Every new exploit,
on the radar.

Windows LPE

A firebeam plugin that exploits the CVE-2024-26229 vulnerability to perform elevation of privilege from a unprivileged user

BOF implementations of CVE-2024-26229 for Cobalt Strike and BruteRatel

Windows CSC服务特权提升漏洞。 当程序向缓冲区写入的数据超出其处理能力时，就会发生基于堆的缓冲区溢出，从而导致多余的数据溢出到相邻的内存区域。这种溢出会损坏内存，并可能使攻击者能够执行任意代码或未经授权访问系统。本质上，攻击者可以编写触发溢出的恶意代码或输入，从而控制受影响的系统、执行任意命令、安装恶意软…

CWE-781: Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code

Nim touch up of CVE 2024 26229

Windows LPE

LPE exploit for CVE-2023-36802

Exploit for CVE-2023-36802 targeting MSKSSRV.SYS driver

PoC for CVE-2023-36802 Microsoft Kernel Streaming Service Proxy

CVE-2023-36802 ITW case

Reverse engineering and vulnerability research on CVE-2023-36802, focusing on object type confusion in mksssrv.sys.

Old CVE, but new way to leak everything.

POC exploit for CVE-2025-21333 heap-based buffer overflow. It leverages WNF state data and I/O ring IOP_MC_BUFFER_ENTRY

LPE due to integer truncation in vskrnlintvsp.sys

KQL para deteccion de CVE-2025-21333 en Sentinel

ES File Explorer Open Port Vulnerability - CVE-2019-6447

Exploiting Android Vulnerability in ES File Explorer

ES File Explorer Open Port Vulnerability - CVE-2019-6447

Very basic bash script to exploit the CVE-2019-6447.

ES File Explorer v4.1.9.7.4 Open port vulnerability exploit. CVE-2019-6447

This repository is developed to understand CVE-2019-6447

Proof of Concept for CVE-2019-18634

A functional exploit for CVE-2019-18634, a BSS overflow in sudo's pwfeedback feature that allows for for privesc

My n-day exploit for CVE-2019-18634 (local privilege escalation)

A reproduction of CVE-2019-18634, sudo privilege escalation with buffer overflow.

An Python Exploit for Sudo vulnerability CVE-2019-18634

exploit for sudo CVE-2019-18634

exploit

PoC Exploit for the NTLM reflection SMB flaw.

Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled.

Proof-of-Concept

cupntlm

PoC Exploit for the NTLM reflection SMB flaw.

This rough PoC checker script tests targets for CVE-2025-33073 vulnerability by attempting to perform NTLM reflection attacks using NTLM auth coercion via samb…

Apache Tomcat Remote Code Execution on Windows

Apache Tomcat Remote Code Execution on Windows - CGI-BIN

Vulnerability analysis and PoC for the Apache Tomcat - CGIServlet enableCmdLineArguments Remote Code Execution (RCE)

CVE-2019-0232-Remote Code Execution on Apache Tomcat 7.0.42

Hi this is a revised and enhanced code for CVE-2019-0232

Proof-of-Concept for CVE-2023-38146 ("ThemeBleed")

PoC for the ThemeBleed Windows 11 CVE-2023-38146 written in python using impacket. https://jnns.de/posts/cve-2023-38146-poc/

A proof of concept using python for the CVE-2023-38146 "ThemeBleed"

Better POC

POC for CVE-2021-21974 VMWare ESXi RCE Exploit

自研针对ESXI 堆栈溢出的CVE-2021-21974 POC，只支持项目给出的的目标和环境，用于学习和研究

Analysis of the ransom demands from Shodan results

ESXi EZ - A custom scanner that takes list of IPs either in JSON, CSV or individually and checks for infection CVE-2021-21974

Nmap NSE script for cve-2021-21974

CVE-2021-21974 Vulnerability Detection Tool Safe PoC that identifies vulnerable SLP implementations without exploitation

一款针对Vcenter的综合利用工具，包含目前最主流的CVE-2021-21972、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、CVE-2022-22972/31656以及log4j，提供一键上传webshell，命令执行或者上传公钥使用SSH免密…

POC for VMWARE CVE-2022-22954

CVE-2022-22954 VMware Workspace ONE Access freemarker SSTI 漏洞 命令执行、批量检测脚本、文件写入

VMware Workspace ONE Access and Identity Manager RCE via SSTI - Test script for shodan, file or manual.

