CVE-2019-16098

CVE-2019-16098 This CVE exploits the RTCore64.sys driver and creates a cmd.exe process with system privileges by copying the token of the System process with one of the low-privilege cmd.exe process. Blog about the approach and the methodology can be found here...

CVE-2025-7771-Vulnerability-Exploration

🔓 ThrottleStop.sys 内核漏洞 — 兼容 HVCI 的物理内存映射器 CVE-2025-7771 — 通过 ThrottleStop.sys IOCTL 实现任意物理内存读写 ⚠️ 免责声明 本项目仅用于教育和研究目的 。目的在于演示一个经过签名、受信任的内核驱动程序如何被武器化，用于从管理员权限提升至 SYSTEM/内核 权限，有效绕过包括 HVCI（超管理器强制代码完整性） 和 安全启动 在内的现代 Windows 安全功能。 请勿将此工具用于恶意目的。 作者对任何滥用行为不承担责任。 📋 目录 漏洞概要 受影响软件 技术分析 存在漏洞的 IOCTL 根本原因 利用链...

MiniPlasma-Runner

MiniPlasma-Runner Modified version of Nightmare-Eclipse/MiniPlasma CVE-2020-17103 adapted for C2 usage. Original PoC runs from disk only. This version runs entirely from memory via execute-assembly, with a split-binary approach to avoid detection. Disclaimer This tool is provided for authorized...

CVE-2026-93145

A flaw was found in the Linux kernel's Qualcomm QCOM Generic Power Domain Controller GDSC driver. When a GDSC provider is unregistered, the driver fails to properly remove generic power domain entries from a global list. This oversight can lead to dangling entries, causing subsequent attempts to...

CVE-2026-90415

A flaw was found in the Linux kernel's RDMA/cxgb4 driver. This vulnerability occurs when the system fails to properly free a Steering Tag STAG index after an unsuccessful attempt to write to adapter memory. This leads to a resource leak, which could be exploited by a local attacker to cause a...

CVE-2026-90239

A flaw was found in the Linux kernel's AMD ISP4 driver. When allocating GPU memory, the isp4ifallocfwgpumem function fails to release partially allocated memory pools if an error occurs during the process. This memory leak could lead to system instability or a Denial of Service DoS over time, as...

CVE-2026-90233

A flaw was found in the Linux kernel's nvme-pci driver. This vulnerability occurs when descriptor Direct Memory Access DMA pools are created during device probing but are not properly released if the probe operation fails. This oversight leads to a memory leak, where dmapool objects are not freed...

Driver-RW

Driver-RW Elevar a NT AUTHORITY\SYSTEM con CVE-2018-19321 Probado en Windows 10 v1511...

CVE-2014-4322

poc代码适用于Nexus 5 Android4.4.4 提升权限：system-root，作为 https://github.com/koozxcv/CVE-2014-7911-CVE-2014-4322getrootprivilege 的一部分 作者：andy 网站：https://blog.csdn.net/koozxcv 该exploit必须以系统权限和特定的SELinux上下文执行。如果exploit成功，你将获得root权限和“kernel” SELinux上下文。 bug信息...

cve-2021-43226PoC

CVE-2021-43226 Reproduction Environment Operating system: Win10 20H2 on Hyper-V, build 19042.508. Found a website https://os.click/en, which has a relatively complete collection of Windows images and no backdoor has been discovered yet. Since the PoC I found was compiled with Visual Studio 2013, ...

CVE-2021-29337

CVE-2021-29337 - MODAPI.sys 中的权限提升 MSI Dragon Center 概述 受影响产品: MSI Dragon Center 受影响版本: 2.0.104.0 CVE MITRE 描述 Dragon Center 中的易受攻击的内核驱动程序 MODAPI.sys 暴露了 IOCTL 0x9C406104，该 IOCTL 允许低权限用户通过调用几个驱动程序例程之一（MmMapIoSpace）直接将物理内存映射到虚拟地址空间，从而与物理内存直接交互。 通过 DeviceIoControl 发送有效的输入和输出缓冲区，可以在最新的 Windows 10...

