#1Tools for creating and customizing malicious code or instructions to execute after exploitation.
Kitploit recommended

Created this exploit for the Hack The Box machine, Blurry.

Python exploit for CVE-2017-11882, a buffer overflow in Microsoft Office Equation Editor, enabling remote code execution via crafted OLE objects.

Just simple PoC for the Atlassian Jira exploit. Provides code execution for unauthorised user on a server.

Icecast Header Overwrite buffer overflow RCE < 2.0.1 (Win32)

Modified standalone exploit ported for Python 3

Python RCE exploit for Apache Spark rewritten from Metasploit module

Standalone Python ≥3.6 RCE Unauthenticated exploit for Supervisor 3.0a1 to 3.3.2

Docker-based proof-of-concept for CVE-2022-22965 (Spring4Shell) remote code execution vulnerability in Spring Boot 2.6.5, with automated webshell…

Simple iOS bootlooper using CVE-2022-46689. Desguised as onlyfans

Scanner and proof-of-concept exploit for Log4j RCE (CVE-2021-44228). Creates a vulnerable application and runs the exploit with a netcat listener.

Proof-of-concept for authenticated arbitrary file upload in Sitecore 10.3, enabling webshell deployment and remote code execution via the import…

Proof-of-concept for CSV injection in Addactis IBNRS 3.10.3.107, demonstrating Excel formula injection leading to OS command execution via crafted…

Working proof-of-concept exploit for CVE-2019-0708 (BlueKeep) that spawns a remote shell on vulnerable Windows systems. Run with Python 3.

AndroRAT is a capability that can be used to inject a root exploit as a silent installation to perform a malicious task on the device. This AndroRAT…

Python implementation of Minsky's Universal Turing Machine with a built-in exploit demonstrating arbitrary code execution (CVE-2021-32471) for…

Python PoC for CVE-2025-29306, a parameter injection RCE in FOXCMS v1.2. Injects PHP code via the id parameter on /images/index.html for authorized…

CVE-2015-6967 PoC Exploit

Python-based exploit for CVE-2021-21086 in Adobe Acrobat Reader DC, generating malicious PDFs with shellcode execution via crafted font charstrings.