exploit_linux_kernel4.13

This repo contains an old poc that combines three CVEs CVE-2017-14954, CVE-2017-18344, CVE-2017-5123. The poc is a Local Privilege Escalation for Linux Kernel 4.13 tested on Ubuntu. The exploit uses an info leak CVE-2017-14954 to bypass KASLR, an arbitrary read CVE-2017-18344 to read the kernel...

CVE-2019-1215

CVE-20190-1215 ws2ifsl.sys UAF exploit for Windows 10 19H1 x64 This exploit uses the recently patched use after free vulnerability CVE-2019-1215 in ws2ifsl.sys to achieve local privilege escalation. The exploit targets Windows 10 19H1 1901 x64 and demonstrates how to bypass kASLR, kCFG and SMEP...

CVE-2025-50168-pwn2own-berlin-2025

Author: D4m0n CVE-2025-50168 This is an exploit submitted to Pwn2Own Berlin 2025 - LPE Category. The vulnerability occurs in Win32kbase!DirectComposition, and further details can be found in the blog post. Acknowledgements kASLR bypass technique: prefetch-tool by carrotc4k3 Special thanks to: Dav...

exploiting-cve-2017-5123

Exploiting CVE-2017-5123 Introduction This repository is an addition to the article published in MISC Magazine 96. We achieved to elevate our privileges in a reliable way, on our virtual machine with SMEP / SMAP and KASLR enabled. It should however be noted that the system if left in an unstable...

Lenovo-CVE-2025-8061

CVE-2025-8061 is a privilege escalation vulnerability in Lenovo's LnvMSRIO.sys driver. The driver exposes IOCTL handlers that allow any user-mode process including unprivileged users to: Read/write arbitrary Model-Specific Registers MSRs Read/write arbitrary physical memory This gives a standard...

vpwn

vpwn by qwertyoruiop generic xnu heap overflow exploitation. demo output: $ ./pwn i Preparing payload... i broke out of kaslr, kaslrslide = 0000000001a00000 + Payload successfully crafted. i Manipulating the heap... i Exploit loaded. + got r00t sh-3.2 uname -a Darwin qwertyoruiops-iMac.local 14.3...

LolModapi

嗨，黑客们。 这是一个 MODAPI.sys 中的未认证 MSR 写入漏洞，该内核驱动由 MSI Dragon Center 2.0.155.0 安装。该驱动暴露了一个设备对象，其安全描述符允许任何本地用户打开它，无需管理员权限，也无需 UAC。一旦获得句柄，MSR 索引上就没有白名单限制，因此你可以随意读写任何 MSR。 读取侧本身就已经能破坏 KASLR。读取 IA32LSTAR 0xC0000082，驱动就会免费把 ntoskrnl!KiSystemCall64 交给你。写入侧才是真正的问题所在。IA32LSTAR 是 CPU 在 syscall...

CVE-2017-16994

/ disablemapminadd.c / / / include include include include include include include / offsets might differ, kernel was custom compiled you can read vmlinux and caculate the offset when testing / / define OFFSETKERNELBASE 0x000000 / define MMAPMINADDR 0x1101de8 define DACMMAPMINADDR 0xe8e810 / get...

cve-2026-43499-m3q-azf1

GhostLock SELinux park — SM-S948U1 / AZF1 m3q Research snapshot of a working SELinux-only park for Samsung Galaxy S26 Ultra SM-S948U1, codename m3q on firmware S948U1UES3AZF1 GKI 6.12.30-android16-5. This package is not a complete root. It flips SELinux to Permissive and holds reclaim long enough...

kernel-exploits

Linux 内核漏洞利用...

iOS26.6-CVE-2026-65343

CVE-2026-65343 — Lectura Fuera de Límites en AppleKeyStore Derrota de KASLR Componente: Extensión de kernel AppleKeyStore — LibSerSEPControlDeserialize Afecta: iOS / iPadOS 26.6 23G71 y anteriores Corregido en: iOS / iPadOS 26.6.1 23G83 Tipo: Lectura fuera de límites en la deserialización de...

prefetch-tool

Herramienta de Prefetch KASLR para Windows Una herramienta de prueba de concepto para evadir KASLR ASLR del kernel en Windows 11. Inspirada en EntryBleed para Linux. Esta herramienta fue desarrollada como parte de un exploit dirigido a Windows 11 24H2. No soy un experto en canales laterales en...

CVE-2026-40369

This is a rewrite and summary of VoidSec’s public technical analysis of CVE-2026-40369, with an added flowchart and defensive notes for my own understanding. All core technical details come from his research. I did not perform independent reverse engineering on this bug. CVE-2026-40369: Defensive...

Elysium-Vanguard-Sentinel-Audit

SENTINEL-ROOT-AUDIT: Honor Magic V2 Hypervisor Detection Suite ➲ Project Overview SENTINEL-ROOT-AUDIT is a professional-grade security suite designed to audit kernel integrity and detect hypervisor-level interventions on the Honor Magic V2 SM8550. While the core vulnerability CVE-2025-38352 allow...

CVE-2026-20805-PoC

CVE-2026-20805 PoC 概念验证，演示 Microsoft 桌面窗口管理器（dwm.exe）中的信息泄露漏洞。 概述 本仓库包含一个自定义概念验证（PoC），用于复现 CVE-2026-20805，这是一个影响 Windows 桌面窗口管理器进程的信息泄露漏洞。该漏洞允许本地已认证用户因 ALPC 相关结构处理不当而泄露内核对象指针，可能削弱内核漏洞缓解措施（如内核地址空间布局随机化（KASLR））。本 PoC 是在发现现有公开脚本存在不稳定性和执行问题后独立实现的，目标是产生可靠且可验证的结果。 漏洞详情 CVE ID： CVE-2026-20805 漏洞类型：...

KasperMeow

Kaspersky arkmon.sys 通过内核调试日志泄露绕过 KASLR Kaspersky 的反 rootkit 监控驱动程序（arkmon.sys）存储了一份包含原始内核指针的内核调试日志。该日志使用 XOR 0xCC + ROT13 进行“加密”——可轻松逆向还原。任何管理员用户都可以通过 IOCTL 读取并解密此日志，从而完全绕过 KASLR。 在撰写本文时，该概念验证可在完全修补的 Windows 11 25H2 及 Kaspersky Standard: K4W-21-26（含最新数据库更新）上运行。...

cve-2026-43499

GhostLock Exploitation Failure Summary on PD2229 SM8475, 5.10.233 GKI I. Vulnerability and Device Facts 1.1 CVE-2026-43499 GhostLock Basic Information Item| Value ---|--- Vulnerability Type| Stack Use-After-Free in the rtmutex / futex PI path Introduced Version| Linux 2.6.39-rc1 May 2011, commit...

sh53d-temp-root

SH-53D temporary root This is a build-specific proof of conce...

CVE-2026-89616

A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the nireadframe function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used kernel memory pages to a local attacker who reads a specially...

AZL-100632 CVE-2026-89616 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...