Exploit for Race Condition in Canonical Ubuntu_Linux

内网渗透中的一些工具及项目资料 入侵与渗透是两个不同的概念，很多人喜欢混为一谈，简单来说，入侵是从信息收集到打点，渗透是横向移动，获取目标，稳固权限。本页是针对内网渗透中整理的一些工具以及项目资料，方便安全从业人员查阅. 此项目同步至：https://forum.ywhack.com/bountytips.php?pentest 目录 信息收集 漏洞利用 免杀系列 代理隧道 权限提升 权限维持 横向移动 技术资料 信息收集 2021.04.06 - https://github.com/shadow1ng/fscan - 一款内网扫描工具，方便一键大保健 推荐： | 编程语言: Gola...

Exploit for Out-of-bounds Write in Php

It is an exploit module for CVE-2019-11043. The target product/service is Apache Log4j, and the vulnerability class/vector is RCE Remote Code Execution. The probable entry point is the JNDI exploit, which is a known vulnerability in Log4j. Notable dependencies/tooling include the Apache Log4j...

Exploit for CVE-2016-4655

This is a PoC exploit for iOS 9.3.5, targeting CVE-2016-4655 and CVE-2016-4656. The exploit aims to gain root access over the device by exploiting kernel vulnerabilities. The supported devices are listed in offsetfinder.h. The exploit is based on the original disclosure by Lookout and the OS X...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

PoC exploit for CVE-2021-4034, a privilege escalation vulnerability in the polkit package. The target product/service is polkit, a Linux system policy kit. The vulnerability class/vector is a privilege escalation vulnerability. The probable entry points are the gconv-modules file and the...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

PoC exploit for CVE-2021-4034, a Linux local privilege escalation vulnerability. The target is the polkit privilege escalation exploit, which has a wide coverage and is stable. The vulnerability class/vector is auth bypass, specifically a privilege escalation exploit. The probable entry point is...

Exploit for CVE-2013-0422

K8tools 20191130 声明: 工具仅供安全研究或授权渗透，非法用途后果自负。 下载: https://github.com/k8gege/K8tools PS: 不定期更新,文件比较大，可按需下载。工具有BUG或建议可直接Github上留言 提权工具均可在远控Cmd或WebShell运行，大部份经过修改编译兼容性稳定性更好 注意：不保证永久有效,喜欢自行保存。 综合工具 + 扫描工具 Ladon 5.7 大型内网渗透扫描神器内置40个功能,支持Cobalt Strike + 扫描工具 K8Cscan5.4 大型内网渗透扫描器内置30个功能,支持Cobalt Strike +...

PoC

PoC exploit for MS-16-137, LSASS Remote Null Ptr Deref. The target product/service is Windows LSASS Local Security Authority Subsystem Service. The vulnerability class/vector is a remote code execution vulnerability, specifically a null pointer dereference. The probable entry point is the...

AutoLocalPrivilegeEscalation

AutoLocalPrivilegeEscalation An automated script that download potential exploit for linux kernel from exploitdb, and compile them automatically This script is created due to Hackademics, there are so much possible exploit for that version of kernel, as a rookie OSCP student, I am not able to fin...

PSKernel-Primitives

PSKernel-Primitives Over time I'll add PowerShell helper functions to assist in kernel exploitation. Common PowerShell Exploit Constructs Create buffer powershell Byte buffer int/hex $Buff = Byte0x41255 + Byte0x420xff Buffer includes pointer Takes care of endianness, may need ".ToInt32" or...

Exploit for CVE-2017-0144

This repository is an offensive tool for Windows. It is an implementation of the DoublePulsar backdoor in C/C++. The tool includes a suite of exploits and detectors for various vulnerabilities, including the EternalBlue vulnerability CVE-2017-0144. The tool can be used to upload a DLL to a...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

This repository is a proof-of-concept PoC exploit for CVE-2021-4034, a vulnerability in the polkit privilege escalation exploit. The exploit is implemented in C and uses the execve system call to execute a shell with elevated privileges. The vulnerability is related to the way polkit handles user...

