Metasploit Framework is the world's most widely used penetration testing platform, with over 39,000 stars and 14,000 forks. It is a modular Ruby application that provides a comprehensive suite of exploit, auxiliary, post-exploitation, payload, encoder, and nop modules. The core architecture separates low-level networking and protocol handling (Rex library) from higher-level module logic, and includes a Rails-based web service layer offering REST and JSON-RPC APIs for remote control and automation. Key entry points include the console CLI (msfconsole), payload generator (msfvenom), and RPC daemon (msfrpcd). Production data flows involve user interaction via console or API, module execution against targets over protocols like HTTP, SMB, Kerberos, and LDAP, establishment of sessions (shell, meterpreter, etc.), and storage of results (credentials, loot, events) in a PostgreSQL database via ActiveRecord. External dependencies include Ruby 3.3.8, PostgreSQL, and optional tools like nmap, John the Ripper, and mingw-w64 for cross-compilation. The framework is actively maintained with daily commits, extensive CI/CD (GitHub Actions for lint, unit tests, acceptance tests), and a well-structured codebase with over 15,000 files.
This repository contains a proof-of-concept exploit for CVE-2026-41089, a critical stack buffer overflow in the Windows Netlogon service via CLDAP (UDP 389). The poc.py script sends a malformed LDAP search request with an oversized username to trigger the vulnerability, causing LSASS to crash and the domain controller to reboot. The implementation includes correct BER/DER encoding primitives for LDAP packet construction, which can be reused in other projects requiring LDAP protocol handling.
This repository is a comprehensive collection of vulnerability proof-of-concept (PoC) exploits and detailed write-ups, primarily targeting Chinese enterprise software (OA, ERP, CMS, network devices, etc.). It contains over 1000 vulnerability entries organized by year and CVE identifier, each with structured risk assessments, HTTP request/response PoCs, FOFA search queries for asset discovery, and custom Snort/Suricata detection rules. The repository also includes executable Python scripts and YAML nuclei templates for automated exploitation and detection. While the majority of content is documentation, the scripts provide reusable scanning patterns with threading, proxy support, and output saving. The code quality is functional but basic, with many single-file scripts. The repository is actively maintained and serves as a practical reference for penetration testers and security researchers, though some CVE numbers appear speculative and PoCs may rely on future-dated vulnerabilities.