Exploit for Unrestricted Upload of File with Dangerous Type in Pi-Hole

PoC exploit for CVE-2020-11108; an RCE and privilege escalation in Pi-hole. The exploit targets Pi-hole = 4.4 and must be run with root privileges. The primary entry point is the cve-2020-11108-rce.py script, which will give a shell as the www-data user, and the root-cve-2020-11108-rce.py script,...

vulhub

This repository is an offensive tool for vulnerability research and exploitation, specifically targeting various web applications and frameworks. The primary vulnerability class/vector targeted by this repository is not explicitly stated, but based on the code and metadata, it appears to be a...

marshalsec

This is a Java-based tool for exploiting Java object deserialization vulnerabilities, specifically targeting BlazeDS AMF Action Message Format versions 0, 3, and X. The tool, named "marshalsec," is designed to test and demonstrate the exploitation of these vulnerabilities, which can lead to remot...

POChouse

Based on the provided information, the vulnerability is a remote code execution RCE vulnerability in Apache Flink 1.9.x. The vulnerability allows an attacker to upload a malicious JAR package, which can be executed by the JobManager process, leading to RCE. The affected versions of Apache Flink a...

charlotte

This is a C++ shellcode launcher, fully undetected as of May 13th, 2021. It dynamically invokes Win32 API functions, XOR encrypts shellcode and function names, and uses random XOR keys and variables per run. The code is designed to be stealthy and difficult to detect. The code is written in C++ a...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft

This is a proof-of-concept POC exploit for CVE-2020-0796, a vulnerability in the SMBv3 protocol. The exploit is implemented in Python and uses the Impacket library to interact with the SMB protocol. The exploit targets the SMBv3 protocol's signing requirement, which can be bypassed to allow for...

vulhub

This repository is an open-source collection of vulnerable web applications and environments for testing and learning purposes. It is maintained by phith0n and hosted on GitHub. The repository contains a variety of applications, including web servers, databases, and other services, that are...

pentestdb

This is an offensive tool for penetration testing. It is a Python-based tool called "pentestdb" that provides a collection of tools and resources for penetration testing, including exploit development, vulnerability scanning, and password cracking. The tool is designed to be easy to use and...

charlotte

It is an offensive tool for Windows. The repository contains a Python script, charlotte.py, which is a fully undetected shellcode launcher. The script uses XOR encryption to encrypt the shellcode and function names. The script is designed to be used with the Metasploit framework, and it can be us...

vulhub

This is a pre-built vulnerable environment based on Docker-Compose, maintained by Vulhub. The repository contains various vulnerable environments, including CouchDB, FFmpeg, Git, InfluxDB, and more. The environments are designed to be easily reproducible and can be used for testing and training...

awesome-windows-exploitation

This is a curated list of Windows exploitation resources and tools. The repository is a collection of articles, tutorials, and tools for Windows exploitation, including stack overflows, heap overflows, and kernel-based Windows overflows. The list includes resources such as articles from Phrack, a...

Exploit for Race Condition in Linux Linux_Kernel

PoC exploit for CVE-2017-1000405, a Linux kernel vulnerability known as Huge Dirty Cow. The target is the Linux kernel, specifically the huge page handling mechanism. The vulnerability class is a use-after-free bug in the huge page handling code, allowing for arbitrary memory access. The probable...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

weblogic-scan weblogic 漏洞扫描工具 妄想试图weblogic一把梭 目前检测的功能 - x console 页面探测 & 弱口令扫描 - x uuid页面的SSRF - x CVE-2017-10271 wls-wsat页面的反序列化 - x CVE-2018-2628 反序列化 - x CNVD-C-2019-48814 后期可以的话还会继续加功能的，主要是一些反序列化的poc真的不好写，我也不咋会.. USE 使用前请先填写config.py中的server参数...

shadowbroker

This repository, afei00123/shadowbroker, contains a collection of exploits and tools leaked by the Shadow Brokers, a group known for releasing sensitive information. The repository includes a README file that lists the contents of the repository, which includes various exploits and tools, such as...

Exploit for Use After Free in Microsoft

CVE-2021-31166 is a proof of concept for a remote UAF Use-After-Free vulnerability in the HTTP.sys protocol stack. The bug occurs in the http!UlpParseContentCoding function, which appends items to a local LISTENTRY and then moves it into the Request structure without NULLing out the local list...

Exploit for Use After Free in Debian Debian_Linux

This is a PoC exploit for CVE-2013-2857, a use-after-free vulnerability in the 3DS browser. The exploit is implemented in JavaScript and uses the UaF3 function to create a use-after-free condition, leading to a crash. The exploit is designed to be used on the 3DS browser, specifically on firmware...

vulhub

This repository is an open-source collection of pre-built vulnerable docker environments, referred to as 'Vulhub'. It is an offensive tool for various areas, including web application security, penetration testing, and vulnerability research. The primary purpose of Vulhub is to provide a convenie...

