Trigon

Trigon Trigon is a deterministic kernel exploit and PPL bypass based on CVE-2023-32434. It supports A9 - A16 devices running iOS 13 - 16.5.1. Being deterministic means that this exploit will never panic during or after exploitation and is completely reliable. Trigon exploits an integer overflow i...

psc

psc psc ps container is a fast process scanner that uses eBPF iterators and Google CEL to query system state with precision and full container context. Why psc? Fast Kernel-Level Access with eBPF Iterators psc uses eBPF iterators to read process and file descriptor information directly from kerne...

CVE-2022-21907-http.sys

CVE-2022-21907 - Double Free in http.sys driver CVE-2022-21907 - Double Free in http.sys driver Summary An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack http.sys to...

Diamorphine

Diamorphine Diamorphine is a LKM rootkit for Linux Kernels 2.6.x-7.x x86/x8664 and ARM/ARM64 Features When loaded, the module starts invisible; Hide/unhide any process by sending a signal 31; Sending a signal 63to any pid makes the module become invisible; Sending a signal 64to any pid makes the...

CVE-2019-18885

CVE-2019-18885 CVE-2019-18885 bobfuzzer Team Members Infomations Overview Target Reproduce Bug Causes Debugger View KASAN Logs Acknowledgments bobfuzzer project team in BoBa.k.a Best of the Best, Republic of Korea. [email protected] finding bugs in linux kernel filesystem modules Team Member...

Exploiting-a-Linux-kernel-vulnerability

Exploiting-a-Linux-kernel-vulnerability - IT19159140 Local Root vulnerability- CVE-2019-13272 / Security Bypass Vulnerability – CVE-2019-14287 Absolutely, I always choose Linux vulnerability, but then I had to choose different vulnerability else because I didn't know two people could do the same...

CVE-2022-42046

EvilWfshbr CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation wfshbr64.sys and wfshbr32.sys specially crafted payload allows arbitrary user to perform bitwise operation with arbitrary EPROCESS offset and flags value to purposely elevate the game process to CodeGen Full...

ptcpdump

ptcpdump %20e2e %20e2e English | 中文 ptcpdump is a tcpdump-compatible packet analyzer powered by eBPF, automatically annotating packets with process/container/pod metadata when detectable. Inspired by jschwinger233/skbdump. Table of Contents Features Installation Requirements Usage Example command...

CVE-2022-0492

CVE-2022-0492 Container Escape Analysis toc Vulnerability Overview Vulnerability ID: CVE-2022-0492 Vulnerable Product: linux kernel - cgroup Affected Versions: linux kernel 5.17-rc3 Vulnerability Impact: When a container does not have additional security measures enabled, an attacker with root...

CVE-2017-16995

CVE-2017-16995 tested for Ubuntu 16.04.01 - Linux 4.4.0-31-generic 50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x8664 This vulnerability allow a simple user to do a privilege escalation and get a root shell if different kernel adjust CRED offset + check kernel stack size...

CVE-2019-6207

CVE-2019-6207 this vulneriliabity can be trigger in sandbox at macOSwop == NETRTFLAGS || w-wop == NETRTFLAGSPRIV && !rt-rtflags & w-warg goto done; / If the matching route has RTFLLINFO set, then we can skip scrubbing the MAC only if the outgoing interface is not loopback and the process has...

CVE-2025-21756

CVE-2025-21756 — Exploitation Lab For educational and authorized security research purposes only. Description CVE-2025-21756 is a use-after-free UAF vulnerability in the Linux kernel's vsock Virtual Socket subsystem, disclosed on February 26, 2025. It allows a local attacker to escalate privilege...

dirtypipe-ebpf_detection

dirtypipe-ebpfdetection -- Dirtypipe detection tool This program was made to detect Dirty Pipe exploitation attempts thanks to eBPF. It also monitors nonvulnerable kernels and docker containers. 🛫 If you want more details on how it works please read the blog post ! 🛬 How does it works? Default...

sigwire

sigwire tail -f for signals. Every signal any process on the box raises — who sent it, who it hit, which signal, how it was raised kill2, the kernel, a POSIX timer, whether the target caught it and how long its handler ran, whether it tore a blocked syscall out with EINTR — decoded off the kernel...

TopazTerminator

TopazTerminator F, Another driver got burned.. I was gatekeeping wsftprm.sys driver for a while ; but since someone posted a public POC, I'm ungatekeeping it. We all know it'll get added to the driver blocklist soon, so here's my implementation for the same — in C This project exploits the...

xattr-oob-swap

xattr-oob-swap CVE-2020-27904: a tfp0 bug for macOS 10.15.x and below. Demo exploit code for my talk at BlackHat ASIA 2021. The vulnerability has been fixed in macOS Big Sur 11.0, and the latest 10.15&10.14 security update. Warranty Use it on your own risk. This will make you macOS panic. I build...

CVE-2022-2078

CVE-2022-2078 $ ./poc ... + getset leakbuffer: 0000 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;? 0010 28 00 00 00 00 02 0a 8f 68 8b a2 be 40 ac 70 8c [email protected]. 0020 ff ff ff ff 00 6c b5 81 .....l.. + kernel=0xffffffff8c70ac40...

vulhub

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. 中文版本Chinese version Quick Start Install Docker examp...

swapgs-attack-poc

PoC for the SWAPGS attack CVE-2019-1125 This repository holds the sources for the SWAPGS attack PoC publicly shown at Black Hat USA, 2019. Contents leakgsbkva - variant 1 look for random values in kernel memory; limited to PE kernel image header leakgsbkvat - variant 2 extract random values from...

memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...