## https://sploitus.com/exploit?id=1FED74CF-F50C-50E7-8FEA-A4C7E3F96253
# 🧨 Exploits Used
This folder documents the exploits used during the Kioptrix Level 3 assessment. Exploit source code itself is **not reproduced here** — each is linked to its original public source, both for attribution and because tracking the upstream version is safer than a possibly-stale local copy.
---
## 1. LotusCMS `eval()` Remote Code Execution
- **Type:** Remote Code Execution (web application)
- **Affects:** LotusCMS 3.0
- **Root cause:** User-controlled input passed into PHP's `eval()` inside the CMS routing logic
- **Used as:** Metasploit module `exploit/multi/http/lcms_php_exec` (attempted first, did not create a session), followed by the manual `lotusRCE.sh` proof-of-concept script
- **Source:** https://github.com/Hood3dRob1n/LotusCMS-Exploit
- **Original write-up:** http://secunia.com/secunia_research/2011-21/
## 2. Dirty COW — Local Privilege Escalation
- **Type:** Local Privilege Escalation
- **Affects:** Linux kernel 2.6.22 < 3.9 (CVE-2016-5195)
- **Root cause:** Race condition in the kernel's copy-on-write (COW) memory handling, allowing a local user to write to memory mappings that should be read-only
- **Used as:** The `/etc/passwd`-method variant, compiled on-target with `gcc -pthread dirty.c -o dirty -lcrypt`
- **Source:** https://www.exploit-db.com/exploits/40839
- **CVE:** https://nvd.nist.gov/vuln/detail/CVE-2016-5195
---
## ⚠️ Usage Note
Both exploits target software that has been patched for years. They are referenced here purely as part of documenting a completed lab exercise in an isolated environment, not as a toolkit for use against systems you don't own or have explicit authorization to test.