-CVE-2018-0834-aab-aar

Shoutout to @reubensammut, u a beast G. CVE-2018-0834 full code execute. include static offsets, bypasses cfg,dep,aslr : enjoy...

CVE-2023-4911

Proof of concept for CVE-2023-4911 Looney Tunables This vulnerability has been discovered by Qualys Threat Research Unit. Here you can read the advisory they published; it explains the vulnerability in depth. The exploit has been tested on Ubuntu 22.04.2 LTS with GLIBC 2.35-0ubuntu3.1. Testing th...

Lenovo-CVE-2025-8061

Lenovo-CVE-2025-8061 PoC for popping a system shell against the LnvMSRIO.sys 3.1.0.36 driver. All credits go to the original author Luis Casvella from Quarkslab. This works against latest Windows 11 Version 24H2 with KVAShadowing and Core Isolation disabled! !NOTE This was compiled using latest...

PESTO

PESTO: PE files Statistical Tool Description PESTO is a Python script that extracts and saves in a database some PE file security characteristics or flags searching for every PE binary in a whole directory, and saving results in a database. It checks for architecture flag in the header, and for t...

Bropper

BROPPER An automatic Blind ROP exploitation python tool Abstract BROP Blind ROP was a technique found by Andrew Bittau from Stanford in 2014. Original paper Slides Most servers like nginx, Apache, MySQL, forks then communicates with the client. This means canary and addresses stay the same even i...

CVE-2026-42945-NGINX-Rift-Toolkit

CVE-2026-42945 Nginx Rift Vulnerability Toolkit Comprehensive toolkit for scanning, patching, and testing CVE-2026-42945 - a critical RCE vulnerability in nginx Table of Contents Overview CVE Details Features Toolkit Components Requirements Installation Usage Workflow Examples Security...

CVE-2015-6086

From Crash to Exploit: CVE-2015-6086 - Out of Bound Read/ASLR Bypass root@kitploit: $$$$$$\ $$\ $$\ $$$$$$$$\ $$$$$$\ $$$$$$\ $$\ $$$$$$$\ $$$$$$\ $$$$$$\ $$$$$$\ $$ $$\ $$ | $$ |$$ | $$ $$\ $$$ $$\ $$$$ | $$ | $$ $$\ $$$ $$\ $$ $$\ $$ / |$$ | $$ |$$ | / $$ |$$$$\ $$ |$$ | $$ | $$ / |$$$$\ $$...

fatal_core_dump

Fatal Core Dump Murder Mystery Repo for generating a core dump debugging murder mystery game site. THIS REPO HAS SPOILERS FOR THE GAME!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! You can play it here: https://www.robopenguins.com/fatalcoredump/ For a blog post on the design process see:...

nginx-rift-private-lab

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This fork extends the original PoC with an ASLR-bypass...

Exploits

A collection of exploits developed by @xer0dayz @Sn1perSecurity https://sn1persecurity.com Vulnserver.exe GMON SEH Overflow Exploit FreeFloat FTP Server HOST Buffer Overflow ASLR Bypass CoolPlayer+ Portable 2.19.6 Stack Overflow ASLR Bypass HTTPoxy Exploit/PoC Scanner Ability FTP 2.34 Buffer...

mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE Lab Remote code execution on the unmodified, stock MariaDB 13.0.1-rc Docker image as uid 999 mysql. Two exploit variants: Variant| File| Requirements| Notes ---|---|---|--- Pure SQL recommended| exploitpuresql.py| a low-priv MariaDB account + TCP| no host access, no docker, ...

CVE-2021-39863

CVE-2021-39863 Adobe Acrobat Reader DC 21.005.20048.43252 32 bit Down load this version : https://ardownload2.adobe.com/pub/adobe/reader/win/AcrobatDC/2100520048/AcroRdrDC2100520048enUS.exe Bypass ASLR, DEP Non Bypass CFG Analysis Team Blog Team Member Blog - mntly Adobe root cause.pdf : Explain...

ezviz_lan_rce

ezvizlanrce This repository contains the slides and PoC videos for the talk SADProtocol goes to Hollywood which was presented at DEF CON 31 Hardware Hacking Village. You can also find the docker image to build binaries that run on the camera and the proof of concept exploits for CVE-2023-34551 an...

CVE-2018-14442

Foxit Reader CPDFParser::mpCryptoHandler Use After Free 1. PDF Format Background 2. Encryption Dictionaries 3. Vulnerability Details 4. ASLR and DEP Bypass 5. Environment Details 6. Trigger 7. Author PDF Format Background PDF is a file format used to represent documents. A pdf is made of multiple...

vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak

vLLM = 0.23.0 incompletely fixes CVE-2026-22778. The original fix added sanitizemessage to the OpenAI router but the Anthropic-compatible router /v1/messages echoes strexc directly. id: CVE-2026-54236 info: name: vLLM = 0.23.0 - Anthropic Router Heap Address Information Leak author: kenlacroix...

peda

peda PEDA - Python Exploit Development Assistance for GDB Key Features: Enhance the display of gdb: colorize and display disassembly codes, registers, memory information during debugging. Add commands to support debugging and exploit development for a full list of commands use peda help: aslr --...

cve-2026-42945-nginx32-lab

CVE-2026-42945 nginx 32-bit Exploit Lab This repository is a reproducible Docker lab for studying CVE-2026-42945 in nginx 1.30.0. It contains a vulnerable 32-bit target, a primitive trigger, a lab-assisted known-address RCE validator, and a no-introspection brute-force driver. The proof boundary...

skeleton

Skeleton but pronounced like Peloton A Zero-Click RCE exploit for CVE-2021-0326 on the Peloton Bike And also every other unpatched Android Device PoC requires ASLR to be disabled. Associated blog post:...

CVE-2023-4427

CVE-2023-4427 CVE-2023-4427 was found by glazunov, and you can find RCA in his report chrome version: 117.0.5938.62 in linux from v8ctf. I choose a very unstable method. To bypass ASLR, use many iframes with different domains in main.html to brute high address, you can change your /etc/hosts to...

ret-sync

ret-sync ret-sync 代表逆向工程工具同步（Reverse-Engineering Tools SYNChronization）。它是一组插件，用于将调试会话（WinDbg/GDB/LLDB/OllyDbg/OllyDbg2/x64dbg）与反汇编器（IDA/Ghidra/Binary Ninja）同步。其核心理念很简单：从静态分析和动态分析两个世界中各取所长。 调试器和动态分析为我们提供： 局部视图，具有实时动态上下文（寄存器、内存等） 内置的特殊功能/API（例如：WinDbg 的 !peb、!drvobj、!address 等） 反汇编器和静态分析为我们提供：...