StackRot

StackRot CVE-2023-3269: Linux kernel privilege escalation vulnerability GitHub-CI-verified exploit A flaw was found in the handling of stack expansion in the Linux kernel 6.1 through 6.4, aka "Stack Rot". The maple tree, responsible for managing virtual memory areas, can undergo node replacement...

CVE-2022-22639

Details See Blog: https://www.trendmicro.com/enus/research/22/d/macos-suhelper-root-privilege-escalation-vulnerability-a-deep-di.html Exploitation of CVE-2022-22639 1. Compile with command: clang exploit.m -o /tmp/exploit -framework Foundation -fobjc-arc -fobjc-link-runtime...

CVE-2017-1000367

CVE-2017-1000367 We discovered a vulnerability in Sudo’s getprocessttyname for Linux: this function opens “/proc/pid/stat” man proc and reads the device number of the tty from field 7 ttynr. Unfortunately, these fields are space-separated and field 2 comm, the filename of the command can contain...

CVE-2024-20656

CVE-2024-20656 PoC for EoP in VSStandardCollectorService150 service https://www.mdsec.co.uk/2024/01/cve-2024-20656-local-privilege-escalation-in-vsstandardcollectorservice150-service/...

Exploit-CVE-2017-6008

Exploit-CVE-2017-6008 The CVE-2017-6008 is a vulnerability in the HitmanPro scan that allows privilege escalation by exploiting a kernel pool buffer overflow. The exploits here use the Quota Process Pointer Overwrite attack as described in the Tarjei Mandt's paper Also, the exploits use my Pool...

RegPwnBOF

RegPwn BOF Cobalt Strike BOF port of the RegPwn exploit by Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. This is a sloppy BOF reimplementation of the original C exploit. All credit for the vulnerability research and exploit goes to Filip Dragovic and MDSec. Blog post :...

COMahawk

COMahawk Privilege Escalation: Weaponizing CVE-2019-1405 and CVE-2019-1322 Video Demo https://vimeo.com/373051209 Usage Compile or Download from Release https://github.com/apt69/COMahawk/releases 1. Run COMahawk.exe 2. ??? 3. Hopefully profit or 1. COMahawk.exe "custom command to run" ie...

tpwn-bis

tpwn-bis simple poc for cve-2015-5932 / cve-2015-5847 / cve-2015-5864 now escalates to root and spawns a shell. a big thanks to @qwertyoruiop for original code and help!...

CVE-2020-1337

CVE-2020-1337 CVE-2020-1337 is a bypass of PrintDemon CVE-2020-1048 ’s patch via a Junction Directory, made to remediate an Elevation of Privileges EoP\Local Privilege Escalation LPE vulnerability affecting the Windows’ Print Spooler Service. The vulnerability does require low privilege access an...

pytmipe

PYTMIPE & TMIPE PYTMIPE PYthon library for Token Manipulation and Impersonation for Privilege Escalation is a Python 3 library for manipulating Windows tokens and managing impersonations in order to gain more privileges on Windows. TMIPE is the python 3 client which uses the pytmipe library...

CVE-2021-27965

CVE-2021-27965 The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a crafted 0x80102040, 0x80102044, 0x80102050, or 0x80102054 IOCTL request. This exploit will be finished, this is a guarantee...

linuxprivchecker

Linuxprivchecker.py A Linux Privilege Escalation Check Script Orginal Author: Mike Czumak Tv3rn1x -- @SecuritySift Current Maintainer: Michael Contino @Sleventyeleven This script is intended to be executed locally on a Linux box to enumerate basic system info and search for common privilege...

CVE-2024-30088-Windows-poc

CVE-2024-30088-Windows-poc This vulnerability exists in the NtQueryInformationToken function, specifically when handling the AuthzBasepCopyoutInternalSecurityAttributes function. It originates from improper management of the locking mechanism by the kernel when operating on objects. This flaw cou...

CVE-2019-1458

CVE-2019-1458 Windows LPE Exploit Caution YOU ONLY HAVE ONE CHANCE TO EXPLOIT FOR EACH KERNEL REBOOT!!!! Screenshot Supported Version Windows 2012 R2 Tested Windows 8 Tested Windows 2008 R2 x64Tested Windows 7.1 x64 Tested Windows 7 x64 Windows 2012 x64 Windows 2008 x64 ALL X32 VERSION SYSTEMS AR...

CVE-2020-35682

CVE-2020-35682 SD-91948: CVE-2020-35682: Authentication Bypass Vulnerability during SAML login in ServiceDesk Plus. As described by ManageEngine. If the target ServiceDesk Plus 11134 installation has SAML login enabled and you have credentials to a low privilege user then you can escalate to...

CVE-2025-24118

TRAVERTINE CVE-2025-24118 Writeup: https://jprx.io/cve-2025-24118 Usage root@kitploit: gcc TRAVERTINE.c -o travertine chgrp everyone travertine chmod g+s travertine ./travertine...

CVE-2024-50804

CVE-2024-50804 Writeup can be found on my blog below. Thanks! https://g3tsyst3m.github.io/cve/msi/Arbitrary-Write-Privilege-Escalation-CVE-2024-50804/...

PEASS-ng

PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation Linux Privesc official course to master LinPEAS Checkhttps://hacktricks-training.com/courses/lhe/ to learn tens of linux privesc techniques and master LinPEAS Basic Tutorial Here you will find privilege escalation tools for...

DirtyClone

DirtyClone CVE-2026-43503 - Python PoC Non-official Python port of DirtyClone — a Linux kernel local privilege escalation vulnerability. This repository contains a working Proof of Concept that allows an unprivileged local user to gain root privileges by exploiting page-cache corruption via clone...

Penetration_Testing_POC

PenetrationTestingPOC Collect and share POCs, scripts, tools, articles, and other techniques used in penetration testing, as a note. Contributions welcome. Please note that all tools may have backdoors or other anomalous behavior; it is recommended to operate in a virtual environment...