Dirty-Pipe-Oneshot

Dirty-Pipe-Oneshot Compiled version of CVE-2022-0847 aka Dirty Pipe. Just one shot to root them all :D just comple the cve-2022-0847.c file gcc cve-2022-0847.c -o getroot then execute it on the victim & get root :D ./getroot /etc/passwd 1 ootz: Happy Rooting 🎭...

cve-2017-8890-msf

Module: Phoenix Talon CVE 2017-8890 This may resolve issue 8571, which requests Phoenix Talon modules. Overview of 2017-8890 This CVE: is the most serious member of the Phoenix Talon class of Linux kernel vulnerabilities. No POC of this CVE exists in the Exploit DB. But other public POC's are...

CVE-2019-10207

CVE-2019-10207 PoC for CVE-2019-10207 linux kernel: bluetooth: hciuart: kernel NULL pointer dereference gcc CVE-2019-10207.c -o cve-2019-10207-poc -static test on 4.20.0 kernel compile CONFIG must be opened: CONFIGBTHCIUARTMRVL=y CONFIGBTMRVL=y...

rover

rover Proof of Concept code for CVE-2016-5696 Rover is a small python program to discover abitrary client source ports as shown in CVE-2016-569. Once the source port is known, the 4 tuple of information needed to confirm that two host are communicating can be completed. When run, rover establishe...

android_kernel_xiaomi_sunny

Linux kernel This file was moved to Documentation/admin-guide/README.rst Please notice that there are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. In order to build the documentation, use make htmldocs or make pdfdocs. The...

CyberMeowfia

Website: nebusec.ai · Twitter @nebusecurity · Bug list 885+ IonStack followup, follow https://github.com/NebuSec/CyberMeowfia/issues/44 Latest research IonStack part II : GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Linux Kernel 📖 Writeup · 🐦 Twitter Longinus : ...

CVE-2023-0045

Bypassing Spectre-BTI User Space Mitigations on Linux This is a working document, please send us feedback if you think we got something wrong or if we missed a citation Version 1.0 José Oliveira esoj Rodrigo Branco BSDaemon Introduction When testing the success rate of Spectre-BTI attacks, we...

difuze

difuze: Fuzzer for Linux Kernel Drivers This repo contains all the sources including setup scripts, you need to get difuze up and running. Tested on Ubuntu = 14.04.5 LTS 0. Running difuze from Docker Refer the readme As explained in our paper, There are two main components of difuze: Interface...

cve-2017-5123

CVE-2017-5123 This repository contains a demonstration of CVE-2017-5123 , an ICMP command-and-control backdoor, and a CWE-78 OS Command Injection vulnerable web app. Part of CSC 4308 - Challenge 3. Prerequisites Linux Kernel : 4.13 up to but excluding 4.13.7 Node.js : 10.x npm : 6.x Overview This...

vulnerability-analysis-

Linux Kernel Vulnerability Analysis: CVE-2021-26708 Overview This repository contains a complete reproduction and analysis of CVE-2021-26708 — a use-after-free vulnerability caused by a race condition in AFVSOCK socket operations in the Linux kernel v5.10.12. The entire experimental environment w...

Dirty-Pipe-Exploits

CVE-2022-0847 Exploits Dirty Pipe What is it ? Disclosed on March 7, 2022 by Max Kellerman2, CVE-2022-0847 is a vulnerability in the Linux kernel versions 5.8 to 5.16.11 that allows attackers to overwrite read-only or immutable files and escalate their privileges on the victim's system...

Copy-Fail-Exploit-CVE-2026-31431

Copy Fail CVE-2026-31431 – Exploit Usage Guide ⚠️ Disclaimer This content is for educational and authorized security testing purposes only. Do NOT run this on systems without explicit permission. 📌 Overview Copy Fail CVE-2026-31431 is a Linux Local Privilege Escalation LPE vulnerability affecting...

copy_fail

copyfail Research Notes CVE-2026-31431 English 简体中文 This repository is a defensive research workspace for studying the Linux copyfail vulnerability tracked as CVE-2026-31431. The goal of this repository is to preserve analysis notes, document impact, and support safe local assessment. It is not...

cve-2025-39682

CVE-2025-39682 exploit on kernelCTF mitigation instance This is also my first ? idk, this is a variant of CVE-2024-58239 1-day exploit. Patch: tls: fix handling of zero-length records on the rxlist This CVE was used in exp398 and and exp403. kernelCTF spreadsheet. For folder structures and how to...

CVE-2014-3153

Towelroot for Ubuntu x86 This exp has been tested on ubuntu 14.04 x86 and ubuntu 12.04.2 x86 successfully. Learning CVE2014-3153 and towelroot. Kernel through version 3.14, use rbtree to store rtwaiternot plistnode, more complex! IA have diffrent threadinfo with ARM!! Source from geekben/towelroo...

CVE-2023-5178

CVE-2023-5178 The exploit for CVE-2023-5178: NVMe-oF-TCP vulnerability, which is a logic error in NVMe-oF-TCP driver during the handle of corrupted Initialize Connection Request. It leads to racy double-free in kmalloc-96 , which can be exploited to gain LPEsee demo below. The exploit targets...

LockingGirl-----CVE-2022-0847-Dirty_Pipe_virus

DirtyPipevirus Dirty Pipe is a kind of Linux exploit. Its CVE is CVE 2022-0847. We use it to delete all files on your Ubuntu. Environment: Ubuntu 20.04 Linux Kernel 5.8 This is the ova file of Ubuntu 20.04:...

tcconfig

.. contents:: tcconfig :backlinks: top :depth: 2 Summary tcconfig is a tc command wrapper. Make it easy to set up traffic control of network bandwidth/latency/packet-loss/packet-corruption/etc. to a network-interface/Docker-containerveth. |PyPI pkg ver| |Supported Python ver| |CI status| |CodeQL|...

CVE-2026-64560-Analysis

CVE-2026-64560 — Linux Kernel posix-cpu-timers non-leader exec race UAF Reproducer / PoC trigger verification : Linux & Android NDK This repository is intended solely for verifying patch status and for research/learning on your own test devices. It does not contain any privilege...

CVE-2020-27786-Kernel-Exploit

CVE-2020-27786 Kernel Exploit Details You can find full details and explaination here: https://1day.dev/notes/Linux-Kernel-n-day-exploit-development TL;DR The vulnerability is a Race Condition that causes a write Use-After-Free. The race window has been extended using the userfaultd technique...