CVE-2018-1932X

CVE-2018-1932X Rust Exploit POC for GIGABYTE APP Center v1.05.21 and earlier Just because your target is memory unsafe doesn't mean your exploit has to be! Vulnerabilities used : CVE-2018-19320 - ring0 memcpy-like functionality CVE-2018-19323 - read and write Machine Specific Registers MSRs...

rendering-code-outside-the-sandbox-cve-2026-76036-dawn-webgpu-buffer-overflow-in-chrome-on-android

CVE-2026-76036 — Banco de pruebas de detección de mipmaps de profundidad/stencil NPOT para Dawn WebGPU Desbordamiento de búfer en el montón crítico CVSS 9.6, CWE-122 en Dawn , la implementación de WebGPU de Chromium, en Google Chrome para Android anterior a 151.0.7922.169 estable 151, publicado e...

Terminator_Killer

Terminator - Asesino de Procesos para Red Team Una herramienta de terminación de procesos en modo kernel que aprovecha un controlador vulnerable CVE-2026-0828 para terminar procesos protegidos desde el modo usuario. Compilación Requiere MinGW-w64 GCC en Windows. Compile con: g++ --%...

CVE-2025-61155

CVE-2025-61155 — GameDriverX64.sys中的任意进程终止 一个经过签名的内核模式反作弊驱动程序——GameDriverX64.sys，随幻塔 （Hotta Studio / Perfect World）一同提供——允许任何非特权本地用户终止任意进程 ，包括受PPL保护的杀毒软件/EDR服务。这是勒索软件操作者会利用的那种原语，并且目前正在被 Interlock 组织在野积极滥用 作为BYOVD EDR-killer。 本仓库是一个完整且可重现的拆解：安全公告、原始IDA Pro逆向工程分析、概念验证（PoC）以及现成的检测与缓解内容。 研究人员： Gabrie...

CVE-2026-63277

A flaw was found in LibreOffice. When linking spreadsheet cell ranges to external data sources in Calc, a document can specify an external Java database driver. By convincing a user to open a specially crafted document, a remote attacker can force the application to download and execute untrusted...

IKEV2-POC

EpSiLoNPoInTIkEv2.cpp ⚠️ 项目正在收尾阶段。目前状态尚未完全可用。 描述 EpSiLoNPoInTIkEv2.cpp 是一个针对 Windows 的 C/C++ 漏洞利用原型，基于 ikeext.dll（Windows 的 IKEv2 驱动程序）中的 double-free 漏洞开发，研究过程中暂定为 CVE-2026-33824。 该项目包含： 完整的混淆层（虚拟机、控制流平坦化、字符串隐藏、伪造二进制签名、内联反分析汇编）。 完整的 IKEv2 漏洞利用引擎（数据包构建、SKF 分片、多线程堆喷布局、ROP 链、任意读写原语）。 绕过 Windows...

CVE-2026-90362

A flaw was found in the Linux kernel's Display Serial Interface DSI driver for Qualcomm Snapdragon MSM devices. The devpmoppsetrate0 function incorrectly removes a power vote for a clock without parking it. This allows the clock to continue running without the necessary power backing, which could...

CVE-2022-20186_CTXZ

Exploit for CVE-2022-20186 The write up can be found here. This is a bug in the Arm Mali kernel driver that I reported in January 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root. The exploit is...

cve-2025-63888-exploit

CVE-2025-63888 ThinkPHP 5.0.24 File Inclusion RCE Exploit A security research tool for detecting and testing the CVE-2025-63888 vulnerability in ThinkPHP 5.0.24, which allows Remote Code Execution through file inclusion attacks. ⚠️ Disclaimer This tool is for authorized security testing and...