traitor

Traitor Automatically exploit low-hanging fruit to pop a root shell. Linux privilege escalation made easy! Traitor packages up a bunch of methods to exploit local misconfigurations and vulnerabilities in order to pop a root shell: Nearly all of GTFOBins Writeable docker.sock CVE-2022-0847 Dirty...

CallbackHell

CallbackHell Exploit for CVE-2021-40449 Win32k - LPE CallbackHell Description Technical Writeup PoC References Description CVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation. The vulnerability was found in the wild by Kaspersky. The discovered exploit was...

CVE-2023-36802-MSKSSRV-LPE

CVE-2023-36802 MSKSSRV.sys Local Privilege Escalation PoC for CVE-2023-36802 Microsoft Kernel Streaming Service Proxy which suffers from a type confusion vulnerability. This proof-of-concept is modeled after the write-up done by Benoît Sevens @benoitsevens. The article can be found here:...

CVE-2016-5195

CVE-2016-5195 mi POC y EXPLOIT personal de CVE-2016-5195 dirty COW Uso POC: escribir archivos de forma arbitraria Simplemente un POC de este CVE, compile el archivo poc.c de la siguiente manera: root@kitploit: $ gcc poc.c -o poc -static -lpthread Debe ejecutarlo de la siguiente manera:...

CVE-2026-15964-PoC

CVE-2026-15964 - Single Sign On For TNG = 2.0.0 Escalada de privilegios no autenticada mediante cambio de contraseña no verificado en el plugin de WordPress Single Sign On For TNG. | ---|--- Gravedad| Crítico 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-620 Cambio de contraseña no...

cve-2021-4034

CVE-2021-4034 - PwnKit Polkit Local Privilege Escalation Overview This repository contains a Proof of Concept for CVE-2021-4034 , also known as PwnKit. It was developed for personal training and educational purposes only. Use only in environments you own or are explicitly authorized to test...

CVE-2020-0041

CVE-2020-0041 本仓库包含由 bluefrostsecurity 实现的 CVE-2020-0041 的 LPE 利用代码，原始版本发布在 https://github.com/bluefrostsecurity/CVE-2020-0041/tree/master/lpe 。 该部分的利用方法可在 https://labs.bluefrostsecurity.de/blog/2020/04/08/cve-2020-0041-part-2-escalating-to-root/ 找到。 此分支仓库将在各自的分支中托管其他内核/设备的移植版本。 衷心感谢...

Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284

Remoto root@kitploit: git clone https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284.git && cd Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284 && gcc -O0 -Wall -o exp exp.c -lutil && ./exp root@kitploit: git clone...

CVE-2025-32463_chwoot

🛠️ CVE-2025-32463chwoot - 在Linux中安全处理权限 📋 概述 CVE-2025-32463chwoot 帮助您理解和处理与 Linux 系统中权限提升相关的特定安全漏洞。该工具允许用户通过 sudo 二进制文件的 chroot 选项，探索和测试向 root 用户的权限提升。 🚀 开始使用 在开始使用该应用程序之前，请确保您的系统满足以下要求： 操作系统 ：Linux（任何支持 Docker 的发行版） Docker ：20.10 或更高版本 CPU ：1 GHz 或更快 内存（RAM） ：至少 512 MB 磁盘空间 ：100 MB 或以上可用空间 📥...

Shocker-TJNULL-OSCP-

HackTheBox: Shocker Writeup A structured and professional walkthrough showcasing the identification and manual exploitation of the critical Shellshock vulnerability, followed by local privilege escalation via misconfigured sudo rights on a Linux target. Technical Overview Target OS: Linux IP...

CVE-2024-55968

CVE-2024-55968 POC for DTEX LPE CVE-2024-55968 Affected product: DEC-M DTEX Forwarder version 6.1.1. DTEX is a unified insider risk management platform. Affected component: DEC-M EventReportingService XPC Helper Attack vector: The DTEX Event Reporting Service was found with a privileged XPC helpe...

CVE-2021-1675-PrintNightmare

CVE-2021-1675 - PrintNightmare LPE PowerShell Caleb Stewart | John Hammond | 2021年6月1日 CVE-2021-1675 是一个关键的远程代码执行与本地权限提升漏洞，被称为“PrintNightmare”。 针对远程代码执行能力，已有公开的概念验证漏洞利用代码（Python、C++），以及用于本地权限提升的 C 版本。我们尚未看到纯 PowerShell 的原生实现，因此希望尝试改进并重塑该漏洞利用方式。 此 PowerShell 脚本利用 PrintNightmare 攻击技术实现本地权限提升 LPE。 已...

CVE-2023-34839

CVE-2023-34839 — Issabel PBX 4.0.0-6: CSRF a Escalada de Privilegios Tabla de Contenidos Descripción General Detalles de la Vulnerabilidad Software Afectado Puntuación CVSS Escenario de Ataque Prueba de Concepto PoC Pasos para Reproducir Impacto Remediación Referencias Aviso Legal Descripción...

CVE-2023-22809-Exploiter

CVE-2023-22809 漏洞利用脚本 免责声明 此脚本仅供教育目的使用。作者对其使用造成的任何滥用或意外后果不承担责任。在测试任何安全工具或漏洞之前，请始终遵循道德准则并获得适当授权。 描述 该 Python 和 Bash 脚本旨在利用 sudo 版本 1.8.0 至 1.9.12p1 中的 CVE-2023-22809 漏洞。该漏洞允许本地攻击者通过利用对 sudoedit 或 sudo -e 命令的不当处理来提升权限。 要求 Python 3.x | Bash 目标机器上安装了 sudo 版本 1.8.0 至 1.9.12p1 能够访问 sudo 命令，并具有潜在的...

Review.CVE-2021-3156

👑 CVE-2021-3156 Baron Samedit — Privilege Escalation via Heap Overflow in sudo 📅 Date: 2025-06-08 ✍️ Author: @TopskiyPavelQwertyGang 🧠 Security Researcher | Red Team Enthusiast 🧠 CVE Overview CVE-ID: CVE-2021-3156 Type: Heap-based Buffer Overflow Component: sudoedit sudo Access Level: Local Goal:...

CVE-2026-42978-PoC-Research

CVE-2026-42978 PoC e Investigación — Use-After-Free en Notificaciones Push de Windows Condición de carrera en el servicio de Notificaciones Push de Windows WpnService que se ejecuta como NT AUTHORITY\SYSTEM. Un atacante con acceso local puede desencadenar un use-after-free durante el apagado de l...

CVE-2022-0492-Docker-Breakout-Checker-and-PoC

CVE-2022-0492 Docker Breakout Checker and PoC Summary Exploiting the vulnerability requires the attacker to have access to a Docker container running on a vulnerable system. Once exploited, the attacker can escape the container and gain complete control over the host system. A vulnerability was...

CVE-2024-5324

CVE-2024-5324 Login/Signup Popup Inline Form + Woocommerce 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Update Description: The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t...

CVE-2020-0683

CVE-2020-0683 Original Poc sent to MSRC. Assigned to CVE-2020-0683 - Windows Installer Elevation of Privilege https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-0683 Source code for Visual Studio C++ 2017 Please read the PDF that describes all the findings and steps to...

powerob

Powerob An on-the-fly Powershell script obfuscator meant for red team engagements. Built out of necessity. This only obfuscates functions and removes found in PowerShell scripts. Roadmap includes bfuscating variables. Pull requests and collaborative welcomed. About This was built out of the need ...