PwnAdventure3

PwnAdventure3 Welcome to Pwnie Island! Pwn Adventure 3: Pwnie Island is a limited-release, first-person, true open-world MMORPG set on a beautiful island where anything could happen. That's because this game is intentionally vulnerable to all kinds of silly hacks! Flying, endless cash, and more a...

skewrun

Skewrun skewrun is an Active Directory time discovery toolkit for red teams. It dynamically resolves the Domain Controller's time via network protocols CLDAP, SMB, NTP, Kerberos, NTLM and executes commands via libfaketime LDPRELOAD, tricking the executed binary into using the exact DC time. This...

Freeloader

Docker support for plexmediaservercrack Patches Plex Media Server running in Docker — both the official plexinc/pms-docker image and the community lscr.io/linuxserver/plex image — using the same LDPRELOAD-on-the-PMS-exec mechanism as the native systemd install. See the top-level README and the fu...

azazel

Azazel V 0.1 The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin. -- 1 Enoch 2:8 Azazel is a userland rootkit based off of the original LDPRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily...

DynastyPersist

DynastyPersist 1.5 DynastyPersist: A streamlined tool for achieving Linux persistence effortlessly. Supports KoTH, Battlegrounds and Pentest Operations Install • Documentation • Usage Documentation FEATURES Features| Description ---|--- SSH Key Generation| Automatically generates SSH keys for...

assethook

AAssetHook AAssetHook is an LDPRELOAD-based hooking library that allows for replacing APK asset files dynamically without modifying an APK. It's also written in rust. It redirects asset file loads to a filepath on an Android device under /data/local/tmp/assethook/com.pkg.name. Needless to say, du...

CVE-2024-37032-PoC

CVE-2024-37032 Probllama PoC — Ollama Path Traversal and Privilege Escalation This repository contains a proof of concept FastAPI registry server, connector script, and preload demo library for authorized lab testing. Use this only on systems you own or are explicitly allowed to test. Files...

ifuncd-up

In Response to Hacker News I see you jokers on the orange website are giving me a hard time. I will make a few choice responses below, but first I offer a challenge: I will send $500 of my own money to the first person who can demonstrate this attack without ifunc. I am genuinely interested, and...

bypass_disablefunc_via_LD_PRELOAD

bypassdisablefunc.php有三个GET选项：cmd，outpath和sopath。 选项非常简单， cmd是你的邪恶命令， outpath是命令输出文件路径（可读和可写）， sopath是我们的共享对象bypassdisablefuncx64.so的绝对路径。例如： http://site.com/bypassdisablefunc.php?cmd=pwd&outpath=/tmp/xx&sopath=/var/www/bypassdisablefuncx64.so 一是cmd参数，待执行的系统命令（如pwd）; 二是outpath参数，保存命令执行输出结果的文件路径（如...

proxychains-ng

ProxyChains-NG 版本 4.17 自述文件 ProxyChains 是一个 UNIX 程序，它通过预加载的 DLL（dlsym、LDPRELOAD）挂钩动态链接程序中的网络相关 libc 函数，并将连接重定向到 SOCKS4a/5 或 HTTP 代理。它仅支持 TCP（不支持 UDP/ICMP 等）。 它的工作方式本质上是一种 HACK；因此它有可能无法与你的程序配合使用，尤其是当你的程序是脚本、会启动大量进程（如后台守护进程）或使用 dlopen 加载“模块”时（glibc 动态链接器中的一个 bug）。不过，它应该适用于简单的编译型（C/C++）动态链接程序。...

Chankro

Chankro Your favourite tool to bypass disablefunctions and openbasedir in your pentests. How it works PHP in Linux calls a binary sendmail when the mail function is executed. If we have putenv allowed, we can set the environment variable "LDPRELOAD", so we can preload an arbitrary shared object...

omae-wa-cheese-da

omae-wa-cheese-da Image GPU任意物理读写（CVE-2025-21479） - KASLR泄露 - SELinux宽容模式 - RKP安全的init-hook根服务器及DEFEX绕过自定义二进制执行（LDPRELOAD） 大约需要6分钟。请耐心等待。 稍后我会优化。 已测试设备 Galaxy Z Flip 5 SM-F731N 固件：F731NKSU5EYD9 Android：15 安全补丁：2025-04-01 SoC：Snapdragon 8 Gen 2 SM8550 / kalama GPU：Adreno 740 v2 Galaxy Z Flip 5...

ElfDoor-gcc

ElfDoor-gcc ElfDoor-gcc is an LDPRELOAD that hijacks gcc to inject malicious code into binaries during linking, without touching the source code. Detailed Article: https://matheuzsecurity.github.io/hacking/gcc/ Install root@kitploit: git clone https://github.com/MatheuZSecurity/ElfDoor-gcc cd...

xzk8s

xzk8s Dockerfile and Kubernetes manifests for reproduce CVE-2024-3094 Build image We use the debian version of the vulnerable xz utils as the base image. We also need to patch the library. The patched version of the liblzma library is taken from the xzbot repository. root@kitploit: FROM...

azazel

Azazel V 0.1 全地はアザゼルによって教えられた業を通して堕落した。すべての罪は彼に帰せよ。 -- 1エノク書2:8 Azazelは、Jynx rootkit由来のオリジナルのLDPRELOAD技術に基づいたユーザーランドルートキットです。より堅牢で追加機能を持ち、アンチデバッグとアンチ検出に重点を置いています。 特徴 アンチデバッグ unhide、lsof、ps、lddの検出を回避 ファイルとディレクトリを隠蔽 リモート接続を隠蔽 プロセスを隠蔽 ログインを隠蔽 PCAPフックによりローカルスニッフィングを防止 2種類のacceptバックドア。 Crypthook...

CVE-2026-43499-OnePlus15

CVE-2026-43499 — OnePlus 15 LPE Educational PoC WARNING: This repository is provided for educational and research purposes only. No pre-built binaries or releases are distributed. You must build everything from source. Android 16 local privilege escalation for OnePlus 15. Fork of...

cve-2023-36845-scanner

Vulnerability Scanner for Juniper CVE-2023-36845 This vulnerability scanner can be used to scan Juniper firewalls to determine if they are vulnerable to CVE-2023-36845. Because this is built on top of go-exploit, this scanner has two phases: Target verification to ensure the target is a potential...

CVE-2026-43499-popsicle

CVE-2026-43499 for popsicle This repository contains an Android 16 local privilege escalation implementation for CVE-2026-43499 on Xiaomi 17 Pro Max popsicle. Verified kernel: root@kitploit: 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k Devices with this kernel Xiaomi 17, Pro, and Ultra...

CVE-2021-44168

Exploit for CVE-2021-44168 Purpose Exploit CVE-2021-44168 to drop a shell on a Fortigate firewall and enable its access via LDPRELOAD tricks that execute when running some of Fortigate's CLI commands. You get a root shell. Use Compile: root@kitploit: gcc -o gensrc-vispkgfile gensrc-vispkgfile.c -...

CVE-2017-14187_PoC_ARMv7

CVE-2017-14187 PoC Proof-of-Concept of Local Privilege Escalation for FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and below 5.2 Triggered by fnsysctl and USB so physical access required. This PoC spawns local root shell by exploiting CVE-2017-14187. Write-up Korean English TL;DR 1. fnsysctl cp...