Exploit for OS Command Injection in Docker

The repository is a proof-of-concept PoC exploit for CVE-2019-5736, a container escape vulnerability in Docker. The PoC is written in Go and is designed to overwrite the /bin/sh binary in a container with a malicious interpreter path, allowing for code execution on the host system. The exploit...

Exploit for CVE-2020-1472

PoC exploit for CVE-2020-1472, a Windows ZeroLogon vulnerability. The exploit targets the Netlogon service on a Domain Controller DC and allows an attacker to set an empty password for the DC's machine account. This is achieved by exploiting the vulnerability in the Netlogon service, which allows...

Exploit for CVE-2019-13272

No description...

Exploit for CVE-2013-0422

K8tools 2020628 声明: 工具仅供安全研究或授权渗透，非法用途后果自负。 下载: https://github.com/k8gege/K8tools 文档: http://k8gege.org PS: 不定期更新,文件比较大，可按需下载。工具有BUG或建议可直接Github上留言 提权工具均可在远控Cmd或WebShell运行，大部份经过修改编译兼容性稳定性更好 注意：不保证永久有效,喜欢自行保存。 综合工具 + 反弹工具 Ladon 6.6.6 反弹MSF/NC ShellTCP/HTTP/HTTPS + 扫描工具 Ladon 6.6 SMB漏洞检测 SMBGhost...

fastjson-remote-code-execute-poc

This is a Java-based proof-of-concept PoC exploit for a remote code execution RCE vulnerability in the FastJSON library, version 1.2.24. The exploit is designed to be used with IntelliJ IDEA, a popular integrated development environment IDE for Java development. The exploit consists of two main...

kerma

This repository is an exploit toolkit for a critical vulnerability in Mikrotik RouterOS Winbox. The vulnerability is present in all versions from 6.29 to 6.42. The toolkit includes several scripts and tools to exploit the vulnerability and extract user credentials. The PoC.py script is the main...

Exploit for Insufficiently Protected Credentials in Linuxfoundation Containerd

It is an offensive tool for Kubernetes. The repository contains information on various methods to hack and exploit Kubernetes clusters, including articles, videos, and presentations on topics such as securing clusters by eliminating risky permissions, Kubernetes pentest methodology, and container...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Google Android

This repository contains a PoC Proof of Concept code for the BlueBorne vulnerabilities. The BlueBorne vulnerabilities are a set of vulnerabilities in Bluetooth devices that allow an attacker to remotely execute code on a device. The PoC code is written in Python and uses the PyBluez library to...

POC-T

This is a Python-based penetration testing framework called POC-T. It is designed to facilitate concurrent testing and provides a variety of features for vulnerability scanning and exploitation. The framework includes a range of built-in scripts for testing various vulnerabilities, including SQL...

RedTeam-Tactics-and-Techniques

Red Teaming Tactics and Techniques...

Exploit for Out-of-bounds Write in Apple Mac_Os_X

This is a PoC exploit for CVE-2019-8695, which is a vulnerability in the MySQL server that allows authentication without knowing the cleartext password. The exploit targets the Secure Password Authentication plugin aka mysqlnativepassword, the default method used by MySQL. The target...

firejail

This repository is an open-source Linux sandboxing platform called Firejail. It is a Linux namespaces and seccomp-bpf sandbox that allows users to run applications in a secure environment, isolating them from the rest of the system. The repository contains a variety of tools and scripts for...

BeRoot

BeRoot Project BeRoot Project is a post exploitation tool to check common misconfigurations to find a way to escalate our privilege. \ It has been added to the pupy project as a post exploitation module so it will be executed in memory without touching the disk. This tool does not realize any...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Pot A honeypot for the Log4Shell vulnerability CVE-2021-44228. License: GPLv3.0 Features Listen on various ports for Log4Shell exploitation. Detect exploitation in request line and headers. Download exploit payloads recursively. Log to file and Azure blob storage. Usage 1. Install Poetry: cur...

