Skip to content
KitploitKITPLOIT
도구블로그
제출
도구블로그
제출

해킹, 침투 테스트 및 사이버 보안 도구를 당신의 보안 무기고에!

Kitploit은 해킹, 사이버 보안 및 침투 테스트 도구 디렉토리입니다. 최신 프로젝트 업데이트를 발견하여 취약점을 찾고, 시스템을 분석하고, 테스트를 자동화하고, 보안을 강화하세요.

··피드·문의·개인정보·© 2026 Kitploit

도구 디렉토리

카테고리

모든 카테고리 보기
Loading categories
도구/GitHubGitHub/m4xsec/my-exploits
Container SecurityExploit FrameworksVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCloud SecurityLearning & EducationPayload DevelopmentLabs & Practice
GitHubm4xsec/my-exploits
11119일 전아직 검토되지 않음

인기

모두 보기 →

커뮤니티에서 가장 많이 사용되는 도구를 찾아보세요.

모든 도구 탐색

도구 컬렉션을 둘러보세요

모든 도구 보기 →
공유

My-Exploits

Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474).

저장소 보기
요청한 언어로 콘텐츠를 사용할 수 없습니다. 영어 버전을 표시합니다.

My-Exploits

Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of concept, and a small Docker lab that stands up only the vulnerable service so anyone can reproduce the bug without taking my word for it.

Nothing here targets a live environment. The labs are throwaway containers on your own host.

Findings

CVEComponentClassAffectedMetasploitPoCLab
CVE-2026-18963KeycloakReset-credentials sticky-selector account takeover< 26.7.2yesyesyes
CVE-2026-39816Apache NiFiTinkerpop / ExecuteGraphQuery Groovy RCE past the execute-code gate2.0.0-M1 .. 2.8.0yesyesyes
CVE-2026-5006HashiCorp VaultTemplated-policy metadata slash injection (HCSEC-2026-32)<= 2.0.3yesyesyes
CVE-2026-7474HashiCorp NomadDynamic host-volume plugin_id path traversal to root (HCSEC-2026-15)<= 2.0.0yesyes

Layout

root@kitploit:~
metasploit-custom-modules/   Metasploit modules + module docs, in the normal framework tree
exploits/                    one self-contained Python PoC per CVE
docker-lab/                  one throwaway Docker lab per CVE, spins up only the vulnerable service

Each of those three has its own README with the details. Short version:

  • metasploit-custom-modules/ drops straight into a framework checkout (or your ~/.msf4). Three modules: the Keycloak takeover, the Vault metadata slash injection, and the NiFi RCE.
  • exploits/ is four dependency-light Python scripts, one per CVE. They run against the matching lab with no edits.
  • docker-lab/ is four independent labs. Each pins the last vulnerable release, wires up whatever the bug actually needs (the graph bundle for NiFi, a real Docker engine for Nomad), and nothing more. No flags, no chained scenario, just the bug.

Reproducing a finding

Pick a CVE, bring its lab up, fire the PoC. For example, Keycloak:

root@kitploit:~
cd docker-lab/keycloak-cve-2026-18963
docker compose up -d
cd ../..
python3 exploits/kc_ato_18963.py \
    --base http://127.0.0.1:8080 --realm larkspur \
    --victim j.okonkwo --newpass Chang3d-by-attacker!

The other three follow the same pattern. Read the per-lab README first, a couple of them need --build and a minute to provision.

Disclosure

All four were reported to the respective vendors and are fixed in the versions noted above. Everything published here runs against the deliberately outdated images in docker-lab/. Point it at anything you do not own and that is on you.

License

MIT. See LICENSE.

도구 다운로드