crowbar

Crowbar - Herramienta de fuerza bruta ¿Qué es Crowbar? Crowbar anteriormente conocido como Levye es una herramienta de fuerza bruta que se puede utilizar durante pruebas de penetración. Fue desarrollada para forzar algunos protocolos de una manera diferente a otras herramientas populares de fuerz...

GrafXploit

Herramienta automatizada de explotación para Grafana CVE-2021-43798 Descripción general Este proyecto es una herramienta de explotación automatizada diseñada para escanear y extraer información sensible de instancias de Grafana comprometidas y vulnerables a CVE-2021-43798. La herramienta identifi...

CVE-2021-43798

CVE-2021-43798 Directory Traversal and Arbitrary File Read on Grafana Authors: Wagner Alves - Red Team Analyst This exploit leverages Directory Traversal and Arbitrary File Read vulnerabilities in Grafana 8.0 - 8.3, allowing it to read files such as /etc/passwd, /etc/hosts, /home/user/.ssh/idrsa,...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 Tested against VMware VCSA 6.7 create ssh keypair ssh-keygen -t rsa -f vcsa.key -N '' create tarbal with ../../../../../home/vsphere-ui/.ssh/authorizedkeys python2 evilarc.py -d 5 -p 'home/vsphere-ui/.ssh' -o unix -f evil.tar authorizedkeys mv evil.tar evil.ova uploa...

LabAutomationCVE-2021-43798

LabAutomationCVE-2021-43798 I make a script for pentest automation where i exploit CVE-2021-43798 a path traversal on Grafana to steal user secrets SSH key and then gain privileges on a Linux system using SUID. I automate this lab to share the pentest methodology...

CVE-2026-20182

CVE-2026-20182 — Cisco Catalyst SD-WAN Controller / Manager Authentication Bypass A proof-of-concept exploit for CVE-2026-20182 , a critical CVSS 10.0 authentication bypass in the vdaemon DTLS service UDP/12346 on Cisco Catalyst SD-WAN Controller vSmart and Manager vManage. Disclosed: May 14, 202...

CVE-2024-21626-demo

CVE-2024-21626-demo Demo for the LT at Container Runtime Meetup 5. This is to raise awareness of the attack risk based on publicly known information, and misuse is strictly prohibited. Slides Container Runtime Meetup 5 - Can You Really Trust That Image? Taking Host Root with CVE-2024-21626 Loggin...

CVE-2024-46987

CVE-2024-46987 Exploit - Camaleon CMS Path Traversal This tool exploits a Path Traversal vulnerability in Camaleon CMS CVE-2024-46987. It allows for arbitrary file download and includes an automated feature to attempt to retrieve SSH keys from users discovered on the system. Features Arbitrary Fi...

CVE-2015-3306

CVE-2015-3306 This contains single-file exploit for ProFTPd 1.3.5 modcopy CVE-2015-3306 vulnerability, especially for TryHackMe Kenobi Lab. Vulnerability Description CVE-2015-3306 is a vulnerability found in ProFTPd 1.3.5 due to a flaw in the modcopy module, which is responsible for enabling FTP...

CVE-2024-415770-ssrf-rce

CVE-2024-415770-SSRF-RCE Description This script is designed to interact with the teamserver. Update the script with your teamserver URL. It performs several steps to register an agent, open a socket, and inject an SSH key into the target's authorized keys. Prerequisites Python 3.x Required Pytho...

CVE-2022-40684

Description Exploit for CVE-2022-40684 authentication bypass vulnerability affecting FortiOS, FortiProxy and FortiSwitchManager appliances. Disclaimer This tool is intended for demonstration purposes, only use against systems where you have explicit authorization. Project maintainer is not...

Grafxploit

Automated Exploit Tool for Grafana CVE-2021-43798 Overview This project is an automated exploit tool designed to scan for and extract sensitive information from compromised Grafana instances vulnerable to CVE-2021-43798. The tool identifies vulnerable plugins and extracts SSH keys from compromise...

CVE-2022-40684

CVE-2022-40684 POC for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager appliances. Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog:...

CVE-2023-34039

CVE-2023-34039 POC for CVE-2023-34039 VMWare Aria Operations for Networks vRealize Network Insight Static SSH key RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039/ Summary VMWa...

CVE-2022-40684

CVE-2022-40684 CVSS score: 9.6 POC for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager appliances. Vulnerable Products FortiOS versions between 7.0.0 – 7.0.6 and 7.2.0 – 7.2.1 FortiProxy versions between 7.0.0 – 7.0.6 and version 7.2.0 FortiSwitchManager versions 7.0...

CVE-2026-102821

A flaw was found in russh. An authenticated remote attacker can cause a Denial of Service DoS by initiating a Secure Shell SSH key renegotiation without completing it and flooding the server with channel open requests. Because the server continues buffering incoming requests without draining the...

CVE-2026-82928 Undocumented access path in mH-DEVELOPER

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

EUVD-2026-87686

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100713

Froxlor versions 2.3.10 and earlier are vulnerable to a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php ). The flaw exists because symlink validation occurs only at check time, while the filesystem path is re-resolved as r...