CopyFail-CVE-2026-31431

CopyFail: CVE-2026-31431 Python implementation of copy.fail. Overwrites the page cache of a setuid-root binary via AFALG + splice to get root. No race, no offsets works on any Linux distro since 2017. Requirements Python 3.6+ 3.12+ uses os.splice natively; older versions fall back to ctypes Linux...

weevely3

Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...

exec-prot-bypass

Executable Space Protection Bypass CVE-2022-25265 This POC demonstrates execution of bytes located in supposedly non-executable region of binary, therefore completely bypassing executable-space protection. The root cause of this can be found here:...

CVE-2024-47176

CUPS Browsd daemon which is by default running as root if allowed in Linux/Unix systems, allow remote connections from any device on the network to create a new printer. Start the python post server and then send the request to add the printer you will se a connection to your http server as root ...

CVE-2021-3560

PolicyKit CVE-2021-3560 Exploitation Authentication Agent C implementation of CVE-2021-3560 exploitation, blog posts about this exploitation: https://ricterz.me/posts/2022-04-28-a-new-exploit-method-for-cve-2021-3560-polkit-linux-privilege-escalation.txt...

libvshadow

libvshadow is a library to access the Volume Shadow Snapshot VSS format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume. Project information: Status: alpha Licence: LGPL-3.0-or-later Also see: OSDFC 2012: Paper - Windowless Shadow Snapshots:...

ScreenOff

ScreenOff CVE-2026-52910 kernel crash poc. ref: https://github.com/5unkn0wn/security-research/tree/CVE-2026-52910ltscosmitigation what socket + SOATTACHREUSEPORTCBPF + setsockopt race. timerfd/epoll callback storm slows down the receive path. replace the cBPF filter while the old prog is still in...

cve-2014-4699-ptrace

writeup https://duasynt.com/blog/cve-2014-4699-linux-kernel-ptrace-sysret-analysis...

SMB-LINUX-CVE-2025-37899

Use-After-Free Vulnerability in Linux Kernel's ksmbd CVE-2025-37899 Description A use-after-free vulnerability has been discovered in the ksmbd module of the Linux kernel, responsible for implementing the SMB Server Message Block protocol for network file sharing. This vulnerability, identified a...

ufonet

Website: https://ufonet.03c8.net Description: UFONet - is a free software, P2P and cryptographic -disruptive toolkit- that allows to perform DoS and DDoS attacks; on the Layer 7 APP/HTTP through the exploitation of Open Redirect vectors on third-party websites to act as a botnet and on the Layer3...

kernel-exploits

Kernel Exploits Various kernel exploits CVE-2021-22555 Linux local root exploit. Updated version of theflow's exploit for CVE-2021-22555. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a D...

ssbd-tools

Tools for exercising Speculative Store Bypass Disable The ssbd-tools project is a collection of programs that makes use of the Speculative Store Bypass Disable SSBD functionality provided in x86 processors. SSBD is a processor based mitigation for the Speculative Store Bypass attack that is...

emba

EMBA The security analyzer for firmware of embedded devices EMBA is designed as the central firmware analysis and SBOM tool for penetration testers, product security teams, developers and responsible product managers. It supports the complete security analysis process starting with firmware...

Some-Tools

Some-Tools Manage all your pentest tools in one place and keep them up to date with one command 😎 The goal of sometools is to be able to manage all your tools that are not include in Kali or that sudo apt install is not available. Sometools works better if tools are a repo but it can be tweak to...

ghostlock-emerald

GhostLock for POCO M6 Pro emerald GhostLock CVE-2026-43499 is a 15-year-old Linux kernel use-after-free in the futex priority-inheritance code that lets any local user gain root. This project uses it to root the POCO M6 Pro MediaTek Helio G99 Ultra / MT6789 and install KernelSU on a locked...

CVE-2019-10207

CVE-2019-10207 PoC for CVE-2019-10207 linux kernel: bluetooth: hciuart: kernel NULL pointer dereference root@kitploit: gcc CVE-2019-10207.c -o cve-2019-10207-poc -static test on 4.20.0 kernel compile CONFIG must be opened: root@kitploit: CONFIGBTHCIUARTMRVL=y CONFIGBTMRVL=y...

azurelinux

Azure Linux 4 An open-source Linux distribution built and optimized forAzure, with sources derived from Fedora Linux. Azure Linux provides a secured, reliable operating system for virtual machines, containers, and bare-metal platforms. Azure Linux is built on a robust open-source foundation from...

CVE-2022-0847-L-nux-PrivEsc

CVE-2022-0847 Description - POC for CVE-2022-0847: Linux Kernel Local Privilege Escalation Vulnerability. - create by antx at 2022-03-08. Detail - Security researcher Max Kellermann responsibly disclosed the 'Dirty Pipe' vulnerability and stated that it affects Linux Kernel 5.8 and later...

DirtyClone

DirtyClone CVE-2026-43503 - Python PoC Non-official Python port of DirtyClone — a Linux kernel local privilege escalation vulnerability. This repository contains a working Proof of Concept that allows an unprivileged local user to gain root privileges by exploiting page-cache corruption via clone...

Reconky-Automated_Bash_Script

Reconky-Automated Bash Script root@kitploit: \ \ /|| \ /|\ /| | || /| /| || \ || \ / / \ / | || | | | | | || \ | || / / \ / | | | | | | | || \ \ || \ / | \ | | | | | | || | \ || \ \ | \ | /| /| || \ || / \ \ | | |/ ///|/ |/ / / Usage ./reconky.sh About Reconky is a script written in bash...