Foxit-Reader-RCE-with-virualalloc-and-shellcode-for-CVE-2018-9948-and-CVE-2018-9958

Custom Exploit : Foxit Reader version 9.0.1.1049 Use After Free with ASLR and DEP bypass on heap My Custom Exploit : Foxit-Reader-RCE-with-virualalloc-and-shellcode-for-CVE-2018-9948-and-CVE-2018-9958 Custom exploit for Win 7 Has space for shellcode My custom ROP chain makes space for shellcode i...

how-to-bypass-aslr-on-linux-x86_64

Breaking 64 bit aslr on Linux x86-64 In this article, I'll discuss about the application of the technique described by Samuel Groß in his Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass, to bypass ASLR on Linux x8664. To show this I'm gonna solve a...

fatal_core_dump

Fatal Core Dump Murder Mystery Repo for generating a core dump debugging murder mystery game site. THIS REPO HAS SPOILERS FOR THE GAME!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! You can play it here: https://www.robopenguins.com/fatalcoredump/ For a blog post on the design process see:...

skeleton

Skeleton but pronounced like Peloton A Zero-Click RCE exploit for CVE-2021-0326 on the Peloton Bike And also every other unpatched Android Device PoC requires ASLR to be disabled. Associated blog post:...

CVE-2015-6086

From Crash to Exploit: CVE-2015-6086 - Out of Bound Read/ASLR Bypass $$$$$$\ $$\ $$\ $$$$$$$$\ $$$$$$\ $$$$$$\ $$\ $$$$$$$\ $$$$$$\ $$$$$$\ $$$$$$\ $$ $$\ $$ | $$ |$$ | $$ $$\ $$$ $$\ $$$$ | $$ | $$ $$\ $$$ $$\ $$ $$\ $$ / |$$ | $$ |$$ | / $$ |$$$$\ $$ |$$ | $$ | $$ / |$$$$\ $$ |$$ / $$ | $$ |...

CVE-2018-0802

CVE-2018-0802 CVE-2018-08022: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802: https://vulners.com/cve/CVE-2018-0802 0patch exploitation and patch video: https://www.youtube.com/watch?v=XU-U4K270Z4 Qihoo 360 blog post...

HardeningMeter

Hardening Meter Copyright c OfriOuzan B4MB1 Want to read more about the security mechanisms? Binary files security mechanisms System security mechanisms Description HardeningMeter is an open-source Python tool carefully designed to comprehensively assess the security hardening of binaries and...

nginx-rift-private-lab

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This fork extends the original PoC with an ASLR-bypass...

Bropper

BROPPER An automatic Blind ROP exploitation python tool Abstract BROP Blind ROP was a technique found by Andrew Bittau from Stanford in 2014. Original paper Slides Most servers like nginx, Apache, MySQL, forks then communicates with the client. This means canary and addresses stay the same even i...

Powershell-Tools

PSUnzipper - PowerShell Unzipper Uses SharpZipLiB in .NET, loaded in runtime no file on disk - ref. https://github.com/icsharpcode/SharpZipLib Can be used with password zip, unzip Both encryption methods AES and ZipCrypto is supported. When zipping/unzipping - no file in temp is created - all...

I-know-where-your-page-lives

I-know-where-your-page-lives I Know Where Your Page Lives: Derandomizing the latest Windows 10 Kernel - ZeroNights 2016 Requirements Intel Processor Haswell or newer Windows 10 x64 Usage Run ASLRSideChannelAttack.exe to get the PML4-Self-Ref entry C:\Users\qa\DesktopASLRSideChannelAttack.exe +...

CVE-2018-14442

Foxit Reader CPDFParser::mpCryptoHandler Use After Free 1. PDF Format Background 2. Encryption Dictionaries 3. Vulnerability Details 4. ASLR and DEP Bypass 5. Environment Details 6. Trigger 7. Author PDF Format Background PDF is a file format used to represent documents. A pdf is made of multiple...

ezviz_lan_rce

ezvizlanrce This repository contains the slides and PoC videos for the talk SADProtocol goes to Hollywood which was presented at DEF CON 31 Hardware Hacking Village. You can also find the docker image to build binaries that run on the camera and the proof of concept exploits for CVE-2023-34551 an...

Metaphor

Metaphor Metaphor - Stagefright with ASLR bypass By Hanan Be'er from NorthBit Ltd. Link to whitepaper: https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf Twitter: https://twitter.com/HighByte Metaphor's source code is now released! The source include a PoC that generat...

CVE-2023-4911

Proof of concept for CVE-2023-4911 Looney Tunables This vulnerability has been discovered by Qualys Threat Research Unit. Here you can read the advisory they published; it explains the vulnerability in depth. The exploit has been tested on Ubuntu 22.04.2 LTS with GLIBC 2.35-0ubuntu3.1. Testing th...

mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE Lab Remote code execution on the unmodified, stock MariaDB 13.0.1-rc Docker image as uid 999 mysql. Two exploit variants: Variant| File| Requirements| Notes ---|---|---|--- Pure SQL recommended| exploitpuresql.py| a low-priv MariaDB account + TCP| no host access, no docker, ...

zombieant

Zombie Ant Farm: A Kit For Playing Hide and Seek with Linux EDRs. Version 0.5-alpha Why? Because monolithic offensive tools are never enough and building your own offensive strategies and tools is fun. What? Offensive Preloading Primitives and Building Blocks. Distributed Payload Warehousing and...

CVE-2023-4427

CVE-2023-4427 CVE-2023-4427 was found by glazunov, and you can find RCA in his report chrome version: 117.0.5938.62 in linux from v8ctf. I choose a very unstable method. To bypass ASLR, use many iframes with different domains in main.html to brute high address, you can change your /etc/hosts to...

CVE-2013-2028-x64-bypass-ssp-and-pie-PoC

for bypass NX PIE SSP ASLR this poc is not stable. sometimes http service will down. you should fix morecore-offset and chose correct libc-file...

memaddressanalysis

Mem Address Analyzer Research project related to memory address space analysis Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed for Linux by Aidan Marlin, aidan dot marlin at nccgroup dot com Developed for Windows by Nikos Laleas, nikos dot laleas at nccgroup dot com...