cve-2019-5736-poc

To run: 1. edit poc command in stage2.c 2. build docker docker build -t cve . 3. run docker docker run -d cve /bin/bash -c "tail -f /dev/null" 4. backup docker-runc cp /usr/bin/docker-runc /usr/bin/docker-runc.bak 5. docker exec -it docker-id /bin/bash 6. in docker run cd /root && ./run.sh && exi...

CVE-2026-6875-PoC-Exploit

CVE-2026-6875 - ServiceNow Pre‑Auth RCE Exploit Framework & PoC Verifier ServiceNow AI Platform — JavaScript Injection → Sandbox Escape → RCE → Root Privesc Exploit Framework & Safe Verifier For authorized security testing only. Legal Disclaimer & Responsible Use This tool is provided for...

ace-vim-neovim

ace-vim-neovim Vim/Neovim Arbitrary Code Execution via Modelines CVE-2019-12735 Usage 1. listen nc -vlp 9999 2. ace vim pocshell.txt And then, your localhost will get shell...

CVE-2022-22715

Blogpost: https://whereisk0shl.top/post/break-me-out-of-sandbox-in-old-pipe-cve-2022-22715-windows-dirty-pipe Exploit needs to be executed from LOW INTEGRITY Cleanup is not completed. The exploit just fix the overwritten TOKEN objects but not the VS pool structure. This part is explained in the...

CVE-2020-0041

CVE-2020-0041 This repository contains code for exploiting CVE-2020-0041, a bug we reported to Google in Decmeber 2019 and was fixed in the Android Security Bulletin from March 2020. You can find the sandbox escape exploit in sandbox/. The analysis of the bug and exploitation approach can be foun...

Sauercloude

Sauercloude 0day VirtualBox 6.1.2 Escape for RealWorld CTF 2020/2021 CVE-2021-2119...

DoubleStar

. . \ \ \ | | | / // | | | \ / \ | | | \ | | / \ \ \ \ \ \ \ \ | \ | | /| \ | |\ / / \ | | / | | / / / / |/ | /|/ \ / / || /|| / / / / / Windows 8.1 IE/Firefox RCE - Sandbox Escape - SYSTEM EoP Exploit Chain | Remote PAC | || ^ | HTTPS RPC/ALPC RPC/ALPC | firefox.exe | ---------- |...

ITScape

ITScape: Guest-to-Host Escape in KVM/arm64 Abstract This document describes the ITScape CVE-2026-46316 vulnerability reported and patched by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/arm64 environment and run commands on the host with kerne...

CVE-2022-0847-Container-Escape

CVE-2022-0847 CVE-2022-0847 used to achieve container escape overwrite any read-only files on host Slides in Chinese available here 利用CVE-2022-0847 Dirty Pipe 实现容器逃逸（效果为覆写宿主机上任意只读文件） 中文汇报PPT在这里 Introduction If the kernel is vulnerable to CVE-2022-0847, the attacker can overwrite read-only files...

CVE-2024-54152

⚙️🔨 IN PROGRESS CVE-2024-54152 POC Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex undisclose...

CVE-2021-3929-3947

CVE-2021-3929-3947 VM escape PoC for CVE-2021-3929 and CVE-2021-3947. Educational purposes only. You can read the white paper for more information. Environment OS: Ubuntu 21.10 Linux: 5.13.0 gcc: 11.2.0 glibc: 2.34 glib: 2.68.4 QEMU: 6.1.0 Guest OS: Ubuntu 21.04 Commands Host qemu-system-x8664 ru...

WPTaskScheduler_CVE-2024-49039

WPTaskScheduler Persistence & CVE-2024-49039, as one of Attack Surface within Task Scheduler. WPTaskScheduler.dll is a component of Task Scheduler, since win 10 1507. This is likely a backdoor tool used for persistence, which was analyzed by security researchers, who found that able to bypass...

CVE-2024-32462

CVE-2024-32462 CVE-2024-32462 code exec sbx escape How the directory should look to compile this ├── org.exploit.SandboxEscape.yaml ├── exploit.py └── app/ └── exploit.desktop How to run & build 1.Install Flatpak SDK if needed: flatpak install flathub org.freedesktop.Platform//21.08 flatpak insta...

onetwoseven-writeup

HTB OneTwoSeven — Full Walkthrough A complete, end-to-end walkthrough of OneTwoSeven , a retired HackTheBox Linux machine. The full chain: deterministic credential generation → symlink escape of an SFTP chroot → vim swap file recovery → SSH port-forwarding to a firewalled admin panel → bypass of...

CVE-2023-28229

CVE-2023-28229 Windows CNG KeyIso RPC EoP/SBX Discovered by: @k0shl Reference: https://whereisk0shl.top/post/isolate-me-from-sandbox-explore-elevation-of-privilege-of-cng-key-isolation If compilation fails, rename rpc.h to something else because I didn't realise rpc.h is a standard include in...

brokentooth

brokentooth POC for CVE-2018-4327 at least I think so since CVE-2018-4327 and CVE-2018-4330 were both discussed by @SparkZheng but it's not clear from him which one relates to which bug but since he described this one first I'm taking a guess. Tested on iPhone 6S 11.3.1 Should work until 11.4 Let...

Exploits

This repository contains a personal collection of Windows CVE I have turned in to exploit source, as well as a collection of payloads I've written to be used in conjunction with these exploits. Some of these CVE have been joined together in exploit chains for RCE, sandbox escapes and privilege...

docker_escape_pwn

Escape from Docker using CVE-2017-1000112 and CVE-2017-18344. Including: gaining root privilage get all capbilities namespace recovery filesystem recovery cgroup limitation bypass seccomp bypass...

CVE-2024-21626-old-docker-versions

Container escape vulnerability in old runc components CVE-2024-21626 During my analysis about CVE-2024-21626 I found that other older docker components are vulnerable about fd leakage that is not mentioned in the security advisory GHSA-xr7r-f8xq-vfvv. Read my full article for detailed explanation...

Learn-about-cve-2025-31133-poc

Learn-about-cve-2025-31133-poc Overview A proof-of-concept demonstration and learning environment for CVE-2025-31133 , a security vulnerability in runc that allows bypassing maskedPaths protection through a race condition. maskedPaths are designed to prevent containers from accessing sensitive ho...