Unwinder

Content SilentMoonWalk Description Credits Usage callfunction! macro indirectsyscall! macro Parameter passing Examples Calling kernel32.dll!Sleep Calling kernel32.dll!OpenProcess Calling NtDelayExecution as indirect syscall Concatenate macro calls Considerations Initial frame PoC Stack replacemen...

system_bt_AOSP10_r33_CVE-2021-0522

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source mkdir /fluoride cd /fluoride git clone...

ghostlock-cve-2026-43499-4.19-k40

GhostLock — CVE-2026-43499 PoC Qualcomm 4.19 kernel Local privilege escalation exploiting CVE-2026-43499 — an rtmutex removewaiter bug that leaves a struct rtmutexwaiter dangling on the waiter's kernel stack kernel/locking/rtmutex.c, CWE-416 use-after-free. Adapted from NebuSec/CyberMeowfia...

stack-overflow-poc

CVE-2018-12086 PoC https://nvd.nist.gov/vuln/detail/CVE-2018-12086 https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2018-12086.pdf TL;DR: some OPC UA stacks are vulnerable to a stack overflow when decoding specially crafted requests. Build mvn clean package...

system_bt_AOSP10_r33_CVE-2021-0507

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source mkdir /fluoride cd /fluoride git clone...

DIR8xx_PoC

phpcgi phpcgi is responsible for processing requests to .php, .asp and .txt pages. Also, it checks whether a user is authorized or not. Nevertheless, if a request is crafted in a proper way, an attacker can easily bypass authorization and execute a script that returns a login and password to a...

CVE-2025-46819

CVE-2025-46819 – Redis Lua Long-String Delimiter Out-of-Bounds Read Malformed long-string delimiter causing Lua lexer OOBs read on Redis 8.2.1. Overview Lua's long-string parser in Redis 8.2.1 mishandles malformed =... sequences, returning sentinel values that lead to buffer underflows or excessi...

nginxpwn

Exploitation Training -- CVE-2013-2028: Nginx Stack Based Buffer Overflow This repository contains the nginx 1.4.0 source code as well as precompiled binaries with and without stack cookies. There's also a Vagrantfile for easy setup. Announcement and patch:...

CVE-2025-32756-POC

CVE-2025-32756: Fortinet RCE PoC A proof-of-concept for the critical stack-based buffer overflow vulnerability CVE-2025-32756 affecting Fortinet products. Vulnerability CVSS : 9.8 Critical Type : Stack-based buffer overflow in AuthHash cookie processing Impact : Unauthenticated remote code...

setcred

FreeBSD setcred2 — research artifacts This subdirectory collects the write-up and working exploits for the setcred2 stack buffer overflow in FreeBSD 14.x kernel. The vulnerability itself is fully documented in setcred.txt. The short version: kernsetcredcopyinsuppgroups uses sizeofgroups where...

DetectionLabELK

DetectionLabELK DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description: DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to all...

CVE-2026-53921-PoC-Exploit

CVE-2026-53921 – odhcpd Stack Overflow For educational and authorized testing only. Unauthorized use is illegal. Vulnerability Overview CVE-2026-53921 is a critical stack buffer overflow in OpenWrt’s odhcpd daemon – the default DHCPv6/DHCPv4/RA server. How it works The vulnerability exists in...

CVE-2025-22457

PoC for CVE-2025-22457 A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways Overview This is a proof of concept exploit to demonstrate exploitation of CVE-2025-22457. For a complete technical analysis of...

CVE-2021-27965

CVE-2021-27965 Proof of concept for CVE-2021-27965 Stack-based Buffer Overflow NOTE: I probably will not update this any further there is still a chance I will finish it. I currently have the ability to cleanly overwrite the instruction pointer, but I believe that this is enough to prove I have t...

system_bt_AOSP10_r33_CVE-2021-0431

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source mkdir /fluoride cd /fluoride git clone...

CVE-2026-117609

rtl433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2mc that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to...

CVE-2026-117609

rtl433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2mc that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to...

CVE-2022-26937

Windows Network File System Crash PoC CVE-2022-26937 nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a critical data structure. The...

sonicwall-cve-2019-7482

sonicwall cve-2019-7482 stack-based overflow...

CVE-2017-8367

CVE-2017-8367 PoC exploit for vulnerability CVE-2017-8367 Easy Mov Converter Register functionality Stack-Based Buffer Overflow. Usage Execute script and the file POCPayload.txt will be created containing the payload. python3 payloadgeneratorCVE-2017-15950.py Open the output file on notepad and...