Exploit for Generation of Error Message Containing Sensitive Information in Postgresql

PoC exploit for CVE-2021-3393. The target product/service or framework is Apache Commons BeanUtils. The vulnerability class/vector is a deserialization vulnerability. The probable entry points are the BasicDynaBean class. The notable dependency/tooling is Apache Commons BeanUtils. The execution...

Phantom-Evasion

This is a Python antivirus evasion tool called Phantom-Evasion. It is free software, licensed under the GNU General Public License GPL version 3. The tool is designed to evade detection by antivirus software and is intended for educational or research purposes only. The tool has several modules,...

Exploit for CVE-2021-34525

This is an offensive tool for Windows. It is a PoC exploit for CVE-2021-34525, an exploit module targeting Windows systems. The tool is designed to exploit a vulnerability in the Windows operating system, allowing an attacker to gain elevated privileges. The exploit is likely to be used for testi...

security-analytics

This repository is a community-driven set of security analytics for auditing cloud usage and detecting threats to data & workloads in Google Cloud. It provides a list of sample security analytics for auditing cloud usage and detecting threats, which may assist detection engineers, threat hunters,...

Exploit for Use After Free in Microsoft

This is a PoC exploit for CVE-2019-0708, also known as the "BlueKeep" vulnerability. The vulnerability is in the Remote Desktop Protocol RDP service, which is a remote access protocol used by Windows systems. The exploit is designed to scan for vulnerable systems and exploit the vulnerability to...

Exploit for Improper Input Validation in Jenkins

hackUtils It is a hack tool kit for pentest and web security research, which is based on BeautifulSoup bs4 module http://www.crummy.com/software/BeautifulSoup/bs4/. Usage: hackUtils.py options Options: -h, --help Show basic help message and exit -b keyword, --baidu=keyword Fetch URLs from Baidu...

PEASS-ng

PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation Basic Tutorial Here you will find privilege escalation tools for Windows and Linux/Unix\ and MacOS. These tools search for possible local privilege escalation paths that you could exploit and print them to you with nice colors s...

Exploit for Out-of-bounds Write in Php

This is an exploit module for a bug in php-fpm CVE-2019-11043. The bug is possible to trigger from the outside in certain nginx + php-fpm configurations, allowing a web user to execute code if the configuration is vulnerable. The exploit targets the "shortopentag" and "htmlerrors" php.ini setting...

Cobaltstrike-MS17-010

This repository is an Aggressor Script for Cobalt Strike targeting the MS17-010 vulnerability. It includes a PowerShell module for scanning and exploiting the vulnerability, as well as a stager for delivering a payload. The script is designed to run on Windows 7 x64 and Windows 2008 R2 systems. T...

Exploit for CVE-2015-1805

This repository contains a collection of exploits for various vulnerabilities, including CVE-2015-1805, CVE-2017-7184, CVE-2017-2636, and CVE-2017-8890. The exploits are written in C and are designed to demonstrate the vulnerabilities in the Linux kernel. CVE-2015-1805 is a vulnerability in the...

Exploit for Use After Free in Microsoft

CVE-2021-31166: HTTP Protocol Stack Remote Code Execution Vulnerability This is a proof of concept for CVE-2021-31166 "HTTP Protocol Stack Remote Code Execution Vulnerability", a use-after-free dereference in http.sys patched by Microsoft in May 2021. According to this tweet the vulnerability has...

Exploit for OS Command Injection in Docker

This is a PoC Proof of Concept exploit for CVE-2019-5736, a vulnerability in the runc binary of the Docker container runtime. The exploit is implemented in Go and is designed to overwrite the runc binary on the host system from within a container. The exploit works by overwriting the /bin/sh bina...

Exploit for Out-of-bounds Write in Php

This is an exploit module for a bug in php-fpm CVE-2019-11043. The bug allows a web user to execute code on a vulnerable server if the server has a specific configuration. The exploit targets the PHP 7+ versions, but the bug itself is present in earlier versions. The exploit works by setting the...

airbug

This repository is an offensive tool for collecting and utilizing web application vulnerabilities, specifically targeting Content Management Systems CMS. It is a Python-based tool that allows users to load and execute Proof of Concept PoC code for various vulnerabilities. The tool is designed to ...

