TripleCross

TripleCross TripleCross is a Linux eBPF rootkit that demonstrates the offensive capabilities of the eBPF technology. TripleCross is inspired by previous implant designs in this area, notably the works of Jeff Dileo at DEFCON 271, Pat Hogan at DEFCON 292, Guillaume Fournier and Sylvain Afchain als...

dlinject

dlinject.py Inject a shared library i.e. arbitrary code into a live linux process, without ptrace. Inspired by Cexigua and linux-inject, among other things. Usage .. . | /| | || || / | .. / | | | | |/ \ | |/ / \ \ \ | \ | |/|| /| |\ \ | /| // | / /| / / /|| / source:...

CVE-2025-32463

README - sudo-chwoot.sh Description Ce script est une preuve de concept PoC qui démontre une technique d'élévation de privilèges exploitant une vulnérabilité théorique dans 'sudo' ex. CVE-2025-32463. Le PoC force 'sudo' à charger une bibliothèque .so manipulée en exploitant la fonctionnalité '-R'...

linux_injector

linuxinjector Un injecteur de bibliothèques partagées simple, sans ptrace, pour Linux x64. Utilisation linuxinjector mode 1. dlopen normal 2. memfd + dlopen pour injection dans des conteneurs 3. shellcode brut pid Identifiant du processus cible. Vous devez disposer des droits ptrace sur ce...

CVE-2024-0132

CVE-2024-0132 CVE-2024-0132 PoC Commençons par choisir une image de base. L'organisation des bibliothèques dans le système dépend de celle-ci. Par exemple, pour alpine, ce sera /usr/lib64/, pour ubuntu, ce sera /usr/lib/x8664-linux-gnu. Nous utiliserons ubuntu comme image de base. FROM ubuntu Le...

noSAMBAnoCRY-CVE-2017-7494

noSAMBAnoCRY CVE-2017-7494 استغلال عن بُعد لثغرة SAMBA CVE-2017-7494 المعروفة باسم isknowpipename! التفاصيل ينقسم هذا الاستغلال إلى 3 أجزاء: ترجمة evilLib للمعماريات التالية: x8664 , x86, أو i686 العثور على مشاركة قابلة للكتابة ورفع evilLib إليها! تحميل evilLib، إذا سار كل شيء على ما يرام، يتم...

ReflectiveDLLInjection

À propos L'injection de DLL réflective est une technique d'injection de bibliothèque dans laquelle le concept de programmation réflective est employé pour effectuer le chargement d'une bibliothèque depuis la mémoire dans un processus hôte. Ainsi, la bibliothèque est responsable de son propre...

nasm_linux_x86_64_pure_sharedlib

NASM Linux x8664 bibliothèque partagée pure sans dépendances .so Testé avec « Reflective SO injection ». Une technique d'injection de bibliothèque dans laquelle le concept de programmation réflexive est employé pour effectuer le chargement d'une bibliothèque depuis la mémoire dans un processus...

CVE-2021-3156

CVE-2021-3156 Introduction This repository was created for studying purpose. The project contains some tools for studying the sudo Baron Samedit vulnerability and the exploit for it. Thanks to Qualys Team for discovering such vulnerability, to Worawit and 0xdevil for the interesting writeups. Usa...

POC-IngressNightmare-CVE-2025-1974

POC لـ IngressNightmare CVE-2025-1974 مطوَّر من: https://github.com/yoshino-s/CVE-2025-1974 https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities الكلام سهل، فقط انظر إلى الكود. التفاصيل متاحة على https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities الاستخدام 1. غيّر عنوان ...

CVE-2025-32463

CVE-2025-32463 - استغلال تصعيد الامتيازات عبر chroot في Sudo نظرة عامة CVE-2025-32463 هي ثغرة حرجة لتصعيد الامتيازات المحلية في إصدارات sudo من 1.9.14 إلى 1.9.17. تسمح هذه الثغرة للمهاجمين الذين لديهم امتيازات sudo بتصعيد الوصول إلى صلاحيات الجذر عن طريق استغلال عيب في تصميم منطق معالجة خيار...

Rocky Linux 9 [CIQ] Security Update: gtk-update-icon-cache / gtk-update-icon-cache-debuginfo / gtk3 / etc (crlsa-2024_9184)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249184 advisory. gtk3: gtk2: Library injection from CWD CVE-2024-6655 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus...

CentOS Linux 7 [TuxCare] Security Update: gtk-update-icon-cache / gtk3 / gtk3-devel / gtk3-devel-docs / etc (CENTOS7:CLSA-2024:1728056039)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1728056039 advisory. - A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the...

Rocky Linux 8 [CIQ] Security Update: gtk-update-icon-cache / gtk-update-icon-cache-debuginfo / gtk3 / etc (crlsa-2024_6963)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20246963 advisory. gtk3: gtk2: Library injection from CWD CVE-2024-6655 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus...

AlmaLinux 9.2 [TuxCare] Security Update: gtk-update-icon-cache / gtk3 / gtk3-devel / gtk3-devel-docs / etc (ALMALINUX9.2:CLSA-2025:1745946091)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745946091 advisory. - A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the...

Malicious code in @years19/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b Package presents itself as an n8n community utility node, but the shipped node file nodes/PwnNode.node.js is a 213-byte stub. The real behavior is in...

EUVD-2026-25014

printenv: environment variables with invalid UTF-8 are silently skipped evades inspection...

GHSA-P7H3-7Q52-72W8 printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows...

CVE-2026-49413

The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the PSUGID process flag. During execve2, this flag is not yet set at the point where the auxiliary vector is constructed, so ATSECURE was incorrectly set to zero for set-user-ID and set-group-ID executables. A...

FreeBSD : FreeBSD -- Flaw in Linuxulator execution of setugid binaries (fa5289e4-6473-11f1-958d-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fa5289e4-6473-11f1-958d-bc241121aa0a advisory. The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the PSUGID...