IoRingReadWritePrimitive

IoRingReadWritePrimitive Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2+ This PoC is using the HackSysExtremeVulnerableDriver. The PoC supports both arbitrary write and arbitrary increment, controlled through a flag passed...

CVE-2026-56129

Description Arbitrary physical memory read/write using Toshiba qiomem.sys from ring 3 only works upto 4GB physical addresses. Driver is distributed via Microsoft Update Catalog. Other variants. Not listed on Microsoft Vulnerable Driver List, no previous CVE alloted. first run acpi.exe to create t...

Windows_LPE_AFD_CVE-2023-21768

CVE-2023-21768 Local Privilege Escalation POC authors: chompie & b33f For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Write primitive works on all vulnerable systems. Usage: WindowsAFDLPECVE-2023-21768.exe where is the process ID in decimal of the...

MSRMapper

MSRMapper BYOVD Manual Mapper for Windows x64 · CVE-2025-8061 Overview MSRMapper is a manual kernel driver mapper for Windows x64 that abuses CVE-2025-8061 in the vulnerable Lenovo driver LnvMSRIO.sys to perform a BYOVD Bring Your Own Vulnerable Driver attack. The project maps a PE64 driver...

Chaos-Rootkit

Chaos-Rootkit Chaos-Rootkit is an x64 Ring 0 rootkit i wrote to better understand kernel internals and rootkit techniques. Gui version Features Hide process: This feature allows you to hide processes from listing tools via DKOM. Elevate specific process privileges : This feature enables you to...

r0ak

r0ak r0ak "roak" is the Ring Zer0 Army Knife -- A Command Line Utility To Read/Write/Execute Ring on for Windows 10 Systems...

CVE-2020-11179-Adreno-Qualcomm-GPU

My independent work from the poc created by P0 researcher Ben Hawkes Original article: https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html My goal is to convert his poc to C, and continue where he left off and turn the poc into either a root shell, or a kernel r/w, a...

Windows_AFD_LPE_CVE-2023-21768

CVE-2023-21768 Local Privilege Escalation POC authors: chompie & b33f 复现文章:hlingxbm For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Write primitive works on all vulnerable systems. Usage: WindowsAFDLPECVE-2023-21768.exe where is the process ID in...

CVE-2021-4204

CVE-2021-4204 Chinese writeup: https://tr3e.ee/posts/cve-2021-4204-linux-kernel-ebpf-lpe.txt For educational/research purposes only. Use at your own risk. Build & Run $ sh buildandrun.sh Build from source... cc -I include -static -w -o exploit exploit.c Start exploit! This might take some while...

r0ak

r0ak r0ak is a Windows command-line utility that enables you to easily read, write, and execute kernel-mode code with some limitations from the command prompt, without requiring anything else other than Administrator privileges. Quick Peek r0ak v1.0.0 -- Ring 0 Army Knife...

page-table-exploitation

page-table-exploitation A demonstration of how page tables can be used to run arbitrary code in ring-0 and lead to a privesc. Uses CVE-2016-7255 as an example...

CVE-2024-0582

Introduction This exploit implements a Dirty Cred attack method to gain unauthorized write access to /etc/passwd. Unlike many similar exploits that create numerous pages or aggressively spray file descriptors, this approach takes a more targeted route to corrupt the necessary kernel structures...

Windows_LPE_AFD_CVE-2023-21768

CVE-2023-21768 Local Privilege Escalation POC authors: chompie & b33f For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Write primitive works on all vulnerable systems. Usage: WindowsAFDLPECVE-2023-21768.exe where is the process ID in decimal of the...

OshoosiClaw

🏹 OpenỌ̀ṣọ́ọ̀sì — OshoosiClaw The Decentralized Immune System for the Modern Endpoint -brightgreen?style=for-the-badge&logo=shield -blueviolet?style=for-the-badge&logo=checkmarx !Baseline Audit Remediatedh...

legion

Legion ZK Auth 🛡️ True Zero-Knowledge Authentication with Hardware-Bound Device Ring Signatures 🎯 What is Legion? Legion is a zero-knowledge authentication system that proves you're authorized without revealing who you are. You prove something based on public data without linking your current...

Windows_MSKSSRV_LPE_CVE-2023-36802

CVE-2023-36802 Local Privilege Escalation POC authors: chompie For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Adapting the exploit to all vulnerable systems is left as an exercise to the reader. Git gud, etc. Usage: WindowsMSKSSRVLPECVE-2023-6802.ex...

CVE-2022-24611

CVE-2022-24611 Details regarding the Z-Wave S0-No-More attack. For a full analysis and report how this works and how to reproduce the findings see the attached PDF file. Short description: Denial of Service attack against S0 and S2 devices tested with the Z- Wave ZW5xx product line, here...

CVE-2025-21333-POC

CVE-2025-21333-POC Proof of Concept that exploits CVE-2025-21333 in vkrnlintvsp.sys not so reliable see Requirements and Limitations section. Under the References section are located very helpful resources for who wants to play with the exploit. A detailed analysis of the vulnerability and the...

CVE-2026-98850

A flaw was found in the Linux kernel's packet socket implementation. An integer overflow occurs in the transmission ring buffer when calculating the total byte count of transmitted frames during a send operation. A local user with raw network privileges can exploit this issue to trigger an intern...

SUSE CVE-2026-98894

In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does...