SEP-14.2-Arbitrary-Write

CVE-2020-5837 exploit The write up can be found in the blog of the RedyOps Labs: https://labs.redyops.com/index.php/2020/04/27/symantec-endpoint-protection-sep-14-2-eop-via-arbitrary-write/ Third Party Tools This exploit code, is heavily based on symboliclink-testing-tools which was Developed by...

CVE-2022-2590-analysis

CVE-2022-2590, Dirty COW restricted to shmem linux kernel version: Linux/x86 6.0.0-rc1 commit 37887783b3fef877bf34b8992c9199864da4afcb Introduction: this vulnerability allows the attacker to write arbitrary content to read-only shared memory page by satisfying the function canfollowwritepte, whic...

linux-kernel-exploitation

Linux Kernel Exploitation A collection of links related to Linux kernel security and exploitation. Updated bimonthly. Pull requests are welcome as well. Follow @andreyknvl on X, @[email protected] on Mastodon, or @andreyknvl on Bluesky to be notified of updates. Subscribe to @linkersec on...

GhostLock-for-OnePlus15T

GhostLock — OnePlus 15T Kernel exploit targeting locked-bootloader OnePlus 15T devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Modified from the originalGhostLock-for-OnePlus...

CVE-2024-30088

CVE-2024-30088 Bug: Bug is inside function AuthzBasepCopyoutInternalSecurityAttributes when kernel copies the AUTHZBASEPSECURITYATTRIBUTESINFORMATION of current token object to user mode, which has structure like this: //0x30 bytes sizeof struct AUTHZBASEPSECURITYATTRIBUTESINFORMATION ULONG...

qq-tim-elevation

Tencent QQ/TIM Local Privilege Elevation Affected Products: QQ 9.7.1.28940 9.7.8.29039 TIM 3.4.5.22071 3.4.7.22084 Affected Components: QQProtect.exe 4.5.0.9424 in TIM 3.4.5.22071 QQProtect.exe 4.5.0.9426 in QQ 9.7.1.28940 QQProtectEngine.dll 4.5.0.9424 in TIM 3.4.5.22071 QQProtectEngine.dll...

CVE-2024-50804

CVE-2024-50804 Writeup can be found on my blog below. Thanks! https://g3tsyst3m.github.io/cve/msi/Arbitrary-Write-Privilege-Escalation-CVE-2024-50804/...

HITCON-2023-Demo-CVE-2023-20562

HITCON 2023 Demo CVE-2023-20562 Description This demonstration took place at HITCON 2023 in Taiwan. The demo highlights the exploitation of AMDCpuProfiler.sys within AMD μProf. By triggering an arbitrary write on the EPROCESS token, privilege escalation to SYSTEM level is achieved. Disabling the...

CVE-2014-0816

CVE-2014-0816 This is an exploit for CVE-2014-0816 JVNDB-2014-000026: Norman Security Suite vulnerable to privilege escalation. This exploit launches CMD.exe with SYSTEM privilege from Non-Administrator privilege by exploiting the vulnerability in an IOCTL handler of ngs.sys / ngs64.sys. Usage...

CVE-2026-54520

CVE-2026-54520 ai-agent-automation workflow file step path traversal allowed read/write outside the expected directory. Primary advisory: GHSA-cm8g-8jfq-887p Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54520 GHSA| GHSA-cm8g-8jfq-887p Project|...

ghostlock-sabrina

GhostLock Sabrina Root exploit for Chromecast with Google TV sabrina via CVE-2026-43499 -- a use-after-free in the Linux kernel's futex PI priority inheritance subsystem. Achieves root on a locked bootloader device running Android 14 with kernel 5.15.170 PGO+BOLT+LTO, clang 17. The vulnerability...

CVE-2022-0185

CVE-2022-0185 This repo contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version fuse version specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege...

cve-2016-0040

cve-2016-0040 poc for cve-2016-0040 bug found and exploited by Meysam Firozi @R00tkitSmm this poc help write arbitrary data to arbitrary address in windows kernel for more info see ny blog : http://ioctl.ir/index.php/2016/02/13/cve-2016-0040-story-of-uninitialized-pointer/...

HITCON-2023-Demo-CVE-2023-20562

HITCON 2023 Demo CVE-2023-20562 Description This demonstration took place at HITCON 2023 in Taiwan. The demo highlights the exploitation of AMDCpuProfiler.sys within AMD μProf. By triggering an arbitrary write on the EPROCESS token, privilege escalation to SYSTEM level is achieved. Disabling the...

cve-2024-32002-poc-aw

CVE-2024-32002 PRC AW A POC for CVE-2024-32002 demonstrating arbitrary write into the .git directory. See cve-2024-32002-submodule-aw for the related submodule repository. What this repo contains A symlink with an arbitraty name that links to the .git directory. A .gitmodules file that defines th...

cve-2024-32002-submodule-aw

CVE-2024-32002 Submodule AW A submodule to demonstrate CVE-2024-32002. Demonstrates arbitrary write into .git. See cve-2024-32002-poc-aw for the working POC that utilises this repo. What this repo contains Simply, a random file so that we can detect it when we clone the parent POC repo The file i...

PS5-IPV6-Kernel-Exploit

PS5 3.xx / 4.xx Kernel Exploit Summary This repo contains an experimental WebKit ROP implementation of a PS5 kernel exploit based on TheFlow's IPV6 Use-After-Free UAF , which was reported on HackerOne. The exploit strategy is for the most part based on TheFlow's BSD/PS4 PoC with some changes to...

test_iconv

Testing CVE-2024-2961 V1 - Under Analysis This repository contains a C program to test for CVE-2024-2961, which involves a buffer overflow vulnerability in the iconv function of the GNU C Library glibc. Due to the structure of PHP’s heap, this overflow can be exploited to modify part of a free li...

CVE-2022-0847

CVE-2022-0847 exploit of CVE-2022-0847 which directly remove password of the root account Usage: 1. gcc cve-2022-0847.c -o exploit 2. ./exploit Requrements: gcc Work summery: The traditional classic exploit POC of Max Kellermann used to add a user with root privilage but in this POC exploit, It...

CVE-2022-0185

CVE-2022-0185 This repo contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version fuse version specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege...