FortiLPE

Description Local privilege escalation PoC exploit for CVE-2025-62676 / EUVD-2025-206993 that targets FortiClient VPN running on Windows. Executes a payload in the context of SYSTEM from a normal user context via an arbitrary XML file write. The PoC has been tested against FortiClient version 7.4...

Dirty-Pipe-CVE-2022-0847

This repository does not have a README...

Penetration-Test

Penetration-Test Full penetration test report against IP Ubuntu VM. Attack chain: directory enumeration → backup file discovery → password cracking → CMS file upload → reverse shell → kernel privilege escalation Dirty Pipe, CVE-2022-0847. Repository Structure /report – Final penetration test repo...

CVE-2020-11493

CVE-2020-11492 Proof-of-Concept PoC for Docker Desktop for Windows privilege escalation vulnerability. This vulnerability was patched in Docker version 2.3.0.2 on May 11th, 2020. This PoC performs the following: creates a named pipe mimicking docker named pipe \.\pipe\dockerLifecycleServer, call...

CVE-2022-0847-dirty-pipe-checker

This repository does not have a README...

CVE-2023-36664-Ghostscript-command-injection

Ghostscript command injection vulnerability PoC CVE-2023-36664 Vulnerability disclosed in Ghostscript prior to version 10.01.2 leads to code execution CVSS score 9.8. Official vulnerability description: Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the...

CVE-2022-24924

Improper access control vulnerability in LiveWallpaperService CVE-2022-24924SVE-2021-24089 Windows version tested: Windows 10 20H2 Build 19042.1348 64bit Live Wallpaper Version: 3.0.9.0 or earlier There is a LiveWallpaperService that works by default in Samsung laptops, but there was a...

CVE-2022-0847

DirtyPipe Exploit for the DirtyPipe vulnerability written, and discovered by Max Kellermann - https://dirtypipe.cm4all.com/ POC...

CVE-2024-0311

CVE-2024-0311 ? これは、私が思うに CVE-2024-0311 および SB10418 の PoC です。 悪意のある内部関係者は、有効なリリースコードなしに Skyhigh Client Proxy の既存ポリシーをバイパスできます。 詳細は多め。エクスプロイト強め。 ¯\ツ /¯ この PoC は、ユーザーが実行した SCPBypass.exe プロセスにインジェクションし、SCPService.exe のパイプ \.\pipe\MCPTrayPipe0 に書き込みを行います。パイプが RW Everyone であっても、WGUARDNT...

exploit-CVE-2017-7494

SambaCry RCE exploit for Samba 4.5.9 Samba is a free software re-implementation of the SMB/CIFS networking protocol. Samba provides file and print services for various Microsoft Windows clients and can integrate with a Microsoft Windows Server domain, either as a Domain Controller DC or as a doma...

RPC-Backdoor

RPC Backdoor Emulation This project is a basic implementation of an "RPC Backdoor" meant to emulate TTPs used by certain groups. The project contains an RPC server with five functions: Execute a command with cmd.exe /c and the CreateProcess API call. Steal a token and execute a command with cmd.e...

CVE-2022-0847-Exploit-Implementation

CVE-2022-0847 エクスプロイト実装 これは、CVE-2022-0847「Dirty Pipe Exploit」を使用して、外部マシン上で任意のコード実行を行うためのリバースBashシェルを起動する方法を示すPOCです。 この脆弱性はLinuxカーネルバージョン5.8以降にのみ影響しますが、バージョン5.16.11、5.15.25、5.10.102以降で修正されました。カーネルを更新してください : このエクスプロイトはセキュリティ研究者のMax...

dirtyPipe-automaticRoot

Dirty Pipe automatic root exploit CVE-2022-0847 Dependencies: Python 3.10 or above How to use: Automatic root: $ python3.10 dirtyPipe.py -a + hjacking super user in /etc/passwd + dropipng shell Write a no write permission, immutable or read-only mounted file: $ python3.10 dirtyPipe.py -w FILE...

dirty-pipe

This repository does not have a README...

CVE-2022-0847-Container-Escape

CVE-2022-0847 CVE-2022-0847 used to achieve container escape overwrite any read-only files on host Slides in Chinese available here 利用CVE-2022-0847 Dirty Pipe 实现容器逃逸（效果为覆写宿主机上任意只读文件） 中文汇报PPT在这里 Introduction If the kernel is vulnerable to CVE-2022-0847, the attacker can overwrite read-only files...

CVE-2022-0847

CVE-2022-0847 exploit of CVE-2022-0847 which directly remove password of the root account Usage: 1. gcc cve-2022-0847.c -o exploit 2. ./exploit Requrements: gcc Work summery: The traditional classic exploit POC of Max Kellermann used to add a user with root privilage but in this POC exploit, It...

Dirty-Pipe-Oneshot

Dirty-Pipe-Oneshot Compiled version of CVE-2022-0847 aka Dirty Pipe. Just one shot to root them all :D just comple the cve-2022-0847.c file gcc cve-2022-0847.c -o getroot then execute it on the victim & get root :D ./getroot /etc/passwd 1 ootz: Happy Rooting 🎭...

CVE-2022-0847-DirtyPipe-Exploits

This repository does not have a README...

inject-assembly

inject-assembly - 기존 프로세스에서 .NET 실행 이 도구는 Cobalt Strike의 전통적인 fork and run 실행 방식에 대한 대안입니다. 로더는 현재 Beacon을 포함한 모든 프로세스에 주입될 수 있습니다. 오래 실행되는 어셈블리는 계속 실행되며, execute-assembly의 동작과 유사하게 출력을 Beacon으로 다시 보냅니다. inject-assembly는 두 가지 구성 요소로 이루어져 있습니다: 1. BOF initializer : 인수와 함께 원격 프로세스에 어셈블리 로더를 주입하는 소형...

DirtyPipe

Dirty Pipe Exploit: CVE-2022-0847 The Dirty Pipe vulnerability, also known as CVE-2022-0847, is a significant flaw within the Linux kernel. This repository provides an adapted version of the widely used exploit code to make it more user-friendly and modular. A very good explanation of this...