Dirty-Pipe-Oneshot

Dirty-Pipe-Oneshot CVE-2022-0847（又名 Dirty Pipe）的编译版本。只需一击即可获得 root 权限 :D 只需编译 cve-2022-0847.c 文件 gcc cve-2022-0847.c -o getroot 然后在目标机器上执行并获取 root 权限 :D ./getroot /etc/passwd 1 ootz: 祝你 Root 愉快 🎭...

dirty-pipe

脏管道 - CVE-2022-0847 这是 Max Kellermann 针对 CVE-2022-0847（即 Dirty Pipe）利用漏洞的代码和使用说明。 请访问 https://dirtypipe.cm4all.com/ 了解更多关于该漏洞的工作原理！ 如何使用 1. 下载并编译漏洞利用二进制文件 git clone https://github.com/0xIronGoat/dirty-pipe.git cd dirty-pipe gcc exploit.c -o exploit 2. 在目标上运行该二进制文件 ./exploit /etc/passwd 1 "$$cat...

CVE-2022-0847

CVE-2022-0847 直接移除root账户密码的CVE-2022-0847漏洞利用程序 使用方法： 1. gcc cve-2022-0847.c -o exploit 2. ./exploit 需求： gcc 工作原理简介： Max Kellermann的传统经典漏洞利用POC用于添加一个具有root权限的用户，但在此POC利用程序中，它通过修改/etc/passwd文件 root❌0:0:root:/root:/bin/bash 来移除root账户的密码。 代码相关细节： 我为此写了一篇博客，请阅读。...

CVE-2023-22809

CVE-2023-22809 Analysis & Exploit 基本状況 脆弱性番号：CVE-2023-22809 脆弱性レベル：高リスク 脆弱性スコア：7.8点 影響バージョン：sudo 1.8.0-sudo 1.9.12p1sudo=1.8.0 or sudo =1.9.12p1 攻撃効果：ローカル権限昇格 攻撃手法 /etc/passwd内のrootをユーザー名に変更する（exppasswd.shを参照） /etc/sudoersを編集して、ユーザーXがパスワードなしで任意の操作を実行できるようにする（expsudoers.shを参照）...

RootRemover

!WARNING 仅限在您拥有或已获授权测试的系统上使用。 RootRemover CVE-2026-31431 临时移除 root 密码，利用 CVE-2026-31431 在不获知当前用户密码的情况下，实现与架构无关的提权至 root。 请负责任地使用，仅在您获授权测试的系统上使用。此方法是否受您的系统支持会有所不同，但在我测试过的每个 Debian 衍生版上都有效。 本 PoC 的基础原理本质上是将 /etc/passwd 中您的 UID 替换为全 0，从而有效地赋予您 root 权限。而本方法改为移除 root 的密码，因此当您运行 su 时可立即获得...

CVE-2026-12503

Improper Link Resolution CWE-59 in /usr/bin/larmstarter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated larmapp attacker to make /etc/passwd writable by the larmapp group leading to root privilege escalation via a symlink attack on...

CVE-2026-15809

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

PT-2026-31313

Name of the Vulnerable Software and Affected Versions Red Hat Process Automation Manager affected versions not specified Description A container privilege escalation flaw exists due to group-writable permissions on the /etc/passwd file during image build time. An attacker executing commands withi...

CVE-2025-8766 Noobaa-core: excessive permissions of /etc could lead to escalation of privilege in the noobaa-core container

A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container,...

EUVD-2020-12559

Malware in sbrugna...

EUVD-2020-12563

Malware in sbrugna...

SUSE CVE-2020-1705

A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/template-service-broker-operator. An attacker with access to the container could use this...

CVE-2019-19354

An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges...

Design/Logic Flaw

A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. This restricted shell can be bypassed after changing the properties of the user admin in the operating...

CVE-2019-19346

An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before the following 4.3.5, 4.2.21, 4.1.37, and 3.11.188-4 . An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their...

Unspecified Vulnerability in Red Hat OpenShift Container Platform openshift/mediawiki

Red Hat OpenShift Container Platform is a suite of application platforms from Red Hat that enable organizations to develop, deploy and manage existing container-based applications across physical, virtual and public cloud infrastructures. A security vulnerability exists in version 4.x.x of...

CVE-2020-1707

A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container openshift/postgresql-apb. An attacker with access to the container could use this flaw to modify /etc/passwd and...

PT-2020-10147 · Red Hat · Openshift/Ocp-Release-Operator-Sdk +2

Name of the Vulnerable Software and Affected Versions: openshift/ocp-release-operator-sdk affected versions not specified openshift/ansible-operator-container as shipped in Openshift 4 affected versions not specified Description: An insecure modification vulnerability in the /etc/passwd file was...

CVE-2019-19351

An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges...

Exploit for Race Condition in Canonical Ubuntu_Linux

This is a PoC exploit for CVE-2016-5195, a vulnerability in the Linux kernel that allows for a local privilege escalation. The exploit is implemented in C++ and has been ported to Go and a legacy version without C++11 features. The exploit modifies the /etc/passwd file, forcing the password...