rp

rp++: a fast ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries Overview rp++ or rp is a C++ ROP gadget finder for PE/ELF/Mach-O executables and x86/x64/ARM/ARM64 architectures. Finding ROP gadgets To find ROP gadget you need to specify a file with the --file / -f option and use the...

freebsd_kernel_hacking

FreeBSD Kernel Hacking Exercises from Joseph Kong's Designing BSD Rootkits, updated for FreeBSD 11/12. Even though the book is over 10 years old, it's highly recommended as it's quite a challenge to update the source code provided in the book to work on modern releases. Further Resources:...

CVE-2022-31814

CVE-2022-31814 root@kitploit: Reworked and optimized exploit script of pfBlockerNG 2.1.426 vulnerability Exploit Title: pfBlockerNG 2.1.426 - Remote Code Execution RCE Shodan Results:...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

CVE-2020-7461

CVE-2020-7461 PoC for DHCP vulnerability NAME:WRECK in FreeBSD For educational purposes only Environment Host: macOS 11.2.1 Vagrant: 2.2.15 Victim: FreeBSD 12.1-STABLE r364849 Attacker: Ubuntu 20.04 Disclaimer This PoC will cause DoS instead of RCE to prevent abuse. PoC Turn off DHCP server in...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

freebsd-dhclient-poc

CVE-2020-7461 Reproducer PoC Authors: Moshe Kol, Shlomi Oberman Reproducer PoC for FreeBSD dhclient heap-based buffer overflow vulnerability when parsing DHCP option 119 CVE-2020-7461. The problem resides in the function findsearchdomainnamelen in the file sbin/dhclient/options.c. This function i...

Blackash-CVE-2025-14558

🚨 CVE-2025-14558 : Critical Remote Code Execution in FreeBSD IPv6 🧠 Overview CVE-2025-14558 is a critical Remote Code Execution RCE vulnerability affecting FreeBSD systems that use IPv6 router solicitation services. A flaw in how untrusted network input is handled allows attackers to execute...

CVE-2011-4862

CVE-2011-4862 Proyecto Final para Seguridad y Privacidad CS 600.443 | Otoño 2018 Originalmente intenté usar diff para crear un parche. Parcheé de la forma en que pensé que sería, antes de mirar el parche real. encrypt.patch es ese parche original que hice con diff. Sin embargo, al intentar aplica...

krf

KRF KRF is a K ernelspace R andomized F aulter. Actualmente soporta los núcleos Linux y FreeBSD. ¿Qué? La inyección de fallos es una técnica de prueba de software que implica inducir fallos "faults" en las funciones llamadas por un programa. Si la función llamada no ha realizado una comprobación ...

cve-2011-4862

cve-2011-4862 I originally tried to use diff to make a patch. I patched it the way I thought it would be, before looking at the real patch. encrypt.patch is this original patch that I made with teh diff. However, when we tried applying this patch to freeBSD, it would not accept it. Instead, we ha...

naxsi

Project Status This is a project status update regarding Naxsi. As you may have noticed, the development of Naxsi has been stopped and the repository will be archived for historical reasons. This means that no new updates or bug fixes will be released for this version. However, if you wish to...

ps5-umtxdbg

NOTES The bug was found in early december 2020, not by me, but a genius who looked 15mins at fbsd and immediately spotted it 🙇‍♂️. This c++ impl was made when experimenting with increasing exploit reliability after ps5 kernel added some heap randomization features. setup vm get vm image...

research-cve-2025-68971

CVE 2025-68971 | Holloway Chew, Kean Ho's Knowledge Research On 2025-12-22, a security vulnerability CVE 2025-68971 CVSS: 5.5/MEDIUM was discovered in open-source Forgejo 13.0.3 application first detected on FreeBSD14 operating system. It caused the operating system went into mass-killing all...

CVE-2026-4747-

CVE-2026-4747: FreeBSD Remote Kernel RCE First remote kernel exploit both discovered and exploited by an AI 📋 Quick Summary...

CVE-2026-4747

root@kitploit: / /\ \ / / | | \ / \ \ \ \ | || | || || \ | | \ \ / /| | | | | | | \ \ | | / /| || | | | | \ V / | ||| / /| || / / \ \ | || | / / | |/ / | / | ||/| \ / // |||| CVE-2026-4747 — FreeBSD Remote Kernel RCE Stack Buffer Overflow inkgssapi.ko → Root Shell in 4 hours...

freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 FreeBSD local privilege escalation viaexecargsadjustargs OOB memmove An operator-precedence bug in execargsadjustargs sys/kern/kernexec.c, present since 2013 lets any local user escalate to root on a...

setcred

FreeBSD setcred2 — research artifacts This subdirectory collects the write-up and working exploits for the setcred2 stack buffer overflow in FreeBSD 14.x kernel. The vulnerability itself is fully documented in setcred.txt. The short version: kernsetcredcopyinsuppgroups uses sizeofgroups where...

CVE-2025-14558

CVE-2025-14558 FreeBSD rtsold DNSSL Command Injection RCE Description rtsold8 does not validate DNSSL domain names for shell metacharacters before passing them to resolvconf8. Command substitution via $ enables remote code execution from an adjacent network. Affected: FreeBSD 13.x, 14.x, 15.x...

FreeBSD : OpenVPN: denial of service (25012057-a886-11f1-a836-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 25012057-a886-11f1-a836-b42e991fc52e advisory. OpenVPN team reports: OpenVPN 2.x allows attackers to potentially cause a denial of service against the...