pe-signgen

pe-signgen Cross-version binary signatures and RVA offsets for Windows PE functions Overview pe-signgen is a tool for reverse engineers and security researchers that automatically generates: Binary signatures byte patterns with wildcards for unexported and exported functions RVA and file offsets...

cve-2018-12386

Firefox Sandboxed RCE Exploit CVE-2018-12386 Here is a simple exploit for the vulnerability CVE-2018-12386 found by Niklas Baumstark, Samuel Groß and Bruno Keith. This is mostly a PoC I did for fun, there is no sandbox bypass and it will only work on a given Linux setup where the offsets used by...

dezlock-dump

dezlock-dump Extracts everything from a running Source 2 game Deadlock, CS2, Dota 2 and generates a patch-proof C++ SDK that resolves offsets at runtime. No hardcoded values, no manual updates when the game patches. Quick Start 1. Download from Releases or build from source 2. Launch your game —...

darksword-kexploit

DarkSword Kernel Exploit Objective-C で再実装されました。 iOS 15.0 - 26.0.1 をサポートする予定です。 オフセットは 15.x? 用にハードコードされています。 注: このエクスプロイトは私が発見/リークしたものではなく、リークの元のソースは https://github.com/htimesnine/DarkSword-RCE です。 このエクスプロイトは CELLEBRITE とはまったく関係なく、私が自由時間のひとつの午後に書いたものです。エクスプロイトロジックはすべて元のリポジトリからのものです iOS 15...

how2heap

Educational Heap Exploitation This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc you are using...

rmx3888-cve-2026-43499-config

CVE-2026-43499 realme RMX3888 向けエクスプロイト設定 デバイス情報 ブランド/モデル : realme RMX3888 Android バージョン : 16 SDK 36 ビルド ID : BP2A.250605.015 カーネル : Linux 6.1.141-android14-11-o-gffc54a6d2287 SoC : Qualcomm SM8650 Snapdragon 8 Gen 3 アーキテクチャ : ARM64 aarch64 概要 このリポジトリには、realme RMX3888 デバイスを対象とした CVE-2026-43499...

CVE-2022-22057_SM-F926U

포크 SM-F926U용으로 원본 익스플로잇 여기에서 가져와 적응시킨 것입니다. 익스플로잇을 발견하고 SM-F926U로 이식하여 사용 가능하게 만드는 데 필요한 모든 질문에 극도로 인내심을 가져주신 m-y-mo 님께 큰 감사를 드립니다. 시작 데몬libtimeline.so을 Shizuku의 코드를 기반으로 추가했습니다. 임시 루트 솔루션이 안정적 이 되도록 하는 더티 트릭을 추가했습니다아래 참조. 면책: 저는 파괴된 기기, 데이터 손실, 데이터 도난, 기기 보안에 대해 책임을 지지 않습니다. 면책 2: 저는 개발자가 아니라 전문...

-CVE-2018-0834-aab-aar

샤우트아웃 @reubensammut, 넌 진짜 대단해 G. CVE-2018-0834 완전한 코드 실행. 정적 오프셋 포함, cfg, dep, aslr 우회 : 즐겨...

netbsd_hfs

NetBSD hfs 로컬 오버플로우 버그 세부 정보: sizet hfslibreadanodeoffsetsvoid inbytes, uint16t outoffsetarray void ptr; if inbytes == NULL || outoffsetarray == NULL return 0; ptr = inbytes; / The offset for record 0 which is the very last offset in the node is always equal to 14, the size of the node descriptor...

Linux Distros Unpatched Vulnerability : CVE-2026-85532

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CP...

PT-2026-103129

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

ntoskrnl-metadata

ntoskrnl-metadata Windows ntoskrnl.exe 이진 파일에서 중요 커널 메타데이터를 추출하기 위한 IDA Python 스크립트입니다. 이 도구는 CVE-2026-40369 및 기타 커널 취약점을 대상으로 하는 익스플로잇 개발에 필요한 함수 RVA와 EPROCESS 구조체 오프셋을 자동으로 추출합니다. 목적 이 도구는 익스플로잇 페이로드에 하드코딩해야 하는 버전별 커널 메타데이터를 자동으로 추출하여 CVE-2026-40369 에 대한 성공적인 익스플로잇을 컴파일하는 데 도움을 줍니다. 추출된 값은 다양한...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE 익스플로잇 MWR Labs 작성 c 2018 세부사항 이 개념 증명 익스플로잇은 macOS 10.13.3 17D47의 Safari 11.0.3 13604.5.6 버전만을 대상으로 합니다. 원하는 페이로드를 생성자와 함께 dylib로 컴파일하십시오. python filetojsarray.py your.dylib payload.js 실행 이 디렉토리를 서비스하고 Safari를 /exploit.html로 지정하십시오. 익스플로잇은 완전히 신뢰할 수 없으...

CVE-2026-73638

Imager versions from 0.4502 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiffloadifd. tiffloadifd validates an IFD entry's data by checking that entry-offset + entry-size stays within the EXIF block, and never checks the start offset itself. Where that sum is n...

CVE-2026-48977

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parselevel0xml processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memo...

Astra Linux – Vulnerability in sane-backends

A out-of-bounds read in SANE backends before version 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, also known as GHSL-2020-083...

Astra Linux – Vulnerability in sane-backends

A out-of-bounds read in SANE backends before version 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, also known as GHSL-2020-081...

Astra Linux – Vulnerability in sane-backends

A out-of-bounds read in SANE backends before version 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, known as GHSL-2020-082...

Linux Distros Unpatched Vulnerability : CVE-2026-79592

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read vulnerability exists in the xlsdumpSummary function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets...

DEBIAN-CVE-2026-79592

An out-of-bounds read vulnerability exists in the xlsdumpSummary function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets...