exploiting-cve-2017-5123

Exploiting CVE-2017-5123 Introduction This repository is an addition to the article published in MISC Magazine 96. We achieved to elevate our privileges in a reliable way, on our virtual machine with SMEP / SMAP and KASLR enabled. It should however be noted that the system if left in an unstable...

CVE-2021-33624

Proof of Concept for CVE-2021-33624 compile with gcc -pthread -o bpfspectretypeconfusion bpfspectretypeconfusion.c -Wall -ggdb -std=gnu99 execute with sudo ./bpfspectretypeconfusion 1 2 ffffffffa4925620 0x10 where 1 and 2 are CPU threads which run on two distinct hardware cores, ffffffffa4925620 ...

AutoLocalPrivilegeEscalation

AutoLocalPrivilegeEscalation An automated script that download potential exploit for linux kernel from exploitdb, and compile them automatically This script is created due to Hackademics, there are so much possible exploit for that version of kernel, as a rookie OSCP student, I am not able to fin...

CVE-2019-13272

CVE-2019-13272 Linux local root exploit Linux 4.10 5.1.17 PTRACETRACEME local root CVE-2019-13272 In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtai...

cve-2025-39682

CVE-2025-39682 exploit on kernelCTF mitigation instance This is also my first ? idk, this is a variant of CVE-2024-58239 1-day exploit. Patch: tls: fix handling of zero-length records on the rxlist This CVE was used in exp398 and and exp403. kernelCTF spreadsheet. For folder structures and how to...

ved-ebpf

VED-eBPF: Kernel Exploit and Rootkit Detection using eBPF VED Vault Exploit Defense-eBPF leverages eBPF extended Berkeley Packet Filter to implement runtime kernel security monitoring and exploit detection for Linux systems. Introduction eBPF is an in-kernel virtual machine that allows code...

TowelRoot

What is TowelRoot? Towelroot gains root access by exploiting a vulnerability in the kernel of Android, which is based on Linux and is a very basic component of the device that basically acts as a middle-man to make the operating system and the physical hardware talk to one another...

CVE-2023-3338-DECPwn

DECPwn Practicing different Linux kernel exploitation techniques with my DECnet vulnerability and null page mapping enabled. Scenarios Everything disabled : qemu-system-x8664 -append "nosmap nosmep nopti nokaslr" Code execution is redirected to the output function in userland, which invokes...

krie

KRIe KRIe is a research project that aims to detect Linux Kernel exploits with eBPF. KRIe is far from being a bulletproof strategy: from eBPF related limitations to post exploitation detections that might rely on a compromised kernel to emit security events, it is clear that a motivated attacker...

NFSundown

Overview Proof-of-Concept exploit for NFSundown CVE-2025-38089. It can remotely trigger a kernel crash in an NFS server. Details A remote attacker can trigger a kernel null pointer dereference and crash the kernel by sending a specially crafted RPC request. This occurs due to improper handling of...

container-cve-2021-22555

Reproducer for CVE-2021-22555 as a container First, this rolls in the exploit code from here as a handy pre-built container: https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555 Pre-built container: quay.io/cgwalters/cve-2021-22555 Mitigation: seccomp profiles A stron...

Check-for-CVE-2023-32629-GameOver-lay

Check for CVE-2023-32629 GameOverlay Script Overview: The script is designed to perform security checks on an Ubuntu system to detect vulnerabilities related to the GameOverlay flaws. It checks for two specific vulnerabilities, CVE-2023-2640 and CVE-2023-32629, which are present in the Linux...

CVE-2023-5178

CVE-2023-5178 The exploit for CVE-2023-5178: NVMe-oF-TCP vulnerability, which is a logic error in NVMe-oF-TCP driver during the handle of corrupted Initialize Connection Request. It leads to racy double-free in kmalloc-96 , which can be exploited to gain LPEsee demo below. The exploit targets...

dirtyPipe-automaticRoot

Dirty Pipe automatic root exploit CVE-2022-0847 Dependencies: Python 3.10 or above How to use: Automatic root: $ python3.10 dirtyPipe.py -a + hjacking super user in /etc/passwd + dropipng shell Write a no write permission, immutable or read-only mounted file: $ python3.10 dirtyPipe.py -w FILE...

vulhub

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. 中文版本Chinese version Quick Start Install Docker examp...

CVE-2019-13272

CVE-2019-13272 Linux local root exploit Linux 4.10 5.1.17 PTRACETRACEME local root CVE-2019-13272 In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtai...

CVE-2021-22555-PipeVersion

CVE-2021-22555 pipe version Using pipe-primitive to exploit CVE-2021-22555, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive Tested on both Linux 4.15 and Linux 5.8...

germy

Overview germy is an NGSM Linux kernel privilege escalation exploit for versions 5.15-rc1 to 6.6-rc1. See TECHNICALDETAILS.md for information on the vulnerabilities and exploit techniques used. Tested on: Ubuntu LTS 20.04.6 5.15.x and 22.04.4 6.5.x Ubuntu non-LTS 23.10 6.5.x Debian 12.5 6.1.x Usa...

kernel-exploit-factory

kernel-exploit-factory Keep updating...... Linux kernel CVE exploit analysis report and relative debug environment. You don't need to compile Linux kernel and configure your environment anymore. This repository is to extract all Linux kernel exploit and relative debug environment. You can use Qem...

ExploitGSM

ExploitGSM Exploit for 6.4 - 6.5 kernels and another exploit for 5.15 - 6.5 Telegram for contact - https://t.me/YuriiCrimson Telegram chat - https://t.me/itcrowdua In winter I found two vulnerabilities in the ngsm driver. After that Jammes wrote to me offering to buy them from me. As you...