HTB-Snapped-Writeup

HTB-Snapped-Writeup HTB Snapped — Hard Linux マシンのwriteup。CVE-2026-27944（Nginx UI の認証なしバックアップ開示）を CVE-2026-3888（snapd の競合状態による LPE）と連鎖させ、システム全体の完全な侵害を達成。 HTB: Snapped — Writeup 難易度: Hard OS: Linux Ubuntu 24.04 リリース日: 2026年3月23日 CVE: CVE-2026-27944, CVE-2026-3888 概要 Snapped は、nginx...

CVE-2026-27944

CVE-2026-27944 POC: Nginx UI 未認証バックアップダウンロード + ダッシュボードアクセス このリポジトリには、Nginx UI の重大な脆弱性である CVE-2026-27944 に対する拡張された概念実証（POC）エクスプロイトが含まれています。 この脆弱性により、未認証の攻撃者が /api/backup エンドポイントを介してシステムバックアップをダウンロードできます。さらに、アプリケーションは X-Backup-Security HTTPレスポンスヘッダー内に AES-256 暗号化キーと IV...

-nginxui_discover

Nginx UI ディスカバリースキャナー - CVE-2026-27944 バージョン検出ツール https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/threading-multi--threaded-brightgreen 著者: NULL200OK Nginx UI Webインターフェースを発見し、そのバージョンを検出し、CVE‑2026‑27944（バージョン ≤...

CVE-2023-30146

CVE-2023-30146 - Assmann/HooToo ウェブカメラエクスプロイト - 機密データの露出 説明 HooToo および Assmann ブランドの IP カメラに問題が発見されました。ファームウェアは、管理者とユーザーの認証情報をバックアップ内に平文で保存します。バックアップは認証なしで取得・解凍できるため、リモートの攻撃者にネットワークへのアクセスを与えることになります。 脆弱性タイプ 機密データの露出 攻撃タイプ リモート 影響 ネットワーク侵害の可能性 背景 IoT 市場で販売されている IP カメラの多くは、HiSilicon H35xx SoC 1...

Cve-2026-27944-Tools-Exploit

🚀 CVE-2026-27944：Nginx UI 未授权备份漏洞利用工具 📌 描述 27944.py 是针对 CVE-2026-27944 的漏洞利用工具，允许攻击者在无需认证的情况下下载并解密 Nginx UI 的备份。 此漏洞存在于 Nginx UI 版本 2.3.2 中，可导致以下数据泄露： · 用户凭据和会话令牌 · SSL 私钥 · Nginx 配置 · 数据库文件 🔧 功能 · ✅ 从目标文件中进行批量扫描 · ✅ 单个目标漏洞利用 · ✅ 自动下载备份 · ✅ 自动解密 AES-256-CBC · ✅ 自动从备份中提取凭据 🛠️ 安装方法 root@kitploit: gi...

Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui

HTB-Snapped-Writeup HTB Snapped — Hard Linux machine writeup...

Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui

CVE-2026-27944 + CVE-2026-33032 — nginx-ui Zero-Credential RCE...

Exploit for Missing Encryption of Sensitive Data in Nginxui Nginx_Ui

CVE-2026-27944 POC: Nginx UI Unauthenticated Backup Download +...

GO-2026-4614 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure in github.com/0xJacky/Nginx-UI

Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

Exploit for CVE-2026-27944

CVE-2026-27944 - Nginx-UI Unauthenticated Backup Download !...

GHSA-G9W5-QFFC-6762 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure

Summary The /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data user credentials,...

Exploit for CVE-2025-11380

CVE-2025-11380 Proof of conc...

CVE-2023-53739 Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure

Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3settings.bin file and extract base64-encoded user and admin passwords witho...

PT-2025-48194

Name of the Vulnerable Software and Affected Versions Astak CM-818T3 2.4GHz wireless security surveillance cameras affected versions not specified Description The cameras have an unauthenticated configuration disclosure issue in the /web/cgi-bin/hi3510/backup.cgi endpoint. This endpoint allows...

CVE-2025-34329

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodesfiles/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates t...

CVE-2025-34329 AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodesfiles/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates t...

CVE-2021-4468

PLANEX CS-QP50F-ING2 smart cameras expose a configuration backup interface over HTTP that does not require authentication. A remote, unauthenticated attacker can directly retrieve a compressed configuration backup file from the device. The backup contains sensitive configuration information,...

CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated...

CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated...

YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

Summary The request to commence a site backup can be performed without authentication. Then these backups can also be downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create an archive and then download the archive without being...