PHP-backdoors

This is a collection of PHP backdoors, a type of malicious code that allows unauthorized access to a web server. The repository contains multiple backdoors, each with its own features and functionality. Here is a summary of the analysis: Classification: Exploit module/toolkit targeting web server...

ExploitOnCLI

This is an offensive tool for searching exploits in multiple databases. The tool, named ExploitOnCLI or EOC, is written in PHP for Linux and allows users to search for exploits in various databases, including Exploit-DB, PacketStormSecurity, IEDB, Siph0n, CXSecurity, and Exploit4Arab. The tool ca...

graphql-playground

This repository is an offensive tool for GraphQL. It is a GraphQL IDE for better development workflows, featuring context-aware autocompletion and error highlighting, interactive, multi-column docs, and support for real-time GraphQL Subscriptions. The tool is vulnerable to an XSS Reflection attac...

Exploit for Out-of-bounds Write in Cypress Cyw20735_Firmware

This repository is an offensive tool for firmware emulation and fuzzing. It provides a virtual environment to fuzz wireless firmwares, allowing for the extraction of their current state and re-execution in a virtual environment for fuzzing. The tool is currently optimized for the CYW20735 Bluetoo...

TEE-reversing

This repository is an offensive tool for learning how to reverse-engineer and achieve trusted code execution on ARM devices. It contains a curated list of public TEE resources, including papers on TEE reversing and security analysis. The repository includes links to various papers and resources o...

hacking-material-books

This repository is an offensive tool for Metasploit and Nmap scripting. It contains a collection of articles and resource files for Metasploit RC/ERB scripting, Nmap NSE scripting, and bash programming. The repository includes examples of how to use Metasploit RC/ERB scripting to automate tasks,...

Exploit for CVE-2024-38819

CVE-2024-38819: Proof of Concept PoC This is a proof of concept for the CVE-2024-38819 vulnerability, which I reported, demonstrating a path traversal exploit. Execution Steps 1. Build the Docker image Spring Boot 3.3.4, based on Spring Framework 6.1.13 cd vuln docker build -t cve-2024-38819-poc...

Exploit for CVE-2013-0422

K8tools 2020628 声明: 工具仅供安全研究或授权渗透，非法用途后果自负。 下载: https://github.com/k8gege/K8tools 文档: http://k8gege.org PS: 不定期更新,文件比较大，可按需下载。工具有BUG或建议可直接Github上留言 提权工具均可在远控Cmd或WebShell运行，大部份经过修改编译兼容性稳定性更好 注意：不保证永久有效,喜欢自行保存。 综合工具 + 反弹工具 Ladon 6.6.6 反弹MSF/NC ShellTCP/HTTP/HTTPS + 扫描工具 Ladon 6.6 SMB漏洞检测 SMBGhost...

Exploit for Improper Null Termination in Php

Ladon POC Moudle CVE-2019-11043 PHP-FPM + Ngnix 漏洞简介 PHP-FPM 远程代码执行漏洞CVE-2019-11043 在长亭科技举办的 Real World CTF 中,国外安全研究员 Andrew Danau 在解决一道 CTF 题目时发现,向目标服务器 URL 发送 %0a 符号时,服务返回异常,疑似存在漏洞。 在使用一些有错误的Nginx配置的情况下,通过恶意构造的数据包,即可让PHP-FPM执行任意代码。 Example 和Ladon.exe放在同一目录,即可对C段或url.txt进行批量检测 bash Ladon...

Exploit for Type Confusion in Google Chrome

This is a JavaScript exploit code for a Chrome vulnerability, specifically CVE-2021-38001. The code is designed to be used in the context of the Chrome V8 JavaScript engine. The code defines two functions: d2u and u2d. The d2u function takes a 64-bit floating-point value and converts it to a 32-b...

Exploit for Deserialization of Untrusted Data in Google Android

CVE-2024-31317 Can I even use this? This was patched in https://source.android.com/docs/security/bulletin/2024-06-01 If your device runs a patch under 2024-06-01 you can use this. The "Google Play system update" date is irrevelant and you can and should update your google play. How to use the...