D3m0n1z3dShell

「😈」D3m0n1z3dShellについて Demonized Shellは、Linuxにおける永続化のための高度なツールです。 インストール git clone https://github.com/MatheuZSecurity/D3m0n1z3dShell.git cd D3m0n1z3dShell chmod +x demonizedshell.sh sudo ./demonizedshell.sh ワンライナーインストール すべてのファイルを含むD3m0n1z3dShellのダウンロード: curl -L...

VulnHub-DC1-Writeup

VulnHub-DC1-Writeup "渗透测试实验室报告，记录了从侦察到 root 的完整攻击链。" 🔓 VulnHub — DC-1 Boot-to-Root 靶机 Writeup 难度： 初级–中级 平台： VulnHub 目标： 获取全部 4 个 flag 并实现完整的 root 级攻陷 攻击机系统： Kali Linux（VirtualBox — NAT 网络） 目标机系统： Debian Linux（Drupal 7 CMS） 📌 目录 1. 实验环境搭建 2. 侦察与信息收集 3. 漏洞利用 — 远程代码执行 4. 后渗透 — Shell 稳定化 5. Flag 1 —...

Explosive-As-Hell-MCS-Qualifer-Web-500

CVE-2025-55182 — React Server Components RCE | CTF ライトアップ カテゴリ: Web Exploitation | 難易度: Medium | 脆弱性: Remote Code Execution → SUID 権限昇格 TL;DR React Server Component のエンドポイントが CVE-2025-55182 RCE に対して脆弱 → SUID バイナリを列挙 → /usr/bin/perl に SUID が設定されていた → Perl の POSIX setuid0 を使用して root に昇格 →...

CHARON

/ || | | | / \ | \ / | \ | | | | | || | / \ | | | | | | | | | | | |/ | "落入永生神的手中是一件可怕的事。" — 希伯来书 10:31 这是什么 一个紧凑、无依赖的 CVE-2026-46333 概念验证：Qualys 于 2026-05-15 披露的 ptracemayaccess mm==NULL 绕过。Charon 将 pidfdgetfd2 与一个正在退出的 SUID-root 进程进行竞态， 以在其 doexit 中短暂的 mm-NULL 窗口期间提取其打开的 /etc/shadow 文件描述符。...

binary-exploitation-labs

Binary Exploitation & Reverse Engineering Labs Hands-on labs...

CVE-2024-29975

UNSUPPORTED WHEN ASSIGNED The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an authenticated local attacker with administrator privileges to execute...

Micro Focus (HPE) Data Protector - SUID Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Micro Focus HPE Data Protector SUID Privilege Escalation', 'Description' = %q This module exploits the trusted $PATH environment variable of the...

Micro Focus (HPE) Data Protector SUID Privilege Escalation Exploit

This Metasploit module exploits the trusted $PATH environment variable of the SUID binary omniresolve in Micro Focus HPE Data Protector versions A.10.40 and below. The omniresolve executable calls the oracleasm binary using a relative path and the trusted environment $PATH, which allows an attack...

Micro Focus (HPE) Data Protector SUID Privilege Escalation

This module exploits the trusted $PATH environment variable of the SUID binary omniresolve in Micro Focus HPE Data Protector A.10.40 and prior. The omniresolve executable calls the oracleasm binary using a relative path and the trusted environment $PATH, which allows an attacker to execute a cust...

ktsuss 1.4 - suid Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ktsuss suid Privilege Escalation', 'Description' = %q This module attempts to gain root privileges by exploiting a vulnerability in ktsuss versio...

ktsuss Suid Privilege Escalation Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ktsuss suid Privilege Escalation', 'Description' = %q This module attempts to gain root privileges by exploiting a vulnerability in ktsuss versio...

Xorg X11 Server - SUID privilege escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xorg X11 Server SUID privilege escalation', 'Description' = %q This module attempts to gain root privileges with SUID Xorg X11 server versions...

Xorg X11 Server SUID Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xorg X11 Server SUID privilege escalation', 'Description' = %q This module attempts to gain root privileges with SUID Xorg X11 server versions...

rpc Suid Privledge Exploit

No description provided by source. !/usr/bin/perl -w exploits suid privledges on rcp Not really tested this but hey works on redhat6.2 not werk on freebsd4.1 stable bug discovered by Andrew Griffiths Exploit written by tlabs greetz to those that know me innit Please set your rcpfile this can be...

dump 0.4b15 exploit (Redhat 6.2)

No description provided by source. / dump-0.4b15x.c dump-0.4b15 exploit: Redhat 6.2 dump command executes external program with suid priviledge. affected: /sbin/dump /sbin/dump.static /sbin/restore /sbin/restore.static Bug found by [email protected] This example was coded by...

dump 0.4b15 Local Root Exploit

No description provided by source. !/bin/sh Redhat 6.2 dump command executes external program with suid priviledge. Discovered by Mat [email protected] Written for and by a scriptkid Tasc ;P Remember, there's no cure for BSE echo "dump-0.4b15 root exploit" echo "Discovered by Mat [email protected]...

dump 0.4b15 (RedHat 6.2) - Local Privilege Escalation

/ dump-0.4b15x.c dump-0.4b15 exploit: Redhat 6.2 dump command executes external program with suid priviledge. affected: /sbin/dump /sbin/dump.static /sbin/restore /sbin/restore.static Bug found by [email protected] This example was coded by [email protected] It was written for EDUCATION...

dump 0.4b15 exploit (Redhat 6.2)

Exploit for linux platform in category local exploits ================================ dump 0.4b15 exploit Redhat 6.2 ================================ / dump-0.4b15x.c dump-0.4b15 exploit: Redhat 6.2 dump command executes external program with suid priviledge. affected: /sbin/dump /sbin/dump.stat...

rpc Suid Privledge Exploit

Exploit for linux platform in category local exploits ========================== rpc Suid Privledge Exploit ========================== !/usr/bin/perl -w exploits suid privledges on rcp Not really tested this but hey works on redhat6.2 not werk on freebsd4.1 stable bug discovered by Andrew Griffit...

dump 0.4b15 - Local Privilege Escalation

!/bin/sh Redhat 6.2 dump command executes external program with suid priviledge. Discovered by Mat Written for and by a scriptkid Tasc ;P Remember, there's no cure for BSE echo "dump-0.4b15 root exploit" echo "Discovered by Mat " echo "-------------------------------------" echo DUMP=/sbin/dump i...