CVE-2026-23111-POC-noddlenpottato

CVE-2026-23111 — noddlenpottato nftables catchall UAF → 비특권 LPE. 대부분의 5.10—6.18 리눅스 커널에서 일반 사용자가 root 권한을 획득합니다. 타깃 커널에 자동으로 적응합니다 — struct 오프셋을 탐지하고, 심볼을 해석하고, ROP 가젯을 찾고, slab 캐시를 결정하며, 맞춤형 익스플로잇을 생성해 컴파일하고 실행합니다. 익스플로잇 체인 개요 slab 재확보 전략 취약점 nftmapcatchallactivatenet/netfilter/nftablesapi.c에서 역...

CVE-2026-89502

A flaw was found in the Linux kernel's ring-buffer component. When sub-buffers are configured with a specific memory allocation order greater than zero, the system attempts to free a memory page using an incorrect size. This memory management error can lead to memory corruption, potentially...

CVE-2026-89636

A flaw was found in the Linux kernel's Server Message Block SMB client. When the freetgts function frees data structures, a pointer ce-tgthint is not properly reset, leaving it pointing to a memory location that has already been deallocated. If this pointer is subsequently used, it can lead to a...

CVE-2026-80929

A flaw was found in the Linux kernel. A non-root user can exploit a vulnerability in the sysctl mechanism, specifically related to the cadpid entry. By unsharing process ID PID and user namespaces, a local attacker can modify this global system control from a child namespace. This allows a user...

CVE-2026-89750

A flaw was found in the Linux kernel's tracing/userevents component. This vulnerability arises when a child process, created via fork, exits and frees memory that the parent process still references. This creates a Use-After-Free UAF condition, where the parent process attempts to access freed...

CVE-2026-89438

A flaw was found in the Linux kernel, specifically within the Intel Speed Select Technology ISST component. This vulnerability arises from insufficient validation of input values, such as logical CPU ID and CLOS ID, used in the core power feature. A local attacker could exploit this by providing...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-89761

A flaw was found in the Linux kernel's AppArmor security module. An out-of-bounds write vulnerability exists when null terminating a label vector due to improper memory allocation. An unprivileged local attacker can exploit this by writing to specific system files, potentially leading to a denial...

FalconFlank

FalconFlank Crowdstrike Falcon 0day 권한 상승 취약점 FalconFlank는 Crowdstrike Falcon Sensor의 악성 Office 매크로 제거 기능을 악용하는 0day 권한 상승 취약점입니다. 당연히 이 내용을 공개하는 시점에는 Crowdstrike가 이미 이에 대한 탐지 기능을 보유하고 있을 것이므로, 테스트하려면 탐지 제외 목록에 추가하거나 PoC를 난독화하고 DLL 로드 기법을 변경해야 합니다. 현재로서는 완전히 업데이트된 Windows 11 25H2 / Windows Server...

psexec_noinstall

psexecnoinstall このリポジトリには、忘れられたパイプを悪用するのに役立つ psexec が含まれています。 凡庸な管理者が PsExec を使用してホストに接続するようにします: これは、RemComCommunication バンドルを見たときに発見しました。これは PsExec では標準的なものです。 psexecnoinstall を使用すると、パイプの DACL がこれを許可しているため、任意の低権限ユーザーとしてこのパイプに接続できます。 チェッカーはこちら: https://github.com/beaverdreamer/nxc-modules...

PetitPotato

PetitPotato PetitPotam によるローカル権限昇格 偽装特権の悪用。 説明 PetitPotam は MS-EFSR Encrypting File System Remote を使用します。これは、ネットワーク経由でアクセスされるリモートに保存された暗号化データに対してメンテナンスおよび管理操作を実行するために使用されるプロトコルです。MS-EFSR には、EfsRpcOpenFileRaw に類似した一連の API があります。EfsRpcOpenFileRaw API の構文を次に示します。 root@kitploit: long EfsRpcOpenFileRa...

Elevate-System-Trusted-BOF

Elevate-System-Trusted-BOF このBOFを使用すると、現在のビーコンをSYSTEMに昇格させ、TrustedInstallerグループの特権を取得できます。偽装はSetThreadTokenAPIを使用して行われます。 コンパイル root@kitploit: gcc elevatex64.c -c -o elevatex64.o 使用方法 root@kitploit: inline-execute C:\elevatex64.o クレジット Mr.Un1k0d3r RingZer0 Team...

cve-2026-31431

CVE-2026-31431 — Linux 커널 algifaead "Copy Fail": 분석 CVE-2026-31431CVSS 3.1 7.8 HIGH , AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H에 대한 보안 연구: AFALG AEAD 인터페이스 체인의 세 가지 조합 가능한 설계 결함이 결정적이고 경쟁 조건이 없는 4바이트 페이지 캐시 쓰기읽기 가능한 모든 파일의 임의 오프셋로 이어집니다 — 디스크 복사본은 깨끗하게 유지되므로 온디스크 체크섬은 아무것도 감지하지 못합니다. 공개 익스플로잇"Copy Fail...

CVE-2026-90450

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-90447

This ICS-CERT advisory (CSAF reference: ICSA-26-254-01) describes a privilege escalation vulnerability in a downstream service where a routing rule selects between two authentication mechanisms based on a client-supplied request header . An authenticated user possessing a shared service credentia...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-89513

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine component for RISC-V architectures. A malicious guest operating system could exploit an integer overflow vulnerability by providing a crafted number of Performance Monitoring Unit PMU events during the SBI PMU EVENTGETINFO...

SeRestoreAbuse

SeRestoreAbuse SeRestorePrivilegeが割り当てられている場合、SYSTEMとしてコマンドを実行します。無効になっている場合は、プログラムが有効化します。 使用方法: SeRestoreAbuse.exe "cmd /c ..."...

weaponised-XSS-payloads

무기화된 XSS 페이로드 alert1을 P1으로 바꾸도록 설계된 XSS 페이로드 블로그 게시물 이 저장소는 "How to Upgrade Your XSS Bugs from Medium to Critical"이라는 제목의 블로그 게시물과 함께 공개되었습니다. https://medium.com/@hakluke/upgrade-xss-from-medium-to-critical-cb96597b6cc4 이게 뭔가요? 이 저장소에는 인기 있는 CMS 플랫폼에서 피해자 브라우저의 컨텍스트로 민감한 기능을 수행하기 위해 XSS 페이로드에 로드할...