the Auth0 AD/LDAP Connector . The connector improperly processes a configuration value during service startup, allowing a low-privileged user on the host to modify the connector's configuration. Upon service restart, the altered configuration can ...

CVE-2025-11001

Usage: root@kitploit: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe Exploiting 7-zip The vulnerability is only exploitable on windows and has one major caveat.The bug can only be exploited when 7-Zip is ran with Admin privileges for this vulnerability to be...

CVE-2024-36539

Here’s a README.md for a Proof of Concept PoC demonstrating the insecure permissions vulnerability in Contour v1.28.3: Proof of Concept PoC for Insecure Permissions Vulnerability in Contour v1.28.3 This repository contains a Proof of Concept PoC script demonstrating an insecure permissions...

JuicyPotatoNG

JuicyPotatoNG Just another Windows Local Privilege Escalation from Service Account to System. Full details at -- https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/ Usage root@kitploit: JuicyPotatoNG by decoderit & splintercode Mandatory args: -t createprocess call:...

WordPress Search Atlas SEO plugin < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion vulnerability

Subscriber+ Google Service Account Credential Overwrite/Deletion vulnerability discovered by Shivamani Vastrala in WordPress Plugin Search Atlas SEO versions 2.6.24...

CVE-2026-15247 Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

StopDefender

StopDefender Stop Windows Defender programmatically creating a new token using TrustedInstaller and Windefend service accounts. One button stop action, no need for supply commandline options nor pid. Usefull for integration with Post Explotation frameworks. Blogpost...

cve-2026-46391

CVE-2026-46391 - Credential Exposure via SSRF in @haxtheweb/open-apis Proof of concept for CVE-2026-46391. Triggers the SSRF vulnerability in the cacheAddress endpoint of @haxtheweb/open-apis and captures the service account credentials sent in the callback. Build root@kitploit: go build -o...