userland-exec

Userland Exec Userland exec replaces the existing process image within the current address space with a new one. It mimics the behavior of the system call execve, but the process structures describing the process image remain unchanged. In other words, the process name reported by system utilitie...

cve-2024-31317

Exploration of CVE-2024-31317 CVE-2024-31317 provides unpriviledged access to any uid and SELinux scope available to proper Android apps. This provides access to uid 1000 system and uid 2000 shell, and can be triggered entirely from an unpriviledged app, allowing for persistence of any...

twiga

Twiga A tool that enumerates Android devices for information useful in understanding its internals and for exploit development. It supports android 4.2 to android 7.1.1 Requirements The most current ADB must be in your path and fully functional The report name must not have any whitespace...

IonStack-S22-cve-2026-43499

IonStack-S22-cve-2026-43499 MERGED WITH ORIGINAL REPO: Find it here https://github.com/CamsShaft/IonStack-S22 Full root in the kernel domain with selinux permissive on my SM-S901W S22 5.10.168-android12-9-27760517-abS901WVLS4DWL3. NOTES: I'm not going into great detail or lengths in this one sinc...

selinux-notebook

The SELinux Notebook Introduction The SELinux Notebook is an Open Source book on SELinux, originally created by Richard Haines and donated to the SELinux community. The Notebook's goal is to be the most current and comprehensive book on SELinux, covering the Linux Kernel components, the userspace...

sudo-CVE-2017-1000367

sudo-CVE-2017-1000367 http://www.openwall.com/lists/oss-security/2017/05/30/16 Compile: gcc -o sudopwn sudopwn.c -lutil Disclaimer: I had no clue what I was doing ;- Requirements System must be selinux-enabled sudo needs to be built with selinux support sudo -r User needs to have sudo permissions...

CVE-2023-6241

Exploit for CVE-2023-6241 The write up can be found here. This is a bug in the Arm Mali kernel driver that I reported in November 2023. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root. The exploit is...

CVE_2022_38181_Raven

Exploit for CVE-2022-38181 for FireTV 2nd gen Cube This is a fork of security researcher Man Yue Mo's Pixel 6 POC for CVE202238181. Read his detailed write-up of the vulnerability here. Changes have been made to account for FireOS's 32bit userspace, as well as the 2nd gen Cube's older Bifrost...

ifuncd-up

in response to Hacker News... I see you jokers on the orange websitehn are giving me a hard time. I will make a few choice responses below, but first I offer a challenge: I will send $500 of my own money to the first person who can demonstrate this attack without ifunc. I am genuinely interested,...

CVE_2022_38181_Gazelle

Exploit for CVE-2022-38181 to run on FireTV 3rd gen Cube This is a fork of security researcher Man Yue Mo's Pixel 6 POC for CVE202238181. Read his detailed write-up of the vulnerability here. Changes have been made to account for FireOS's 32bit userspace. The POC exploits a bug in the ARM Mali...

CVE-2019-2215-HuaweiP20Lite

Port CVE-2019-2215 bad binder to Huawei P20lite Android 8.0.0 Description This project is an exploit for CVE-2019-2215 on Huawei P20lite in version Android 8.0.0. Kernel is in version 4.4.23. This vulnerability is probably the most documented one tutorials, real port on physical phone on this top...

zenfone9-root

zenfone9-root — temporary root on a bootloader-locked ASUS Zenfone 9 Research code and notes for obtaining temporary root uid 0 on an ASUS Zenfone 9 AI2202 whose bootloader cannot be unlocked — because ASUS discontinued its unlock tool, removed the OEM-unlocking toggle from Developer options, and...

root-exploit-pixel3

Root Exploit for Pixel 3 Family This folder contains a local privilege escalation exploit, a modification of the bluefrostsecurity PoC for CVE-2020-0041. The exploit disables SELinux and then launches a root shell. The exploit was provided with hardcoded offsets for a Pixel 3 device running the...

s26-m1q-ghostlock-selinux

S26 SM-S942U1 / m1q GhostLock CVE-2026-43499 — uid=0 root + KernelSU 激活达成 针对 Samsung Galaxy S26（SM-S942U1，codename m1q，SoC SM8850 骁龙 8 Elite Gen2， 内核 6.12.30-android16-5-android16-5-pd30ff70，Android 16）的 CVE-2026-43499（GhostLock）提权研究。 ✅ 最终结果：uid=0 root + KernelSU 激活达成 exploit 后通过 root helper 验证 $...

ghostlock-a17

GhostLock — CVE-2026-43499 on Samsung Galaxy A17 Full user-to-root exploit chain for CVE-2026-43499 "GhostLock" on the Samsung Galaxy A17 SM-A175F , running Android 16 / GKI 6.12. The chain starts from the public GhostLock primitives and ends with a usermode helper executing as: uid=0root gid=0ro...

CVE_2022_46395_Raven

Exploit for CVE-2022-46395 to run on FireTV 2nd gen Cube This is a fork of security researcher Man Yue Mo's Pixel 6 POC for CVE-2022-46395. Read his detailed write-up of the vulnerability here. Changes have been made to account for FireOS's 32-bit user space. The POC exploits a bug in the ARM Mal...

tricorne

Tricorne A Fedora Remix for offensive security. "My treasure? If you want it, I'll let you have it. Seek it out! I left everything at that place!" Gol D. Roger The short version Kali owns Debian. BlackArch owns Arch. Parrot owns the "security-focused desktop" niche. No one owns RPM-world offensiv...

CVE-2021-1961

Exploit code for CVE-2021-1961. Full write-up is available on my blog. In order to build the exploit, run Android NDK's ndk-build. In order to run the exploit, you need to have access to /dev/qseecom, which means having the right user/group and the right SELinux context. This can be done either o...

CVE-2014-4322_poc

CVE-2014-4322poc poc code works on Nexus Android 4.4/5.0 Gain privileges:system - root,as a part of https://github.com/retme7/CVE-2014-7911poc author: retme [email protected] @returnsme on twitter & @retme on weibo website: retme.net The exploit must be excuted as system privilege and severa...

CVE-2022-20186

Exploit for CVE-2022-20186 The write up can be found here. This is a bug in the Arm Mali kernel driver that I reported in January 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root. The exploit is...