a394578488
vim plugin
2026-05-07 14:17:43 -04:00
22a9dc4522
Add docs
2026-04-30 14:54:09 -04:00
1d5eae0f5b
Merge pull request #21034 from Chocapikk/add-module-opendcim-sqli-rce
...
Add openDCIM install.php SQLi to RCE module
2026-04-14 16:04:13 -04:00
5b6c2be9d1
Land #21003 , unifies Selenium Firefox and Chrome modules
...
Unified Selenium Grid/Selenoid RCE with Firefox + Chrome auto-detection
2026-04-14 16:32:06 +02:00
0976f88058
Land #20835 , adds module unauthenticated command injection Eclipse Che machine-exec (CVE-2025-12548)
...
Add Eclipse Che machine-exec unauthenticated RCE (CVE-2025-12548)
2026-03-25 14:39:01 +01:00
81faae13ca
Merge pull request #21033 from Alpenlol/barracuda-esg-cve-2023-2868
...
Add exploit for CVE-2023-2868 Barracuda ESG command injection
2026-03-23 13:18:34 -07:00
8ad5924bf1
Fix: Use parent of fix commit (78178d1~1) for vulnerable Encoder checkout
2026-03-13 22:59:51 +01:00
8d44dcd1fb
Fix: Lab setup documentation for first-time environments
...
- Fix DB permissions (bind mount creates files as www-data instead of mysql)
- Force table creation (cli.php skips it when configuration.php already exists)
- Revert entire Encoder working tree, not just getImage.php (78178d1 patched multiple files)
- Run git checkout from inside the container to avoid safe.directory issues
2026-03-13 22:55:23 +01:00
63561130af
Address PR review feedback for CVE-2023-2868 module
2026-03-12 12:59:30 -07:00
f34a0b5d31
Fix: Address PR review feedback for openDCIM module
...
Add ARTIFACTS_ON_DISK side effect and fetch payload note in docs.
2026-03-12 20:44:19 +01:00
5150a4b68b
Docs: Clarify that .compose/encoder is a clone of AVideo-Encoder repo
...
The commit c9861e9c exists in WWBN/AVideo-Encoder (not WWBN/AVideo).
Add a note explaining that .compose/encoder is a git clone created by
the container entrypoint, with a link to the correct repository.
2026-03-11 22:05:23 +01:00
38e74740f3
Fix: Use correct commit hash for vulnerable getImage.php in lab setup
...
The previous commit (e0c2768) did not touch getImage.php. Use c9861e9c
which is the last commit before the security patch (78178d1) that
modifies the file.
2026-03-11 21:23:27 +01:00
dfe73bb4c5
Add exploit for AVideo Encoder getImage.php command injection (CVE-2026-29058)
...
Unauthenticated OS command injection via the base64Url parameter in
getImage.php. The URL is interpolated into an ffmpeg shell command
without escapeshellarg(), and FILTER_VALIDATE_URL does not block
shell metacharacters in the URL path.
2026-03-06 21:30:12 +01:00
59a1992214
Land #21017 , adds module for SSTI in Tactical RMM (CVE-2025-69516)
...
Add Tactical RMM Jinja2 SSTI RCE module (CVE-2025-69516)
2026-03-05 15:38:32 +01:00
2d8c3d69ed
Feat: Add openDCIM install.php SQLi to RCE module
...
Exploits CVE-2026-28515, CVE-2026-28516, CVE-2026-28517 to chain
missing authorization, SQL injection, and command injection in
openDCIM's install.php for remote code execution.
2026-02-28 21:13:51 +01:00
782c1d5455
Add exploit for CVE-2023-2868 Barracuda ESG command injection
2026-02-27 23:29:56 -08:00
45c058d6f1
Land #21005 , adds gnu inetutils auth bypass module against a Synology NAS to documentation
...
add dsm target exploitation to gnu telnetd docs
2026-02-25 16:49:30 +01:00
fae76b2961
Land #20978 , adds module BeyondTrust unauth command injection (CVE-2026-1731)
...
Add CVE-2026-1731 support and modernize targets for BeyondTrust PRA/R…
2026-02-25 14:18:59 +01:00
7dcc036b6d
Land #21006 , adds module for Ollama path traversal RCE (CVE-2024-37032)
...
Add Ollama path traversal RCE module (CVE-2024-37032)
2026-02-25 13:06:09 +01:00
002daf8d7d
Merge branch 'beyondtrust-rce-2026' into collab/exploit/beyondtrust/cve-2026-1731
2026-02-25 12:53:37 +01:00
12e21e4c66
Fixes documentation
2026-02-24 12:23:26 -05:00
5aeff61b26
Fix: Address PR review feedback for Ollama RCE module
...
Co-Authored-By: msutovsky-r7 <190406428+msutovsky-r7@users.noreply.github.com >
2026-02-24 17:51:23 +01:00
51af9d0ff1
Adds documentation
2026-02-24 10:25:49 -05:00
1ddee63f05
Merge pull request #20983 from sfewer-r7/0day-grandstream
...
Add exploit (CVE-2026-2329) and auxiliary modules for the Grandstream GXP1600 series
2026-02-24 08:50:42 -06:00
62a466cbed
Land #20819 , adds WSL startup folder persistence module
...
wsl startup folder persistence
2026-02-24 07:59:11 +01:00
bef9b7ad3b
Feat: Add Tactical RMM Jinja2 SSTI RCE module (CVE-2025-69516)
2026-02-23 19:31:22 +01:00
ece2374532
target user for wsl_startup_folder
2026-02-21 21:04:40 -05:00
b17d227d28
Feat: Add Ollama path traversal RCE module (CVE-2024-37032)
2026-02-21 16:52:43 +01:00
a24f53f2b6
add dsm exploitation to telnetd docs
2026-02-21 10:27:47 -05:00
638b47ebf3
Feat: Unified Selenium Grid/Selenoid RCE with Firefox + Chrome auto-detection
...
Replace separate Chrome and Firefox modules with a single module that
auto-detects available browsers and picks the best attack vector.
Firefox profile handler preferred (unpatched on all Grid versions).
Remove incorrect CSRF framing, sudo wrapper, add FileDropper and
Selenoid support.
2026-02-21 14:41:42 +01:00
3dd3661352
Feat: Add Selenoid support to Selenium Grid Chrome RCE module
2026-02-21 12:34:09 +01:00
9e72f45349
Feat: Add Selenium Grid Chrome binary override RCE module
2026-02-21 12:07:08 +01:00
1f547f19fb
Merge pull request #20832 from DataExplorerX/doc-linux-samba-module
...
Add documentation for linux/samba/chain_reply module (CVE-2004-0883)
2026-02-20 18:12:05 -06:00
7f8b18d7dc
Update documentation/modules/exploit/linux/samba/chain_reply.md
2026-02-20 17:45:14 -06:00
fcb41a2275
Update documentation/modules/exploit/linux/samba/chain_reply.md
...
Update documentation to point to a specific wayback machine page since the original does not exist, and a few of the wayback machine links are also broken.
2026-02-20 17:42:34 -06:00
36b29fb458
Add vulnerable environment setup guide to module documentation
...
Step-by-step minikube-based setup for deploying a vulnerable
che-machine-exec instance for module verification.
2026-02-19 11:27:27 +00:00
c6f7d03d03
Merge pull request #20919 from h00die/emacs
...
emacs extension persistence
2026-02-18 10:58:13 -05:00
08efa9cd16
add in the Grandstream modules
2026-02-17 22:33:46 +00:00
4adf87ac18
Merge pull request #20929 from jheysel-r7/feat/mod/cve-2026-24061
...
GNU Inetutils Telnet Auth Bypass (CVE-2026-24061)
2026-02-11 11:12:29 -08:00
f632cf34bf
add in a module and docs fo rteh EPMM exploit
2026-02-05 12:26:38 +00:00
bd049dcba4
doc update
2026-02-03 18:41:51 -08:00
a868bc95b2
GNU Inetutils Telnet Auth Bypass
2026-02-03 17:45:59 -08:00
75ff7b6af1
emacs extension persistence
2026-01-31 22:54:18 -05:00
c47a74d0dd
Merge pull request #20770 from vognik/Splunk_2022-43571_CVE-2024-36985
...
Add Splunk RCE Exploits (CVE-2022-43571 & CVE-2024-36985)
2026-01-20 12:36:51 -08:00
7b092aeedb
Land #20806 , adds module for unauthenticated command injection in Control Web Panel API (CVE-2025-67888)
...
Adds module for Control Web Panel API Command Injection (CVE-2025-67888)
2026-01-14 15:44:25 +01:00
472016b753
Land #20796 , moves udev module into persistence category
...
update udev to persistence mixin
2026-01-09 16:14:08 +01:00
be9b2c9491
Add documentation for prison_management_rce
2026-01-06 12:33:49 +02:00
ae8ab28eed
Fix msftidy_docs warnings in chain_reply documentation
2026-01-05 16:01:16 +05:30
c225256956
Add meterpreter scenario and redact IPs in documentation
2025-12-31 15:37:46 +00:00
475846ea2a
Add Eclipse Che machine-exec unauthenticated RCE (CVE-2025-12548)
...
This module exploits an unauthenticated RCE vulnerability in the
Eclipse Che machine-exec service. The service accepts WebSocket
connections without authentication on port 3333, allowing command
execution via JSON-RPC.
Affects Red Hat OpenShift DevSpaces environments.
2025-12-30 21:14:55 +00:00
h00die