CVE-2022-1015

CVE-2022-1015 This repository contains a PoC for local privilege escalation of CVE-2022-1015, a bug in the nftables component of the linux kernel that I found. You can read a detailed analysis of this vulnerability and the exploitation strategy over at my blog. Right now, the exploit is a bit...

CVE-2025-61155

CVE-2025-61155 — Arbitrary Process Termination in GameDriverX64.sys A signed kernel-mode anti-cheat driver — GameDriverX64.sys, shipped with Tower of Fantasy Hotta Studio / Perfect World — lets any unprivileged local user terminate arbitrary processes , including PPL-protected antivirus/EDR...

CVE-2026-43499

CVE-2026-43499 — Linux Kernel Futex PI Use-After-Free Bug removewaiter in kernel/locking/rtmutex.c is used by the slowlock paths but also for proxy-lock rollback in rtmutexstartproxylock when invoked from futexrequeue. In the proxy-lock case waiter::task is not current, but removewaiter incorrect...

CVE-2022-0847-Container-Escape

CVE-2022-0847 CVE-2022-0847 used to achieve container escape overwrite any read-only files on host Slides in Chinese available here 利用CVE-2022-0847 Dirty Pipe 实现容器逃逸（效果为覆写宿主机上任意只读文件） 中文汇报PPT在这里 Introduction If the kernel is vulnerable to CVE-2022-0847, the attacker can overwrite read-only files...

packet_edit_meme

PACKETEDITMEME - aka CVE-2026-46331 net/sched actpedit partial-COW page-cache corruption culprit 899ee91156e5, present v5.18 .. fixed v7.1-rc7. packeteditmeme.c turns it into unprivileged local root: a userns CAPNETADMIN child overwrites the cached ELF entry of setuid-root /bin/su with...

android-badbinder-demo

CVE-2019-2215 Bad Binder — Exploit Analysis This repository is a small test project for researching the vulnerability CVE-2019-2215 Bad Binder and writing a working prototype of an exploit for Android with a simple graphical interface in Kotlin/Jetpack Compose. In the README I: 1. Describe the...

copyfail-guard

copyfail-guard Automated detection and mitigation tool for the vulnerability CVE-2026-31431 "Copy Fail", a local privilege escalation LPE in the algifaead module AFALG interface of the Linux kernel. ⚠️ Scope: this project is purely defensive. It does not contain, generate, or reference exploit...

CVE-2025-60719-AFD.SYS

!IMPORTANT This proof of concept is for demonstration and learning purposes only. Use it with care. CVE-2025-60719-AFD.SYS Akamai researchers have created a new AI capability for instant root-cause analysis. The tool is a supervised multi-agent system, dubbed Patchdiff-AI. In this article we are...

AV_Kernel_Vulns

AVKernelVulns Pocs for Antivirus Software‘s Kernel Vulnerabilities found by myself...

CVE-2021-3493

CVE-2021-3493 Ubuntu OverlayFS Local Privesc Affected Versions Ubuntu 20.10 Ubuntu 20.04 LTS Ubuntu 19.04 Ubuntu 18.04 LTS Ubuntu 16.04 LTS Ubuntu 14.04 ESM Usage gcc exploit.c -o exploit ./exploit Description "Ubuntu specific issue in the overlayfs file system in the Linux kernel where it did no...

ODIS-project-explorer

ODIS project explorer Nefarious Motorsports forum thread: http://nefariousmotorsports.com/forum/index.php?topic=23836.0 This Python project is meant to unpack and make use of the data stored in MCD Runtime Projects colloquially known as ".db and .key files ". Normally, these files are used by the...

recon_2024_windbg_workshop

REcon 2024 - Tips & Tricks for better debugging with WinDbg This repository contains the materials created for the workshop "Tips & Tricks for better debugging with WinDbg", at REcon 2024. Setup The workshop materials aims to provide useful features for WinDbg, when debugging in kernel-mode, but...

CVE-2022-42045

CVE-2022-42045 Summary We discovered an Arbitrary code injection in Zemana amsdk.sys kernel-mode driver, a part of Zemana Antimalware SDK. The vulnerability allows to inject an arbitrary code into the one of the driver code sections and then to execute it with kernel-mode privileges local...

ksmbd-n-day

README This repo accompanies my research article Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days, in which I develop a POC for n-days from 2023: CVE-2023-52440 and CVE-2023-4130. I provide the kernel .config, a kernel run script, an image build script, and the POC. The...

antispy

AntiSpy English | 简体中文 A powerful anti rootkit toolkit AntiSpy is a free but powerful anti virus and rootkits toolkit. It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks. With its assistance,you can easily spot and...

backdoors

Backdoors Tools designed for maintaining access to systems and proof-of-concept demonstrations written by the team at Hacker House. These tools are designed to simulate or demonstrate common persistence techniques such as kernel mode hooking and command & control implementations. File| Descriptio...

CVE-2026-53359-Kernel-Fix

中文 | English 中文 升级 Linux Kernel 7.1.3 修复 CVE-2026-53359 教程 声明： 本文仅记录本人服务器环境下的修复过程，并非安全专业分析。如有不当之处，欢迎指正。 验证说明： 经源码比对确认，Linux Kernel 7.1.3 已包含修复 commit 81ccda30b4e8（"KVM: x86: Fix shadow paging use-after-free due to unexpected role"），该补丁在 arch/x86/kvm/mmu/mmu.c 的 kvmmmugetchildsp 函数中增加了 role.word...

CVE-2026-43499

CVE-2026-43499 Exploitation Notes Severity: HIGH CVSS: 7.8 Impact: Confidentiality, Integrity, Availability Published: 2026-05-21 Technical Summary CVE-2026-43499 is a vulnerability within the Linux kernel, specifically affecting the rtmutex component, which is responsible for managing real-time...

chocobo

chocobo Chocobo Root CVE-2016-8655 Analysis Notes This is the newest Linux privesc, released 2016-12-06 here http://seclists.org/oss-sec/2016/q4/607. References found at this point: http://www.theregister.co.uk/2016/12/07/androiddirtycowkernelpatch/ https://www.exploit-db.com/exploits/40871/ Goal...

CVE-2023-3338-DECPwn

DECPwn Practicing different Linux kernel exploitation techniques with my DECnet vulnerability and null page mapping enabled. Scenarios Everything disabled : qemu-system-x8664 -append "nosmap nosmep nopti nokaslr" Code execution is redirected to the output function in userland, which invokes...