CVE-2022-0847

CVE-2022-0847 Dirty Pipe Linux Kernel Privilege Escalation Analysis toc This article was first published on Huawei Security's official account, this is the blog version more complete First published link: https://mp.weixin.qq.com/s/6VhWBOzJ7uu80nzFxe5jpg Vulnerability Introduction Vulnerability I...

FRAGNESIA-Charan-cve-2026-46300

Charantej Architecture: Hardened Container Staging & Syscall Telemetry Lab An enterprise-grade, defense-in-depth container containment and runtime security telemetry framework. Designed from the perspective of a Cisco Lead Cybersecurity Architect, the Charantej Architecture isolates staging...

Hunt-Weird-Syscalls

Hunt-Weird-Syscalls This is a ETW based POC to monitor for abnormal syscalls. For now, the syscalls NtOpenThread and NtSetContextThread are monitored to identify IOCs indicating both direct and indirect syscalls. Description This project uses ETW, more precisely kernel based ETW providers, to...

CVE-2017-5123

CVE-2017-5123 Linux privilege escalation exploiting waitid syscall. The exploit is brought to you by @XeR0x2A and @chaignc from HexpressoTeam for educational purposes only. The bug was introduced the 2017-05-21 and fixed 2017-10-09, 4.14.0-rc4+ is known vulnerable. asciicast If you have a...

EDRs

EDRs This repo contains information about EDRs that can be useful during red team exercise. patchsyscalldynamically64.c This proof-of-concept is resolving the syscall ID dynamically no need to check the version running on the remote host. To get the information on disk not tampered a call to...

shellnoob

ShellNoob Writing shellcodes has always been super fun, but some parts are extremely boring and error prone. Focus only on the fun part, and use ShellNoob! For a quick overview, check the slides for the Black Hat Arsenal talk: link Want to contribute? Feature request? Bug report? Swears? All...

CVE-2017-16995

Linux Kernel Version 4.14 - 4.4 Ubuntu && Debian Description This vulnerability exists in the eBPF bpf2 system call in the Linux kernel. When a user provides a malicious BPF program that causes a calculation error in the eBPF verifier module, it leads to arbitrary memory read/write issues...

Chrome-App-Bound-Encryption-Decryption

ChromElevator Chrome App-Bound Encryption Decryption 🚀 Overview A post-exploitation tool demonstrating a complete, in-memory bypass of Chromium's App-Bound Encryption ABE. This project utilizes Direct Syscall-based Reflective Process Hollowing to launch a legitimate browser process in a suspended...

STrace

STrace Steve's Tracer. A DTrace on windows syscall hook reimplementation. Think of this like a patchguard compatible SSDT hook, but without hacks. This doesn't support SSSDT win32k apis, as the DTrace system call APIs themselves do not support this additional table. Zw kernel apis can be traced i...

syscall_exploit_CVE-2018-8897

This repository does not have a README...

CVE-2026-31431-Copy-Fail---Minified-LPE-PoC

CVE-2026-31431-CopyFail---Minified-LPE-PoC ⚠️ Disclaimer For Educational and Authorized Security Testing Purposes Only. This Proof-of-Concept PoC was synthesized for authorized Red Team emulation and vulnerability auditing. The authors and contributors assume no liability for the misuse of this...

tfo-connect-bypass

Using TCP Fast Open to Bypass Syscall-based Networking Rules CVE-2026-63828/CVE-2026-72243 PoC TCP Fast Open TFO is a method of initializing and using a TCP connection where the client can send data in the initial SYN packet sent to the server. This extension to the TCP protocol was implemented f...

MalwareApiLibrary

MalwareApiLibrary : collection of apis used for malware development : StringManagementLib : manage strings, string hashes, and others WinApiManagementLib : replacement of GetModuleHandle and GetProcAddress functions SyscallsManagementLib : runs Hellsgate, TartarusGate, PerunsFart so far to unhook...

cve-2014-0038

Local root exploit for CVE-2014-0038 Bug: The X86X32 recvmmsg syscall does not properly sanitize the timeout pointer passed from userspace. Exploit primitive: Pass a pointer to a kernel address as timeout for recvmmsg, if the original byte at that address is known it can be overwritten with known...

ptrace-vuln

ptrace-vuln To check for vulnerability CVE-2019-13272 It is just a sample proof of concept generated by LLM and does not cover all cases. The basic idea is if the system is not hardened and ptrace is not removed, the vulnerability should be considered applicable. Steps to compile code and run it:...

CVE-2022-0185

CVE-2022-0185 Linux Kernel Privilege Escalation Escape toc Vulnerability Overview Vulnerability ID: CVE-2022-0185 CVSS Score: Affected Product: linux kernel - fsconfig syscall Affected Versions: linux kernel 5.1-rc1 5.16.2 Exploitation Requirements: Linux local; requires CAPSYSADMIN capability ca...

TamperingSyscalls

TamperingSyscalls TamperingSyscalls is a 2 part novel project consisting of argument spoofing and syscall retrival which both abuse EH in order to subvert EDRs. This project consists of both of these projects in order to provide an alternative solution to direct syscalls. Tampering with syscalls...

reproducer-poc-CVE-2022-0847

Naive detector and reproducer of CVE-2022-0847 dirty pipe. Uses simple generator of syscall sequences / programs from purposefully limited set of building blocks / input values only generation, no advanced fuzzing; no mutation; no coverage guidance; no shrinking / minimization and detects...

copyFail30

CopyFail for Python versions 3.10 Os did not contain splice before version 3.10. This version of copyFail uses ctypes to make the syscall between descriptors without a utilizing the splice wrapper. Works on both older and current versions of python3. Based on...

CsWhispers

CsWhispers Source generator to add D/Invoke and indirect syscall methods to a C project. Quick Start Add the latest NuGet package to your project and allow unsafe code. Exe net481 enable enable 12 true true Create a file in your project called CsWhispers.txt and set its build action properties to...