Exploits

将常用的cve工具做个备份(CVE-2021-42321,CVE-2022-23277,CVE-2022-41082,Exchange_GetVersion_MatchVul)

This PoC is targeting vulnerabilities in Palo Alto PAN-OS, specifically CVE-2024-0012 and CVE-2024-9474. This script automates the exploitation process, including payload creation, chunked delivery, and seamless command execution.

Cleo Unrestricted file upload and download PoC (CVE-2024-50623)

Palo Alto Networks PAN-OS(CVE-2024-9474) POC

Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "set_sys_adm" function of the "adm.cgi" binary, and is due to improper santization of the user provided "newpass" field.

Fast, parallel SSH discovery and security auditing across hosts and CIDR ranges: identifies SSH on any port in real time, then flags auth methods, weak crypto, Terrapin (CVE-2023-48795), and reused host keys.

This repository contains a Proof of Concept (PoC) exploit for CVE-2024-11680, a critical vulnerability in ProjectSend r1605 and older versions. The exploit targets a Cross-Site Request Forgery (CSRF) flaw in combination with Privilege Misconfiguration issues.

Zimbra Lab de CVE-2022-37042 y CVE-2022-37393

Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (CVE-2024-6387)

CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) RCE POC

CVE-2024-11680: Improper Authentication (CWE-287)

CVE-2024-51567 is a Python PoC exploit targeting an RCE vulnerability in CyberPanel v2.3.6’s upgrademysqlstatus endpoint, bypassing CSRF protections.

CVE-2022-30190 Proof-Of-Concept

CVE-2024-21762 是 Fortinet 公司的 FortiOS 和 FortiProxy 产品中的一个严重漏洞，存在于其 SSL VPN 组件中。

CVE-2024-35250 的 Beacon Object File (BOF) 实现。

CVE-2023-47246 是 SysAid On-Premise 软件（版本 23.3.36 之前）中的一个路径遍历漏洞。攻击者可以利用该漏洞将文件写入 Tomcat 的 webroot 目录，从而在服务器上执行任意代码。

CVE-2024-23692 是影响 Rejetto HTTP File Server（HFS）2.3m 及之前版本的模板注入漏洞。该漏洞允许远程未授权的攻击者通过发送特制的 HTTP 请求，在受影响的系统上执行任意命令。

Some scripts to simulate an attack (used for CVE-2024-21626)