Linux-for-a-Pentester

🐧 Linux for a Pentester 💀 "Theory is great, but the shell is where the magic happens." This repository is a curated collection of Linux command notes built from real-world labs, CTFs, and hands-on practice. No fluff, just the raw commands and practical notes needed for a Pentester. 📂 Repository...

CVE-2026-12166_CVE-2026-12167_CVE-2026-12168

Multiple Local Privilege Escalation Vulnerabilities in Little Orbit GFAC Driver GFACSysx64.sys | ---|--- CVE IDs| CVE-2026-12166, CVE-2026-12167, CVE-2026-12168 Vendor| Little Orbit Product| GamersFirst Anti-Cheat GFAC Driver GFACSysx64.sys Affected Versions| No version information is embedded in...

Lockdoor-Framework

Lockdoor v2.3 ⚠️ This project is not maintained anymore. ⚠️ Find more at https://g.co/kgs/TtYRJJP Table of contents Table of contents Changelog 📌 : Badges 📌 : Support me 💰 : Contributors ⭐ : Versions 06/2021 : 2.3 03/2020 : 2.2.3 Blogs & Articles 📰 : Overview 📙 : Features 📙 : Pentesting Tools...

CVE-2019-13272

CVE-2019-13272 Linux local root exploit Linux 4.10 5.1.17 PTRACETRACEME local root CVE-2019-13272 In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtai...

CVE-2023-3460

CVE-2023-3460 The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This script perform an exploit for this vulnerability and scan different...

DavRelayUp

DavRelayUp A quick and dirty port of KrbRelayUp with modifications to allow for NTLM relay from webdav to LDAP in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Force start the WebClient service 2. Start webdav relay...

DiagSpill

DiagSpill CVE-2026-74469 Writeup !WARNING The PoC is provided solely to help defenders, maintainers, and authorized security teams validate patches, mitigations, detections, and exposure on systems they own or are explicitly authorized to test. You are solely responsible for ensuring that your us...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

CVE-2022-25365

CVE-2022-25365 The privilege escalation vulnerability in Docker Desktop for Windows reference: https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-1 File list poc.py Coded by followboy1999 createsymlink.exe...

CVE-2023-27326

Parallels Desktop VM Escape This repository contains an exploit for a Parallels Desktop vulnerability which has been assigned CVE-2023-27326. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. The exploit was tested on Parallels Deskto...

CVE-2026-24294

CVE-2026-24294 - Local NTLM Reflection LPE via SMB Arbitrary Port Local privilege escalation on Windows Server 2025 via NTLM reflection, abusing the SMB arbitrary port feature introduced in Windows 11 24H2 / Server 2025. Vulnerability Windows 11 24H2 / Server 2025 introduced an SMB client feature...

CVE-2026-41651-analysis

CVE-2026-41651 — Pack2TheRoot Analysis PackageKit Local Privilege Escalation TOCTOU Race Condition CVSS v3.1: 8.8 HIGH | CWE-367 | Published: 2026-04-22 📌 Overview This repository compiles a personal analysis report and research material on the PackageKit local privilege escalation vulnerability...

sqlite-fj-using-auth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-fj-using-auth sqlite-fj-using-auth Class: Privilege leftover Reach: Local SQLite 3.53.4 b09c88c / SOURCEID 2026-07-24 19:02:57 bf7c7f30031888f4e796e429ab3978879485813aaca6f641c7b33e4e09459bcc - Hwaci lookupName...

CVE-2025-68921

CVE-2025-68921 A local privilege escalation vulnerability exists in Nahimic, an audio enhancement software pre-installed on many gaming laptops. The issue allows a low-privileged user to escalate privileges to NT AUTHORITY\SYSTEM . This vulnerability was reported to Lenovo PSIRT, tracked as...

CVE-2022-3910

CVE-2022-3910 1. dirtycred exp: t1dpoc README.md: CVE-2022-3910 and DirtyCred: Analysis of Linux Privilege Escalation Vulnerability 2. cross-cache exp: t1dexp README.md: CVE-2022-3910 Analysis-2...

SdoKeyCrypt-sys-local-privilege-elevation

SdoKeyCrypt.sys - Local Privilege Elevation Vulnerability 1. What is SdoKeyCrypt.sys? SdoKeyCrypt.sys is a keyboard protection driver for a MMORPG, aka Massively-Multiplayer-Online-Role-Playing-Game, called MapleStory Online which is published by Shanda Group in China. The game's official website...

proftpd-sftp-copy-file-write

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · proftpd-sftp-copy-file-write proftpd-sftp-copy-file-write Class: Privilege leftover / File write Reach: Remote ProFTPD 1.3.9d f59f248 - proftpd.org contrib modsftp advertises copy-file once SFTPEngine is on...

CVE-2026-62183

CVE-2026-62183 — Apache Syncope user self-service privilege escalation Improper Privilege Management CWE-269 in Apache Syncope. An authenticated, low-privilege user can grant themselves arbitrary roles and group memberships, external resources, and a new realm through the user self-service API —...

CVE-2026-6018-9-Local-Privilege-Escalation-Chain

CVE-2025-6018 + CVE-2025-6019: Local Privilege Escalation Chain Target OS: openSUSE Leap 15.x / SUSE Linux Enterprise 15.x Required access: Unprivileged local user with SSH access Result: Full root shell Overview This document details the manual exploitation of two chained local privilege...

DirtyAH6

DirtyAH6 CVE-2026-80844 Writeup !WARNING The PoC is provided solely to help defenders, maintainers, and authorized security teams validate patches, mitigations, detections, and exposure on systems they own or are explicitly authorized to test. You are solely responsible for ensuring that your use...