Microsoft Windows 11 Version 24H2 Cross Device Service – Elevation of Privilege
#!/usr/bin/env python3
local
local 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
macOS LaunchDaemon iOS 17.2 – Privilege Escalation
#!/usr/bin/env python3
ABB Cylon Aspect Studio 3.08.03 – Binary Planting
# Exploit Title: ABB Cylon Aspect Studio 3.08.03 - Binary Planting
Microsoft Windows Server 2016 – Win32k Elevation of Privilege
# Exploit Title: Microsoft Windows Server 2016 - Win32k Elevation of
Zyxel USG FLEX H series uOS 1.31 – Privilege Escalation
# Exploit Title: Zyxel USG FLEX H series uOS 1.31 - Privilege Escalation
TP-Link VN020 F3v(T) TT_V6.2.1021) – DHCP Stack Buffer Overflow
#define _WINSOCK_DEPRECATED_NO_WARNINGS
RDPGuard 9.9.9 – Privilege Escalation
# Exploit Title: RDPGuard 9.9.9 - Privilege Escalation
VirtualBox 7.0.16 – Privilege Escalation
# Exploit Title: VirtualBox 7.0.16 - Privilege Escalation
Microsoft Windows 11 Pro 23H2 – Ancillary Function Driver for WinSock Privilege Escalation
# Exploit Title: Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation
Microsoft – NTLM Hash Disclosure Spoofing (library-ms)
# Exploit title: Microsoft - NTLM Hash Disclosure Spoofing (library-ms)
ZTE ZXV10 H201L – RCE via authentication bypass
# Exploit Title: ZTE ZXV10 H201L - RCE via authentication bypass
Daikin Security Gateway 14 – Remote Password Reset
# Daikin Security Gateway 214 - Remote Password Reset
Microsoft Windows – XRM-MS File NTLM Information Disclosure Spoofing
# Exploit Author: John Page (aka hyp3rlinx)
unzip-stream 0.3.1 – Arbitrary File Write
# Exploit Title: unzip-stream 0.3.1 - Arbitrary File Write
Microsoft Windows 11 – Kernel Privilege Escalation
# Exploit Title: Microsoft Windows 11 - Kernel Privilege Escalation
Microsoft Windows 11 23h2 – CLFS.sys Elevation of Privilege
# Exploit Title: Microsoft Windows 11 23h2 - CLFS.sys Elevation of Privilege
tar-fs 3.0.0 – Arbitrary File Write/Overwrite
# Exploit Title: tar-fs 3.0.0 - Arbitrary File Write/Overwrite
AnyDesk 9.0.1 – Unquoted Service Path
# Exploit Title: AnyDesk 9.0.1 - Unquoted Service Path
ASUS ASMB8 iKVM 1.14.51 – Remote Code Execution (RCE)
# Exploit Title: ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE)
Ruckus IoT Controller 1.7.1.0 – Undocumented Backdoor Account
# Exploit Title: CommScope Ruckus IoT Controller 1.7.1.0 - Undocumented Account
qBittorrent 5.0.1 – MITM RCE
# Exploit Title: qBittorrent 5.0.1 MITM RCE
ollama 0.6.4 – Server Side Request Forgery (SSRF)
# Exploit Title: ollama 0.6.4 - SSRF
Solstice Pod 6.2 – API Session Key Extraction via API Endpoint
# Exploit Title: Solstice Pod API Session Key Extraction via API Endpoint
NVIDIA Container Toolkit 1.16.1 – Time-of-check Time-of-Use (TOCTOU)
# Exploit Title: Container Breakout with NVIDIA Container Toolkit
VeeVPN 1.6.1 – Unquoted Service Path
# Exploit Title: VeeVPN 1.6.1 - 'VeePNService' Unquoted Service Path
Genexus Protection Server 9.7.2.10 – ‘protsrvservice’ Unquoted Service Path
#Exploit Title: Genexus Protection Server 9.7.2.10 - 'protsrvservice' Unquoted Service Path Service Path
SolarWinds Kiwi Syslog Server 9.6.7.1 – Unquoted Service Path
# Exploit Title: SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path
Oracle Database 12c Release 1 – Unquoted Service Path
# Exploit Title: Oracle Database 12c Release 1 - Unquoted Service Path
Bonjour Service ‘mDNSResponder.exe’ – Unquoted Service Path Privilege Escalation
# Exploit Title: Bonjour Service - 'mDNSResponder.exe' Unquoted Service
Plantronics Hub 3.25.1 – Arbitrary File Read
# Exploit Title: Plantronics Hub 3.25.1 – Arbitrary File Read
PrusaSlicer 2.6.1 – Arbitrary code execution
# Exploit Title: PrusaSlicer 2.6.1 - Arbitrary code execution on g-code export
Terratec dmx_6fire USB – Unquoted Service Path
# Exploit Title: Terratec dmx_6fire USB - Unquoted Service Path
AnyDesk 7.0.15 – Unquoted Service Path
# Exploit Title: AnyDesk 7.0.15 - Unquoted Service Path
ESET NOD32 Antivirus 17.0.16.0 – Unquoted Service Path
# Exploit Title: ESET NOD32 Antivirus 17.0.16.0 - Unquoted Service Path
Microsoft Windows Defender – Detection Mitigation Bypass TrojanWin32Powessere.G
[+] Credits: John Page (aka hyp3rlinx)
Microsoft Windows 10.0.17763.5458 – Kernel Privilege Escalation
#############################################
Rapid7 nexpose – ‘nexposeconsole’ Unquoted Service Path
# Exploit Title: Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path
ASUS Control Center Express 01.06.15 – Unquoted Service Path
# Exploit Title: ASUS Control Center Express 01.06.15 - Unquoted Service Path
Dell Security Management Server <1.9.0 - Local Privilege Escalation
# Exploit Title: [title] Dell Security Management Server versions prior to
vm2 – sandbox escape
# Exploit Title: vm2 Sandbox Escape vulnerability
LaborOfficeFree 19.10 – MySQL Root Password Calculator
# Exploit Title: LaborOfficeFree 19.10 MySQL Root Password Calculator - CVE-2024-1346
KiTTY 0.76.1.13 – Command Injection
# Exploit Title: KiTTY 0.76.1.13 - Command Injection
KiTTY 0.76.1.13 – ‘Start Duplicated Session Username’ Buffer Overflow
# Exploit Title: KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow
KiTTY 0.76.1.13 – ‘Start Duplicated Session Hostname’ Buffer Overflow
# Exploit Title: KiTTY 0.76.1.13 - 'Start Duplicated Session Hostname' Buffer Overflow
Microsoft Windows Defender / Trojan.Win32/Powessere.G – Detection Mitigation Bypass
[+] Credits: John Page (aka hyp3rlinx)
A-PDF All to MP3 Converter 2.0.0 – DEP Bypass via HeapCreate + HeapAlloc
#!/usr/bin/python
Windows PowerShell – Event Log Bypass Single Quote Code Execution
[+] Credits: John Page (aka hyp3rlinx)
(shellcode) Linux-x64 – create a shell with execve() sending argument using XOR (/bin//sh) [55 bytes]
# Exploit Title: Linux-x64 - create a shell with execve() sending argument using XOR (/bin//sh) [55 bytes]
Saflok – Key Derication Function Exploit
// Exploit Title: Saflok KDF
Microsoft Windows Defender – VBScript Detection Bypass
[+] Credits: John Page (aka hyp3rlinx)