提供批量扫描URL以及执行命令功能。Workspace ONE Access 模板注入漏洞，可执行任意代码

CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspace ONE Access and Identity Manager

PoC for CVE-2022-22954 - VMware Workspace ONE Access Freemarker Server-Side Template Injection

Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

Python implementation for CVE-2021-42278 (Active Directory Privilege Escalation)

Exploiting CVE-2021-42278 and CVE-2021-42287

Detection script for CVE-2021-42278 and CVE-2021-42287

Go implementation of NoPac, exploiting CVE-2021-42278 and CVE-2021-42287

WSO2 RCE (CVE-2022-29464) exploit and writeup.

😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

A bots loader for CVE-2022-29464 with multithreading

Perform With Mass Exploits In WSO Management.

RCE exploit for WSO2

cve-2022-29464 批量脚本

WSO2 RCE (CVE-2022-29464)

Python script to exploit CVE-2022-29464 (mass mode)

A Python script to exploit CVE-2022-36446 Software Package Updates RCE (Authenticated) on Webmin < 1.997.

CVE-2022-36446 - Webmin 1.996 Remote Code Execution

CVE-2022-36446 POC 실습

Script de python para Webmin 1.996

Chrome extension that uses vulnerabilities CVE-2021-33044 and CVE-2021-33045 to log in to Dahua cameras without authentication.

Dahua IP camera CVE research toolkit (CVE-2021-33044/33045, CVE-2025-31700/31701)

Dahua IPC/VTH/VTO devices auth bypass exploit

Camera Dahua Research lỗ hổng CVE-2021-33044

DAHUA_AUTH-BYPASS-CVE-2021-33044

CVE-2020-5902 BIG-IP

Proof of concept for CVE-2020-5902

F5 BIG-IP RCE CVE-2020-5902 automatic check tool

Automated script for F5 BIG-IP scanner (CVE-2020-5902) using hosts retrieved from Shodan API.

exploit code for F5-Big-IP (CVE-2020-5902)

Python script to exploit F5 Big-IP CVE-2020-5902

F5 BIG-IP 任意文件读取+远程命令执行RCE

CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost

Scanner for CVE-2020-0796 - SMBv3 RCE

CVE-2020-0796 Remote Code Execution POC

SMBGhost (CVE-2020-0796) Automate Exploitation and Detection

PoC for triggering buffer overflow via CVE-2020-0796

CVE-2020-0796 Local Privilege Escalation POC

Cobalt Strike AggressorScripts CVE-2020-0796

A reliable exploit + write-up to elevate privileges to root. (Tested on Ubuntu 22.04)

All Credit to MaherAzzouzi (https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit). This is a copy of the exploit for CTFs

Privilege escaltion exploit script for Boardlight machine on HackTheBox. I had access as the Larissa user and ran this script from the /tmp directory; script h…

Exploit created by nu11secur1ty (https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706)

CVE-2022-37706-Enlightenment v0.25.3 - Privilege escalation

PoC

ROOT TOOL

POC for CVE-2024-36991: This exploit will attempt to read Splunk /etc/passwd file.

Path Traversal On The "/Modules/Messaging/" Endpoint In Splunk Enterprise On Windows

Critical Splunk Vulnerability CVE-2024-36991: Patch Now to Prevent Arbitrary File Reads

Proof of Concept for CVE-2024-36991. Path traversal for Splunk versions below 9.2.2, 9.1.5, and 9.0.10 for Windows which allows arbitrary file read.

Path traversal vulnerability in Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10 that allows reading sensitive files.

Exploit for CVE-2024-36991 , written by me, enumerates a handfull of things, not all, cause not needed.

