kernel-exploit-factory

kernel-exploit-factory Keep updating...... Linux kernel CVE exploit analysis report and relative debug environment. You don't need to compile Linux kernel and configure your environment anymore. This repository is to extract all Linux kernel exploit and relative debug environment. You can use Qem...

vulhub

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. 中文版本Chinese version Quick Start Install Docker examp...

page-cache-corruption-lpes

Page Cache Corruption LPEs 3 Linux kernel local privilege escalation exploits. Same bug class as Dirty COW and Dirty Pipe. Root shell in seconds. Every major distro affected. All three corrupt the kernel's page cache — the in-memory copy of files that processes actually read and execute. The...

DirtyPipe-Exploit

CSE 5380: Information Security Paper CVE-2022-0847 Dirty Pipe By Karan Vasudevamurthy UTA ID: 1002164438 What is CVE? Common Vulnerabilities and Exposures CVE is a list of publicly disclosed information security vulnerabilities and exposures. The MITRE corporation introduced CVE in 1999 to identi...

ghostlock-emerald

GhostLock for POCO M6 Pro emerald GhostLock CVE-2026-43499 is a 15-year-old Linux kernel use-after-free in the futex priority-inheritance code that lets any local user gain root. This project uses it to root the POCO M6 Pro MediaTek Helio G99 Ultra / MT6789 and install KernelSU on a locked...

CVE-2021-22555-PipeVersion

CVE-2021-22555 pipe version Using pipe-primitive to exploit CVE-2021-22555, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive Tested on both Linux 4.15 and Linux 5.8...

ScreenOff

ScreenOff CVE-2026-52910 kernel crash poc. ref: https://github.com/5unkn0wn/security-research/tree/CVE-2026-52910ltscosmitigation what socket + SOATTACHREUSEPORTCBPF + setsockopt race. timerfd/epoll callback storm slows down the receive path. replace the cBPF filter while the old prog is still in...

cve-2024-6387-poc

cve-2024-6387-poc a signal handler race condition in OpenSSH's server sshd 7etsuo Description An exploit for CVE-2024-6387, targeting a signal handler race condition in OpenSSH's server sshd on glibc-based Linux systems. The vulnerability allows for remote code execution as root due to...

CVE-2025-39866

CVE-2025-39866 - use-after-free Author: Byte Reaper Description This POC attempts to exploit the CVE-2025-39866 vulnerability, which is a flaw in Linux systems iwb” and schedules the critical free via “wbputmany”. step 3 : - thread 2 : free wbolb - thread 1 - pointer - free object wb free old -...

krie

KRIe KRIe is a research project that aims to detect Linux Kernel exploits with eBPF. KRIe is far from being a bulletproof strategy: from eBPF related limitations to post exploitation detections that might rely on a compromised kernel to emit security events, it is clear that a motivated attacker...

CVE-2022-0847

DIRTY PIPE CVE-2022-0847 This is a kernel vulnerability that allows overwriting of data in arbitrary read-only files, which can therefore lead to privilege escalation since an unprivileged process can write into a privileged process. All credits go to 🥇Max Kellermann for finding the vulnerability...

rvbbit-arsenal

RVBBIT Arsenal: The Ultimate Offense & Defense Duality Overview This repository houses two sides of the same coin: attack/ – Project RVBBIT, a classic Linux kernel rootkit with embedded miner and network worm. defense/ – RvbbitSafe, the definitive countermeasure that detects, neutralizes, and...

ebpfmon

ebpfmon ebpfmon is a tool for monitoring eBPF programs. It is designed to be used with bpftool from the linux kernel. ebpfmon is a TUI terminal UI application written in Go that allows you to do real-time monitoring of eBPF programs. Installation eBPFmon can be built from source or there is a...

optee-qemu

CVE-2021-44733: Fuzzing and exploitation of a use-after-free in the Linux kernel TEE subsystem Recently a use-after-free vulnerability was discovered in the Linux kernel TEE subsystem, up to and including version 5.15.11, and was assigned CVE-2021-44733 1. At a first glance it did not seem to be...

GhostLock-for-OnePlus15T

GhostLock — OnePlus 15T Kernel exploit targeting locked-bootloader OnePlus 15T devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Modified from the originalGhostLock-for-OnePlus...

exploits

exploits CVE-2021-22600: Linux kernel LPE exploit CVE-2021-3156: Linux local privilege escalation through heap overflow in sudo Demo CVE-2021-3156: One shot exploit for heap overflow vulnerability in sudo CVE-2020-6507: Out of bounds write in V8. Chrome versions = 83.0.4103.97. RCE CVE-2020-16040...

kernel-exploits

Kernel Exploits Various kernel exploits CVE-2021-22555 Linux local root exploit. Updated version of theflow's exploit for CVE-2021-22555. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a D...

Dirty-Pipe

CVE-2022-0847 Dirty Pipe Exploit Affected versions =5.8, 5.16.11, 5.15.25 and 5.10.102 exp.c Use this vulnerability to overwrite read-only files exp-root-shell.c Generate shellcode that executes /bin/sh to overwrite a SUID program owned by root, using passwd as an example. Then run the overwritte...

CVE-2026-43284

🚨 CVE-2026-43284 - Dirty Frag 🚨 Universal Linux Kernel Local Privilege Escalation 📋 Overview Dirty Frag also known as Copy Fail 2 is a high-impact local privilege escalation vulnerability in the Linux kernel. It allows an unprivileged local user to obtain root privileges on affected systems...

CVE-2022-32250

CVE-2022-32250 This is my exploit for CVE-2022-32250, written entirely based on the research from NCC Group's blog. Tested on: Kernel version 5.13 Success rate: 70% Building Building requires libmnl and libnftnl. make all Disclaimer The Proof-of-Concept and the write-up of the vulnerability are f...