draytek-arsenal

Draytek Arsenal: Observability and hardening toolkit for Draytek edge devices. Advanced attackers are increasingly choosing edge devices as targets. However, these devices are controlled by closed-source software known as firmware, often distributed in a proprietary format. This is an added...

CVE-2025-32463_POC

Checking nsswitch.conf default values: root@kitploit: passwd: files systemd After calling chroot, sudo trys to parse the config values at nsswitch.conf to run the command, which leads it to try to open libnsssystemd.so.2...

CVE-2020-14372

CVE-2020-14372: Bypassing not so Secure Boot with one "simple trick" Vulnerability details One day I typed "help" into GRUB2's console and saw some really "fun" commands: readbyte ADDR: Read 8-bit value from ADDR writebyte ADDR VAL: Write 8-bit value VAL to ADDR I immediately thought I found the...

POC-CVE-2025-55182

CVE-2025-55182 - React RSC RCE PoC para la vulnerabilidad de deserialización en el protocolo Flight de React Server Components. ¿Qué es? Next.js 14+ y React 19 usan un protocolo propietario "Flight" para comunicarse entre cliente y servidor. El problema: el servidor carga cualquier módulo sin...

OVSwrap-CVE-2026-64531-Mitigation-Tool

Herramienta de Mitigación OVSwrap CVE-2026-64531 Un script sencillo que detecta y mitiga la vulnerabilidad OVSwrap que afecta a los módulos del kernel de Open vSwitch. Características Detecta módulos vulnerables de Open vSwitch Determina si el módulo está cargado Bloquea la carga automática Elimi...

CVE-2025-32463_Sudo_PoC

CVE-2025-32463SudoPoC PoC per CVE-2025-32463: escalation di privilegi locale in sudo tramite --chroot. Sfrutta l'iniezione di moduli NSS attraverso ambienti chroot appositamente predisposti. Progettato per ricercatori di sicurezza e ambienti esclusivamente di laboratorio. CVE-2025-32463 -...

CVE-2021-1675_CarbonBlack_HuntingQuery

Query di ricerca CarbonBlack per CVE-2021-1675 PrintNightmare 1 Basata sulla regola Sigma per il rilevamento del codice POC root@kitploit: filemodname:c:\windows\system32\spool\drivers\x64\3\old\1\123 2 Basata sulla regola Sigma per il rilevamento del codice POC root@kitploit:...

Redis-RCE

Redis-RCE esecuzione remota di codice per redis4 e redis5 codice python da https://github.com/Ridter/redis-rce Esecuzione del comando riuscita caricando il file so, che estende il nuovo comando system.exec strings explin.so |grep sys root@kitploit: system system.exec syserrlist.h sysnerr syserrli...

ghostlock-app

GhostLock-App 中文: READMEZH.md Dispositivi Supportati Kernel| Dispositivi ---|--- 6.1.118-android14-11-ga3b9c44908dd-ab13320413| Redmi Note 15 Pro+ 6.1.118-android14-11-gca0ef6d17716-ab13624819| Xiaomi 14 6.1.138-android14-11-g0c3d559bcd85-ab14529422| Xiaomi 14...

CVE-2021-4034

CVE-2021-4034 Un giorno per l'exploit di escalation dei privilegi di polkit Basta eseguire make, ./cve-2021-4034 e godersi la shell di root. L'avviso originale dei veri autori è qui PoC Se l'exploit funziona, otterrai subito una shell di root: root@kitploit: localuser@ubuntu-poc:/CVE-2021-4034$...

CVE-2026-22686-RemoteCodeExecution-RCE-PoC

RCE em Ambientes ESM — O Problema do require Ao alcançar a fuga da sandbox via CVE-2026-22686, executar comandos do SO em um projeto ESM "type": "module" exige contornar as restrições de carregamento de módulos do Node.js. As abordagens padrão falham pelos seguintes motivos:...

CVE-2025-32463

CVE-2025-32463 - Escalatione dei Privilegi di Sudo PoC /////// Disclaimer ///////////////////////////////////////////////////////////////////////////////////////////////////////////////// Questo progetto è fornito esclusivamente a scopo didattico. Utilizzando qualsiasi parte di questo repository,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: perl-Encode (UTSA-2026-093243)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093243 advisory. Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library in the current working directo...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed a UAF Use-After-Free issue caused by a race between btftrygetmodule and loadmodule. While working on code to populate the BTF IDs for modules during their initialization, I noticed that by the time the initialization...

Astra Linux – Vulnerability in zsh

In Zsh before version 5.8, attackers who were able to execute commands could regain privileges lost due to the --no-PRIVILEGED option. Zsh failed to overwrite the saved user ID, so the original privileges could be restored by executing MODULEPATH=/dir/with/module zmodload with a module that calls...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Module: Fix eshstrndx.shsize=0 OOB access It is trivial to create a module that triggers OOB access with the following code: if info-secstringsstrhdr-shsize – 1 != '\0' Bug: Unable to handle page faults for the address:...

CVE-2026-74636

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

AZL-97325 CVE-2026-74636 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

CVE-2026-74636

CVE-2026-74636 is a race condition in the Linux kernel tracing subsystem. When two modules are loaded concurrently on different CPUs, event_define_fields() and update_event_fields() can access class->fields simultaneously without proper mutual exclusion. Specifically, trace_event_update_all() ...

CVE-2026-74636 tracing: Fix race between update_event_fields and, event_define_fields

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...