Exploit for GitLab CVE-2021-22205 Unauthenticated Remote Code Execution

Last update: Dec 30, 2021

Overview

Vuln Impact

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Affected Version

Gitlab CE/EE < 13.10.3
Gitlab CE/EE < 13.9.6
Gitlab CE/EE < 13.8.8

Vuln Impact

Soon...

Reference

https://github.com/mr-r3bot/Gitlab-CVE-2021-22205

https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html

https://github.com/Al1ex/CVE-2021-22205

Owner

Hendrik Agung

uwuwu~

GitHub Repository

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).

Flask-SeaSurf SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF). CSRF vulnerabilities have been found in large and popular

183 Dec 28, 2022

Log4j-Scanner with Bind-Receipt and custom hostnames

Hrafna - Log4j-Scanner for the masses Features Scanning-system designed to check your own infra for vulnerable log4j-installations start and stop scan

18 Jan 23, 2022

Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack

O365DevicePhish Microsoft365_devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack This is a simple proof-of-concept script t

4 Sep 23, 2022

Exploit grafana Pre-Auth LFI

Grafana-LFI-8.x Exploit grafana Pre-Auth LFI How to use python3

2 Jul 25, 2022

A simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities

master_librarian A simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities. To install requirements: $ sudo pyth

167 Dec 19, 2022

Python3 script for scanning CVE-2021-44228 (Log4shell) vulnerable machines.

Log4j_checker.py (CVE-2021-44228) Description This Python3 script tries to look for servers vulnerable to CVE-2021-44228, also known as Log4Shell, a v

8 Feb 27, 2022

A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye

MotionEye/MotionEyeOS Authenticated RCE A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye. You need administrator crede

1 Apr 18, 2022

A CTF2.5/MMF2 Decompiler

CondaDEV A CTF2.5/MMF2 Decompiler What is CondaDEV? CondaDEV (anaCondaDEVeloper) is a fork of Anaconda Mode 4.1, with a lot of Quality of Life patches

4 Mar 07, 2022

Um script simples de Port Scan + DNS by Hostname

🖥 PortScan-DNS Esta é uma ferramenta simples de Port Scan + DNS by Hostname... 💻 | DNS Resolver / by Hostname: HOST IP EXTERNO IP INTERNO 💻 | Port

7 Dec 08, 2022

Threat research and reporting from IronNet's Threat Research Teams

IronNet Threat Research 🕵️ Overview This repository contains IronNet's Threat Research. Research & Reporting 📝 Project Description Cobalt Strike Res

36 Dec 02, 2022

proxyshell payload generate

Py Permutative Encoding https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-pst/5faf4800-645d-49d1-9457-2ac40eb467bd Generate proxyshell

63 Nov 15, 2022

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1

CVE-2021-22911 Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1 The getPasswordPolicy method is vulnerable to NoS

47 Nov 09, 2022

Simple Python 3 script to detect the "Log4j" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreading

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreading The script

187 Jan 03, 2023

FBGen is simple facebook user based wordlist generator using Username/ID and cookie.

2 Jul 20, 2022

This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to the attack classes defined and curated malapi.io.

F2Amapper This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to

3 Sep 03, 2022

Exploit for GitLab CVE-2021-22205 Unauthenticated Remote Code Execution

Related tags

Overview

Vuln Impact

Affected Version

Vuln Impact

Reference

Owner

Hendrik Agung

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).

Log4j-Scanner with Bind-Receipt and custom hostnames

Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack

Exploit grafana Pre-Auth LFI

A simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities

Python3 script for scanning CVE-2021-44228 (Log4shell) vulnerable machines.

A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye

A CTF2.5/MMF2 Decompiler

Um script simples de Port Scan + DNS by Hostname

Threat research and reporting from IronNet's Threat Research Teams

proxyshell payload generate

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1

Simple Python 3 script to detect the "Log4j" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreading

FBGen is simple facebook user based wordlist generator using Username/ID and cookie.

This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to the attack classes defined and curated malapi.io.

A Python script that can be used to check if a SAP system is affected by CVE-2022-22536

Fetch Chrome, Firefox, WiFi password and system info

一个自动挖掘漏洞的框架，日后会发展成强大的信息收集+漏洞挖掘脚本！

CamRaptor is a tool that exploits several vulnerabilities in popular DVR cameras to obtain device credentials.

"Video Moment Retrieval from Text Queries via Single Frame Annotation" in SIGIR 2022.