kurasagi

kurasagi kurasagi is full POC of PatchGuard bypass for Windows 24H2 - 25H2. For more information, please refer to the product branch, which contains the PDF paper detailing the bypass. If any BSOD which is related toCRITICALSTRUCTURECORRUPTION PatchGuard appears, please create issue with it!...

CVE-2024-20698

CVE-2024-20698 About this vulnerability: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20698 Analysis of the patch In the ntoskrnl.exe we have two patched functions: sub1406AE224 and WbAddLookupEntryEx. The vulnerable function is WbAddLookupEntryEx. Paths to this function: To cal...

PS4-5.05-Kernel-Exploit

PS4 5.05 Kernel Exploit Summary In this project you will find a full implementation of the second "bpf" kernel exploit for the PlayStation 4 on 5.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This exploit also contains...

gobee

gobee Write your BPF programs in Go, not C. gobee transpiles a strict subset of Go into BPF C, generates typed Go bindings for the userspace side, and gates loads against the running kernel. The Go ecosystem has solid userspace tooling for BPF. The kernel side has always ended with "now write you...

CVE-2025-62215-POC

CVE-2025-62215 — Windows Token UAF SepTokenSidSharingEnabled Race Condition This repository is for educational and research purposes only. Overview A Use-After-Free vulnerability PoC that occurs in the SepTokenSidSharingEnabled optimization path of the Windows kernel. When NtDuplicateToken...

emba

EMBA The security analyzer for firmware of embedded devices EMBA is designed as the central firmware analysis and SBOM tool for penetration testers, product security teams, developers and responsible product managers. It supports the complete security analysis process starting with firmware...

cve-2026-43499

IonStack Kernel exploit for Redmi Pad Pro dizi / POCO Pad 5G. Cloudflare Pages Deployment Git Integration 1. Go to Cloudflare Dashboard Workers & Pages Create Pages Connect to Git 2. Select this repository 3. Build settings: Framework preset: None Build command: leave empty Build output directory...

ovswrap-poc

ovswrap-poc CVE-2026-64531 OVSwrap PoC - Linux kernel Open vSwitch LPE; for patch validation and security research...

Trigon

Trigon Trigon is a deterministic kernel exploit based on CVE-2023-32434. It currently supports A9 - A11 devices running iOS 13 - 15.7.6 . Being deterministic means that this exploit will never panic during or after exploitation and is completely reliable. Trigon exploits an integer overflow in th...

CVE-2024-27804

CVE-2024-27804 ./build.sh ./panic.sh paniccpu 4 caller 0xfffffe0026851cdc: Unaligned kernel data abort. at pc 0xfffffe0026aed514, lr 0xfffffe0026aed5d8 saved state: 0xfffffe3a396e3200 x0: 0x000000000000000e x1: 0xfffffe1002bdc01b x2: 0x0000000000000000 x3: 0xfffffe3a396e3444 x4: 0xfffffe3a396e344...

rex

| | \ / / | | | | | | | | \ / | | \ / / / \ ' / | |/ | ' / | | | || / | | \ \ | | | | \ \ || \//\ |//\\|| ||/|/|| ||/ Rex Kernel Extensions Table of Contents What is Rex Example program Build and run Documentations Why Rex License What is Rex Rex is a safe and usable kernel extension...

exploit_mitigations

Exploitation Mitigations The goal is to list exploitation mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability is easily exploitable or not depending on exploitation mitigations in place. An example is the...

VectorKernel

VectorKernel PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support x64 family 64bit OS only. Environment All modules are tested in Windows 11 x64. To test drivers, following options can be used for the testing machine: 1. Enable Loadin...

CVE-2024-21338

CVE-2024-21338 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled. Compiling Use Microsoft Visual Studio with the C++ package to successfully compile the PoC on both Release and Debug modes. Post Original blog post:...

ITScape

ITScape: Guest-to-Host Escape in KVM/arm64 Abstract This document describes the ITScape CVE-2026-46316 vulnerability reported and patched by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/arm64 environment and run commands on the host with kerne...

linux-kernel-algif-aead-checker

CVE-2026-31431 / Copy Fail Checker 🔒 Linux kernel vulnerability checker for the algifaead-based Copy Fail attack path. Detects if your system is vulnerable and provides mitigation steps. Features Kernel version vulnerability range detection AFALG crypto module check Protection status KPTI, SELinu...

Exploits + Shellcode + GHDB

The Exploit Database Git Repository This is an official repository of The Exploit Database, a project sponsored by Offensive Security. Our repositories are: Exploits & Shellcodes: gitlab.com/exploit-database/exploitdb Binary Exploits: gitlab.com/exploit-database/exploitdb-bin-sploits Papers:...

CVE-2026-53359

CVE-2026-53359 In the Linux kernel, the following vulnerability has been... - https://github.com/advisories/GHSA-wpw8-53h7-xqcq ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration...

linux-exploit-suggester

LES: Linux privilege escalation auditing tool Quick download: wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O les.sh Details about LES usage and inner workings: https://blog.z-labs.eu/2019/05/10/les-paper.html Additional resources for the...

CVE-2021-22555-PipeVersion

CVE-2021-22555 pipe version Using pipe-primitive to exploit CVE-2021-22555, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive Tested on both Linux 4.15 and Linux 5.8...