exploit_mitigations

Exploitation Mitigations The goal is to list exploitation mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability is easily exploitable or not depending on exploitation mitigations in place. An example is the...

LooneyPwner

LooneyPwner Exploit tool for CVE-2023-4911, targeting the 'Looney Tunables' glibc vulnerability in various Linux distributions. LooneyPwner is a proof-of-concept PoC exploit tool targeting the critical buffer overflow vulnerability, nicknamed "Looney Tunables," found in the GNU C Library glibc...

heaptrace

About heaptrace is a heap debugger for tracking glibc heap operations in ELF64 x8664 binaries. Its purpose is to help visualize heap operations when debugging binaries or doing heap pwn. replaces addresses with easy-to-understand symbols detects heap corruption and memory leakage issues can debug...

how2heap

Educational Heap Exploitation This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc you are using...

CVE-2015-0235-workaround

CVE-2015-0235-workaround aka GHOST glibc vulnerability A shared library wrapper with additional checks for the vulnerable functions gethostbyname2r and gethostbynamer . The proper solution for CVE-2015-0235 is to upgrade glibc to at least glibc-2.18. In some cases, an immediate glibc upgrade is n...

heap-viewer

HeapViewer An IDA Pro plugin to examine the heap, focused on exploit development. Currently supports the glibc malloc implementation ptmalloc2. 3rd place winner of the 2018 Hex-Rays Plugin Contest Requirements IDA Pro = 7.0 Tested on glibc 2.23 = 2.26 GraphView for linked lists bins/tcache Struct...

ssh_poc2024

cve-2024-6387-poc a signal handler race condition in OpenSSH's server sshd 7etsuo Description An exploit for CVE-2024-6387, targeting a signal handler race condition in OpenSSH's server sshd on glibc-based Linux systems. The vulnerability allows for remote code execution as root due to...

cnext-exploits

CNEXT exploits Exploits for CNEXT CVE-2024-2961, a buffer overflow in the glibc's iconv, by @cfreal Usage $ git clone --recurse-submodules https://github.com/ambionics/cnext-exploits.git $ pip install -r requirements.txt Technical analysis The vulnerability and exploits are described in the...

CVE-2023-4911

PoC of CVE-2023-4911 "Looney Tunables" This is a PoC of CVE-2023-4911 a.k.a. "Looney Tunables" exploiting a bug in glibc dynamic loader's GLIBCTUNABLES environment variable parsing function parsetunables. Code has been tested on Ubuntu 22.04.3 with glibc version 2.35-0ubuntu3.3. No attempts have...

CVE-2024-6387

0.Summary This is essentially a statistical vulnerability: it requires a large number of attempts to win the race condition and successfully execute arbitrary code, and the attacker needs to overcome many obstacles," Schwartz told SecurityWeek. "Even in the best case, the most famous vulnerabilit...

CVE-2024-6387

Vulnerability Description CVE-2024-6387 exploit targets a signal handler race condition in the OpenSSH server sshd on glibc-based Linux systems. Due to calling an async-signal-unsafe function in the SIGALRM handler, this vulnerability allows remote code execution as root. Vulnerability Summary Th...

fsop-finder

Glibc FSOP code path finder Find FSOP code path that can hijack control flow and stack pointer in GLIBC Libio. Description: 1. Install this plugin 2. Open libc.so.6 in Binary ninja, then click Tools - Plugins - Find FSOP code path 3. You should see the result in Log windows Useful discoveries: //...

cve-2023-4911-exploit-optimized

Security Notice : This repository contains working exploit code for educational and research purposes. Use responsibly and only on systems you own or have explicit permission to test. CVE-2023-4911 Exploit Looney Tunables Optimized, multi-processing exploits for CVE-2023-4911 targeting x8664 and...

CVE-glibc

CVE-glibc CVE-2015-0235 glibc Get Host by Name Issue Copy and paste to get/check wget https://github.com/alanmeyer/CVE-glibc/raw/master/get-GHOST.sh chmod +x get-GHOST.sh ./get-GHOST.sh References: https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html...

CVE-2015-7547-proj-master

We are providing this code as-is. You are responsible for protecting yourself, your property and data, and others from any risks caused by this code. This code may cause unexpected and undesirable behavior to occur on your machine. This code may not detect the vulnerability on your system. Note...

CVE-2023-4911

CVE-2023-4911 This is a PoC for CVE-2023-4911 "Looney Tunables" that exploits a bug in the glibc dynamic loader's GLIBCTUNABLES environment variable parsing function parsetunables. This is a rewrite of the C PoC's into a pure python approach. I did this to make it easier to customize the exploit...

CVE-2024-6387

0. TL;DR This is essentially a statistical vulnerability: it requires a large number of attempts to win the race condition and successfully execute arbitrary code. Attackers need to overcome many obstacles, "Schwartz told SecurityWeek." Even in the best case, the most well-known vulnerabilities...

CVE-2024-2961

CVE-2024-2961 CVE-2024–2961 Security Issue Mitigation Script Description This repository contains a Bash script to check and mitigate the buffer overflow vulnerability identified in GNU libc glibc versions 2.39 and older, known as CVE-2024-2961. This vulnerability affects PHP when the iconv...

CVE-2021-3156

CVE-2021-3156 CVE-2021-3156: Sudo heap overflow exploit for Debian 10 Vulnerability analysis and exploit development: https://syst3mfailure.io/sudo-heap-overflow Exploit designed for: Sudo: Version 1.8.27 1.8.27-1+deb10u1 Checksum sha256:...

glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state

A flaw was found in glibc. Converting crafted EUCJISX0213 input to UCS-4 or the internal wide character encoding for example with iconv can cause the converter to make no progress, hanging the calling application. Some EUCJISX0213 sequences decode to two code points; if the output buffer has room...