CVE-2020-0041

CVE-2020-0041 This repository contains code for exploiting CVE-2020-0041, a bug we reported to Google in Decmeber 2019 and was fixed in the Android Security Bulletin from March 2020. You can find the sandbox escape exploit in sandbox/. The analysis of the bug and exploitation approach can be foun...

CVE-2023-42931

CVE-2023-42931 The exploit targets a LPE works on macOS 14.0-14.1.2, 13.0-13.6.2, 12.0-12.7.1 Usage chmod +x PoC.sh ./PoC.sh Credit This exploit is based on research from the original article: Local Privilege Escalating my way to root through Apple macOS filesystems. License This project is...

CVE-2026-24061

CVE-2026-24061 - telnetd auth bypass What it's about Argument injection in telnetd from GNU InetUtils. Versions 1.9.3 to 2.7. CVSS 9.8. On the CISA KEV list since 26.01.2026, meaning it's actively exploited in the wild. The whole trick is that telnetd takes the value of the USER environment...

FluxER

🔒 FluxER Fluxion Easy Runner for Termux Automated installer and launcher for Fluxion - a wireless security auditing toolkit for WPA/WPA2 testing and network analysis in Termux environments. 🎯 Features Automated Setup : One-command installation of Ubuntu proot and Fluxion Optimized for Termux :...

EPScalate

EPScalate An elevation of privilege vulnerability in QuickHeal's Seqrite Enterprise Endpoint Security Solution EPS. The vulnerability has been assigned a CVE ID of CVE-2023-31497. https://user-images.githubusercontent.com/39941993/230790056-87157751-b96c-49a6-81df-bf3126acfbd6.mp4 Vendor and...

CVE-2019-8561

CVE-2019-8561 Proof of concept exploit for CVE-2019-8561 discovered by Jaron Bradley @jbradley89 Patched in macOS 10.14.4. This script exploits a TOCTOU bug in installer which enables code execution as root. See Jaron's Objective By the Sea v2 talk "Bad Things in Small Packages" where he...

ctf

CTF Related stuff Table of Contents The challs are linked in the table below. Description| Event/Game| Solution ---|---|--- Smash The Stack| ---| --- Blackbox| Level 1| An exe with a "login" functionality with the password in plain text in the memory. Blackbox| Level 2| An exe with setuid for...

TempRoot-Huawei

TempRoot-Huawei Temporary root for Huawei hardened kernel via CVE-2019-2215 This code is written for P20 Pro CLT-AL00, and kernel offset is taken from firmware with build fingerprint: 'HUAWEI/CLT-AL00/HWCLT:8.1.0/HUAWEICLT-AL00/176C00:user/release-keys' Background Like Samsung's KNOX, Huawei adde...

copy-fail-CVE-2026-31431

CVE-2026-31431 Copy Fail exploit Author: pyroceper Tested on: Ubuntu 25.10 x8664 $ make $ ./exploit Detected kernel: 6.17.0 Making backup of /etc/passwd to /tmp Backup saved as /tmp/passwd.bak Obtaining root shell... id uid=0pwn gid=0root groups=0root whoami pwn CREDITS & REFERENCES: Original...

CVE-2021-38647

CVE-2021-38647 CVE-2021-38647 - POC to exploit unauthenticated RCE OMIGOD on Azure UNIX/Linux VMs! Details In Microsoft's Azure, the OMI application gets installed automatically when services like Azure Automation Accounts, Update Management, Log Analytics, Configuration Management, etc., are use...

asus-cmd

ASUS Router infosvr UDP Broadcast root Command Execution Several models of ASUS's routers include a service called infosvr that listens on UDP broadcast port 9999 on the LAN or WLAN interface. It's used by one of ASUS's tools to ease router configuration by automatically locating routers on the...

AutomatedRoot

AutomatedRoot Root MediaTek devices using mtk-su exploit CVE-2020-0069. Requirements Python 3.9 or newerin %PATH% for Windows. ADB in %PATH% for Windows. The CVE-2020-0069 PoC mtk-su. Usage Download the mtk-su binaries from the MediaTek's SU XDA page and move them to their corresponding folders...

hyperfox

Hyperfox Hyperfox is a security auditing tool that proxies and records HTTP and HTTPS traffic between two points. Installation You can install the latest version of hyperfox to /usr/local/bin with the following command requires admin privileges: curl -sL...

Audit-BlackBox-Web-to-Root

Pentest Lab: Web and System Exploitation Chain Drupal to Root Disclaimer This project was carried out in a controlled and isolated laboratory environment for educational and academic purposes. No real infrastructure was targeted. The goal is to learn how to secure systems by understanding attack...

dirty-frag-check

Dirty Frag check CVE-2026-43284 / CVE-2026-43500 Read-only checker for the "Dirty Frag" Linux kernel local-root vulns CVE-2026-43284, CVE-2026-43500. Checks kernel version, module state, KernelCare livepatch, and any modprobe blacklist you've added. Doesn't run exploit code. Companion to...

CoreTrustDemo

Demo for Linus Henze's CoreTrust bug CVE-2022-26766, CoreTrust allows any root certificate See https://worthdoingbadly.com/coretrust/ for usage...

avdroot

avdroot Root an Android Studio emulator by patching its ramdisk with Magisk — in pure Go. English · 简体中文 avdroot takes an AVD from a cold start to a working root shell with one command. Everything happens on the host: the ramdisk is decompressed, rewritten so Magisk's init replaces /init, and re...

FortiSandbox-RCE-Exploit-CVE-2026-39808

FortiSandbox RCE Scanner — CVE-2026-39808 Unauthenticated OS Command Injection as root in Fortinet FortiSandbox Vulnerability • Installation • Usage • How It Works • Pipeline • Shodan Dorks • Disclaimer Vulnerability CVE-2026-39808 is a critical unauthenticated OS command injection vulnerability ...

CVE-2024-25832-PoC

CVE-2024-25830 and CVE-2024-25832 - DataCube3 Improper Access Control and Unrestricted File Upload. Overview This repository features a Proof of Concept PoC for a two-step exploit chain targeting DataCube3 devices. It combines CVE-2024-25830 Improper Access Control to extract root passwords and...

cve-2014-0038

Local root exploit for CVE-2014-0038 Bug: The X86X32 recvmmsg syscall does not properly sanitize the timeout pointer passed from userspace. Exploit primitive: Pass a pointer to a kernel address as timeout for recvmmsg, if the original byte at that address is known it can be overwritten with known...