logrotten

!WARNING This repository has been moved to https://codeberg.org/whotwagner/logrotten. Please visit the new location for the latest updates. Winning a race condition in logrotate to elevate privileges Brief description logrotate is prone to a race condition after renaming the logfile. If logrotate...

CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit

CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Guide 📋 Quick Exploitation Steps Step 1: Prepare XFS Image Local Machine root@kitploit: Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image mn...

opensuse-leap-privesc-exploit

CVE-2025-6018 + CVE-2025-6019 Exploit Chain This exploit was developed to solve a HackTheBox challenge targeting openSUSE Leap 15.6. Credits This exploit is based on the original research by the Qualys Security Team: Advisory: https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt...

CVE-2022-0492-Docker-Breakout-Checker-and-PoC

CVE-2022-0492 Docker Breakout Checker and PoC Summary Exploiting the vulnerability requires the attacker to have access to a Docker container running on a vulnerable system. Once exploited, the attacker can escape the container and gain complete control over the host system. A vulnerability was...

CTT-Vsyslog-Vortex-CVE-2023-6246

CTT-Vsyslog-Vortex-CVE-2023-6246 CVE-2023-6246 glibc vsysloginternal heap buffer overflow exploitation using Convergent Time Theory α = 0.0302011. 33-layer temporal heap spray + phase-locked trigger for reliable local privilege escalation. README.md root@kitploit: CTT-Vsyslog-Vortex Temporal...

pyCobaltHound

Quick summary pyCobaltHound is an Aggressor script extension for Cobalt Strike which aims to provide a deep integration between Cobalt Strike and Bloodhound. pyCobaltHound strives to assists red team operators by: Automatically querying the BloodHound database to discover escalation paths opened ...

CVE-2019-16097

CVE-2019-16097-batch Disclaimer Only for security research purposes. Do not use for illegal testing. You bear all consequences!!! CVE-2019-16097-batch Batch vulnerability exploitation script Add target addresses in batch to the url.txt file http://1.1.1.1 http://2.2.2.2 Run this script with Pytho...

CVE-2023-22809

Linux Privilege Escalation Exploit for CVE-2021-3560 Sudoedit a.k.a -e - Local Privilege Escalation For educational and authorized security research purposes only Original Exploit Authors n3m1dotsys Vulnerability Description In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra...

CVE-2019-10915

The vulnerability is an authentication bypass in the TIA Administrator server. An attacker could execute arbitrary application commands through websockets on the node.js server which is externally exposed by default. By exploiting this vulnerability, an unauthenticated remote attacker could perfo...

ipfire-2-25-auth-rce

Ipfire 2-25 core update 156 authenticated rce system run command when install any packet system getting 7zip from just html and check the tmp directory version 2.25 - core update 156 ipfire allows run arbitrary os command as nobody after login Be root! check the suid binaries backup program run...

NotCVE-2026-0010

Summary Vulnerability: Unauthenticated IPC Local Privilege Escalation to SYSTEM via Barrier Daemon TCP Port 24801 Vendor: debauchee Barrier project Product: Barrier 2.4.0 final release, 2021-11-01 CWE: CWE-306: Missing Authentication for Critical Function Description Barrier's Windows service...

msi-central_privesc

CVE-2022-38532 Local privilege escalation in MSI Center desktop application. The vulnerability exist in "CFeatures" of MSI.CentralServer.exe. MSI.CentralServer.exe is an application that gathers information about your system, it collaborates with MSI.TerminalServer.exe. The ExecuteTask function...

CVE-2021-4034

CVE-2021-4034 PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec in Python Usage root@kitploit: git clone https://github.com/rvizx/CVE-2021-4034 cd CVE-2021-4034 python3 cve-2021-4034-poc.py Notes C : https://github.com/arthepsy/CVE-2021-4034 Fix root@kitploit: sudo chmod...

container-cve-2021-22555

Reproducer for CVE-2021-22555 as a container First, this rolls in the exploit code from here as a handy pre-built container: https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555 Pre-built container: quay.io/cgwalters/cve-2021-22555 Mitigation: seccomp profiles A stron...

json-interop-vuln-labs

JSON Interoperability Vulnerability Labs Description These are the companion labs to my research article "An Exploration of JSON Interoperability Vulnerabilities". Lab 1: Free purchases in an E-commerce Application Key Collision Attacks: Inconsistent Duplicate Key Precedence Inconsistent Large...

CVE-2023-20938-poc

CVE-2023-20938 — Android binder UAF privilege escalation A local privilege escalation proof-of-concept for CVE-2023-20938 , a use-after-free in the Android binder driver. From an unprivileged shell it gains uid 0 and drops SELinux to permissive , then spawns a root shell. Target for this build:...

bloodyAD

⚠️ autobloody has been moved to its own repo bloodyAD bloodyAD is an Active Directory privilege escalation swiss army knife Description This tool can perform specific LDAP calls to a domain controller in order to perform AD privesc. bloodyAD supports authentication using cleartext passwords,...

CVE-2023-32243-Detection-and-Mitigation-in-WordPress

🔐 CVE-2023-32243 – Detection and Mitigation in WordPress 📘 Project Title: Detection and Mitigation of CVE-2023-32243 in the Essential Addons for Elementor WordPress Plugin 🧠 Abstract This project explores the exploitation and prevention of CVE-2023-32243 , a critical privilege escalation...

CVE-2025-26206

🚨 CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0 Welcome to the official repository documenting the discovery and details of CVE-2025-26206 , a critical Cross-Site Request Forgery CSRF vulnerability in Sell Done Storefront v.1.0. Discovered by B. Sibhi , this...

cve-2015-5602

CVE-2015-5602 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2015-5602 Image author: https://github.com/t0kx/privesc-CVE-2015-5602...