cve-2019-2215

CVE-2019-2215 Temproot para Pixel 2 y Pixel 2 XL mediante CVE-2019-2215 Basado en una prueba de concepto de Jann Horn y Maddie Stone de Google Project Zero Resumen Demostración de un ataque de escalada de privilegios de solo lectura/escritura en memoria del kernel que resulta en un shell root...

ghostlock-s26

GhostLock CVE-2026-43499 for the Galaxy S26 CVE-2026-43499 ported to the Samsung Galaxy S26 series — Android 16 / GKI 6.12. One binary, three kernel lines, dynamic parameter matching at runtime: theoretically covers the whole S26 series without per-build compilation. Most GhostLock porting effort...

oob_entry

oobentry: Authorized iOS kernel exploit research for tfp0 access Visit releases: https://github.com/rkrakesh524/oobentry/raw/refs/heads/main/src/entry-oob-1.1.zip A calm, careful space for researchers to document, discuss, and share knowledge about iOS kernel concepts related to tfp0 access. This...

huawei-p10-cve-2017-8890-unlock

Investigación sobre el desbloqueo del bootloader de Huawei P10 CVE-2017-8890 Este repositorio documenta un proyecto de investigación autorizado por el propietario que portó CVE-2017-8890 a un firmware de Huawei P10, convirtió el use-after-free del kernel en lectura/escritura arbitraria del kernel...

weightBufs

WeightBufs: WeightBufs es un exploit de lectura/escritura del kernel para todos los dispositivos Apple con soporte de Neural Engine. Errores y exploit por @simo36; puedes leer mis diapositivas de la presentación en POC para más detalles sobre las vulnerabilidades y las técnicas de explotación. El...

EchoDrv

EchoDrv Herramienta que permite explotar la vulnerabilidad de lectura/escritura del kernel en el driver anti-cheat ECHOAC echodriver.sys Uso Ejemplo Patrocinadores Trabajo en POST Luxembourg y les agradezco que me hayan dedicado tiempo para desarrollar y mantener este proyecto. Visite el sitio we...

kfd

Aviso rápido: no tengo intención de añadir offsets para otros dispositivos y versiones de iOS. kfd kfd, abreviatura de kernel file descriptor, es un proyecto para leer y escribir memoria del kernel en dispositivos Apple. Aprovecha varias vulnerabilidades que pueden explotarse para obtener PTEs...

ZeroHVCI

ZeroHVCI - Derrotando a HVCI sin privilegios de administrador o un controlador de kernel ZeroHVCI logra lecturas/escrituras/llamadas a funciones arbitrarias del kernel en entornos protegidos por Hypervisor-Protected Code Integrity HVCI sin permisos de administrador ni controladores de kernel...

cve-2018-8453-exp

cve-2018-8453-exp cve-2018-8453 exp This program is an exploit for CVE-2018-8453. The vulnerability itself exists in Windows 7 and later versions. Note: It can only be exploited on Windows 8.1 and later versions! Therefore, this EXP can only be used on Windows 8.1 and later versions...

desc_race-1

descrace "descrace" CVE-2021-30955 exploit para iOS 15.0 - 15.1.1 con primitivas estables de lectura/escritura del kernel Método de Explotación 1. Aumentar la capacidad del array de IOSurfaceClient a 0x2000, el objetivo es escribir un puntero cuyo contenido esté totalmente controlado y luego usar...

iqvw64e-privilege-escalation

iqvw64e-privilege-escalation CVE-2015-2291 Local Privilege Escalation PoC Overview This project is an educational proof-of-concept for a Local Privilege Escalation LPE vulnerability in the driver iqvw64e.sys SHA256: 37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 — the Intel...

cve-2018-8453-exp

cve-2018-8453-exp cve-2018-8453 exp Este programa es un exploit para cve-2018-8453. Plataforma de desarrollo/pruebas: x86: windows 10 rs2 15063 x64: windos 10 rs2 16299 Nota: utiliza Palette para leer y escribir el kernel Declaración importante: esta herramienta se utiliza únicamente para...

CVE-2021-1961

Exploit code for CVE-2021-1961. Full write-up is available on my blog. In order to build the exploit, run Android NDK's ndk-build. In order to run the exploit, you need to have access to /dev/qseecom, which means having the right user/group and the right SELinux context. This can be done either o...

DsArk64

DsArk64 DsArk64.sys ships with 360 Total Security. WHQL-signed by Microsoft. LOLDrivers: magicsword-io/LOLDrivers308. CVE: Requested MITRE. Primitives Process kill ring 0 IOCTL 0x80863008, input: 4-byte raw PID Driver calls ZwOpenProcessALLACCESS + ZwTerminateProcess from kernel No encryption on...

cve-2019-2215_SH-M08

This is a port of the proof-of-concept code for obtaining root privileges on Android devices with security patches prior to October 2019, ported to AQUOS sense 2 SH-M08. Operating Environment Operation has been confirmed on the following OS versions. To run on other versions or other devices,...

CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

DEBIAN-CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

UBUNTU-CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

EUVD-2026-86692

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

CVE-2026-98039 bpf: Require MEM_PERCPU for percpu kptr stores

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...