CVE-2026-31431

🐞 CVE-2026-31431 - Copy Fail A logic flaw in authencesn chained through AFALG and splice into a controlled 4-byte write in the page cache of any readable file on the system. No race condition, no offsets, no compiled payload. The same 732-byte script gains root on every Linux distribution since...

IoRingReadWritePrimitive

IoRingReadWritePrimitive Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2+ This PoC is using the HackSysExtremeVulnerableDriver. The PoC supports both arbitrary write and arbitrary increment, controlled through a flag passed...

CVE-2026-31431-Copy-Fail

CVE-2026-31431: When the Copy Isn’t a Copy and the Failure Comes Too Late Artifacts and scripts for the CopyFail writeup. The deep-dive walkthrough: https://4xura.com/binex/kernel/copy-fail/ Layout proof-of-concept/ contains the primitive-only demos used in the writeup. exploit-scripts/ contains...

GhostLock-GOT-W29

CVE-2026-43499 GhostLock — HUAWEI MatePad Pro 11 GOT-W29 Privilege escalation research on CVE-2026-43499 rtmutex/futex-PI stack UAF, "GhostLock" for the GOT-W29 HarmonyOS 4.0, kernel 4.19.157-perf+. Final Conclusions 1. The vulnerability is real and triggerable : a value-holding PI cycle makes...

kfd

Quick disclaimer: I have no intention of adding offsets for other devices and iOS versions. kfd kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices. It leverages various vulnerabilities that can be exploited to obtain dangling PTEs, which will be...

CVE-2019-9791

Exploit chain for CVE-2019-9791 & CVE-2019-11708 against Firefox 65.0 Works against Firefox 65.0 on windows 64bit. CVE-2019-11708 part is taken from exploit by 0vercl0k: https://github.com/0vercl0k/CVE-2019-11708 The exploit uses CVE-2019-9791 to obtain read/write primitive in content process the...

nginx-rift-private-lab

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This fork extends the original PoC with an ASLR-bypass...

CVE-2025-6554

CVE-2025-6554 This repository contains This repository constructed and proved the addressof and fakeobj primitives, as well as the arbitrary address read/write primitives in V8 sandbox. Reproduce Information Commit: 609a85c2a1bd77d6f6905369f4bc4fcf34c5db09 Command Line: out\x64.release\d8...

RtlHijack

RtlHijack A repository with scripts to demonstrate alternative Read and Write primitives using Rtl functions the unintended way. RtlFillMemory.c RtlFillMemory takes three arguments: a pointer to the destination memory, the number of bytes to write, and a single byte value. Writes only a byte into...

CVE-2022-2639-PipeVersion

CVE-2022-2639 using pipe primitive CVE-2022-2639: Linux kernel openvswitch local privilege escalation. introduced in: e64457191a259537bbbfaebeba9a8043786af96f v3.13 fixed in: cefa91b2332d7009bc0be5d951d6cbbf349f90f8 v5.18 Using pipe-primitive to exploit CVE-2022-2639, so no kaslr leak nor smap sm...

CVE-2022-25636-PipeVersion

CVE-2022-25636 pipe version Using pipe-primitive to exploit CVE-2022-25636, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive...

CVE-2022-0185-PipeVersion

CVE-2022-0185 pipe version Using pipe-primitive to exploit CVE-2022-0185, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive...

SharpWnfSuite

SharpWnfSuite This is the repository for Windows Notification Facility WNF tools. Currently, a C port of the tools in wnfun developed by Alex Ionescu @aionescu and Gabrielle Viala @pwissenlit has been uploaded. When I develop additional tools for Windows Notification Facility, they will be upload...

CVE-2024-4947

CVE-2024-4947 A in-the-wild V8 type confusion bug. This repository contains Analysis and PoCs to escalate this vulnerability to have the same exploit pattern as CVE-2024-12695, Object Hash Reassign. AddressOf / FakeObject Primitives constructed by using the type confusion to assign object hash to...

CVE-2021-22555-PipeVersion

CVE-2021-22555 pipe version Using pipe-primitive to exploit CVE-2021-22555, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive Tested on both Linux 4.15 and Linux 5.8...

Ivanti-Pulse_VPN-Client_Exploit-CVE-2023-35080_Privilege-escalation

Ivanti/Pulse VPN Client Exploit of CVE-2023-35080 leading to a privilege escalation Code related to the exploitation of the CVE-2023-35080 which leverages a write primitive in the Ivanti/Pulse VPN client kernel driver in Windows. The write primitive conducts to a privilege escalation. The exploit...

CVE-2021-28664-PoC

CVE-2021-28664-PoC Mali kbase GPU driver UAF CVE-2021-28664 → kernel arbitrary physical memory read/write primitive PoC skeleton. Targets generic ARM64 Android platforms, independent of any specific vendor or device model. Research scope stops at "kernel arbitrary physical memory read/write...

extra_recipe

// ianbeer kernel arbitrary read/write exploit for CVE-2017-2370 for iOS 10.2 Only tested on iPod Touch 6G 14C92 - other devices/firmwares will not work out of the box! the bug machvoucherextractattrrecipetrap is a mach trap which can be called from any context. It's brand new code, added in iOS...

CVE-2026-31431

copy.fail — AFALG AEAD splice primitive CVE-2026-31431 Overview This project is a C port of the original Python prototype, by offsecguy. It leverages the Linux kernel crypto API AFALG using: authencesnhmacsha256,cbcaes AEAD mode MSGMORE flag splice system call The technique feeds data from a...

copyfailautopatch

copyfailautopatch Detect and optionally mitigate CVE-2026-31431 "Copy Fail" on a Linux host. The vulnerability is a page-cache write primitive reachable through the AFALG socket family using the authencesnhmacsha256,cbcaes AEAD transform. This script reproduces the same primitive Theori...