CVE-2022-0185-PipeVersion

Versão pipe do CVE-2022-0185 Usando pipe-primitive para explorar CVE-2022-0185, então não é necessário vazamento de kaslr nem bypass de smap smep ktpi : P: O que é pipe-primitive? R: https://github.com/veritas501/pipe-primitive...

CVE-2021-22555-PipeVersion

CVE-2021-22555 versão pipe Usando pipe-primitive para explorar CVE-2021-22555, então não é necessário vazamento de kaslr nem bypass de smap smep ktpi : P: O que é pipe-primitive? R: https://github.com/veritas501/pipe-primitive Testado tanto no Linux 4.15 quanto no Linux 5.8...

CVE-2017-5123

CVE-2017-5123 Prova de Conceito CVE-2017-5123 - EPL - Contornando SMEP/SMAP. Sem KASLR A implementação waitid em kernels upstream não restringia o destino alvo para copiar informações de resultados. Isso pode permitir que usuários locais escrevam em memória do kernel protegida, levando à escalaçã...

CVE-2022-25636-PipeVersion

CVE-2022-25636 पाइप संस्करण pipe-primitive का उपयोग करके CVE-2022-25636 का शोषण करने के लिए, इसलिए न तो kaslr leak की आवश्यकता है और न ही smap smep ktpi bypass की : प्रश्न: pipe-primitive क्या है? उत्तर: https://github.com/veritas501/pipe-primitive...

CVE-2021-21551

CVE-2021-21551 के लिए PoC डेल dbutil23.sys ड्राइवर का उपयोग करके विंडोज LPE। शोषण दृष्टिकोण रीड/राइट लागू करें, शेलकोड आवंटित करें, smep को बायपास करने के लिए पेज फ्लिप करें, haldispatch ptr को ओवरराइट करें, शेलकोड निष्पादित करें।...

exploiting-cve-2017-5123

Explorando o CVE-2017-5123 Introdução Este repositório é um complemento ao artigo publicado na MISC Magazine 96. Conseguimos elevar nossos privilégios de forma confiável, em nossa máquina virtual com SMEP / SMAP e KASLR ativados. Deve-se notar, no entanto, que o sistema fica em um estado instável...

SdoKeyCrypt-sys-local-privilege-elevation

SdoKeyCrypt.sys - Уязвимость локального повышения привилегий 1. Что такое SdoKeyCrypt.sys? SdoKeyCrypt.sys — это драйвер защиты клавиатуры для MMORPG Massively Multiplayer Online Role-Playing Game под названием MapleStory Online, издаваемой Shanda Group в Китае. Официальный сайт игры:...

CVE-2019-1215

CVE-20190-1215 ws2ifsl.sys استغلال UAF لـ Windows 10 19H1 x64 يستخدم هذا الاستغلال ثغرة الاستخدام بعد التحرير use after free التي تم تصحيحها مؤخراً CVE-2019-1215 في ws2ifsl.sys لتحقيق تصعيد الامتيازات المحلية. يستهدف الاستغلال Windows 10 19H1 1901 x64 ويوضح كيفية تجاوز kASLR و kCFG و SMEP. عند...

nullmap

nullmap Um mapeador de drivers manual muito simples baseado no meu antigo voidmap e no POC do CVE-2023-21768 por chompie e b33f. Como a primitiva de leitura/escrita de memória pós-exploração do IoRing subjacente não lida muito bem com muitas leituras e escritas consecutivas, decidi sobrescrever o...

CVE-2017-5123

CVE-2017-5123 Exploit para a vulnerabilidade do kernel CVE-2017-5123 Pode compilá-lo com: gcc -static -Wall -Wextra -Werror -o cve20175123 CVE-2017-5123.c Se quiser uma explicação mais detalhada, escrevi um artigo explicando como funciona, pode encontrá-lo aqui Este exploit é mais fiável do que o...

Exploit for CVE-2025-8061

Lenovo-CVE-2025-8061 PoC fo...

Linux Distros Unpatched Vulnerability : CVE-2016-9644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The getuserasmex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with t...

AMD SMM Supervisor Vulnerability Security Notice

Bulletin ID: AMD-SB-7011 Potential Impact: Loss of confidentiality, integrity, and availability Severity: High Summary External researchers reported a potential vulnerability during SMM Supervisor initialization which may impact some AMD processors. On systems that do not have Supervisor Mode...

x86: speculative vulnerability in 32bit SYSCALL path

ISSUE DESCRIPTION Due to an oversight in the very original Spectre/Meltdown security work XSA-254, one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks. IMPACT An...

SUSE CVE-2016-9644

The getuserasmex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this...

x86: Multiple speculative security issues

ISSUE DESCRIPTION 1 Researchers have discovered that on some AMD CPUs, the implementation of IBPB Indirect Branch Prediction Barrier does not behave according to the specification. Specifically, IBPB fails to properly flush the RAS Return Address Stack, also RSB - Return Stack Buffer - in Intel...

CVE-2022-0002

A flaw was found in hw. The Intra-mode BTI refers to a variant of Branch Target Injection aka SpectreV2 BTI where an indirect branch speculates to an aliased predictor entry for a different indirect branch in the same predictor mode, and a disclosure gadget at the predicted target transiently...

CVE-2022-0001

A flaw was found in hw. The Branch History Injection BHI describes a specific form of intra-mode BTI. This flaw allows an unprivileged attacker to manipulate the branch history before transitioning to supervisor or VMX root mode. This issue is an effort to cause an indirect branch predictor to...

CVE-2021-26708

A flaw was found in the Linux kernel. Wrong locking in the AFVSOCK socket can cause a local privilege escalation, bypassing SMEP and SMAP. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Reliable Datagram Sockets (RDS) rds_atomic_free_op Privilege Escalation Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Reliable Datagram Sockets RDS rdsatomicfreeop NULL pointer dereference Privilege Escalation', 'Description' = %q This module attempts to gain roo...