Catálogo de exploits

srakkk/cve-2024-32002-demo

srakkk/cve-2024-32002-hook

Exploit for CVE-2019-18935

Script to obfuscate a payload the same way as it was done by the XZ utils attack (CVE-2024-3094)

root Privileges

cve-2023-2745

Redux Python3 Version of CVE-2010-2861

moeinmiadi/CVE-2015-1635_PoC

Patch for CVE-2025-54236(a.k.a Session Reaper) which allows customer account takeover and RCE under certain conditions. This patch is actually a Magento 2 extension and universal compatible for Magento 2.3 & 2.4. If you cannot upgrade Magento or cannot apply the official hotfix, try this one.

CaelumIsMe/CVE-2019-9053-POC

Proof-of-Concept (POC) of a simple firewall in Python designed to mitigate the Spring4Shell (CVE-2022-22965) RCE attack by inspecting and blocking malicious request bodies.

📋 ملخص مشروع MikroTik RouterOS 6.49.18 Exploit Kit 🎯 نظرة عامة تم إنشاء مشروع احترافي وشامل لاختراق أجهزة MikroTik RouterOS 6.49.18 يتضمن جميع المكونات المطلوبة مع واجهة عربية كاملة وتوثيق مفصل. ✅ المكونات المكتملة 1️⃣ سكربتات الاختراق (7 سكربتات ✅ المميزات الرئيسية 1🎯 دعم CVE-2023-30799 اقراء دليل ملخص شامل للاداة PROJECT_SUMMARY.md

We are presented with a security alert indicating the detection of the Follina (CVE-2022-30190) vulnerability. A malicious Word document triggered msdt.exe execution, suggesting possible remote code execution on the host JonasPRD. Our task is to investigate the alert, confirm exploitation, assess impact, and recommend remediation.

Custom vulnerable VM (Ubuntu 14.04) designed for teaching multi-stage penetration testing. Features 10 interconnected challenges across Forensics, Web Exploitation (SQLi, XSS), Cryptography, and Kernel Exploitation (OverlayFS/CVE-2015-1328) to achieve full root compromise.

End-to-end Domain Controller exploitation using Metasploit and Impacket: discovered DC10, exploited Zerologon (CVE-2020-1472), extracted NTLM hashes, gained SYSTEM shell, and established a Meterpreter session.

0axz-tools/CVE-2024-51793

Sudo Vulnerability Local PrivEsc (CVE-2025-32463) POC with Python

autocode07/cisagov__check-cve-2019-19781.4142e02b

CVE-2017-1000367

CVE-2024-27956

PoC of CVE-2025-60751

Tool that reproduces CVE-2025-55315 in ASP.NET Core.

POC of CVE-2025-61882

Investigation into the XZ Utils backdoor (CVE-2024-3094): chronology, attack chain, risk to SSH, and supply-chain insights. Includes slides, sources, and mitigations (parity checks, attestations, or SBOMs, as well as SLSA)

Proof of concept for CVE-2022-1364 against Alibaba's UC Browser

The default configuration of LDAP on FortiOS v6.0.x to v6.2.0 does not check server identity for LDAP/S leading to MITM attacks. This PoC demos full exfiltration of credentials sent on the local subnet to an LDAP server that is easily impersonated.

Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)

This repo shows an exploit to CVE-2021-24762. This is an Blind SQLi exploit that, on default config, greps the admin password.

Exploit for CVE-2025-11001 or CVE-2025-11002

CVE-2024-53677 관련 컨설턴트용 툴 개발