copyfail-deconstructed

copyfail-deconstructed 易于理解的 CVE-2026-31431 版本，这是一种允许任何人成为 root 的权限提升技术。原始概念验证位于：https://github.com/theori-io/copy-fail-CVE-2026-31431，但经过高度压缩和混淆，以尽可能减小体积。本仓库试图以更易读的方式分解该代码，包括代码的作用、payload 的加载方式以及如何针对不同架构。更多技术细节请参见：https://xint.io/blog/copy-fail-linux-distributions。 使用方法 默认情况下，运行 python3...

Linux-CopyFail-C-Version-CVE-2026-31431

Linux CopyFail- Versión en C - CVE-2026-31431 Versión limpia en C de Copy Fail CVE-2026-31431: exploit de escalada de privilegios local en Linux que utiliza la primitiva AFALG + authencesn + splice. Sobrescribe la caché de páginas de /usr/bin/su con un pequeño shellcode setuid para obtener...

CVE-2026-31431-rs

PoC CVE-2026-31431 copyfail Estructura root@kitploit: src/ ├── main.rs Exploit: AFALG + splice para sobrescribir /bin/su └── bin/ └── payload.rs Payload Binarios nostd autocontenidos con cero dependencias en tiempo de ejecución: poc-rs: 4.1 KB payload incrustado mediante includebytes! payload: 1....

cve-2026-31431

CVE-2026-31431 This document describes a public Python exploit related to the CVE-2026-31431 vulnerability. The code demonstrates the exploitation of the flaw using primitives from the Linux AFALG subsystem, AEAD cryptographic operations, and memory manipulation via splice, with the goal of...

SunOS <= 4.1.3 LD_LIBRARY_PATH and LD_OPTIONS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/43/info There exists a vulnerability involving environment variables and setuid/setgid programs under SunOS 4.0 and higher. A dynamically-linked program that is invoked by a setuid/setgid program has access to the caller'...

Linux Kernel 3.0 3.3.5 - CLONE_NEWUSER|CLONE_FS Local Privilege Escalation

Linux Kernel 3.0 3.3.5 - CLONENEWUSER|CLONEFS Local Privilege Escalation / source: https://www.securityfocus.com/bid/58478/info Linux kernel is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to gain kernel privileges, which will aid in further attacks....

GLIBC (via /bin/su) Local Root Exploit

No description provided by source. / Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of /bin/su program with the address of the shellcode, so, the program executes it when main returns or exit is called Thanks a lot to rwxrwxr...

CVE-2002-2039

In QNX RTOS versions 4.25 and 6.1.0, /bin/su allows local users to read sensitive information from core dump files by sending SIGSERV (invalid memory reference); impact is partial confidentiality. The description notes the local privilege/impact but does not provide exploitable details, affected ...

GLIBC - '/bin/su' Local Privilege Escalation

/ Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of /bin/su program with the address of the shellcode, so, the program executes it when main returns or exit is called Thanks a lot to rwxrwxrwx for explaining me this technique...