exploiting-cve-2017-5123

Exploiting CVE-2017-5123 Introduction This repository is an addition to the article published in MISC Magazine 96. We achieved to elevate our privileges in a reliable way, on our virtual machine with SMEP / SMAP and KASLR enabled. It should however be noted that the system if left in an unstable...

CVE-2019-1215

CVE-20190-1215 ws2ifsl.sys UAF exploit for Windows 10 19H1 x64 This exploit uses the recently patched use after free vulnerability CVE-2019-1215 in ws2ifsl.sys to achieve local privilege escalation. The exploit targets Windows 10 19H1 1901 x64 and demonstrates how to bypass kASLR, kCFG and SMEP...

CVE-2025-50168-pwn2own-berlin-2025

Author: D4m0n CVE-2025-50168 This is an exploit submitted to Pwn2Own Berlin 2025 - LPE Category. The vulnerability occurs in Win32kbase!DirectComposition, and further details can be found in the blog post. Acknowledgements kASLR bypass technique: prefetch-tool by carrotc4k3 Special thanks to: Dav...

CVE-2026-20805-PoC

CVE-2026-20805 PoC Proof of Concept demonstrating an information disclosure vulnerability in Microsoft Desktop Window Manager dwm.exe. Overview This repository contains a custom Proof of Concept PoC developed to reproduce CVE-2026-20805, an information disclosure vulnerability affecting the Windo...

kernel-exploits

Linux kernel exploits Date| Link| Description| Vector| Impact ---|---|---|---|--- 02.2016| CVE-2016-2384| Double-free in USB MIDI driver| USB + Local| LPE 03.2016| prefetch-side-channel| KASLR bypass via prefetch| Local| Info-leak 12.2016| CVE-2016-9793| Signedness issue with socket buffers| Loca...

CVE-2026-40369

This is a rewrite and summary of VoidSec’s public technical analysis of CVE-2026-40369, with an added flowchart and defensive notes for my own understanding. All core technical details come from his research. I did not perform independent reverse engineering on this bug. CVE-2026-40369: Defensive...

vpwn

vpwn by qwertyoruiop generic xnu heap overflow exploitation. demo output: $ ./pwn i Preparing payload... i broke out of kaslr, kaslrslide = 0000000001a00000 + Payload successfully crafted. i Manipulating the heap... i Exploit loaded. + got r00t sh-3.2 uname -a Darwin qwertyoruiops-iMac.local 14.3...

Elysium-Vanguard-Sentinel-Audit

SENTINEL-ROOT-AUDIT: Honor Magic V2 Hypervisor Detection Suite ➲ Project Overview SENTINEL-ROOT-AUDIT is a professional-grade security suite designed to audit kernel integrity and detect hypervisor-level interventions on the Honor Magic V2 SM8550. While the core vulnerability CVE-2025-38352 allow...

exploit_linux_kernel4.13

This repo contains an old poc that combines three CVEs CVE-2017-14954, CVE-2017-18344, CVE-2017-5123. The poc is a Local Privilege Escalation for Linux Kernel 4.13 tested on Ubuntu. The exploit uses an info leak CVE-2017-14954 to bypass KASLR, an arbitrary read CVE-2017-18344 to read the kernel...

KasperMeow

Kaspersky arkmon.sys KASLR Bypass via Kernel Debug Log Leak Kaspersky's anti-rootkit monitor driver arkmon.sys stores a kernel debug log containing raw kernel pointers. The log is "encrypted" with XOR 0xCC + ROT13 - trivially reversible. Any admin user can read and decrypt this log via IOCTL,...

CVE-2017-16994

/ disablemapminadd.c / / / include include include include include include include / offsets might differ, kernel was custom compiled you can read vmlinux and caculate the offset when testing / / define OFFSETKERNELBASE 0x000000 / define MMAPMINADDR 0x1101de8 define DACMMAPMINADDR 0xe8e810 / get...

cve-2026-43499

GhostLock Exploitation Failure Summary on PD2229 SM8475, 5.10.233 GKI I. Vulnerability and Device Facts 1.1 CVE-2026-43499 GhostLock Basic Information Item| Value ---|--- Vulnerability Type| Stack Use-After-Free in the rtmutex / futex PI path Introduced Version| Linux 2.6.39-rc1 May 2011, commit...

Lenovo-CVE-2025-8061

CVE-2025-8061 is a privilege escalation vulnerability in Lenovo's LnvMSRIO.sys driver. The driver exposes IOCTL handlers that allow any user-mode process including unprivileged users to: Read/write arbitrary Model-Specific Registers MSRs Read/write arbitrary physical memory This gives a standard...

LolModapi

hi hackers. This one is an unauthenticated MSR write inside MODAPI.sys, the kernel driver that MSI Dragon Center 2.0.155.0 installs. The driver exposes a device object with a security descriptor that lets any local user open it, no admin and no UAC. Once you have the handle there is no whitelist ...

cve-2026-43499-m3q-azf1

GhostLock SELinux park — SM-S948U1 / AZF1 m3q Research snapshot of a working SELinux-only park for Samsung Galaxy S26 Ultra SM-S948U1, codename m3q on firmware S948U1UES3AZF1 GKI 6.12.30-android16-5. This package is not a complete root. It flips SELinux to Permissive and holds reclaim long enough...

iOS26.6-CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB Read KASLR Defeat Component: AppleKeyStore kernel extension — LibSerSEPControlDeserialize Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds read in SEP control message deserialization Impact: Kernel pointer lea...

prefetch-tool

Strumento Prefetch KASLR per Windows Uno strumento proof-of-concept per bypassare KASLR ASLR del kernel su Windows 11. Ispirato da EntryBleed per Linux. Questo strumento è stato sviluppato come parte di un exploit che ha come target Windows 11 24H2. Non sono affatto un esperto di canali laterali,...

sh53d-temp-root

SH-53D temporary root This is a build-specific proof of conce...

kasld v0.4.0

KASLD recovers the Linux kernel's virtual and physical memory layout — primarily the kernel text base — from a local process. What it can recover is a function of that process's vantage: its privileges and capabilities, the system's configuration, and any container confinement. It recovers the ba...

CVE-2026-89616

A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the nireadframe function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used kernel memory pages to a local attacker who reads a specially...