4210 matches found
Another-Metabase-RCE-CVE-2023-38646
Extension of the Pre-Auth RCE in Metabase CVE-2023-38646 explained here This helped me to avoid errors related to "database already in use" with H2 and postgre as engines "token": "TOKEN", "details": "isondemand": false, "isfullsync": false, "issample": false, "cachettl": null, "refingerprint":...
CVE-2025-69219
CVE-2025-69219 — Apache Airflow Providers HTTP RCE via Unsafe Pickle Deserialization Severity: High CVSS 3.1: 8.8 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE: CWE-913 — Improper Control of Dynamically-Managed Code Resources Affected: apache-airflow-providers-http = 5.1.0, Fixed in:...
CVE-2023-4863
CVE-2023-4863/CVE-2023-41064 A POC for CVE-2023-4863. NOT an exploit Shout to @benhawkes who discovered the right set of codelengths to trigger this vulnerability! Please consult Ben's blog post for more information! https://blog.isosceles.com/the-webp-0day/...
CVE-2023-24055
Disclaimer This script is for educational and demonstration purposes only. The author does not endorse or condone the use of this script for any criminal or malicious activities and it should only be used where explicitly allowed with proper permission. This script should be used with caution, as...
androrat
'm in progress internationalization, Welcome to join. Androrat Fork/Silent Edition Remote Administration Tool for Android Androrat is a client/server application developed in Java Android for the client-side and in Java/Swing for the Server. The name Androrat is a mix of Android and RAT Remote...
CVE-2019-11932-whatsApp-exploit
CVE-2019-11932-whatsap-exploit The address of system and the gadget must be replaced by the actual address found by an information disclosure vulnerability. After replacing address of system and gadget. Run the code to generate the corrupted GIF file: now lets do it...
CVE-2020-0688_EXP
CVE-2020-0688EXP CVE-2020-0688EXP Auto trigger payload python3 CVE-2020-0688EXP.py -h usage: CVE-2020-0688EXP.py -h -s SERVER -u USER -p PASSWORD -c CMD -e optional arguments: -h, --help show this help message and exit -s SERVER, --server ECP Server URL Example: http://ip/owa -u USER, --user USER...
phywhispererusb
PhyWhisperer-USB What is this thing? This is a hardware trigger for FI or SCA, which triggers on the USB phy. Be sure to read the documentation at http://phywhispererusb.readthedocs.io/ as well! If you are getting started, there are a few demonstration notebooks showing how to: Sniff Data Stream...
BadOutlook
Bad Outlook A simple PoC which leverages the Outlook Application Interface COM Interface to execute shellcode on a system based on a specific trigger subject line. By utilizing the Microsoft.Office.Interop.Outlook namespace, developers can represent the entire Outlook Application or at least...
OffensivePascal-CVE-2011-2523
CVE-2011-2523 FreePascal implementation of CVE-2011-2523 Vulnerability vsFTPD 2.3.4 Using : in the username opens a backdoor as root on port 6200 on the target Requirements Synapse. If you don't have it, install through the OPM...
CVE-2024-4701-POC
CVE-2024-4701-POC POC for CVE-2024-4701 Download the genie docker file from https://netflix.github.io/genie/docs/4.3.0/demo/docker-compose.yml or this repo run docker-compose up Download the attached http payload loadlib Run the following command nc -w 5 localhost 8080 loadlib You may need to...
PowerLurk
PowerLurk PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. The goal is to make WMI events easier to fire off during a penetration test or red team engagement. Please see my post Creeping on Users with WMI Events: Introducing PowerLurk for more detailed information:...
CVE-2019-7489
This repository does not have a README...
CVE-2026-21508_POC
Proof-of-concept for CVE-2026-21508 For more information see: https://0xc4r.github.io/posts/CVE-2026-21508 Descrption: Proof-of-concept consist in a simple batch script and a DLL project: The DLL will be used to perform the DLL hijacking attack and will mainly perform the following actions when...
RadareEye
A tool for scanning nearby devices and execute command when the target device comes in between range.. NOTE:- RadareEye Owner will be not responsible if any user performs malicious activities using this tool. Use it for Learning purpose only. Installation of RadareEye : git clone...
CVE-2021-43297-POC
CVE-2021-43297 Vulnerability Description Apache Dubbo Hessian-Lite 3.2.11 and earlier versions contain a potential RCE attack risk. When Hessian-Lite encounters a serialization exception, it outputs related information, which may trigger the toString method of certain maliciously crafted Beans,...
KeePwn
A python script to help red teamers discover KeePass instances and extract secrets. Features KeePass Discovery Look for KeePass installation files through SMB C$ share. Accept multiple target sources IP, CIDR, hostname, file. Check for KeePass metadata version, last access time. Check for running...
UninstalledAppCanary
Uninstalled App Canary Prior Work This builds on the deception engineering work around Windows Service Canaries https://research.nccgroup.com/2021/03/04/deception-engineering-exploring-the-use-of-windows-service-canaries-against-ransomware/ Thesis Certain threat actors uninstall a number of...
CVE-2023-34468
CVE-2023-34468 Exploit Overview This repository provides a Python-based exploit tool for CVE-2023-34468 , a critical remote code execution vulnerability CVSS 9.8 in Apache NiFi versions 0.0.2 through 1.21.0. It allows authenticated users to execute arbitrary code by manipulating H2 database...