packer-tutorial

Table of Contents 1. What is a packer? : An introduction into the purpose of packers and a guide through what the development necessities of a packer are. 2. Prerequisites : Tools needed to work with this tutorial. 3. Getting a taste : A demonstration of what you will be building with this...

CVE-2026-89582

A flaw was found in the bnx2x component of the Linux kernel. This flaw occurs due to a double free vulnerability within the bnx2xinitfirmware function's error handling path. Memory pointers are freed without being set to NULL, allowing the bnx2xreleasefirmware cleanup function to attempt freeing...

CVE-2026-89670

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. A race condition exists in the nfsdopenlocalfh function where an nfsdfile object can be freed and its memory recycled while another process attempts to access it. This can lead to a use-after-free vulnerability,...

Split

Description Divide and Conquer is an algorithm that is commonly applied in programming to solve a complex problem by dividing it into many simpler sub-problems. We can apply this approach to offensive security with a different goal: confuse EDRs so they lose track of our activities, preventing th...

exploit-writing-for-oswe

Exploit Writing for OSWE Background What This repository contains a list of useful snippets and tips that pertain to the writing of exploit scripts in the OSWE labs and certification exam. Some examples here may go against certain coding practices, but our end goal is to write the exploit script...

MemFiles

MemFiles DISCLAIMER: This project is complex and failure to understand how it works and adequately test it can result in you crashing Beacons and losing access! I highly encourage you to read all of the documentation up until the "Technical Details, Design Considerations, and Commentary" section!...

CVE-2026-89575

A flaw was found in the Linux kernel's device mapper dm-raid1 component. This vulnerability occurs in the buildconstructorstring function, where insufficient space is reserved for a NUL-terminator when formatting a string with sprintf. This oversight can lead to a buffer overflow, potentially...

DInvoke

DInvoke Dynamic replacement for PInvoke on Windows. DInvoke contains powerful primitives that may be combined intelligently to dynamically invoke unmanaged code from disk or from memory with careful precision. This may be used for many purposes such as PE parsing, intelligent dynamic API...

ntqueueapcthreadex-ntdll-gadget-injection

🧪 NtQueueApcThreadEx NTDLL Gadget Injection Introduction This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument0-3 parameters by passing a random pop r32; ret gadget can be used for stealthy code injection. Within this PoC, the gadget in this case is picked random...

CVE-2026-89737

A flaw was found in the Linux kernel's USB Type-C Thunderbolt driver. The tbtaltmoderemove function fails to properly disable and drain work items before freeing associated plug and cable references. This oversight can lead to a use-after-free vulnerability, where the system attempts to access...

OSDS_Paper_CVE-2016-5195

CVE-2016-5195 "Dirty COW" This repository contains my paper and presentation slides on CVE-2016-5195, a Linux privilege escalation vulnerability, written for the Operating Systems: Design And Security course at FMI, University of Bucharest. Correction In my paper I claimed that you can use Dirty...

domain-enumeration-sicarius

Sicarius 🐴 ⚡️ Fast subdomain enumeration tool 🐴 ⚡️ 🦆 @unp4ck 🪳🫠 Install root@kitploit: git clone github.com/unp4ck/sicarius.git cd sicarius touch config/config.yaml add your apis keys here! pip3 install -r requirements.txt --user Post Installation API Key is needed before querying on third-party...

CVE-2026-90455

A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a single fixed,...

CVE-2026-54258

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...

DEBIAN-CVE-2026-54258

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...

CVE-2026-49992

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

CVE-2026-89733

A flaw was found in the Linux kernel's USB Video Class UVC gadget driver. This vulnerability occurs in the uvcfunctionbind and uvcfunctionunbind functions, where pointers to freed memory are not properly cleared. This can lead to a use-after-free UAF condition, potentially allowing an attacker to...

CVE-2026-89587

A flaw was found in the Linux kernel's ACPI Platform Firmware Runtime Update pfrupdate component. The querycapability function, responsible for handling ACPI buffer objects from firmware, performs an unchecked memory copy operation. If the firmware provides an oversized buffer, a stack buffer...

CVE-2020-8816

CVE 2020-8816 : Pi-hole versions = 4.3.2 is affected by a Remote Code Execution vulnerability. An authenticated user of the Web portal can execute arbitrary command with the underlying server with the privileges of the local user executing the service. EXAMPLE : go run CVE-2020-8816.go -host $LHO...

CVE-2025-55234

CVE-2025-55234 This vulnerability allows attackers to perform relay attacks against the SMB Server Message Block protocol. If successful, it can lead to Elevation of Privilege EoP essentially allowing unauthorized users to gain higher-level access on a system By Mark Mallia Issue This vulnerabili...