NimbusPWN-CVE-2022-29799-29800

NimbusPwn — networkd-dispatcher !NOTE Other distros: dnf install gcc dbus-devel pkgconf Fedora/RHEL or pacman -S gcc db...

CVE-2021-3156

Baron Samedit - Sudo CVE 2021-3156 PoC Written in BASH and C. Written by: TheFlash2k/Ali Taqi Wajid Usage: root@kitploit: This would spawn a root shell directly if the sudo is vulnerable. $ make $ ./exploit...

CVE_2022_0847

CVE20220847 CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability POC A Simple Proof of concept to get root shell. root@kitploit: $ gcc cve20220847.c -o exploit $ ./exploit /etc/passwd 1 ootz: $ su rootz id uid=0root gid=0root groups=0root...

CVE-2026-24061

🚨 CVE-2026-24061 — “TelneTD” Critical Remote Authentication Bypass in GNU Inetutils telnetd The ghost of 2015 just came back to own everything still running telnet. Zero authentication. One environment variable. Instant root shell. ⚠️ Overview CVE-2026-24061 is a critical remote privilege...

CVE-2017-16995

CVE-2017-16995 tested for Ubuntu 16.04.01 - Linux 4.4.0-31-generic 50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x8664 This vulnerability allow a simple user to do a privilege escalation and get a root shell if different kernel adjust CRED offset + check kernel stack size...

tpwn-bis

tpwn-bis simple poc for cve-2015-5932 / cve-2015-5847 / cve-2015-5864 now escalates to root and spawns a shell. a big thanks to @qwertyoruiop for original code and help!...

DirtyPipe-BSI

Dirty...What? This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite the root password field in /etc/passwd and restore it after obtaining a root shell. Note: I claim no credit for finding this vulnerability or writing the proof of concept. This exploit is simply a...

RancidCrisco

RancidCrisco Minimum Viable PoC for CVE-2023-20126 This is the initial release. It works, but its the 'simplest case' exploit. Tested and working on SPA112/SPA122 - SPA232D requires a different firmware image. Gives a root-shell on port 23000/tcp. I still need to clean up the toolchain used for...

CVE-2022-37706-SUID

CVE-2022-37706-SUID CVE-2022-37706-Enlightenment v0.25.3 - Privilege escalation ./exploit.sh CVE-2022-37706 Trying to find the vulnerable SUID file... This may take few seconds... + Vulnerable SUID binary found! + Trying to pop a root shell! + Enjoy the root shell : mount: /dev/../tmp/: can't fin...

CVE-2021-44731-snap-confine-SUID

CVE-2021-44731-snap-confine-SUID Local Privilege Escalation Exploit for CVE-2021-44731, snap-confine 2.54.2 and lower All credit to Qualys for finding this and providing a detailed exploit. https://www.qualys.com/2022/02/17/cve-2021-44731/oh-snap-more-lemmings.txt Quick and Dirty snap-confine LPE...

CVE-2021-4034

CVE-2021-4034 One day for the polkit privilege escalation exploit Just execute make, ./cve-2021-4034 and enjoy your root shell. The original advisory by the real authors is here PoC If the exploit is working you'll get a root shell immediately: root@kitploit: vagrant@ubuntu-impish:/CVE-2021-4034$...

CVE-2026-24061-lab

CVE-2026-24061 — Reproduction Lab ⚠️ For educational purposes only. Isolated lab environment. Français ci-dessous Summary Critical authentication bypass CVSS 9.8 in GNU InetUtils telnetd ≤ 2.7. By injecting -f root as the USER variable via the Telnet NEWENVIRON option, an unauthenticated attacker...

CVE-2016-2067

ADRENO GPU IOMMU DMA EXPLOIT Tested under Nexus 6p google/angler/angler:6.0.1/MMB29M/2431559:user/release-keys About the bug Discussed in 2016 via Blackhat EU About the exploit With iommu dma writes, vdso.so is overwritten with shellcode. So after /init executes kernelclockgettime, the shellcode...

root-exploit-pixel3

Root Exploit for Pixel 3 Family This folder contains a local privilege escalation exploit, a modification of the bluefrostsecurity PoC for CVE-2020-0041. The exploit disables SELinux and then launches a root shell. The exploit was provided with hardcoded offsets for a Pixel 3 device running the...

CVE-2025-32463

Reference: https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot Executing the PoC on Ubuntu 24.04.2 LTS server with Sudo v1.9.15p5, using an unprivileged user with no Sudo rules defined, results in a root shell outside of the chrooted environment. lowpriv@prod:/CVE-2025-3246...

FEP3370-advanced-ethical-hacking

DynoRoot CVE-2018-1111 Final project for the course Advanced Ethical Hacking at KTH, Stockholm This project demonstrates a known vulnerability of Fedora and RedHat machines related to an unsafe client-side implementation of the Dynamic Host Configuration Protocol DHCP. A rogue DHCP server can cra...

CVE-2025-32463

Heavily influenced/copied/based on the format of a similar repo by pr0v3rbs -- https://github.com/pr0v3rbs/CVE-2025-32463i\chwoot.git This is a C reimplementation for rapid, single-source delivery, execution, and cleanup. CVE-2025-32463 – sudo chroot "chwoot" PoC This repository provides a...

unisoc-su

unisoc-su A method for CVE-2025-31710 and to connect to cmdskt abstract socket to obtain a root shell on unisoc unpatched models Before everyone screams, Unisoc itself authorized me to publish this after CVE-2025-31710 bullettin, so stay quiet. Let's start with a joke Yes, you are not dreaming,...

Nagios-CVE-2019-15949-RCE

Nagios-CVE-2019-15949-RCE-Poc a python PoC for the CVE-2019-15949 Overview A vulnerability exists in Nagios XI = 5.6.5 allowing an attacker to leverage an RCE to escalate privileges to root. The exploit requires access to the server as the 'nagios' user, or CCM access via the web interface with...

DirtyPipePython

dirty.py Description This is an exploit for the Linux kernel vulnerability CVE-2022-0847 DirtyPipe discovered by Max Kellerman. This code combines two existing DirtyPipe POC's into one: febinrev Overwrites sudo binary to directly pop a root shell eremus-dev A direct copy of Kellerman's POC into...