Exploits

Project information

Miscellaneous proof of concept exploit code written at Xiphos Research for testing purposes. phpMoAdmin(CVE-2015-2208) LotusCMS(OSVDB-75095) ElasticSearch(CVE-2015-1427) ShellShock (httpd) (CVE-2014-6271) IISlap - http.sys Denial of Service/RCE PoC (DoS only). (MS-15-034) se0wned -remote root WPsh0pwn - (WPVDB-7830) nmediapwn - Wordpress N-Media Website Contact Form with File Upload 1.3.4 Shell Upload pwnflow - file upload 2.5.2 Shell Upload delusions - Shell Upload (CVE-2014-6446) suiteshell - (CVE-2015-NOTYET) suiteracer - (CVE-2015-xxxx) unsanitary - Address Sanitizer + Setuid Binary = Local Root exploit (LD_PRELOAD vector) DiamondFox - Shell Upload DoubtfullyMalignant - BenignCertain DoS PoC TorCT-Shell - Shell Upload vBullshit - (CVE-2015-7808) Xanity-Shell - Shell Upload Joomraa - PoC + upload blacklist bypass (CVE-2016-8869, CVE-2016-8870, CVE-2016-9836) Deathsize - remote code execution & local root exploit AssetExploder - remote code execution DroppleGanger - Droppler <= 1.6.5 Auth-Bypass & RCE tr-06fail - remote device takeover in ZyXEL Routers screen2root - (CVE-2017-5618) local privesc FreeACS-Pwn - disclosed at BSides Edinburgh. Joomblah - SQL Injection exploit (CVE-2017-8917) pisspoorpool - Local file inclusion exploit for p2pool status page wipgpwn - Remote Root Exploit for WePresent WiPG-1000,1500,2000 devices dloser - D-Link DNS-320/330/350/x Remote Root Exploit TBA