suricata_exporter

Suricata Prometheus Exporter 这是一个用于 Suricata 的 Prometheus Exporter，通过 unix socket 使用 dump-counters 来查询指标。 使用方法 root@kitploit: $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket. default "/var/run/suricata.socket" -version Output...

CVE-2024-31317

CVE-2024-31317 前言 前两天看到JD的公众号发了篇CVE-2024-31317漏洞的分析，通篇看下来感觉还是比较有意思，且车机目前主流方案均为安卓系统且都在该漏洞的有限范围内，遂开始复现。...

Document-Linux-Privilege-Escalation

Linux 权限提升（通过 snapd） 项目目标： 利用 Canonical 的 snapd 守护进程（Ubuntu Linux 中的默认服务）REST API 中的漏洞“DirtySock”（CVE-2019-7304），获取 root 访问权限。 Ramil Mustafayev 的指南：https://kryptohaker.medium.com/linux-privilege-escalation-via-snapd-using-dirty-sock-exploit-and-demonstration-of-cve-2019-7304-892716cf99ca 设置： 此漏洞在...

CVE-2026-84381

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...

uptux

uptux 针对 Linux 系统的专门权限提升检查工具。 目前已实现： 可写的 systemd 路径、服务、定时器和套接字单元 反汇编 systemd 单元文件以查找： 指向可执行文件的可写引用 指向可写目录的损坏符号链接 相对路径语句 可写的 Unix 套接字文件（隐蔽 API） 可写的 D-Bus 路径 过度宽松的 D-Bus 服务设置 以 root 身份运行并在文件绑定的 Unix 域套接字上响应的 HTTP API 这些检查基于我自身研究中遇到的情况，此工具肯定不涵盖所有你应该关注的内容。别忘了经典方法！ 使用方法 所有功能都包含在一个文件中，因为在受限的 shell...

CVE-2021-40438

CVE-2021-40438 漏洞利用 PoC（附 Docker 环境搭建） 切换到包含 Apache 配置和 Dockerfile 的目录（仓库中已提供）。 构建镜像： docker build -t cve-2021-40438:1.0 . 运行 Docker 镜像： docker run --rm -d -p 4444:80 cve-2021-40438:1.0 （注意：你也可以使用镜像 ID 代替镜像名称，使用命令 'docker images' 查看镜像详细信息） 漏洞利用： curl...

EUVD-2026-66587

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-80580

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-80578

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...

CVE-2026-80562

In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use rawspinlockt for the register lock iohirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger -...

CVE-2026-80555

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Free all memory if cpinit fails The routine cpfree is called to unpin/free any memory once an I/O is completed successfully, or if cpprefetch fails. But if cpinit fails, and cp-initialized is not enabled, the same...

CVE-2026-80552

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing...

CVE-2026-80550

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Fix out of bounds check on CCW array The routine ccwchaincalclength counts the number of channel command words CCWs that are chained together in a single channel program, and rejects anything larger than...

CVE-2026-80542

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpudmcrtcsetvblank amdgpudmcrtcsetvblank dereferences acrtcstate-stream when vblank is enabled/queried from DRMIOCTLMODECRTCGETSEQUENCE before a stream is attached to it. BUG:...

CVE-2026-80522

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx-cryptlen calculation in tegragcmdoonereq Perform rctx-cryptlen calculation in tegragcmdoonereq the same way it is done in tegraccmcryptinit. The current formulae may lead to a crash if a caller does not...

CVE-2026-74751

In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop loads one word ahead before checking the aligned boundary: REGL t1, SZREGt0 // load next word addi t0, t0, SZREG // advance orc.b t1, t1 bgeu...

CVE-2026-74749

In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension exittousermodeloop invokes rseqgranttimesliceextension with interrupts enabled. If the extension is granted it invokes hrtimerrearmdeferredtif to ensure that a pending...

CVE-2026-74744

In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit neededheadroom and neededtailroom from phydev ipvlan devices inherit hardheaderlen from phydev during ipvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying phydev or stacked lower...

CVE-2026-74736

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: reject dev-bound programs bound to a different device clsbpfprogfromefd obtained a SCHEDCLS program via bpfproggettypedev but never verified that a device-bound offloaded program's bound netdev matches the TC...

CVE-2026-58090

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...