shellcode

shellcode “漏洞为一台从未被编程过、且并非为可编程性而设计的计算机提供了一种汇编语言。” -- Halvar Flake 一系列新旧 shellcode 样本。 文章 https://hnsecurity.it/blog/new-and-old-shellcode-samples/ Shellcode x86 setuid-linux.c。适用于 Linux/x86 的旧版 setuid/execve shellcode（30 字节）。 portbind-linux.c。适用于 Linux/x86 的旧版 setuid/portbind shellcode（96 字节）。...

userland-exec

Userland Exec Userland exec reemplaza la imagen del proceso existente dentro del espacio de direcciones actual por una nueva. Imita el comportamiento de la llamada al sistema execve, pero las estructuras del proceso que describen la imagen del proceso permanecen sin cambios. En otras palabras, el...

Linux_X86_Reverse_TCP_Alphanumeric_Staged_Shellcode_Execve-bin-bash

此存储库没有 README。...

ulexecve

クイックスタート 動的または静的にリンクされたELF Linuxバイナリを、execveを呼び出すことなく実行します。 root@kitploit: cat /bin/echo | ulexecve - hello hello はじめに このPythonツールはulexecveと呼ばれ、 userland execve...

Webmin_Exploit_reverse_shell

简介： Webmin 漏洞利用是针对 Webmin 服务的一种定向漏洞利用，可在旧版本的 Webmin 上进行利用。该漏洞利用使用多种技术在目标系统上执行恶意代码并获得未经授权的访问权限。 它涉及： 使用 C 和汇编代码在目标系统上执行命令。 利用反调试、XOR 解密以及 execve 和 prctl 等系统调用技术来生成反向 Shell。 功能特性： 反调试：使用 ptrace 系统调用防止对漏洞利用进行调试。 XOR 解密：使用 XOR 加密在内存中解码诸如 kthreadd 和 /bin/sh 之类的加密字符串。 prctl 系统调用：将进程名称更改为...

CVE-2026-89766

This Linux kernel vulnerability affects the PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl(), which perform a ptrace credentials check before handing out a namespace file descriptor. Unlike the equivalent procfs paths (proc_ns_get_link, proc_ns_readlink), the pidfd path did not hold the target task'...

SLAE

SLAE Securitytube Linux 汇编专家（SLAE） SLAE-721 构建 root@kitploit: + Assembling ... + Linking ... + Extract Shellcode from binary ... "\x31\xc0\x50\x68\x2f\x2f\x73\x68" "\x68\x2f\x62\x69\x6e\x89\xe3\x89" "\xc1\xb0\x0b\xcd\x80" + Create C-Header file ... + Compile PoC ... + Run PoC ... + Shellcode...

experiments

实验 各种实验 / PoC 的仓库。 debugging-secure-kernel: PoC：在 QEMU KVM 之上使用 gdb 调试 Windows 10 安全内核 dns: 有关 DNS / 证书透明度 / 同形字（Homoglyphs）的实验 Attack Surface Reduction: 揭秘 Windows 攻击面减少（Attack Surface Reduction）的内部机制 VDM: Windows Defender 的 VDM 格式（签名数据库） Primary Group ID: 分析对 primaryGroupID AD 属性更改执行的安全检查...

PT-2026-89259

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...

EUVD-2026-70105

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-58089

When a process calls execve2 to execute a setuid or setgid image, hwpmc4 is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after...

EUVD-2026-66234

When a process calls execve2 to execute a setuid or setgid image, hwpmc4 is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: exec: Force a single empty string when argv is empty Quoting 1 Ariadne Conill: “In several other operating systems, it is a hard requirement that the second argument to execve2 be the name of a program. This prevents scenarios...

CVE-2026-49415 Local privilege escalation via execve(2) TOCTOU race

During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...

CVE-2026-49415

FreeBSD kernel is affected by a TOCTOU race in execve(2): when executing a SUID binary, the new address space is installed before credentials are updated, so a same-user process can read or modify memory via procfs/linprocfs during the window. An unprivileged local user can exploit this to gain r...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100573)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100573 advisory. In the Linux kernel, the following vulnerability has been resolved: signal: clear JOBCTLPENDINGMASK for caller in zapotherthreads When a multi-threaded process...

CVE-2026-74486

The CVE-2026-74486 entry describes a Linux kernel vulnerability in binfmt_misc where load_misc_binary() clones the interpreter file and denies write access with exe_file_deny_write_access(), while the exec path later calls exe_file_allow_write_access(). This mismatch can cause repeated write-deni...

DEBIAN-CVE-2026-68186

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: set haveexecfd only once the interpreter is opened loadmiscbinary raises bprm-haveexecfd as soon as it sees the 'O' or 'C' flag. This happens well before it opens the interpreter. If that open fails the flag stays set...

UBUNTU-CVE-2026-68187

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...