CVE-2019-2215

CVE-2019-2215 PoC for old Binder vulnerability based on P0 exploit Description A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the...

CVE-2023-1326-PoC

CVE-2023-1326-PoC A proof of concept for CVE-2023–1326 in apport-cli 2.26.0 This vulnerability is privilege escalation in apport-cli 2.26.0, similar to CVE-2023–26604, this vulnerability only works if assign in sudoers: A privilege escalation attack was found in apport-cli 2.26.0 and earlier whic...

Review.CVE-2021-3156

👑 CVE-2021-3156 Baron Samedit — Privilege Escalation via Heap Overflow in sudo 📅 Date: 2025-06-08 ✍️ Author: @TopskiyPavelQwertyGang 🧠 Security Researcher | Red Team Enthusiast 🧠 CVE Overview CVE-ID: CVE-2021-3156 Type: Heap-based Buffer Overflow Component: sudoedit sudo Access Level: Local Goal:...

CVE-2021-3156

CVE-2021-3156 sudoのヒープオーバーフローによるLPE（ローカル権限昇格）、Go製 blasty氏のエクスプロイトに基づく...

CVE-2025-26125

Description The PoC program exploits the IMFForceDelete driver which exposes an ioctl that allows unprivileged users to delete files and folders. We can turn this into a privilege escalation by using a technique explained by ZDI and Halov, which exploits the MSI rollback mechanism which is design...

Ubuntu-GameOver-Lay

UbuntuP-GameOverLay Using CVE-2023-2640 CVE-2023-3262 to escalate previlege CVE 2023-2640 https://nvd.nist.gov/vuln/detail/CVE-2023-2640 On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs. xattrs", an unprivileged user may se...

CVE-2019-1388

CVE-2019-1388 guest→システム（UAC手動権限昇格、gif画像は少し遅いのでお待ちください 参考リンク http://www.svenbeast.com/post/OsMblUp6w/ https://github.com/Lz1y/imggo...

vss-fr2system

vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...

CVE-2025-34077

CVE-2025-34077 — WordPress Pie Register ≤ 3.7.1.4 - 管理者権限昇格 認証不要 💀 作成者 Mrj Haxcore 🧠 脆弱性の概要 WordPress用プラグイン Pie Register バージョン ≤ 3.7.1.4 は、認証不要のエンドポイントを公開しており、攻撃者は特定のペイロードをPOSTするだけで管理者セッションを乗っ取る ことができます。 この悪用により、ログイン資格情報を一切必要とせずに、ユーザーID 1通常は admin のセッションCookieを窃取 できます。 📦 影響を受けるソフトウェア プラグイン名: Pie...

CVE-2023-38646

CVE-2023-38646 Fork ofkh4sh3i's removing the need for Burp Collector. CVE-2023-38646 Pre-Auth RCE in Metabase: Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication ...

CVE-2025-60710

CVE-2025-60710 This is PoC for local privilege escalation vulnerability in \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task. When this scheduled task is started the taskhostw.exe process whill try to open the C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP directory...

CVE-2024-26229

CVE-2024-26229 Windows CSC サービスの特権昇格の脆弱性。 プログラムがバッファの処理能力を超えるデータを書き込むと、ヒープベースのバッファオーバーフローが発生し、余分なデータが隣接するメモリ領域にあふれ出します。このオーバーフローはメモリを破損させ、攻撃者が任意のコードを実行したり、システムに不正にアクセスしたりする可能性があります。本質的には、攻撃者はオーバーフローを引き起こす悪意のあるコードや入力を作成し、影響を受けるシステムを制御したり、任意のコマンドを実行 したり、マルウェアをインストールしたり、機密データにアクセスしたりできます。...

CVE-2019-1253

CVE-2019-1253 MSRCに送信した元のPoC。 この問題は2019年9月のPatch Tuesdayの定例アップデートで修正されました。 CVE-2019-1253 - Windowsの特権昇格の脆弱性として割り当てられました。 https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1253 2つのPoCがあります。最初にMSRCに送信したものは"AppxExploitEdge"ディレクトリにあります。...

CVE-2026-76178 Multiple vulnerabilities in Ocsreports for OCS Inventory NG

A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...

CVE-2019-15511

GOG Galaxy Exploit for CVE-2019-15511 root@kitploit: usage: exploit.py -h --action LaunchElevatedRequest,FixDirectoryPrivilegesRequest,CreateDirectoryRequest,QueryProcessInfoRequest,InstallServiceRequest,DeleteServiceRequest,MoveAndVerifyGlobalDependencyRequest target positional arguments: target...

CVE-2019-11932

CVE-2019-11932 The system address and the gadget must be replaced by the real address found by an information disclosure vulnerability. After replacing the system address and the gadget. Run the code to generate the malicious GIF file: root@kitploit: notroot@osboxes:/Desktop/gif$ make...

CVE-2025-50505

CVE-2025-50505 Unauthorized API Leads to Arbitrary Command Execution and Privilege Escalation in Clash Verge Rev Description The vulnerability stems from an unauthenticated API endpoint exposed by the clash-verge-service component, which is installed with elevated privileges by default. This flaw...

MagiskEoP

Introduction This is an exploit for a vulnerability CVE-2024-48336 in Magisk app that allows a local app to silently gain root access without user consent. Vulnerability was initially reported by @vvb2060 and PoC-ed by @canyie. It has been fixed in Canary 27007. Demo video for exploit this...

CVE-2023-20198-RCE

Fofa root@kitploit: body="window.onload=function url ='/webui';window.location.href=url;" && ishoneypot=false && isfraud=false Usage root@kitploit: usage: CVE-2023-20198-RCE.py -h -u URL -p PROXY -au ADDUSER -ap ADDPASS -du DELUSER -pm PRIVILEGEMODE -em EXPLOITMODE -oc OSCMD -cc CLICMD...

PySQLRecon

PySQLRecon PySQLRecon is a Python port of the awesome SQLRecon project by @sanjivkawa. See the commands section for a list of capabilities. Post demonstrating SCCM TAKEOVER-1 with PySQLRecon. Install PySQLRecon can be installed with pip3 install pysqlrecon or by cloning this repository and runnin...