git_rce

CVE-2024-32002 PoC 1. Debes configurar la opción de enlace simbólico de git de la siguiente manera: git config --global core.symlinks true 2. Luego explota CVE-2024-32002 con el siguiente comando: git clone --recursive https://github.com/EQSTSeminar/gitrce.git Escenario de Ataque...

SEP-14.2-Arbitrary-Write

Exploit CVE-2020-5837 El análisis se puede encontrar en el blog de RedyOps Labs: https://labs.redyops.com/index.php/2020/04/27/symantec-endpoint-protection-sep-14-2-eop-via-arbitrary-write/ Herramientas de Terceros Este código de exploit se basa en gran medida en symboliclink-testing-tools, que f...

CVE-2025-48799

Descripción Esto es un PoC para CVE-2025-48799, una vulnerabilidad de elevación de privilegios en el servicio de Windows Update. Esta vulnerabilidad afecta a clientes Windows win11/win10 con al menos 2 discos duros. Cuando la máquina tiene múltiples discos duros, es posible cambiar la ubicación...

CVE-2023-51127

CVE-2023-51127 FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic...

colabcat

Colabcat Run Hashcat on Google Colab with session restore capabilities with Google Drive. Usage Go to the link below to open a copy of the colabcat.ipynb file in Google Colab: https://colab.research.google.com/github/someshkar/colabcat/blob/master/colabcat.ipynb Click on Runtime, Change runtime...

CVE-2024-54910

CVE-2024-54910 https://vulners.com/cve/CVE-2024-54910 Este documento explora una vulnerabilidad que permite escrituras arbitrarias de archivos, lo que conduce a una escalada de privilegios en un sistema Windows que tenga instalado Hasleo Backup Suite Free = 4.9.4. Demuestra cómo las operaciones d...

CVE-2023-36723

CVE-2023-36723 This is PoC for arbitrary directory creation bug in Container Manager service. This PoC is not thoroughly tested so it may not even work most of the time it was enough for msrc to confirm vulnerability. In order to exploit this vulnerability a Windows Sandbox feature have to be...

CVE-2020-7283-McAfee-Total-Protection-MTP-16.0.R26-EoP

Exploit CVE-2020-7283 El write-up se puede encontrar en el blog de RedyOps Labs: https://labs.redyops.com/index.php/2020/07/14/mcafee-total-protection-mtp-16-0-r26-escalation-of-privilege-cve-2020-7283/ Herramientas de Terceros Este código de exploit se basa en gran medida en...

-CVE-2020-8103-Bitdefender-Antivirus-Free-EoP

Exploit de CVE-2020-8103 El informe se puede encontrar en el blog de RedyOps Labs: https://labs.redyops.com/index.php/2020/04/24/bitdefender-antivirus-free-escalation-of-privileges/ Herramientas de Terceros Este código de exploit se basa en gran medida en symboliclink-testing-tools, desarrollado...

CVE-2020-1066-EXP

Referencia Esta vulnerabilidad es una vulnerabilidad de elevación de privilegios local por reemplazo de archivos arbitrarios causada por el manejo incorrecto de objetos de enlace simbólico por parte del servicio Windows CardSpace Declaración El autor proporciona el PoC únicamente con fines de...

EUVD-2026-90788

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

CVE-2021-26415

PoC PoC rápido para CVE-2021-26415 como se describe en https://www.cloaked.pl/2021/04/cve-2021-26415/ El BaitAndSwitch.exe está compilado desde https://github.com/googleprojectzero/symboliclink-testing-tools/tree/master/BaitAndSwitch...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP En sistemas Windows, se descubrió que GlobalProtect versiones de aplicación 6.1.1-5 y 6.2.0-89 era vulnerable a la eliminación arbitraria de archivos con privilegios elevados mediante un ataque de enlace simbólico, lo que conduce a una escalada de...

AlmaLinux 9.2 [TuxCare] Security Update: squashfs-tools (ALMALINUX9.2:CLSA-2025:1751888935)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751888935 advisory. - squashfsopendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2024:1734531954)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1734531954 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when...

Rocky Linux 8 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc Multiple Vulnerabilities (crlsa-2021_1853)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211853 advisory. unbound: integer overflow in the regional allocator via regionalalloc CVE-2019-25032 unbound: integer overflow in sldnsstr2wirednamebuforigin can lead to a...

Rocky Linux 8 [CIQ] Security Update: squashfs-tools / squashfs-tools-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3139)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243139 advisory. squashfs-tools: unvalidated filepaths allow writing outside of destination CVE-2021-40153 squashfs-tools: possible Directory Traversal via symbolic link...

Rocky Linux 8 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource Multiple Vulnerabilities (crlsa-2021_1723)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211723 advisory. sudo: symbolic link attack in SELinux-enabled sudoedit CVE-2021-23240 sudo: possible directory existence test due to race condition in sudoedit...

CVE-2023-23946-POC

Exploit PoC CVE-2023-23946 Explicación y PoC de la CVE-2023-23946 La vulnerabilidad CVE-2023-23946 es causada por un fallo en la forma en que git maneja los enlaces simbólicos. Cuando git crea un enlace simbólico, en realidad no lo maneja como un enlace simbólico y, debido a eso, podemos explotar...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1746188134)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746188134 advisory. - A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host...