security checks

🔍 Miner Hunter Crypto-miner detection, removal, and hardening toolkit for Linux servers. Built from real-world incident response — detects miners that hide from ps, top, htop, and btop using rootkit techniques. 📦 Installation git clone https://gitlab.com/abdom.seada/security-checks.git cd...

CVE-2022-32250

CVE-2022-32250 This is my exploit for CVE-2022-32250, written entirely based on the research from NCC Group's blog. Tested on: Kernel version 5.13 Success rate: 70% Building Building requires libmnl and libnftnl. make all Disclaimer The Proof-of-Concept and the write-up of the vulnerability are f...

reverse-shell

reverse-shell Reverse Shell as a Service - https://reverse-shell.sh Easy to remember reverse shell that should work on most Unix-like systems. Detects available software on the target and runs an appropriate payload. Usage 1. Listen for connection On your machine, open up a port and listen on it...

dwipe

dwipe dwipe is a tool to wipe disks and partitions for Linux to help secure your data. dwipe aims to reduce mistakes by providing ample information about your devices during selection. Quick Comparison Feature| dwipe| nwipe| shred| dd ---|---|---|---|--- Firmware wipes SATA/NVMe secure erase| ✓| ...

CVE-2021-3560_Polkit

CVE-2021-3560 Polkit Local Privilege Escalation .--. .-" "-. .--. / .. / .-. .-. / .. \ | | '| / Y \ |' | | | \ \ \ 0 | 0 / / / | \ '- ,.-" "-./, -' / '-' / ^ ^ \ '-' .--'| . ./ |'--. / \ \ / / \ / '. '---' .' \ / '---' \ / \ An automated exploit for the CVE-2021-3560 vulnerability affecting...

dirtypipe2

dirtypipe2 Linux Kernel 5.8 5.15.25 - Local Privilege Escalation DirtyPipe 2 Exploit Author: Antonius w1sdom github : https://github.com/bluedragonsecurity web : https://www.bluedragonsec.com tested on : linux kernel 5.13.0-21-generic compiled on lubuntu 20.04.5 linux lubuntu 20.04.2 - linux kern...

CVE-2021-3560

CVE-2021-3560 Polkit - Local Privilege Escalation Original discovery by kevinbackhouse from GitHub Security Lab References https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/ https://www.youtube.com/watch?v=QZhz64yEd0g https://ubuntu.com/security/CVE-2021-3560 Blog...

CVE-2021-42008

CVE-2021-42008 Exploiting A 16-Year-Old Vulnerability In The Linux 6pack Driver Reference https://syst3mfailure.io/sixpack-slab-out-of-bounds...

Platypus

Platypus A host management hub for fleets of Linux machines. Install the Platypus agent on every host you own; the agent dials back to your Platypus server over TLS + protobuf; from the server you get an interactive shell, file management, and network tunnelling on every managed host — through on...

penelope

Penelope is a modern shell handler for penetration testers and CTF players. It provides a more capable alternative to basic netcat listeners, adding automatic PTY upgrades, session management, logging, file transfers and helper modules. Table of Contents 📥 Installation ⚙️ Features 🖥️ Session...

fireELF

fireELF fireELF is a opensource fileless linux malware framework thats crossplatform and allows users to easily create and manage payloads. By default is comes with 'memfdcreate' which is a new way to run linux elf executables completely from memory, without having the binary touch the harddrive...

bpflock

bpflock - Lock Linux machines bpflock - eBPF driven security for locking and auditing Linux machines. Note: bpflock is currently in experimental stage , it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. Sections 1. Introduction...

check_CVE-2019-3462

Check @Debian and @Ubuntu GNU / Linux for CVE-2019-3462 in APT...

CVE-2022-27666

CVE-2022-27666 This is the exploit for CVE-2022-27666, a vulnerability that achieves local privilege escalation on the latest Ubuntu Desktop 21.10. Our preliminary experiment shows this vulnerability affects the latest Ubuntu, Fedora, and Debian. Our exploit was built to attack Ubuntu Desktop...

goBox

goBox GO sandbox to run untrusted code. goBox uses Ptrace to hook into READ syscalls, giving you the option to accept or deny syscalls before they are executed. Usage Usage of ./gobox: gobox FLAGS command flags: -h Print Usage. -n value A glob pattern for automatically blocking file reads. -y val...

pciem

PCIem A Linux kernel framework enabling synthetic userspace PCIe device emulation. | Documentation What is PCIem? PCIem is a framework that creates virtual PCIe devices in the Linux kernel by leveraging a few novel techniques to populate synthetic cards as legitimate PCI devices to the host OS. T...

januscape

Januscape — Linux KVM/x86 guest-to-host escape tracking site Source for the Januscape patch-status tracker: a single-page site recording which distributions have shipped a fix for the KVM/x86 guest-to-host escape in the Linux kernel. Where the facts live Everything about the bug — CVE IDs, affect...

chef-os-hardening

os-hardening Chef cookbook 1 2 Description This cookbook provides numerous security-related configurations, providing all-round base protection. It configures: Configures package management e.g. allows only signed packages Remove packages with known issues Configures pam and pamlimits module Shad...

copy_fail

copyfail Research Notes CVE-2026-31431 English 简体中文 This repository is a defensive research workspace for studying the Linux copyfail vulnerability tracked as CVE-2026-31431. The goal of this repository is to preserve analysis notes, document impact, and support safe local assessment. It is not...

cve-2018-14634

cve-2018-14634 This is a exploit published for researchers discovered by cloud-based security and compliance solution provider Qualys Affect kernel versions 2.6.x, 3.10.x and 4.14.x To successfully exploit this vulnerability, attackers need to have access to the targeted system and run their...