shellcode

shellcode "الثغرة الأمنية توفر لغة تجميع لجهاز كمبيوتر لم يُبرمج من قبل، ولم يُصمم مع مراعاة قابلية البرمجة." -- هالفر فليك مجموعة من عينات shellcode القديمة والجديدة. مقال https://hnsecurity.it/blog/new-and-old-shellcode-samples/ Shellcode...

ulexecve

त्वरित आरंभ execve को कभी कॉल किए बिना डायनामिक या स्टैटिकली कंपाइल्ड ELF लिनक्स बाइनरी निष्पादित करें। root@kitploit: cat /bin/echo | ulexecve - hello hello परिचय यह पायथन टूल ulexecve कहलाता है और इसका मतलब userland execve है। यह आपको लिनक्स सिस्टम पर userland से बिना कभी execve सिस्टमकॉल कॉल क...

SLAE

SLAE Securitytube Linux Assembly Expert SLAE SLAE-721 البناء root@kitploit: + Assembling ... + Linking ... + Extract Shellcode from binary ... "\x31\xc0\x50\x68\x2f\x2f\x73\x68" "\x68\x2f\x62\x69\x6e\x89\xe3\x89" "\xc1\xb0\x0b\xcd\x80" + Create C-Header file ... + Compile PoC ... + Run PoC ... +...

experiments

تجارب مستودع لتجارب / إثباتات مفاهيم متنوعة. debugging-secure-kernel: إثبات مفهوم لتصحيح أخطاء نواة Windows 10 الآمنة باستخدام gdb، فوق QEMU KVM dns: تجارب حول DNS / شفافية الشهادات / المحارف المتشابهة Attack Surface Reduction: إزالة الغموض عن دواخل Windows Attack Surface Reduction VDM: تنسيق VDM...

EUVD-2026-70105

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

userland-exec

التنفيذ في فضاء المستخدم يستبدل تنفيذ فضاء المستخدم صورة العملية الحالية داخل مساحة العناوين الحالية بأخرى جديدة. يحاكي سلوك استدعاء النظام execve، لكن البنى الخاصة بالعملية التي تصف صورة العملية تبقى دون تغيير. بعبارة أخرى، سيبقى اسم العملية كما تبلغه أدوات النظام بالاسم القديم. يمكن استخدام هذه...

Linux_X86_Reverse_TCP_Alphanumeric_Staged_Shellcode_Execve-bin-bash

لا يحتوي هذا المستودع على ملف README...

Webmin_Exploit_reverse_shell

مقدمة: استغلال Webmin هو استغلال موجّه لخدمة Webmin، ويمكن استغلاله على الإصدارات الأقدم من Webmin. يستخدم هذا الاستغلال تقنيات متنوعة لتنفيذ تعليمات برمجية خبيثة والحصول على وصول غير مصرح به إلى النظام المستهدف. يتضمن ما يلي: استخدام كل من لغة C ولغة التجميع Assembly لتنفيذ الأوامر على النظام...

CVE-2026-58089

When a process calls execve2 to execute a setuid or setgid image, hwpmc4 is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after...

EUVD-2026-66234

When a process calls execve2 to execute a setuid or setgid image, hwpmc4 is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: exec: Force a single empty string when argv is empty Quoting 1 Ariadne Conill: “In several other operating systems, it is a hard requirement that the second argument to execve2 be the name of a program. This prevents scenarios...

CVE-2026-49415

FreeBSD kernel is affected by a TOCTOU race in execve(2): when executing a SUID binary, the new address space is installed before credentials are updated, so a same-user process can read or modify memory via procfs/linprocfs during the window. An unprivileged local user can exploit this to gain r...

CVE-2026-49415 Local privilege escalation via execve(2) TOCTOU race

During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...

CVE-2026-74486

The CVE-2026-74486 entry describes a Linux kernel vulnerability in binfmt_misc where load_misc_binary() clones the interpreter file and denies write access with exe_file_deny_write_access(), while the exec path later calls exe_file_allow_write_access(). This mismatch can cause repeated write-deni...

DEBIAN-CVE-2026-68186

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: set haveexecfd only once the interpreter is opened loadmiscbinary raises bprm-haveexecfd as soon as it sees the 'O' or 'C' flag. This happens well before it opens the interpreter. If that open fails the flag stays set...

UBUNTU-CVE-2026-68187

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

CVE-2026-68187

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

UBUNTU-CVE-2026-68186

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: set haveexecfd only once the interpreter is opened loadmiscbinary raises bprm-haveexecfd as soon as it sees the 'O' or 'C' flag. This happens well before it opens the interpreter. If that open fails the flag stays set...

CVE-2026-68187 exec: fix unsigned loop counter wrap in transfer_args_to_stack()

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...