Exploit for Privilege Context Switching Error in Canonical Ubuntu_Linux

PoC exploit for CVE-2021-3493, a local privilege escalation vulnerability in Ubuntu OverlayFS. The target is the Linux kernel, specifically the overlayfs file system, which did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker coul...

Exploit for CVE-2015-1701

CVE-2015-1701 Win32k Elevation of Privilege Vulnerability. Original info https://www.fireeye.com/blog/threat-research/2015/04/probableapt28useo.html Protection Apply MS15-051 for fix. https://technet.microsoft.com/library/security/MS15-051 Authors c 2015 CVE-2015-1701 Project Credits R136a1...

pocsuite3

This is a Python package called pocsuite3 that provides a framework for remote vulnerability testing and proof-of-concept development. It is designed to be used by penetration testers and security researchers. The package has a powerful proof-of-concept engine and comes with many features,...

CTF-All-In-One

This is a comprehensive guide to CTF Capture The Flag competitions, specifically focusing on the Pwn binary exploitation aspect. The book is written by Yang Chao, a member of L-Team, and is intended for beginners. It covers the basics of binary exploitation, including memory management, buffer...

vulhub

This repository is an open-source collection of pre-built vulnerable docker environments, known as Vulhub. It is a collection of vulnerable environments, not a single exploit or tool. The repository contains a variety of vulnerable environments, including CouchDB, FFmpeg, Git, InfluxDB, and more,...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

weblogic-scan weblogic 漏洞扫描工具 妄想试图weblogic一把梭 目前检测的功能 - x console 页面探测 & 弱口令扫描 - x uuid页面的SSRF - x CVE-2017-10271 wls-wsat页面的反序列化 - x CVE-2018-2628 反序列化 - x CNVD-C-2019-48814 后期可以的话还会继续加功能的，主要是一些反序列化的poc真的不好写，我也不咋会.. USE 使用前请先填写config.py中的server参数...

Exploit for CVE-2020-2551

描述 在Oracle官方发布的2020年1月关键补丁更新公告CPU（Critical Patch Update）中，公布了一个Weblogic WLS组件IIOP协议中的远程代码执行漏洞（CVE-2020-2551）。 该漏洞可以绕过 Oracle 官方在 2019 年 10 月份发布的最新安全补丁。攻击者可以通过 IIOP 协议远程访问 Weblogic Server 服务器上的远程接口，传入恶意数据，从而获取服务器 权限并在未授权情况下远程执行任意代码。官方给出的CVSS 评分为 9.8。 IIOP 协议以 Java 接口的形式对远程对象进行访问，默认启用，可通过 7001...

Information_Collection_Handbook

The repository is an information collection handbook for penetration testing and source code analysis. It contains a collection of tools and resources for gathering information about a target, including domain name information, application information, and source code analysis. The repository...

Exploit for SQL Injection in Zabbix

This repository is an open-source collection of pre-built vulnerable docker environments, referred to as 'Vulhub'. It is an offensive tool for web application security testing and vulnerability research. The primary purpose of Vulhub is to provide a simple and convenient way to test and demonstra...

maltrail

This is a Python script repository for a malicious traffic detection system called Maltrail. The repository contains various files and directories, including configuration files, data storage files, and scripts for data processing and analysis. The script uses a variety of techniques to detect...

Exploit for Off-by-one Error in Sudo_Project Sudo

PoC exploit for CVE-2021-3156, a heap overflow vulnerability in sudoedit. The target product/service is sudoedit, a command-line utility for editing files with superuser privileges. The vulnerability class/vector is a heap overflow, which can lead to a privilege escalation LPE. The probable entry...

Exploit for Off-by-one Error in Sudo_Project Sudo

This is a Python script repository for exploiting the CVE-2021-3156 vulnerability in sudo. The vulnerability is a heap-based overflow in the sudo package, which can be exploited to gain root privileges. The repository contains several exploit scripts, each targeting a specific version of the sudo...

Exploit for Path Traversal in Vmware Cloud_Foundation

PoC exploit for CVE-2021-21972, a remote code execution vulnerability in VMware vCenter 6.5-7.0. The exploit uploads the web shell "shell.jsp" to the target server, which is then executed to gain remote code execution. The exploit is invoked by running the Python script "vcenterrce.py" with the U...

PayloadsAllTheThings

This repository is an offensive tool for Web Application Security and Pentest/CTF. It contains a list of useful payloads and bypass for various web application security vulnerabilities. The repository includes tools and exploits for vulnerabilities such as CRLF injection, CSRF injection, and CORS...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Redhat Jboss_Enterprise_Application_Platform

PoC exploit for CVE-2016-2183, a Padding Oracle vulnerability in Apache Shiro. The exploit targets the RCE Remote Code Execution vector, leveraging the Padding Oracle attack to bypass encryption and inject arbitrary data. The probable entry point is the shirooraclepadding.py script, which is...