CVE-2024-36991: Path traversal that affects Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10.

This binary POC automates the exploitation of CVE-2024-36991 by sending crafted curl requests to a vulnerable Splunk instance. It retrieves sensitive files and…

Privilege escalation with polkit - CVE-2021-3560

PolicyKit CVE-2021-3560 Exploit (Authentication Agent)

CVE-2021-3560 Local PrivEsc Exploit

a reliable C based exploit and writeup for CVE-2021-3560.

PolicyKit CVE-2021-3560 Exploitation (Authentication Agent)

Exploit for CVE-2021-3560 (Polkit) - Local Privilege Escalation

fixed msf module for cve-2017-7269

iis6 exploit 2017 CVE-2017-7269

CVE-2017-7269 回显PoC ,用于远程漏洞检测..

CVE-2017-7269 to webshell or shellcode loader

An exploit for Microsoft IIS 6.0 CVE-2017-7269

Ruby Exploit for IIS 6.0 Buffer Overflow (CVE-2017-7269)

Kernel exploit for Xbox SystemOS using CVE-2024-30088

该漏洞存在于 NtQueryInformationToken 函数中，特别是在处理AuthzBasepCopyoutInternalSecurityAttributes 函数时，该漏洞源于内核在操作对象时对锁定机制的不当管理，这一失误可能导致恶意实体意外提升权限。

🆘New Windows Kernel Priviledge Escalation Vulnerability

Questa repository contiene una replica (tentativo di replica) scritto in Python per CVE-2024-30088.

Kernel exploit for Xbox SystemOS using CVE-2024-30088

This is a modified version of the original CVE-2024-30088 exploit, adapted to work in non-interactive environments (WinRM).

compiled poc binary local privilege escalation by oilrig

Exploit for command injection vulnerability found in uhttpd binary from TP-Link Tapo c200 IP camera

🔐 "PWNTAPO: Unveiling Command Injection in TP-Link Tapo C200 Cameras (<= v1.1.16 Build 211209)" 🔓

TP-Link Tapo c200 ver <1.1.15 - Remote Code Execution (RCE)

Sets up a local Tapo C200 using CVE-2021-4045

CVE-2021-4045 CVE-2021-4045 is a Command Injection vulnerability that allows Remote Code Execution in the TP-Link Tapo c200 IP camera. It affects all firmware …

LPE exploit for CVE-2023-21768

Using CVE-2023-21768 to manual map kernel mode driver

Windows_AFD_LPE_CVE-2023-21768

cve-2023-21768

CVE-2023-21768 Windows 11 22H2 系统本地提权 POC

C# / .NET version of CVE-2023-21768

MOVEit CVE-2023-34362

CVE-2023-34362: MOVEit Transfer Unauthenticated RCE

POC for CVE-2023-34362 affecting MOVEit Transfer

Repository with everything I have tracking the impact of MOVEit CVE-2023-34362

CVE-2023-34362-IOCs. More information on Deep Instinct's blog site.

an exploit of POC for CVE-2023-34362 affecting MOVEit Transfer

This shellscript given the OrgKey 0 will parse the header of the base64 artifacts found in MOVEit Logs and decrypt the Serialized object used a payload

CVE-2024-0044: a "run-as any app" high-severity vulnerability affecting Android versions 12 and 13

RunAsAnyone: PoC and writeup for bypassing the initial patch of CVE-2024-0044, Android run-as any app vulnerability allowing privilege escalation from adb to i…

Exfiltrate sensitive user data from apps on Android 12 and 13 using CVE-2024-0044 vulnerability remotely

EvilDroid automates the exploitation of CVE-2024-0044, installing malicious payloads on a target device and extracting sensitive data. It features automated AD…

利用 CVE-2024-0044 Android 权限提升下载任意目标App沙箱文件。

CVE-2024-0044

a vulnerability affecting Android version 12 & 13

CVE-2024-0044: uma vulnerabilidade de alta gravidade do tipo "executar como qualquer aplicativo" que afeta as versões 12 e 13 do Android