CVE-2010-2883

CVE-2010-2883 PoC for CVE-2010-2883 using TTD research, Metasploit techniques, BOF+ROP and HEAP spraying for educational purposes only...

crauEmu

Mascot designed by@kottsarapkin crauEmu is an uEmu extension for developing and analyzing payloads for code-reuse attacks. Slides from ZeroNights 2019 Demo 1 - X32-64, Edge, rop-gadgets from pwnjs Demo 2 - ARM64, checkm8 callback-chain RopEditor Installation 1. Put the file crauEmu.py in same...

CVE-2015-5736

CVE-2015-5736 PoC for CVE-2015-5736 using ROP, PreviousMode overwrite and Token strealing for educational purposes only...

TORQUE-Resource-Manager-2.5.x-2.5.13-stack-based-buffer-overflow-exploit-CVE-2014-8729-CVE-2014-878

TORQUE-Resource-Manager-2.5.x-2.5.13-stack-based-buffer-overflow-exploit-CVE-2014-8729-CVE-2014-878 Exploit Title: TORQUE Resource Manager 2.5.x-2.5.13 stack based buffer overflow Date: 10 Nov 2014 Exploit Author: @inso - Moussajee Thomas, @socks - Laurenceau Gary Vulnerability discovered by:...

EhTrace

EhTrace EhTrace pronounced "ATrace" is a high-performance binary tracing and instrumentation framework for Windows. It enables deep runtime analysis of Windows executables without requiring source code, binary modifications, or traditional debugging. Overview EhTrace leverages Windows Vectored...

CVE-2024-0039-Exploit

CVE-2024-0039-Exploit Description Python script for exploiting CVE-2024-0039: arbitrary code execution on vulnerable Android devices. WARNING : This code is intended for educational and constructive purposes only, on the side of good, so to speak! Usage Run the script with the necessary arguments...

Bropper

BROPPER An automatic Blind ROP exploitation python tool Abstract BROP Blind ROP was a technique found by Andrew Bittau from Stanford in 2014. Original paper Slides Most servers like nginx, Apache, MySQL, forks then communicates with the client. This means canary and addresses stay the same even i...

PS4-5.05-Kernel-Exploit

PS4 5.05 Kernel Exploit Summary In this project you will find a full implementation of the second "bpf" kernel exploit for the PlayStation 4 on 5.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This exploit also contains...

h-encore

h-encore h-encore , where h stands for hacks and homebrews, is the second public jailbreak for the PS Vita™ which supports the newest firmwares 3.65, 3.67 and 3.68. It allows you to make kernel- and user-modifications, change the clock speed, install plugins, run homebrews and much more. Write-up...

Byepervisor

Byepervisor Summary PS5 hypervisor exploit for = 2.xx firmware. Two vulnerabilities and exploit chains are contained in the repo, they are independent of each other and either can be used. One exploit is provided mainly just for preservation /oldjumptableexploit, only the primary exploit chain...

ROPInjector

ROPInjector A tool written in C Win32 to convert any shellcode in ROP and patch it into a given portable executable PE. It supports only 32-bit target PEs and the x86 instruction set. Published in Blackhat USA 2015, "ROPInjector: Using Return Oriented Programming for Polymorphism and Antivirus...

effective-waffle

effective-waffle yet another sleep encryption thing. also used the default github repo name for this one. TpAllocWork + TpPostWork + TpWaitForWork + TpReleaseWork to create + execute + clean the callback. The callback is some scuffed assembly that queues up a ton of rop gadgets that will pop...

Router-Exploit-Shovel

Router Exploit Shovel Automated Application Generation for Stack Overflow Types on Wireless Routers Router exploits shovel is an automated application generation tool for stack overflow types on wireless routers. The tool implements the key functions of exploits, it can adapt to the length of the...

CVE-2024-21762

CVE-2024-21762 out-of-bounds write in Fortinet FortiOS CVE-2024-21762 vulnerability Exploit poc by assetnote ssldohandshakeptr = b"%60%ce%42%00%00%00%00%00" getcwdptr = b"%70%62%2c%04%00%00%00%00" pivot1 = b"%52%f7%fd%00%00%00%00%00" push rdi; pop rsp; ret; pivot2 = b"%ac%c9%ab%02%00%00%00%00" ad...

rop-tool

rop-tool v2.4.2 A tool to help you write binary exploits OPTIONS rop-tool v2.4.2 Help you make binary exploits. Usage: rop-tool OPTIONS Commands : gadget Search gadgets patch Patch the binary info Print info about binary heap Display heap structure disassemble Disassemble the binary search Search...

ropr

ropr ropr is a blazing fast multithreaded ROP Gadget finder What is a ROP Gadget? ROP Return Oriented Programming Gadgets are small snippets of a few assembly instructions typically ending in a ret instruction which already exist as executable code within each binary or library. These gadgets may...

CVE-2022-0185

CVE-2022-0185 This repo contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version fuse version specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege...

ROP_ROCKET

Introducing the ROP ROCKET This new, advanced ROP framework made it debute at at DEF CON 31 with some unprecedented capabilities. ROCKET generates several types of chains, and it provides new patterns or techniques. Please note that this is still a work in progress, with some updated and enhanced...

exrop

Exrop Automatic ROP chain generator for x86-64 binaries, powered by Triton symbolic execution. Features Set registers to constants or other registers rdi=0x41414141, rdi=rax Write to memory constant and register-based addresses/values Write strings/bytes to memory Function calls with mixed...

PS5-UMTX-Jailbreak

PSFree version 1.4.0 PSFree is a WebKit exploit using CVE-2022-22620 to gain arbitrary read/write. vulnerable: PS4 6.xx-9.xx tested 6.00-9.60 PS5 1.xx-5.xx tested 1.00-5.50 CREDITS: anonymous for PS4 firmware kernel dumps janisslsm from ps4-dev on discord.com contributed ROP chain managers for 8....