CVE-2022-0847_dirty-pipe

CVE-2022-0847 / Dirty Pipe Hacked up Dirty Pipe CVE-2022-0847 PoC that hijacks a SUID binary to spawn a root shell. and attempts to restore the damaged binary as well Score CVSS : 7.8 HIGH A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper...

CVE-2021-4034

CVE-2021-4034 January 25, 2022 | An00bRektn This is a golang implementation of CVE-2021-4034 based on read as: blatantly stolen from clubby789's implementation of the vulnerability discovered by Qualys. I made a blog post going into further detail about the vulnerability, mainly for myself, but f...

CVE-2019-7192_QNAP_Exploit

QNAP Pre-Auth Root RCE CVE-2019-7192 CVE-2019-7195 Exploit for now, you can read system files /etc/shadow, ssh private key, etc. Usage: pip install -r requirements.txt or just pip install requests python3 gundy.py https://vulnerableurl:port Sample Output Vulnerability The vulnerabilities can be...

IDiagnosticProfileUAC

IDiagnosticProfileUAC Just another UAC bypass using auto-elevated COM object Virtual Factory for DiagCpl 12C21EA7-2EB8-4B55-9249-AC243DA8C666. This COM object can be used to create instance of DiagnosticProfile D0B7E02C-E1A3-11DC-81FF-001185AE5E76 COM object which exposes SaveDirectoryAsCab metho...

CVE-2021-4034-Rust

CVE-2021-4034-Rust Linux LPE using polkit-1 written in Rust. Build instructions Install rust if you haven't already git clone https://github.com/deoxykev/CVE-2021-4034-Rust cd CVE-2021-4034-Rust rustup target add x8664-unknown-linux-musl cargo build --release Vuln Check check for pkexec which...

printnightmare-detection-lab

PrintNightmare Threat Detection & Incident Response Lab CVE-2021-34527 📌 Overview This project documents an end-to-end security monitoring, detection engineering, and incident response implementation targeting PrintNightmare CVE-2021-34527. PrintNightmare is a critical vulnerability in the Window...

copy-fail-go

Copy Fail - CVE-2026-31431 - golang version ⚠️ WARNING: This program is highly dangerous and experimental. Manual cleanup is required to clear the exploit. Use at your own risk! Technical Writeup original repo run check /usr/bin/su before run: user@pc:$ hexdump -n 300 -x /usr/bin/su 0000000 457f...

CVE-2023-23397-POC

CVE-2023-23397-POC Exploit POC for CVE-2023-23397 Appointment.cs : the modified file from https://github.com/Sicos1977/MsgKit/blob/master/MsgKit/Appointment.cs Exploit.cs : the code i used to replicate creating the malicious appointment . i modified the code picture in MDSEC article here :...

pwnkit-scanner

PwnKit Scanner Check CVE-2021-4034 vulnerability This test is not 100% reliable, but it helps with a quick scan. How to use Linux Debian based systems: wget https://raw.githubusercontent.com/codiobert/pwnkit-scanner/main/pwnkit-scanner-debian.sh -q -O - |bash How to use Linux Red Hat based system...

PegasusX

PegasusX OS X 10.11.6 LPE PoC for CVE-2016-4655 / CVE-2016-4656 CVEs Analysis & Writeup A detailed analysis of the CVEs used in this PoC is available here: Analysis and exploitation of Pegasus kernel vulnerabilities CVE-2016-4655 / CVE-2016-4656...

CVE-2025-65900

CVE-2025-65900: Kalmia CMS v0.2.0 - is vulnerable to Incorrect Access Control Vulnerability Overview CVE ID: CVE-2025-65900 Product: DifuseHQ Kalmia CMS Affected Version: 0.2.0 Vulnerability Type: Incorrect Access Control Privileges Required: Low Read-only user account Impact This vulnerability...

CVE-2026-21017-LDAP-Anonymous-Bind-Privilege-Escalation

CVE-2026-21017 – LDAP Anonymous Bind Privilege Escalation Program Code Python ldap3 sim ldapanonsim.py - LDAP server allowing anonymous bind with write access from ldap3 import Server, Connection, ALL Simulated: real server would be misconfigured server = Server'ldap://localhost:389', getinfo=ALL...

pkexec-lpe-poc

pkexec-lpe-poc POC for CVE-2021-4034 Original Writeup For ease of use, it accepts a C file payload instead of a hardcoded shell. usage: make ./poc payload.c tested on Ubuntu 20.04.3 LTS - Linux target 5.4.0-81-generic...

CVE-2021-4034

CVE-2021-4034 A simple proof-of-concept for CVE-2021-4034 pkexec local privilege escalation. Based on the excellent summary by our friends at Qualsys. How do? 1. Clone this repository onto a machine with a vulnerable version of pkexec. 2. ./run.sh 3. Shenanigans...

CVE-2021-29441

CVE-2021-29441 Usage: CVE-2021-29441.exe ip Alibaba Nacos unauthorized account addition...

Compiled-PoC-Binary-For-CVE-2023-28252

Compiled PoC Binary For CVE-2023-28252 The repo contains a precompiled binary which can be run on a Windows machine vulnerable to CVE-2023-28252 The precompiled binary is a slightly modified version of the PoC exploit seen in fortra's repo. The file can be run with the following arguments:...

CVE-2021-4034

CVE-2021-4034 This is an exploit created for CVE-2021-4034 meant as a POC. It is based off the info at https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt. How to use it: Download the exploit folder. Compile prog.c with gcc prog.c Go to the GCONVPATH=. folder and ensure that the "code" fil...

CVE-2021-4034-Pwnkit

CVE-2021-4034 PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec CVE-2021-4034 https://seclists.org/oss-sec/2022/q1/80...

CVE-2021-4034-POC

CVE-2021-4034-POC POC for pwnkit vulnerability discovered by Qualys. Compile & execute: gcc lpe.c -o lpe; ./lpe Creates the following directory/file structure: /tmp ├── GCONVPATH=. │ └── test ├── payload.c ├── payload.so ├── test │ └── gconv-modules References...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Golang go

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Golang go which can result in an Out-of-bounds Read, Infinite Loop, or Improper Validation condition. Golang go is used in our Speech utilities. These vulnerabilities have been addressed. Please read the details for...