legion

Legion ZK Auth 🛡️ True Zero-Knowledge Authentication with Hardware-Bound Device Ring Signatures 🎯 What is Legion? Legion is a passwordless zero-knowledge authentication system that proves you're authorized without revealing who you are. Authenticate using only your fingerprint + 24-word recovery...

Windows_MSKSSRV_LPE_CVE-2023-36802

CVE-2023-36802 Local Privilege Escalation POC authors: chompie For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Adapting the exploit to all vulnerable systems is left as an exercise to the reader. Git gud, etc. Usage: root@kitploit:...

r77-rootkit

r77 ルートキット ファイルレス ring 3 ルートキット r77は、すべてを隠蔽するring 3ルートキットです： ファイル、ディレクトリ プロセスとCPU/GPU使用率 レジストリキーと値 サービス TCPおよびUDP接続 ジャンクション、名前付きパイプ、スケジュールタスク プレフィックスによる隠蔽 "$77"で始まるすべてのものが隠蔽されます。 設定システム 動的な設定システムにより、プロセスをPID や名前 で、ファイルシステムアイテムをフルパス で、特定のポートのTCPおよびUDP接続などを隠蔽できます。...

r0ak

r0ak r0ak is a Windows command-line utility that enables you to easily read, write, and execute kernel-mode code with some limitations from the command prompt, without requiring anything else other than Administrator privileges. Quick Peek root@kitploit: r0ak v1.0.0 -- Ring 0 Army Knife...

rosenbridge

项目：rosenbridge ：x86 CPU中的硬件后门 github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax 概述 项目：rosenbridge 揭示了某些台式机、笔记本电脑和嵌入式 x86 处理器中的硬件后门。 该后门允许 ring 3（用户态）代码绕过处理器保护，自由读写 ring 0（内核态）数据。虽然该后门通常处于禁用状态（需要 ring 0 执行才能启用），但我们发现它在某些系统上 默认启用 。 此仓库包含用于检查您的处理器是否受影响、关闭后门（如果存在）的实用程序，以及用于发现和分析后门的研究和工具。 ...

Windows_AFD_LPE_CVE-2023-21768

CVE-2023-21768 Local Privilege Escalation POC authors: chompie & b33f 复现文章:hlingxbm For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Write primitive works on all vulnerable systems. Usage: root@kitploit: WindowsAFDLPECVE-2023-21768.exe where is the...

CVE-2020-11179-Adreno-Qualcomm-GPU

我在P0研究员Ben Hawkes创建的poc基础上的独立工作 原文：https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html 我的目标是将他的poc转换为C语言，并从他停下的地方继续， 把poc变成root shell或内核r/w，然后以某种方式修改系统以展示内核代码执行。 很可能，ttbr0的偏移量在我的测试手机上不同 需要计算和调试来找到偏移量 sunfish:/data/local/tmp $ ./adrenaline 0xfc45c000 main: rptr is...

qiomem

Descripción Lectura/escritura arbitraria de memoria física usando Toshiba qiomem.sys desde ring 3 solo funciona hasta direcciones físicas de 4 GB. El Driver se distribuye a través del Catálogo de Actualizaciones de Microsoft. Otras variantes. No listado en la Lista de Controladores Vulnerables de...

Windows_LPE_AFD_CVE-2023-21768

CVE-2023-21768 Local Privilege Escalation POC authors: chompie & b33f For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Write primitive works on all vulnerable systems. Usage: root@kitploit: WindowsAFDLPECVE-2023-21768.exe where is the process ID in...

CVE-2024-0582

Introduction This exploit implements a Dirty Cred attack method to gain unauthorized write access to /etc/passwd. Unlike many similar exploits that create numerous pages or aggressively spray file descriptors, this approach takes a more targeted route to corrupt the necessary kernel structures...

r0ak

r0ak r0ak（“roak”）是 Ring 0 军刀 —— 一个用于在 Windows 10 系统上读取/写入/执行 Ring 0 的命令行工具。...

CVE-2025-21333-POC

CVE-2025-21333-POC Prueba de concepto que explota CVE-2025-21333 en vkrnlintvsp.sys no muy fiable, véase la sección Requisitos y Limitaciones. En la sección de Referencias se encuentran recursos muy útiles para quienes quieran jugar con el exploit. Un análisis detallado de la vulnerabilidad y el...

CVE-2021-4204

CVE-2021-4204 中文版 writeup：https://tr3e.ee/posts/cve-2021-4204-linux-kernel-ebpf-lpe.txt 仅用于教育/研究目的。使用风险自负。 构建与运行 root@kitploit: $ sh buildandrun.sh Build from source... cc -I include -static -w -o exploit exploit.c Start exploit! This might take some while... phase1/7 'create bpf maps' running +...

SUSE CVE-2026-80876

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix event length with forced 8-byte alignment When RBFORCE8BYTEALIGNMENT is true, rbcalculateeventlength reserves the space of event-array0 for placing the data length and rbupdateevent stores the data length in...

Cronos-Rootkit

Cronos Rootkit Cronos 是一款 Windows 10/11 x64 ring 0 rootkit。Cronos 能够隐藏进程、保护进程，并通过令牌操作提升其权限。 功能 隐藏进程 提升进程权限 保护进程 贡献 欢迎贡献...

Chaos-Rootkit

Chaos-Rootkit Chaos-Rootkit 是我编写的一个 x64 Ring 0 rootkit，目的是更好地理解内核内部原理和 rootkit 技术。 GUI 版本 功能 隐藏进程：此功能允许你通过 DKOM 在进程列表工具中隐藏进程。 提升特定进程权限：此功能允许你提升特定进程的权限。 将磁盘和内存中的驱动程序替换为 Microsoft 驱动程序：此实现的所有功劳归于 IDontCode Back Engineering 的出色工作，我还为此功能处理了卸载和关闭例程，确保 rootkit 的驱动程序不会在某个时刻损坏或崩溃。 除了指定的进程 ID...

EUVD-2026-71506

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix event length with forced 8-byte alignment When RBFORCE8BYTEALIGNMENT is true, rbcalculateeventlength reserves the space of event-array0 for placing the data length and rbupdateevent stores the data length in...

CVE-2026-80876 ring-buffer: Fix event length with forced 8-byte alignment

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix event length with forced 8-byte alignment When RBFORCE8BYTEALIGNMENT is true, rbcalculateeventlength reserves the space of event-array0 for placing the data length and rbupdateevent stores the data length in...

CVE-2026-80876

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix event length with forced 8-byte alignment When RBFORCE8BYTEALIGNMENT is true, rbcalculateeventlength reserves the space of event-array0 for placing the data length and rbupdateevent stores the data length in...

CVE-2026-80876

CVE-2026-80876 affects the Linux kernel ring-buffer subsystem on architectures where RB_FORCE_8BYTE_ALIGNMENT is true (observed on riscv64 with CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y). The root cause is a mismatch in length calculation: rb_calculate_event_length() unconditionally reserves sizeof(even...