CVE-2023-4911

CVE-2023-4911 This is a PoC for CVE-2023-4911 "Looney Tunables" that exploits a bug in the glibc dynamic loader's GLIBCTUNABLES environment variable parsing function parsetunables. This is a rewrite of the C PoC's into a pure python approach. I did this to make it easier to customize the exploit...

CTFs

CTF Writeups Hey there, I'm Sean and I enjoy doing CTF problems in my spare time. My current position has me doing a lot of binary exploitation and software reverse engineering so I tend to focus on those categories. Most writeups that I see online suck and I hope these do a better job explaining...

CVE-2025-51726

As requested, I have now demonstrated both vulnerabilities BA2022 & BA2015 with practical exploitation scenarios and PoC evidence, which shows how an attacker could abuse these issues in a real-world context. 📌 1. BA2022 Weak Hash in Code Signing – SHA-1 Exploitation Demonstration Although the...

CVE-2026-46333

CVE-2026-46333 Research and educational repository for CVE-2026-46333 , focused on reproducible analysis and a safe test PoC workflow. 1 CVE-2026-46333 This project documents the vulnerability behavior, test setup, and validation approach so researchers and defenders can reproduce findings...

MiniPlasma-Runner

MiniPlasma-Runner Modified version of Nightmare-Eclipse/MiniPlasma CVE-2020-17103 adapted for C2 usage. Original PoC runs from disk only. This version runs entirely from memory via execute-assembly, with a split-binary approach to avoid detection. Disclaimer This tool is provided for authorized...

CVE-2022-21392

CVE-2022-21392: Local Privilege Escalation via NMR SUID in Oracle Enterprise Manager In Oracle installations, where the “nmr” binary is present and SUID-ed as “root”, due to insecure directory permissions, the “oracle” user can elevate his/her privileges to that of the “root” user by replacing th...

CVE-2019-14745

CVE-2019-14745 Vulnerabilidad armada de radare2 CVE-2019-14745 asignado encontrada por @CaptnBanana y blenk92 Para detalles sobre la vulnerabilidad, lee https://bananamafia.dev/post/r2-pwndebian/ Uso En primer lugar, necesitas los bindings de Python de LIEF https://lief.quarkslab.com/ Luego,...

CVE-2026-31431

🔥 CVE-2026-31431 - "Copy Fail !!!" Una escalada de privilegios local sorprendentemente simple pero letal en el kernel de Linux 📌 Resumen CVE-2026-31431 apodado "Copy Fail" es una vulnerabilidad de escalada de privilegios local en el subsistema criptográfico del kernel de Linux, que afecta...

CVE-2022-37704

Descripción sugerida Amanda 3.5.1 tiene una falla que permite la escalada de privilegios desde el usuario normal backup hasta root. El binario SUID ubicado en /lib/amanda/rundump ejecutará /usr/sbin/dump como root con argumentos controlados por el atacante, lo que puede conducir a la escalada de...

CVE-2025-6019-exploit

CVE-2025-6019: Privilege Escalation Exploit via UDisks2 Filesystem Resize Vulnerability Details CVE ID : CVE-2025-6019 Impact : Local Privilege Escalation LPE Affected Systems : Linux systems with vulnerable udisks2 versions Mechanism : Race condition during filesystem resize allows access to SUI...

x86-cpp-reversing-skill

x86-cpp-reversing Una habilidad de Claude Code para la ingeniería inversa de binarios x86 IA-32 little-endian de 32 bits y desensamblado compilado desde C++. Recupera diseños de clases, vtables, despacho virtual y jerarquías de RTTI/herencia desde binarios ELF o PE, y cubre los flujos de trabajo...

CVE-2025-24204

CVE-2025-24204 Acerca de CVE-2025-24204 es una vulnerabilidad que permite leer la memoria de cualquier proceso en sistemas macOS con SIP habilitado. La causa raíz de esta vulnerabilidad se debe a la adición de un entitlement excesivamente potente com.apple.system-task-ports.read al binario gcore...

CVE-2024-32019-POC

Privilege Escalation via ndsudo Netdata Local Exploit This POC is used to exploit a vulnerable ndsudo utility bundled with Netdata to escalate local privileges to root. The exploit works by injecting a malicious binary into the user’s PATH that impersonates a trusted command nvme and is executed...

CVE-2024-55347

CVE Disclosure: CVE-2024-55347 Public Disclosure of CVE-2024-55347 🚀 Date: 10-02-2025 Summary A Binary Planting vulnerability in Kroll Artifact Parser And Extractor KAPE v1.3.0.2 allows attackers to escalate privileges and execute arbitrary code by placing a maliciously crafted Binary file in a...

cve-2021-4034-mock

CVE-2021-4034 PwnKit Sistema de Vulnerabilidad Simulada Este proyecto es un sistema simulado que reproduce el principio de funcionamiento central de la vulnerabilidad CVE-2021-4034 Out-of-Bounds Read/Write ocurrida en el demonio pkexec de Linux. Sin una elevación real de privilegios SUID, simula ...

CVE-2026-25250

🕷️ CVE-2026-25250: Validación Incorrecta de la Cadena de Carga de Arranque Confiable Un cargador de arranque de terceros firmado por Microsoft que carga un binario EFI secundario sin verificación de firma ni integridad, colapsando la cadena de confianza de Secure Boot desde dentro. 📑 Tabla de...

SUIDGuard

SUIDGuard - Una extensión del kernel que añade mitigaciones a OS X para dificultar la explotación Copyright c Stefan Esser / SektionEins GmbH, 2015. Todos los derechos reservados. [email protected] - https://www.sektioneins.de/ SITIO WEB OFICIAL Si has llegado aquí desde un artículo de...

bin2shell

bin2shell bin2shell es una utilidad muy pequeña para extraer código shell del archivo binario root@kitploit: bash bin2shell.sh additionNum \x45\x6e\x74\x65\x72\x20\x4e\x75\x6d\x62\x65\x72\x20\x31\x20\x3a\x20\x45\x6e\x74\x65\x72\x20\x4e\x75\x6d GRACIAS TOUHID SHAIKH...

notepad-v8.8.1-LPE-CVE-

notepad-v8.8.1-LPE-CVE- CVE-2025-49144 Notepad++ v8.8.1 SYSTEM-level POC 📌 CVE-2025-49144 is a high-severity local privilege escalation vulnerability found in the Notepad++ v8.8.1 and prior version installers. This vulnerability stems from uncontrolled executable search path behavior during...

CVE-2023-33781

CVE-2023-33781 Description D-Link DIR-842V2 v1.0.3 was discovered to allow a user to run an arbitrary binary when connecting to telnet. This vulnerability can be triggered using backup/restore functionality. Proof of concept...