Catálogo de exploits

kaisaryousuf/CVE-2018-8208

Implements the POP/MOV SS (CVE-2018-8897) vulnerability by leveraging SYSCALL to perform a local privilege escalation (LPE).

Exploit for CVE-2018-4233, a WebKit JIT optimization bug used during Pwn2Own 2018

Foxit Reader version 9.0.1.1049 Use After Free with ASLR and DEP bypass on heap

A Burp extension to detect and exploit versions of Telerik Web UI vulnerable to CVE-2017-9248.

CVE-2007-2447 - Samba usermap script

Crestron AirMedia AM-100 Traversal and Hashdump Metasploit Modules

on Mac 10.12.2

A demo exploit of CVE-2016-9079 on Ubuntu x64

PercussiveElbow/CVE-2004-2271-MiniShare-1.4.1-Buffer-Overflow

CVE-2013-6117

This Python 3 script is for uploading shell (and other files) to Windows Server / Linux via Oracle 11g R2 (CVE-2010-3600).

likekabin/CVE-2018-4121

likekabin/ShareDoc_cve-2015-5477

Collection of exploits/POC for PrestaShop cookie vulnerabilities (CVE-2018-13784)

Linux Null pointer dereference

happynote3966/CVE-2018-7602

happynote3966/CVE-2018-7600

dd

happynote3966/CVE-2014-3704

XML external entity (XXE) vulnerability in /ssc/fm-ws/services in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10 (0day CVE-2018-12463)

Analysis of VBS exploit CVE-2018-8174

lonehand/Oracle-WebLogic-CVE-2017-10271-master

likekabin/CVE-2018-2628

Aruthw/CVE-2014-6271

qy1202/https-github.com-Ridter-CVE-2017-11882-

Exploitable target to CVE-2017-5638

stevenlinfeng/CVE-2018-2628

Rig Exploit for CVE-2018-8174 As with its previous campaigns, Rig’s Seamless campaign uses malvertising. In this case, the malvertisements have a hidden iframe that redirects victims to Rig’s landing page, which includes an exploit for CVE-2018-8174 and shellcode. This enables remote code execution of the shellcode obfuscated in the landing page. After successful exploitation, a second-stage downloader is retrieved, which appears to be a variant of SmokeLoader due to the URL. It would then download the final payload, a Monero miner.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Text Annotations. When setting the point attribute, the process does not properly validate the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process.