MitigationToolkit-ROSN-LR5-Full

🧬 ROSN-LR5 – مجموعة أدوات PoC لتصعيد الامتيازات على مستوى النواة والتخفيف CVE-2026-31431 أداة هجومية ودفاعية لثغرة CVE-2026-31431 في أنظمة Linux. تجمع بين إثبات مفهوم لتصعيد الامتيازات المحلية LPE وأدوات لفحص وتخفيف مؤقت لمتجه الهجوم القائم على AFALG. ⚖️ للاستخدام الأخلاقي حصريًا : يتم توزيع هذا...

docker-socket-risk-demos

docker-socket-risk-demos Repositorio complementario para el vídeo: Deja de montar docker.sock — Ejecuta Trivy sin ceder acceso root — inspirado en CVE-2026-33634 https://www.youtube.com/watch?v=xLTYzfPY3xI Este repositorio contiene la aplicación web de ejemplo y el prompt de Claude Code utilizado...

CopyFail-CVE-2026-31431

CopyFail: CVE-2026-31431 Implementación en Python de copy.fail. Sobrescribe la caché de páginas de un binario setuid-root mediante AFALG + splice para obtener root. Sin condiciones de carrera, sin offsets; funciona en cualquier distribución de Linux desde 2017. Requisitos Python 3.6+ 3.12+ usa...

CVE-2022-20186

CVE-2022-20186 익스플로잇 라이트업은 여기에서 확인할 수 있습니다. 이는 2022년 1월에 제가 보고한 Arm Mali 커널 드라이버의 버그입니다. 이 버그를 이용하면 신뢰할 수 없는 앱 도메인에서 임의의 커널 코드 실행 권한을 얻을 수 있으며, 이를 통해 SELinux를 비활성화하고 루트 권한을 획득할 수 있습니다. 익스플로잇은 Google Pixel 6에서 테스트되었으며 2021년 11월부터 2022년 2월까지의 패치 레벨을 지원합니다. 몇 가지 이미지 오프셋만 변경하면 다른 펌웨어에 대한 지원을 쉽게 추가할 수...

YAPS

YAPS - O tro S hell P HP m ás Sí, como el nombre lo revela, este es otro shell reverso PHP, uno más entre cientos disponibles, pero con algunas ventajas. Es un solo archivo PHP que contiene todas sus funciones y puedes controlarlo a través de un simple listener TCP por ejemplo, nc -lp 1337. En la...

CVE-2026-0163-EXP

CVE-2026-0163 DESCARGO DE RESPONSABILIDAD Este repositorio es solo con fines educativos y de investigación. El autor no es responsable de ningún uso indebido, daño o actividad ilegal causada por el uso de este material. Úselo bajo su propio riesgo. Respete las leyes aplicables y las pautas éticas...

CVE-2013-2094

CVE-2013-2094 Linux 2.6.32/2.6.37 - 3.8.10 PERFEVENTS root local x86/x8664 sem backconnect...

CVE-2020-0041

CVE-2020-0041 Questo repository contiene codice LPE per sfruttare CVE-2020-0041 implementato da bluefrostsecurity come rilasciato su https://github.com/bluefrostsecurity/CVE-2020-0041/tree/master/lpe . L'approccio di sfruttamento per questa parte si trova su...

CVE-2025-27591-below-

CVE-2025-27591 – Escalata dei privilegi in Below 1 Introduzione Below è uno strumento Linux per registrare e visualizzare dati di sistema come l'utilizzo hardware e le metriche dei cgroup. Nelle versioni precedenti alla v0.9.0 , il servizio systemd di Below viene eseguito con privilegi root e cre...

CVE-2026-53694-NoMachine-LPE

CVE-2026-53694 : Élévation de privilèges locale dans NoMachine par injection d'arguments Aperçu Ce dépôt contient le rapport et la preuve de concept PoC pour CVE-2026-53694, une vulnérabilité d'élévation de privilèges locale LPE dans NoMachine pour Linux. En raison d'une neutralisation incorrecte...

CVE-2026-20217

ZendTo 6.15-8 / RCE ClamAV con profilo esatto e riproduzione della variante root Questa directory è un bundle autonomo di riproduzione per laboratorio autorizzato della catena di esecuzione di codice senza account da ZendTo a ClamAV e della sua continuazione separata Smarty/cron-root con profilo...

parallels-file-move-privesc

parallels-file-move-privesc Este repositório contém um exploit para CVE-2023-50226 / ZDI-CAN-21227, que pode ser usado para escalar privilégios para root usando o Parallels Desktop em versões anteriores a 18.3.2...

CVE-2023-0386-go-poc

PoC in Go di CVE-2023-0386 ./main /tmp/fuse Esegue il programma e crea un mount fuse sulla directory "/tmp/fuse". Presuppone che tu abbia compilato la shell nella directory root con il nome "shell" di default. Dopo aver eseguito il programma, dovrebbe esserci un binario eseguibile nella directory...

EPScalate

EPScalate Una vulnerabilità di escalation dei privilegi nella soluzione Seqrite Enterprise Endpoint Security EPS di QuickHeal. Alla vulnerabilità è stato assegnato l'ID CVE CVE-2023-31497. https://user-images.githubusercontent.com/39941993/230790056-87157751-b96c-49a6-81df-bf3126acfbd6.mp4 Dettag...

pentesting-obioba

pentesting-obioba Pentesting Blackbox: Shellshock CVE-2014-6271 + Log4Shell CVE-2021-44228. Root-Eskalation. Executive und technischer Bericht Pentesting Obioba — Sicherheitsaudit Blackbox Projekt des Bootcamp 360° in Cybersicherheit von The Bridge Digital Talent Accelerator 2025-2026. 🎯...

CVE-2026-63343 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The...

CVE-2026-20200

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...

CVE-2026-67599

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...

CVE-2026-67599 ClearOS 7.9 OS Command Injection via Log Viewer filter parameter

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...

EUVD-2026-52409

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...