pagecache-lpe-containment-kit

Page-Cache LPE Containment Kit Detect, contain, and verify defenses against two Linux page-cache-corruption local privilege escalations — DirtyClone CVE-2026-43503 and pedit COW CVE-2026-46331 — on hosts and containers. This is an educational, defensive security kit. It explains how both...

PoC-in-GitHub

PoC in GitHub 2026 CVE-2026-0006 2026-03-02 In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

AutoLocalPrivilegeEscalation

AutoLocalPrivilegeEscalation An automated script that download potential exploit for linux kernel from exploitdb, and compile them automatically This script is created due to Hackademics, there are so much possible exploit for that version of kernel, as a rookie OSCP student, I am not able to fin...

EvilOSX

EvilOSX An evil RAT Remote Administration Tool for macOS / OS X. Marco Generator by Cedric Owens This project is no longer active Features Emulate a terminal instance Simple extendable module system No bot dependencies pure python Undetected by anti-virus OpenSSL AES-256 encrypted payloads...

AV-EDR-Killer

AV/EDR Killer https://github.com/user-attachments/assets/1eda3340-2af2-4136-b74e-be7a3f4b3924 This project demonstartes how a legit, and signed driver can be weponized to gain kernel level access. 🚨 The vulnerable driver: wsftprm.sys , signed by TPZ SOLUCOES DIGITAIS LTDA, and previously exposed ...

RegPwnBOF

RegPwn BOF Cobalt Strike BOF port of the RegPwn exploit by Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. This is a sloppy BOF reimplementation of the original C exploit. All credit for the vulnerability research and exploit goes to Filip Dragovic and MDSec. Blog post :...

CVE-2026-123037

A flaw exists in the ansible-core user module where the User.ssh_key_gen() function improperly handles symlinks when generate_ssh_key is enabled. While it guards individual key files, it only verifies the ~/.ssh directory using os.path.exists(). An unprivileged user on a managed node can replace ...

CVE-2021-1675

CVE-2021-1675 - PrintNightmare LPE PowerShell Caleb Stewart | John Hammond | July 1, 2021 CVE-2021-1675 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare." Proof-of-concept exploits have been released Python, C++ for the remote code execution...

SMBGhost-LPE-Metasploit-Module

SMBGhost-LPE-Metasploit-Module This is an implementation of the CVE-2020-0796 aka SMBGhost vulnerability, compatible with the Metasploit Framework Notes: This module made to be used when you have a valid shell to escalate your privileges. You can change the payload, if you want to have your custo...

Exploit-Chain-CVE-2025-6018-6019

https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt This exploit chains CVE-2025-6018 and CVE-2025-6019 to achieve local privilege escalation from an unprivileged user to root on vulnerable SUSE/openSUSE systems. CVE-2025-6018 is a PAM Pluggable Authentication Modules environment variabl...

dirtyfrag

Dirty Frag: Universal Linux LPE Abstract This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim @v4bel, which can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write CVE-2026-43284 vulnerability and the...

CVE-2023-5178

CVE-2023-5178 The exploit for CVE-2023-5178: NVMe-oF-TCP vulnerability, which is a logic error in NVMe-oF-TCP driver during the handle of corrupted Initialize Connection Request. It leads to racy double-free in kmalloc-96 , which can be exploited to gain LPEsee demo below. The exploit targets...

CVE-2026-112109

A flaw was found in SafeNet Authentication Client SAC. An authenticated local user can trigger a heap-based buffer overflow through the SACSrv service interface. Successful exploitation may allow arbitrary code execution with elevated Local System privileges, resulting in local privilege...

juicy-potato

Juicy Potato abusing the golden privileges A sugared version ofRottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM Summary RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS...

Sudo-Chroot

Description: Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. Local Privilege Escalation by sudo-chroot -R...

CVE-2026-43494

🛠️ PinTheft — CVE-2026-43494 Local Privilege Escalation in Linux Kernel via RDS + iouring Page Cache Overwrite 📌 Overview PinTheft is a sophisticated local root exploit for CVE-2026-43494 , a reference-counting bug in the Linux kernel's Reliable Datagram Sockets RDS subsystem. By combining a...

CVE-2018-1000001

glibc - 'getcwd' Local Privilege Escalation Attention: All rights to the exploit writer. I have just compiled and organized a repository for this CVE. CVE: 2018-1000001 Alias: RationalLove exploit-debian - Exploit compiled in debian x64 exploit-ubuntu - Exploit compiled in ubuntu x64 Am I...

DavRelayUp

DavRelayUp A quick and dirty port of KrbRelayUp with modifications to allow for NTLM relay from webdav to LDAP in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Force start the WebClient service 2. Start webdav relay...

KrbRelay

KrbRelay Relaying 3-headed dogs. More details at https://googleprojectzero.blogspot.com/2021/10/windows-exploitation-tricks-relaying.html and https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html This should be working on most fully patched Windows systems...

Important: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...