exploits

الاستغلالات كود استغلالات متنوع من نوع إثبات المفهوم PoC كُتب في Xiphos Research لأغراض الاختبار. الاستغلالات الحالية قد يكون الفهرس غير محدّث phpMoAdmin Remote Code Execution CVE-2015-2208 LotusCMS Remote Code Execution OSVDB-75095 ElasticSearch Remote Code Execution CVE-2015-1427 ShellShock htt...

CVE-2023-6875

Ce que fait l'exploit Place un jeton qui vous permet de consulter les e-mails. Recherche le nom d'utilisateur de l'admin ; s'il ne le trouve pas, définit "admin" par défaut. Demande un lien pour réinitialiser le mot de passe de l'admin, qui est envoyé par e-mail à l'admin. Utilise le jeton placé ...

CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 Téléchargement automatique de shell WordPress Royal Elementor 1.3.78 Téléchargement de shell...

CVE-2024-10793

CVE-2024-10793 PoC أضف هذه الأسطر إلى ملف hosts الخاص بك: root@kitploit: 127.0.0.1 goodcms.lab 127.0.0.1 attacker.com قم بتشغيل WordPress باستخدام docker: root@kitploit: $ sudo systemctl start docker $ sudo docker-compose up -d افتح http://goodcms.lab:2121 ونفّذ خطوات تثبيت WordPress. ثبّت...

CVE-2024-37085

CVE-2024-37085 Nicht authentifizierter Shell-Upload zu vollständigem Administrator auf domänengebundenen esxi-Hypervisoren. Herunterladen ESXIVORTEX Details: eine Authentifizierungsumgehung, die zu einem Shell-Upload im Kontext von vpxuser führt, was zu vollständiger Administratorberechtigung auf...

CVE-2022-31814

pfBlockerNG = 2.1.426 Неавторизованный RCE Этот скрипт является эксплойтом для проверки концепции для pfBlockerNG = 2.1.426, который позволяет выполнять удаленный код. Он принимает один целевой URL или список URL, загружает оболочку, выполняет команду, а затем удаляет оболочку. Требования Этот...

CVE-2017-10271

संक्षिप्त विवरण कमांड निष्पादन और प्रतिध्वनि सीधे शेल अपलोड करें लिनक्स पर वेबलॉजिक 10.3.6.0 के साथ परीक्षण सफल उपयोग विधि python weblogicwlswsatexp.py -t 172.16.80.131:7001 root@kitploit: usage: weblogicwlswsatexp.py -h -t TARGET -c CMD -o OUTPUT -s SHELL optional arguments: -h, --help show this...

Prestashop-CVE-2024-34716

Script de Exploração para Ataque CSRF e Reverse Shell Este script automatiza um exploit de CSRF Cross-Site Request Forgery para enviar um reverse shell PHP para o servidor web do alvo e executá-lo. O reverse shell é entregue como um arquivo ZIP através de um payload CSRF elaborado, que é acionado...

CVE-2022-41544

CVE-2022-41544 Script di Exploit Questo repository contiene uno script per sfruttare la vulnerabilità CVE-2022-41544 in GetSimple CMS. Lo script esegue diversi passaggi per verificare la presenza di vulnerabilità, divulgare le chiavi API, impostare i cookie, ottenere i token CSRF, caricare una...

Worpress-CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 Auto Shell Upload WordPress Royal Elementor 1.3.78 Shell Upload Visita https://phankz.com...

CVE-2023-26469

CVE-2023-26469 REC PoC Questo repository contiene uno script di exploit per CVE-2023-26469, che consente a un attaccante di sfruttare il path traversal per accedere ai file ed eseguire codice su un server che esegue Jorani 1.0.0. Inoltre, lo script include la funzionalità di upload di shell per...

RCE

CVE-2022-31814 Bug di WebApp root@kitploit: import argparse import requests import time import sys import urllib.parse from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning parser =...

CVE-2023-45878

CVE-2023-45878 Escrevi este script baseado no trabalho de https://herolab.usd.de/security-advisories/usd-2023-0025/ . O exploit funciona usando uma exploração de Gravação Arbitrária de Arquivos no Gibbon LMS 25.0.1. Este PoC fará upload de um script php cmd simples e, em seguida, o usará para...

WPForce

WPForce - Suite di attacco per Wordpress DESCRIZIONE: WPForce è una suite di strumenti di attacco per Wordpress. Attualmente contiene 2 script: WPForce, che esegue brute force sui login tramite API, e Yertle, che carica shell una volta trovate le credenziali di admin. Yertle contiene anche vari...

CVE-2023-5360

CVE-2023-5360 Un EXPLOIT open-source per Il plugin WordPress The Royal Elementor Addons and Templates precedente alla versione 1.3.79 non valida correttamente i file caricati, il che potrebbe consentire a utenti non autenticati di caricare file arbitrari, come PHP, e ottenere RCE. Indice...

CVE-2024-6132

CVE-2024-6132 Pexels: Free Stock Photos = 1.2.2 - Upload Arbitrario di File Autenticato Contributor+ Utilizzo root@kitploit: usage: CVE-2024-6132.py -h -u URL -un USERNAME -p PASSWORD -shellurl SHELLURL Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload | BY...

pwnacle-fusion

pwnacle-fusion Automatisierter Exploit für Oracle Reports, CVE-2012-3153 / CVE-2012-3152 Credits an @misssudo für die Veröffentlichung Verwendung: ./pwnacle.rb targeturl payloadurl Dieser Exploit nutzt beide CVEs aus, um eine .jsp-Shell von Ihrer payloadurl hochzuladen, die dann unter...

CVE-2019-9978

Social Warfare Plugin Wordpress 3.5.2 रिमोट कोड निष्पादन Wordpress Social Warfare रिमोट कोड निष्पादन स्वतः शेल अपलोड दिनांक: मार्च, 2019 डाउनलोड लिंक: https://wordpress.org/plugins/social-warfare/ संदर्भ: https://wpvulndb.com/vulnerabilities/9259 संस्करण: CVE: 2019-9978 उपयोग: python script.py...

Wp_Adning_Advertising_Shell_Upload

WpAdningAdvertisingShellUpload python 2.7...

CVE-2018-15961

CVE-2018-15961 - RCE no Adobe ColdFusion Este repositório contém o código do meu exploit para a vulnerabilidade RCE no Adobe ColdFusion 2021. Descrição do Exploit O exploit envia uma requisição POST contendo um reverse shell JSP para /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm...