What is in this dump?

All of these exploits are originally coded by oxagast / Marshall Whittaker. Some of them were already known vulnerabilities that I took and re-evaluated then wrote an exploit for them that I thought was more functional or logical in some way. Some of these vulnerabiltiies are partial PoC exploits that will make something crash, but not actually get root. Some will straight drop you at a root shell. None of this code should ever under any circumstances be run in a production environment, or on a system that you do not have express permission to run a penetration test on.

Word of warning: some of this code breaks things. Read it before running it.

TIP: You can access a plaintext version of each exploit by removing the slash, and appending .txt after the exploit’s file extension.
Example: https://oxasploits.com/exploits/cve-2024-23824-nginxui-api-injection.rb turns into https://oxasploits.com/exploits/cve-2024-23824-nginxui-api-injection.rb.txt

NEW: You can also access an updated RSS feed to grab exploits as I release them!

• Webmin remote root CVE-2006-3392
• Perl pipe local shell CVE-2010-2626
• Pk5001z router exploit CVE-2016-10401
• HP iMC dbman.exe PLAT CVE-2017-5816
• udisks 2.8.0 mem courruption CVE-2018-17336
• Kernel 4.15.x i915 driver exploit CVE-2019-12881
• Bitcoin Core client design flaw CVE-2019-15947
• Polkit/dbus/sudo exploit CVE-2021-3560
• Arbitrary file pushing via MITM'd network for AOL AIM.
• OpenSSH 9.2 Read any file as root
• Shadow-utils long shell variable bug.
• IPSet for netfilter buffer overflow.
• A bash wildcard expansion abuse case.
• Samsung Galaxy S8 BT HID/HCI_EVT injection attack
• Nginx API Injection MSF module
• Django SSPanel good create RCE MSF module
• Boche Netrunner hardcoded creds RCE

There is also a GitHub repo that contains all of the above exploits and more.

Email me at oxagast@oxasploits.com for any questions, comments, or if you have an idea for an interesting target you may want to collaborate on!