prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

vibebox

an ultrafast, open-source sandbox for running coding agents safely. English | 简体中文 VibeBox is a per-project micro-VM sandbox for running coding agents on macOS Apple Virtualization Framework. It’s optimized for a daily-driver workflow: fast warm re-entry, explicit mounts, and reusable sessions. W...

K000164212: Buildah vulnerability CVE-2024-1753

Security Advisory Description A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source...

Exploit for CVE-2026-87772

CVE-2026-87772 — Pardus About Local Privilege Escalation A pa...

DriverJack

DriverJack Introduction DriverJack is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. To...

CVE-2023-0386-libs

Install compilation environment sudo apt install -y gcc libfuse-dev pkg-config Compile exploit gcc -Wall CVE-2023-0386.c pkg-config fuse --cflags --libs -DFILEOFFSETBITS=64 -o CVE-2023-0386-exp -static -lfuse Generate shellcode msfvenom -p linux/x86/exec CMD=/bin/sh PrependSetuid=True -f elf -o...

util-linux: TOCTOU in the mount program via ancestor directory swap on target path

When an /etc/fstab entry is configured with the user or users option, mount8 validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use TOCTOU window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that...

Important: Red Hat Security Advisory: util-linux security update

An update for util-linux is now available for Red Hat Enterprise Linux 9.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2025-6019

CVE-2025-6019: libblockdev Local Privilege Escalation Vulnerability Summary CVE-2025-6019 is a local privilege escalation LPE vulnerability discovered in the libblockdev library, which interacts with the udisks2 daemon and Polkit. Vulnerability Description A local attacker with allowactive Polkit...

docker_cve-2015-2925

Docker + CVE-2015-2925 = escaping from --volume Recent vulnerability in Linux known for about half of the year several months publicly made it possible to escape from bind mounts. In particular in case of Docker it's possible to escape from inside the directory mounted via --volume option to the...

CVE-2025-9074

CVE-2025-9074 – Docker Desktop Windows Container→Host Write via Exposed Engine API Author: w01f Status: Proof-of-Concept educational / authorized testing only Overview This project demonstrates a PoC for CVE-2025-9074 , a misconfiguration/exposure in certain versions of Docker Desktop for Windows...

CVE-2023-0386

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalat...

CVE-2025-9074

Description Vibe coded a small exploit script in pure Bash without dependencies on tools that might not be installed. The script talks to the internal Docker API, creates and starts a new container, mounts the host C drive and then executes a command inside that. The output is streamed back to th...

rtty_CVE-2025-56708-CVE-2025-56709

CVE-2025-56708&CVE-2025-56709 【CVE-2025-56709】savepath Buffer Overflow Vulnerability Overview In rtty totalsize = ctx-remainsize = bufferpullu32beinfo; ment = findmountpointsavepath; if ment uint64t avail; if !strcmpment-mnttype, "ramfs" struct sysinfo si; if sysinfo&si logerr"download file fail:...

CVE-2026-124746

A flaw was found in BusyBox. An integer overflow occurs in the volumeid component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by...

CVE-2026-124746

A flaw was found in BusyBox. An integer overflow occurs in the volumeid component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by...

CVE-2026-124746

A flaw was found in BusyBox. An integer overflow occurs in the volumeid component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by...

vulnerable-container-hub

The OWASP Vulnerable Container Hub Project Background There are many repositories out there to provide vulnerable environments such as web applications, containers or virtual machines to those who want to learn security, since it helps not only students or someone who recently joined the field to...

subpath-exploit

Sample Kubernetes Escape via CVE-2017-1002101 Description After hearing about the issue and following this guide, I wanted to explore things a bit more. This repo contains a couple pod deployments and helper shell scripts that demonstrate the attack mechanism in the simplest way possible so that...

CVE-2022-23648-POC

PoC for CVE-2022-23648 This is a proof of concept for @fel1x's CVE-2022-23648. Disclosure info here, CVE info here and a blog with some more information and mitigation ideas here. The Containerfile has the info. needed, and you can change the target of the VOLUME to try out different paths. Easie...