CVE-2016-6187_LPE

CVE-2016-6187 - Linux Kernel Exploit Kernel Exploit for CVE-2016-6187 Local Privilege Escalation affected versions: 4.6.5 Exploit was developed against a custom compiled 4.6 kernel + buildroot kconfig coming soon and defeats KASLR, SMEP, SMAP KPTI not available for 4.6 Presentation slides...

rootkit-detection-ebpf-time-trace

Rootkit Detection with eBPF Time Tracing This repository contains code to collect time measurements of kernel functions that are manipulated by rootkits when they hide files, as well as a semi-supervised detection method that analyzes shifts of kernel function execution times. This implementation...

Dirty-Pipe-CVE-2022-0847-POCs

Dirty-Pipe-CVE-2022-0847-POCs Author: Max Kellermann [email protected] Contributor: Bl4sty https://twitter.com/bl4sty A new Linux vulnerability known as 'Dirty Pipe' allows local users to gain root privileges through publicly available exploits. Today, security researcher Max Kellermann...

CVE-2024-36424

CVE-2024-36424 This vulnerability was discovered and disclosed by M. Akil Gündoğan from Secunnix Vulnerability Research Team. This repository will hold the proof-of concept and advisories. Details: Product: K7 Ultimate Security Affected versions: v17.0.2019 CVE ID: CVE-2024-36424 Operating System...

CVE-2019-0708

CVE-2019-0708 - BlueKeep RDP RDP Connection Sequence: https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-rdpbcgr/023f1e69-cfe8-4ee6-9ee0-7e759fb4e4ee Analysis of RDP Service Vulnerability:...

iptable_evil

iptableevil iptableevil is a very specific backdoor for iptables that allows all packets with the evil bit set, no matter the firewall rules. The initial implementation is in iptableevil.c, which adds a table to iptables and requires modifying a kernel header to insert a spot for it. The second...

CVE-2023-0179-PoC

Needle CVE-2023-0179 exploit This repository contains the exploit for my recently discovered vulnerability in the nftables subsystem that was assigned CVE-2023-0179, affecting all Linux versions from 5.5 to 6.2-rc3, although the exploit was tested on 6.1.6. The vulnerability details and writeup c...

Umbra

Umbra Umbra is an experimental remotely controllable LKM rootkit for kernels 4.x and 5.x up to 5.7 which opens a network backdoor that can spawn reverse shells to remote hosts, launch malware remotely and much more. The rootkit is still under development, although the features listed below are...

auditd

/ | / // / / /| |/ / / / / / / / / / // / // / / // // / // |,/,///,/ Best Practice Auditd Configuration Idea The idea of this auditd configuration is to provide a best-practice baseline that is designed to load out-of-the-box on major Linux distributions covers a broad set of security-relevant...

bad-epoll

Bad Epoll: The bug missed by Mythos An unprivileged process escalating to root on Google kernelCTF. Bad Epoll CVE-2026-46242 is a race-condition use-after-free in the Linux kernel's epoll subsystem. This bug lets an unprivileged process become root, not only on Linux desktops and servers but also...

CVE-2022-32250-exploit

CVE-2022-32250-Linux-Kernel-LPE Demo Video https://www.youtube.com/watch?v=YqmwA6fPjKE About CVE-2022-32250 allows a local user to escalate privileges to root because an incorrect NFTSTATEFULEXPR check leads to a use-after-free. Reference Linux Kerenel Exploit CVE-2022-32250 with mqueue Affected...

gobee

gobee Write your BPF programs in Go, not C. gobee transpiles a strict subset of Go into BPF C, generates typed Go bindings for the userspace side, and gates loads against the running kernel. The Go ecosystem has solid userspace tooling for BPF. The kernel side has always ended with "now write you...

CVE-2018-4407

CVE-2018-4407 CVE-2018-4407 is a buffer overflow vulnerability in the XNU kernel's ICMP error code. It causes IOS devices to crash both laptops and mobiles upon receival of one yes 1! single bad packet. The bug was originally disclosured by Kevin Backhouse on his lgtm blogpost on October 30th 201...

mquire

mquire mquire, a play on the memory and inquire words, is a memory querying tool inspired by osquery. Key advantage: No external debug symbols needed mquire can analyze Linux kernel memory snapshots without requiring external debug symbols. Everything needed for analysis is already embedded in th...

HugeDirtyCowPOC

"Huge Dirty Cow" POC A POC for the Huge Dirty Cow vulnerability CVE-2017-1000405. Full details can be found here. Before running, make sure to set transparent huge pages to "always": echo always | sudo tee /sys/kernel/mm/transparenthugepage/enabled...

CVE-2019-8781-macOS

CVE-2019-8781 Security Advisory CVE-2019-8781 POC Details The POC elevate the process to root and execute a shell. Exploit environment - macOS 10.14.6 18G95 Should works on all macOS version that's released before 10.15.0 - SMEP: On - SMAP: Off - Kernel ASLR slide passed to the argv1 Building You...

kasld

KASLD recovers the Linux kernel's virtual and physical memory layout — primarily the kernel text base — from a local process. What it can recover is a function of that process's vantage: its privileges and capabilities, the system's configuration, and any container confinement. It recovers the ba...

used_sock

usedsock Kernel exploit for iOS 12-12.2 and 12.4. This isn't meant to be used in a jailbreak. You can find the writeup here...

CVE-2025-21333-POC

CVE-2025-21333-POC Proof of Concept that exploits CVE-2025-21333 in vkrnlintvsp.sys not so reliable see Requirements and Limitations section. Under the References section are located very helpful resources for who wants to play with the exploit. A detailed analysis of the vulnerability and the...

CVE

CVE A collection of proof-of-concept exploit scripts written by the STAR Labs team for various CVEs that they discovered or found by others. CVE-2026-53264 Target: Linux Kernel Version: CentOS 9 kernel version 5.14.0-721 Exploit Written By: Lee Jia Jie CVE-2025-29824 Target: Windows Common Log Fi...