Dirty-Pipe-CVE-2022-0847-POCs

Dirty-Pipe-CVE-2022-0847-POCs Author: Max Kellermann [email protected] Contributor: Bl4sty https://twitter.com/bl4sty A new Linux vulnerability known as 'Dirty Pipe' allows local users to gain root privileges through publicly available exploits. Today, security researcher Max Kellermann...

dirty-pipe-poc

Dirty Pipe POC CVE-2022-0847 POC - https://dirtypipe.cm4all.com/ Description This exploit attempts to use the CVE-2022-0847 vulnerability to overwrite a read only file. When make exploit is run, it will: 1. Create a readonlyfile.txt 2. Execute the dirtypipe exploit. 3. Check if the dirtypipe...

CVE-2022-0847-DirtyPipe-Exploit

CVE-2022-0847-DirtyPipe Vulnerability Overview On March 7, foreign security researcher Max Kellermann published a blog disclosing a local privilege escalation vulnerability CVE-2022-0847 in the Linux kernel: https://dirtypipe.cm4all.com/ CVE-2022-0847 is a local privilege escalation vulnerability...

dirtypipe-ebpf_detection

dirtypipe-ebpfdetection -- Dirtypipe detection tool This program was made to detect Dirty Pipe exploitation attempts thanks to eBPF. It also monitors nonvulnerable kernels and docker containers. 🛫 If you want more details on how it works please read the blog post ! 🛬 How does it works? Default...

pipe_finder

Pipe Finder 1.0 Automated script to search in SMB protocol for availables pipe names Screenshots Requirements metasploit-framework wget locate pipeauditv2.rb module https://github.com/peterpt/pipeauditorfb - It will be installed on first run Install Requirements apt-get install metasploit-framewo...

cve-2022-0847dirtypipe-exploit

cve-2022-0847dirtypipe-exploit...

CVE-2022-0847

CVE-2022-0847 Description - POC for CVE-2022-0847: Linux Kernel Local Privilege Escalation Vulnerability. - create by antx at 2022-03-08. Detail - Security researcher Max Kellermann responsibly disclosed the 'Dirty Pipe' vulnerability and stated that it affects Linux Kernel 5.8 and later...

SharpNamedPipePTH

SharpNamedPipePTH This project is a C tool to use Pass-the-Hash for authentication on a local Named Pipe for user Impersonation. You need a local administrator or SEImpersonate rights to use this. There is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily...

CVE-2022-0847-dirty-pipe-checker

CVE-2022-0847-dirty-pipe-checker Bash script to check for CVE-2022-0847 "Dirty Pipe" https://dirtypipe.cm4all.com/ Usage Check current kernel version ./dpipe.sh Check specific kernel version ./dpipe.sh 5.10.11...

NamedPipePTH

NamedPipePTH This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotat...

CVE-2024-0311

CVE-2024-0311 ? This is a PoC for what I believe is CVE-2024-0311, SB10418. A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code. Much details. Very exploit. ¯\ツ /¯ The PoC injects into a user-ran SCPBypass.exe process and writes to the...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...

CVE-2022-24924

LiveWallpaperService의 부적절한 접근 제어 취약점 CVE-2022-24924SVE-2021-24089 테스트된 Windows 버전: Windows 10 20H2 Build 19042.1348 64bit Live Wallpaper 버전: 3.0.9.0 이하 Samsung 노트북에는 기본적으로 동작하는 LiveWallpaperService가 있습니다. 그런데 SYSTEM 서비스에서 SYSTEM 권한으로 디렉터리를 생성하는 취약점이 있었습니다. Live Wallpaper는 일반적으로 Samsung 노트북에 기본 설치...

dirtyPipe-automaticRoot

Dirty Pipe 자동 루트 익스플로잇 CVE-2022-0847 의존성: Python 3.10 이상 사용 방법: 자동 루트: $ python3.10 dirtyPipe.py -a + hjacking super user in /etc/passwd + dropipng shell 쓰기 권한이 없거나, immutable불변 또는 읽기 전용으로 마운트된 파일에 쓰기: $ python3.10 dirtyPipe.py -w FILE OFFSET DATA @terabitSec 🦜님의 제공...

dirty-pipe-poc

POC Exploit to add user to Sudo for CVE-2022-0847 Dirty Pipe Vulnerability This repo is based of the Vulnerability, Writeup and Exploit produced by Max Kellermann all found here. Just like everyone I had to take advantage of playing with the worlds most trivial to repro Priv Esc the blog post doe...

CVE-2022-0847

DirtyPipe Max Kellermann이 작성하고 발견한 DirtyPipe 취약점 익스플로잇 - https://dirtypipe.cm4all.com/ POC...

CVE-2020-11493

CVE-2020-11492 Windows용 Docker Desktop 권한 상승 취약점에 대한 개념 증명PoC입니다. 이 취약점은 2020년 5월 11일 Docker 버전 2.3.0.2에서 패치되었습니다. 이 PoC는 다음을 수행합니다: docker named pipe \.\pipe\dockerLifecycleServer를 모방하는 named pipe를 생성하고, docker 서비스로부터 연결 후 ImpersonateNamedPipeClient를 호출하며, 현재 스레드에서 가장된 액세스 토큰을 검색 및 복제하고, 해당 토큰을...

CVE-2022-0847-Container-Escape

CVE-2022-0847 CVE-2022-0847은 컨테이너 탈출을 달성하는 데 사용됩니다 호스트의 읽기 전용 파일 덮어쓰기 슬라이드 중국어는 여기에서 확인 가능 利用CVE-2022-0847 Dirty Pipe 实现容器逃逸（效果为覆写宿主机上任意只读文件） 中文汇报PPT在这里 소개 커널이 CVE-2022-0847에 취약한 경우, 공격자는 읽기 전용 파일을 덮어쓸 수 있습니다 비영구적! 자세한 내용은 https://dirtypipe.cm4all.com/ 참조. 그러나 컨테이너는 컨테이너 내부의 파일에만 접근할 수 있습니다. 다행히...

CVE-2022-0847-POC

CVE-2022-0847 CREDITS: vulnerability author: Max Kellermann max kellermann explanation: https://dirtypipe.cm4all.com/ RESOURCES: PAGE CACHE: https://manybutfinite.com/post/page-cache-the-affair-between-memory-and-files/ PIPE:...

thats_no_pipe

그것은 파이프가 아니다 Windows 명명된 파이프 통신을 가로채는 Frida 기반 프로젝트 목표 이 프로젝트는 특정 WinAPI 함수를 후킹하고 이를 웹소켓을 사용하여 HTTP 프록시로 전달함으로써 IPC 통신을 가로채는 것을 목표로 합니다. 아키텍처 명명된 파이프에 대한 읽기와 쓰기는 서로 다른 함수에서 발생할 수 있습니다. 이 섹션에서 WriteFile은 명명된 파이프에 대한 쓰기를, ReadFile은 명명된 파이프로부터의 읽기를 나타냅니다. 가로챈 경우, 작성될 데이터는 다음 스키마를 따릅니다. WriteFile --...