CVE-2023-4911

Proof of concept for CVE-2023-4911 Looney Tunables This vulnerability has been discovered by Qualys Threat Research Unit. Here you can read the advisory they published; it explains the vulnerability in depth. The exploit has been tested on Ubuntu 22.04.2 LTS with GLIBC 2.35-0ubuntu3.1. Testing th...

CVE-2015-7547

CVE-2015-7547 glibc vulnerability test script This provides a shell script for testing the glibc vulnerability CVE-2015-7547. It's written for rpm based systems such as Red Hat Enterprise Linux / RHEL / CentOS 5/6/7. Detection for other distributions may follow. Resolution 1. Run bin/test-glibc.s...

cve-2023-4911-exploit-optimized

Security Notice : This repository contains working exploit code for educational and research purposes. Use responsibly and only on systems you own or have explicit permission to test. CVE-2023-4911 Exploit Looney Tunables Optimized, multi-processing exploits for CVE-2023-4911 targeting x8664 and...

CVE-2024-6387

CVE-2024-6387 This is an altered PoC for d0rb/CVE-2024-6387. This takes glibc addresses and trys to exploit the CVE through them...

CVE-2023-4911

CVE-2023-4911 This is a PoC Proof Of Concept for the Looney Tunables Linux Privilege Escalation vulnerability. This is based on this PoC. Great thanks to leesh3288. Here you can find a very detailed writeup, and here you can see a very cool video by IppSec. Usage Check if it's vulnerable env -i...

cve-2015-7547

PoC attack server for CVE-2015-7547 vulnerability in glibc DNS resolver To test on local machine with a vulnerable glibc version: user@localhost:/ echo 'nameserver 127.0.0.127' | sudo tee /etc/resolv.conf user@localhost:/ echo 'nameserver 127.0.0.127' | sudo tee -a /etc/resolv.conf user@localhost...

looney-tunables-CVE-2023-4911

PoC of CVE-2023-4911 Looney Tunables This is a PoC of CVE-2023-4911 a.k.a. "Looney Tunables" exploiting a bug in glibc dynamic loader's GLIBCTUNABLES environment variable parsing function parsetunables. Getting Started Executing program We can check if target is vulnerable env -i...

regreSSHion

regreSSHion Exploit PoC Description This repository contains an exploit targeting CVE-2024-6387 regreSSHion, a vulnerability in OpenSSH's server sshd on glibc-based Linux systems. It exploits a race condition in the signal handler of OpenSSH, potentially leading to remote code execution as root...

exploit_mitigations

Exploitation Mitigations The goal is to list exploitation mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability is easily exploitable or not depending on exploitation mitigations in place. An example is the...

LooneyPwner

LooneyPwner Exploit tool for CVE-2023-4911, targeting the 'Looney Tunables' glibc vulnerability in various Linux distributions. LooneyPwner is a proof-of-concept PoC exploit tool targeting the critical buffer overflow vulnerability, nicknamed "Looney Tunables," found in the GNU C Library glibc...

heaptrace

About heaptrace is a heap debugger for tracking glibc heap operations in ELF64 x8664 binaries. Its purpose is to help visualize heap operations when debugging binaries or doing heap pwn. replaces addresses with easy-to-understand symbols detects heap corruption and memory leakage issues can debug...

how2heap

Educational Heap Exploitation This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc you are using...

CVE-2015-0235-workaround

CVE-2015-0235-workaround aka GHOST glibc vulnerability A shared library wrapper with additional checks for the vulnerable functions gethostbyname2r and gethostbynamer . The proper solution for CVE-2015-0235 is to upgrade glibc to at least glibc-2.18. In some cases, an immediate glibc upgrade is n...

heap-viewer

HeapViewer An IDA Pro plugin to examine the heap, focused on exploit development. Currently supports the glibc malloc implementation ptmalloc2. 3rd place winner of the 2018 Hex-Rays Plugin Contest Requirements IDA Pro = 7.0 Tested on glibc 2.23 = 2.26 GraphView for linked lists bins/tcache Struct...

ssh_poc2024

cve-2024-6387-poc a signal handler race condition in OpenSSH's server sshd 7etsuo Description An exploit for CVE-2024-6387, targeting a signal handler race condition in OpenSSH's server sshd on glibc-based Linux systems. The vulnerability allows for remote code execution as root due to...

cnext-exploits

CNEXT exploits Exploits for CNEXT CVE-2024-2961, a buffer overflow in the glibc's iconv, by @cfreal Usage $ git clone --recurse-submodules https://github.com/ambionics/cnext-exploits.git $ pip install -r requirements.txt Technical analysis The vulnerability and exploits are described in the...

CVE-2023-4911

PoC of CVE-2023-4911 "Looney Tunables" This is a PoC of CVE-2023-4911 a.k.a. "Looney Tunables" exploiting a bug in glibc dynamic loader's GLIBCTUNABLES environment variable parsing function parsetunables. Code has been tested on Ubuntu 22.04.3 with glibc version 2.35-0ubuntu3.3. No attempts have...

CVE-2024-6387

0.Summary This is essentially a statistical vulnerability: it requires a large number of attempts to win the race condition and successfully execute arbitrary code, and the attacker needs to overcome many obstacles," Schwartz told SecurityWeek. "Even in the best case, the most famous vulnerabilit...

CVE-2024-6387

Vulnerability Description CVE-2024-6387 exploit targets a signal handler race condition in the OpenSSH server sshd on glibc-based Linux systems. Due to calling an async-signal-unsafe function in the SIGALRM handler, this vulnerability allows remote code execution as root. Vulnerability Summary Th...

fsop-finder

Glibc FSOP code path finder Find FSOP code path that can hijack control flow and stack pointer in GLIBC Libio. Description: 1. Install this plugin 2. Open libc.so.6 in Binary ninja, then click Tools - Plugins - Find FSOP code path 3. You should see the result in Log windows Useful discoveries: //...