AzureADAssessment

Microsoft Azure AD 评估 评估人员指南 如果你是执行客户评估的 Microsoft 员工或合作伙伴，请参阅 Wiki 中的评估指南。 从 PowerShell 库安装 如果遇到任何错误，请参阅本文档末尾的常见问题解答部分。 root@kitploit: Install-Module AzureADAssessment -Force -Scope CurrentUser If you have already installed the module, run the following instead to ensure you have the latest...

MemProcFS v5.18

MemProcFS: MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system. Easy trivial point and click memory analysis without the need for complicated commandline arguments! Access memory content and artifacts via files in a mounted virtual file system or v...

cq

cq Code Query, a universal code security scanning tool. CQ scans code for security vulnerabilities and other items of interest to security-focussed code reviewers. It outputs text files containing references to issues found, into an output directory. These output files can then be reviewed,...

cve-2023-5044

CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept This is a quick Go program to exploit the recent CVE in the Ingress Nginx controller. Details on how to do this are already out there via Rory McCune's blog at https://raesene.github.io/blog/2023/10/29/exploiting-CVE-2023-5044/, this just...

LiveCTF-DEFCON30

LiveCTF 2022 本仓库用于存储 DEF CON CTF 决赛 LiveCTF 活动的挑战、基础设施说明、直播配置以及其他受版本控制的信息。 LiveCTF 中使用的挑战 | 挑战名称| 参赛队伍| 胜者 ---|---|---|--- 十六强赛: 1| syscall-me-maybe| Shellphish vs PTBWTL| Shellphish 十六强赛: 2| open-to-interpretation| StarBugs vs ./V /home/r/.bin/tw| StarBugs 十六强赛: 3| nopcoding| OSUSEC vs Maple...

CVE-2020-27838

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install CVE-2020-27838 Run bellow command to check CVE-2020-27838 -h Configurations 2. We integrated with the Telegram A...

NegoExRelay

Negoexrelayx - Negoex 中继工具 用于滥用 Kerberos PKU2U 和 NegoEx 的工具包。 需要 impacket 建议直接从 git 安装 impacket，以获取最新版本。 negoexrelayx.py 该工具允许你将 NegoEx（带 PKU2U）认证中继到其他计算机，并在不知道凭据的情况下完成认证，类似于 Ntlmrelayx。 root@kitploit: NegoEx relay tool. By @rubinmor Main options: -h, --help show this help message and exit -ts Ad...

OverlayFS-PrivEsc-CVE-2022-0944

CVE-2022-0944: Privilege Escalation Vulnerability in OverlayFS 🛡️ Security advisory and mitigation guide for the Linux kernel privilege escalation vulnerability in OverlayFS. 📜 Overview CVE-2022-0944 is a security vulnerability in the Linux kernel's OverlayFS subsystem that allows local attackers...

hashr

HashR：生成你自己的哈希集合 目录 HashR：生成你自己的哈希集合 目录 关于 要求 构建 HashR 二进制并运行测试 设置 HashR 使用 docker 运行 HashR 操作系统配置与所需第三方工具 为处理任务设置存储 设置 PostgreSQL 存储 设置 Cloud Spanner 设置导入器 GCP（谷歌云平台） AWS（亚马逊云服务） GCR（谷歌容器镜像仓库） Windows WSUS TarGz Deb RPM Zip（以及类似 zip 的格式） ISO 9660 设置导出器 设置 Postgres 导出器 设置 GCP 导出器 附加标志 关于 HashR...

majordomo-CVE-2026-27174-poc

majordomo-CVE-2026-27174-poc 这是一个概念验证（PoC），利用 MajorDomo（Major Domestic Module）管理面板的 PHP 控制台功能，实现未经身份验证的远程代码执行。 漏洞 MajorDoMo 的管理面板通过 /admin.php 暴露了一个 PHP 求值控制台。由于 panel.class.php 在身份验证重定向后缺少 exit，AJAX 处理器 incpanelajax.php 会被无条件包含——使得任何未经身份验证的 HTTP 请求都能触达其 eval。 攻击者只需一个 GET 请求即可执行任意 PHP...

Elevator

Descripción Elevator permite omitir la UAC y lanzar un proceso elevado con privilegios de administrador completos. Esto se logra abusando del comportamiento del servidor RPC que implementa la funcionalidad de UAC, como demostró James Forshaw en su artículo Llamando a servidores RPC locales de...

pyrmax

pyrmax 用于 Ubiquiti AirMAX 线协议帧的解码器和编码器，涵盖 AC（WA 固件）和 M（XW/XM 固件）系列。 解码 ：明文外部头由 ksy/ 下的 Kaitai Struct 模式驱动。AC 载荷 （按版本门控，依据 msgtype 切换，带 deauth XOR 去掩码）由 ac.py 手写实现——该逻辑不适合纯解析式 Kaitai。 编码 ：手写实现，与解码路径逐字段对应。 Status Variant| Decode| Encode| pcap iteration ---|---|---|--- AC| ✅ 全部 5 种 msg 类型（beacon、ass...

CVE-2017-1000117

CVE-2017-1000117 Malicious actors can craft "ssh://…" links to trick victims into accessing the malicious link when executing programs, thereby achieving command execution. This link can be placed in the .gitmodules file of a git project, so that when a victim performs git clone...

Exploit-CVE-2025-24801

CVE-2025-24801 This exploit uses CVE-2025-24801 to get Remote Code Execution RCE via Local File Inclusion LFI at GLPI 10.0.17. Proof of Concept PoC of this CVE with explaination to this vulnerability in GLPI. Observation Some applications expose the /glpi/ endpoint e.g.,...

CVE-2024-47533-PoC

CVE-2024-47533 – Cobbler XMLRPC Authentication Bypass → Reverse Shell Unauthenticated RCE 📌 Summary This repository contains a Proof-of-Concept PoC exploit for CVE-2024-47533 , a critical authentication bypass in Cobbler's XMLRPC API that leads to unauthenticated remote code execution RCE. The...

rails-PoC-CVE-2016-2098

A Proof of Concept of vulnerability: CVE-2016-2098 University project created by @alejandro-marting where we can check the vulnerability 2096 Using: rails 4.2.5.1 view has a vulnerable code app/views/poc/render1.html.erb !...

CVE-2024-29510

Original research and POC code: https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ NOTE: I have made no changes to the POC apart from the command executed. Full credit goes to Thomas Rinsma @ Codean Labs for their amazing research and POC. Local Scenario 1...

CVE-2023-41892_poc

CVE-2023-41892poc Customized this for my own use pocnoauth.py Basic PHP one-liner webshell OS command execution via ?cmd= pocauth.py Simple key-based authentication added webshell SHA-256 hash comparison method Commands can only be executed if the correct key is provided Code modification require...

CVE-2022-41220

Description of CVE-2022-41220 md2roff 1.9 suffers from a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. Replication To replicate the vulnerability, download a vulnerable version of md2roff version 1.9: root@kitploit: git clone...

CVE-2025-6018-6019

CVE-2025-6018 CVE-2025-6019 PoC Exploit Local Privilege Escalation LPE - openSUSE / SUSE Linux Enterprise 15 Working PoC/Exploit for CVE-2025-6018 and CVE-2025-6019 - Privilege escalation from unprivileged user to root on openSUSE Leap 15.x and SUSE Linux Enterprise 15.x 🎯 Quick Summary CVE ID|...