container-cve-2021-22555

Reproducer for CVE-2021-22555 as a container First, this rolls in the exploit code from here as a handy pre-built container: https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555 Pre-built container: quay.io/cgwalters/cve-2021-22555 Mitigation: seccomp profiles A stron...

CVE-2022-1227_Exploit

CVE-2022-1227Exploit Un script para explotar CVE-2022-1227. Antecedentes Se recomienda Ubuntu 20.10. Podman TODO: agregar cuál es el principio de esta vulnerabilidad Instalar podman Siga las instrucciones del documento oficial: https://podman.io/getting-started/installationinstalling-on-linux Par...

foxcage

foxcage Run Firefox in a rootless Podman container for security isolation. Your browser runs with almost no Linux capabilities, in its own user and network namespace, isolated from the host — while still having full GPU acceleration, audio, and DRM support. Why foxcage? Firefox already has a...

CVE-2026-64531

CVE-2026-64531 — OVSwrap Linux kernel Open vSwitch module local privilege escalation normal user → root PoC. Exploits the integer wraparound of the 16-bit nlalen field to escalate from a normal user all the way to root. Vulnerability Summary When the nested action stream generated by OVS exceeds...

kernel-exploits

内核漏洞利用 各种内核漏洞利用 CVE-2021-22555 Linux 本地 root 提权漏洞利用。 theflow 针对 CVE-2021-22555 的 漏洞利用 的更新版本。 在 net/netfilter/xtables.c 中发现了一个堆越界写入漏洞，影响自 v2.6.19-rc1 起的 Linux 内核。该漏洞允许攻击者通过用户命名空间获取权限，或造成 DoS（通过堆内存破坏）。 CVE-2019-13272 Linux 本地 root 提权漏洞利用。 Jann Horn 针对 CVE-2019-13272 的 漏洞利用 的更新版本。 在 5.1.17 之前的 Linux...

CVE-2023-0386

typora-copy-images-to: ./image CVE-2023-0386 Uso del exploit: Primero : Subir fuse.c y exp.sh al directorio /tmp. Puedes usar scp o python3 -m http.server para subir el archivo al objetivo. root@kitploit: scp /Desktop/CVE-2023-0386/exp.sh [email protected]:/tmp scp...

CVE-2021-22555-Exploit

CVE-2021-22555-Exploit CVE-2021-22555 Exploit Por Andy Nguyen INFORMACIÓN Se descubrió una escritura fuera de los límites del heap que afecta a Linux desde v2.6.19-rc1 en net/netfilter/xtables.c. Esto permite a un atacante obtener privilegios o provocar una denegación de servicio DoS mediante...

CVE-2017-7184

CVE-2017-7184 – Linux Kernel XFRM Privilege Escalation No Sudo Overview This repository contains a proof-of-concept local privilege escalation exploit for CVE-2017-7184 , a Linux kernel vulnerability in the XFRM IPsec netlink subsystem. The exploit demonstrates how an unprivileged user can gain...

CVE-2021-3493

CVE-2021-3493 — Ubuntu OverlayFS Local Privilege Escalation A working proof-of-concept for CVE-2021-3493 , a local privilege escalation vulnerability in the Ubuntu kernel's OverlayFS implementation. An unprivileged user can mount an overlay filesystem inside a user namespace and set arbitrary fil...

CVE-2023-2640-CVE-2023-32629-Interactive-PoC

CVE-2023-2640 & CVE-2023-32629 GameOverLay - Real Host Root Escape PoC An interactive, multi-step Local Privilege Escalation LPE Proof of Concept PoC targeting the Ubuntu Linux kernel OverlayFS vulnerabilities CVE-2023-2640 / CVE-2023-32629. Unlike standard automated one-liners that trap your...

CVE-2024-1086

CVE-2024-1086 Con fines educativos. Referencias: https://pwning.tech/nftables/ https://github.com/Notselwyn/CVE-2024-1086 Kconfig: root@kitploit: +CONFIGCONFIGFSFS=y +CONFIGSECURITYFS=y +CONFIGNFTABLES=y mnlcbrun: Operation not supported +CONFIGNETFILTERNETLINKGLUECT=y +CONFIGNETLINKDIAG=y...

OVSwrap

OVSwrap CVE-2026-64531 Writeup !WARNING The PoC is provided solely to help defenders, maintainers, and authorized security teams validate patches, mitigations, detections, and exposure on systems they own or are explicitly authorized to test. You are solely responsible for ensuring that your use ...

CVE-2015-1328

CVE-2015-1328 TryHackMe Walkthrough – Linux Kernel Privilege Escalation CVE-2015-1328 Objective The goal of this walkthrough was to escalate privileges from a low-privileged user karen to root by exploiting a vulnerable Linux kernel. Step 1 – Initial Enumeration After connecting to the target...

CVE-2018-18955

CVE-2018-18955 Linux local root exploit. Wrapper for Jann Horn's exploit for CVE-2018-18955, forked from kernel-exploits. In the Linux kernel 4.15.x through 4.19.x before 4.19.2, mapwrite in kernel/usernamespace.c allows privilege escalation because it mishandles nested user namespaces with more...

CVE-2024-56433

CVE-2024-56433 shadow-utils - Insecure default subordinate ID assignment for local users Summary The default subordinate ID assignment creates risk for collision with existing user ID's, creating potential for arbitrarily changing UID/GID and gaining unauthorized access to data and network...

CVE-2019-5736-Custom-Runtime

CVE-2019-5736-Custom-Sandbox General CVE-2019-5736 implemented using a shallow, self-written container runtime to understand the exploit. Exploit is based on and almost all copied from the runc-poc by twistlock: https://github.com/twistlock/RunC-CVE-2019-5736/tree/master/maliciousimagePOC Contain...

kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

A flaw was found in the Linux kernel's Point-to-Point Protocol PPP subsystem. A local unprivileged user can exploit this vulnerability by creating a new user namespace and bypassing authorization checks for unattached administrative input/output controls ioctls. This allows the user to perform...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053326 advisory. In the Linux kernel, the following vulnerability has been resolved: cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns What we want is to...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ppp: The requirement for CAPNETADMIN in the target netns is necessary for unattached IOCTls. The opening of /dev/ppp is currently allowed for file-fcred-userns, while unattached administrative IOCTls operate on...

Linux Distros Unpatched Vulnerability : CVE-2026-74994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collaps...