Exploit for CVE-2020-17008

CVE-2020-17008 splWOW64 Elevation of Privilege C:\Windows\splwow64.exe Poc From: https://bugs.chromium.org/p/project-zero/issues/detail?id=2096 0x01 set splwow64poc.exe Low cd splwow64poc\x64\Release icacls splwow64poc.exe /setintegritylevel L /setintegritylevel CIOI级别将完整性 ACE 显式...

Exploit for CVE-2020-17057

cve-2020-17057 cve-2020-17057 poc 微软于2020-11-10日发布补丁修补...

Exploit for OS Command Injection in Apache Struts

CVE-2020-26259 CVE-2020-26259: XStream1.4.14 is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights. https://x-stream.github.io/CVE-2020-26259.html XStream 1.4.14 pom.xml com.thoughtworks.xstream xstream 1.4.14 poc...

Exploit for Expression Language Injection in Apache Struts

PoC exploit for CVE-2020-17530, a deserialization vulnerability in Apache Struts 2.0.0 to 2.5.25. The target product/service is Apache Struts, specifically the struts2showcasewar application. The vulnerability class/vector is deserialization, allowing for remote code execution. The probable entry...

Exploit for Deserialization of Untrusted Data in Apache Tapestry

This repository contains a proof-of-concept PoC exploit for the CVE-2020-17531 vulnerability in Apache Struts 2. The exploit is written in Python and uses the requests library to send a malicious request to the vulnerable application. The PoC exploit is designed to execute a command on the...

mad-metasploit

This is a Metasploit custom module repository, mad-metasploit, which contains a collection of exploits and plugins for various vulnerabilities. The repository is maintained by hahwul and is available on GitHub. The repository includes a variety of exploits, including: AIX Calendar Manager Service...

PayloadsAllTheThings

It is an offensive tool for funding. This repository contains a collection of funding models, including GitHub Sponsors, Ko-fi, and Buy Me a Coffee. The primary vulnerability class is not explicitly stated, but the tool appears to be related to funding models rather than a specific vulnerability...

mad-metasploit

This repository is an offensive tool for Metasploit framework. It is a collection of custom modules, plugins, and resource scripts for Metasploit. The primary purpose of this repository is to provide a comprehensive set of tools for exploiting vulnerabilities in various systems and applications...

ctf-writeups

This is a PoC exploit for a double free vulnerability in a binary. The exploit creates overlapping chunks on the heap, manipulates heap metadata, and overwrites the mallochook with a one-gadget address to execute /bin/sh. The challenge is interesting because it does not allow the exploitation of...

vulhub_v2

It is an offensive tool for web application security training. The repository contains a collection of vulnerable Docker environments for web application security training. The tool is designed to be easy to use, requiring only two simple commands to set up a vulnerable environment. The tool is n...

pikachu

It is an offensive tool for web application security training. The primary CVE ID is not explicitly mentioned, but the tool is designed to simulate various web application vulnerabilities, including but not limited to, Burt Force, XSS, CSRF, SQL-Inject, RCE, Files Inclusion, Unsafe file downloads...

Sitadel

This repository is an update for WAScan, making it compatible with Python versions 3.4 and above. It allows for more flexibility in writing new modules and implementing new features, such as frontend framework detection, content delivery network detection, defining risk levels for scans, and a...

vulhub

This repository is an open-source collection of pre-built vulnerable docker environments, known as Vulhub. It is an offensive tool for testing and demonstrating vulnerabilities in various software and systems. The primary purpose of Vulhub is to provide a simple and easy-to-use platform for...

vulhub

It is an offensive tool for Docker environments. The repository contains a collection of vulnerable Docker environments, including CouchDB, FFmpeg, Git, InfluxDB, and Oracle Java. The environments are designed to be used for testing and training purposes, allowing users to practice exploiting...

Exploit for CVE-2019-2888

CVE-2019-2888 WebLogic EJBTaglibDescriptor XXE漏洞 https://www.oracle.com/security-alerts/cpuoct2019.html fernflower.jar weblogic.jar/weblogic/servlet/ejb2jsp/dd/EJBTaglibDescriptor.class ╭─root@jas502n /var ╰─ find ./ |grep EJBTaglibDescriptor  ✔  8388  18:32:43...

PowerSploit

This is an offensive tool for Windows PowerShell exploitation. The repository contains a PowerShell post-exploitation framework called PowerSploit, which provides various tools for exploiting vulnerabilities in Windows systems. The framework includes modules for antivirus bypass, code execution,...

Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java

PoC exploit for CVE-2020-6287, a vulnerability in SAP NetWeaver AS Java. The exploit targets the CTCWebService component, allowing an unauthenticated attacker to add a user with no administrator permission set. The vulnerability is present in the CTCWebServiceBean?wsdl endpoint, which is accessed...

vulhub

It is an offensive tool for web application security testing. The repository contains a collection of pre-built vulnerable docker environments, allowing users to test web application security without requiring prior knowledge of docker. The tool is designed to be easy to use, with a simple...