exrop

Exrop Generador automático de cadenas ROP para binarios x86-64, impulsado por la ejecución simbólica de Triton. Características Establecer registros a constantes u otros registros rdi=0x41414141, rdi=rax Escribir en memoria direcciones/valores basados en constantes y registros Escribir...

exrop

Exrop Automatic ROP chain generator for x86-64 binaries, powered by Triton symbolic execution. Features Set registers to constants or other registers rdi=0x41414141, rdi=rax Write to memory constant and register-based addresses/values Write strings/bytes to memory Function calls with mixed...

CVE-2014-7911poc

CVE-2014-7911 POC for CVE-2014-7911 for Nexus5 Android 4.4.4r1 based on retme7 and auo, use different rop chain Info Usage launch this poc, click the “CVE-2014-7911” button, you will see a pwn.txt created by system user in /data:...

ropium

Acerca de ROPium anteriormente ROPGenerator es una biblioteca/herramienta que facilita la creación de exploits ROP. Extrae y analiza automáticamente gadgets de binarios y permite encontrar cadenas ROP con consultas semánticas. ROPium soporta las arquitecturas X86 y X64 , próximamente se ampliará...

PS4-5.05-Kernel-Exploit

PS4 5.05 Kernel Exploit Summary In this project you will find a full implementation of the second "bpf" kernel exploit for the PlayStation 4 on 5.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This exploit also contains...

RustChain

Descripción Esta herramienta es una PoC simple de cómo ocultar artefactos de memoria usando una cadena ROP en combinación con breakpoints de hardware. La cadena ROP cambiará las protecciones de la página de memoria del módulo principal a N/A mientras duerme es decir, cuando se llama a la función...

DeepSleep

DeepSleep Una variante de Gargoyle para x64 para ocultar artefactos de memoria utilizando solo ROP y PIC. Muchas gracias a @waldoirc por documentar gran parte de esta técnica en su blog Esta implementación es diferente porque no utiliza ninguna APC y está completamente implementada como PIC...

ABL_ROP

Updating ABL serial with ROP: When ran this notebook will load ABL and attempt to update the device's serial number via ROP chain to call memmove. Derived from eShard's https://github.com/eshard/pixel6-boot/blob/main/runablpublic.ipynb whilst following along with...

CVE-2020-0022

CVE-2020-0022 vulnerability exploitation on Bouygues BBox Miami Android TV 8.0 - ARM32 Cortex A9 By Polo35 - 2020/08/24 "Usage: python poloexploit.py targetbtmac targetadbip, shellcommand, disablereboot, verbose" Based on scripts by Jan Ruge CVE-2020-0022 an Android 8.0-9.0 Bluetooth Zero-Click R...

ROP_ROCKET

Presentando el ROP ROCKET Este nuevo y avanzado framework ROP debutó en DEF CON 31 con capacidades sin precedentes. ROCKET genera varios tipos de cadenas y proporciona nuevos patrones o técnicas. Tenga en cuenta que esto sigue siendo un trabajo en progreso, con algunas capacidades actualizadas y...

CVE-2014-7911

CVE-2014-7911 基于 retme7 的 Nexus5 Android 4.4.4r1 上的 CVE-2014-7911 POC，使用了不同的 ROP 链 信息 http://ele7enxxh.com/CVE-2014-7911-Detailed-Analysis-Of-Android-Local-Privilege-Escalation-To-System-Vulnerability.html 用法 通过 adb 连接你的手机 root@kitploit: adb push jni/expolit /data/local/tmp adb logcat | grep auo...

Ropper

Ropper Puedes usar ropper para mostrar información sobre archivos binarios en diferentes formatos y puedes buscar gadgets para construir cadenas ROP para diferentes arquitecturas x86/X8664, ARM/ARM64, MIPS/MIPS64, PowerPC/PowerPC64, SPARC64. Para el desensamblado, ropper utiliza el increíble...

CVE-2024-21762

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-21762...

CVE-2014-1303

CVE-2014-1303 Linux PoC CVE-2014-1303 基于堆的WebKit缓冲区溢出 概念验证，针对Linux。 该仓库演示了Linux 上WebKit基于堆的缓冲区溢出漏洞CVE-2014-1303。 用于seccamp讲座。 注意： 原始漏洞利用是针对Mac OS X和PS4 PlayStation4编写的。 我已在Ubuntu 14.04上移植并测试了工作，WebKitGTK 2.1.2 用法 首先，你需要运行一个简单的web服务器， root@kitploit: $ python server.py 然后 root@kitploit: $ cd...

CVE-2025-0282

PoC for CVE-2025-0282 A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways Overview This is a proof of concept exploit to demonstrate exploitation of CVE-2025-0282, and is based upon the exploitation strate...

CVE-2024-0039-Exploit

CVE-2024-0039-Exploit Description Python script for exploiting CVE-2024-0039: arbitrary code execution on vulnerable Android devices. WARNING : This code is intended for educational and constructive purposes only, on the side of good, so to speak! Usage Run the script with the necessary arguments...

CVE-2023-3640

SCTF2023kernelpwn SCTF 2023 kernel pwn Off-topic: A little advertisement — the author is a 2024 undergraduate graduate student, participating in this year's autumn recruitment. Feel free to contact me sycrop This problem aims to test two points. 1. The starting points of the cpu entry area mappin...

CVE-2018-9411

CVE-2018-9411 Exploit code for CVE-2018-9411 for MediaCasService. Note that this exploit is only provided for educational or defensive purposes; it is not intended for any malicious or offensive use. Full write-up for the vulnerability and the exploit is available on the Zimperium blog. If you ha...

CVE-2025-0282

CVE-2025-0282 の PoC Ivanti 製品におけるリモート認証なしのスタックバッファオーバーフロー 概要 この PoC は、以下に影響を及ぼす重大な脆弱性 CVE-2025-0282 の悪用を実証します: Ivanti Connect Secure Ivanti Policy Secure Ivanti Neurons for ZTA gateways watchTowr の調査 に基づき、この PoC は特に Ivanti Connect Secure 22.7r2.4 を対象とした ROP チェーンを使用します。他のバージョンでは、カスタム ROP...

Shelter

Shelter Shelter is a completely weaponized sleep obfuscation technique that allows to fully encrypt your in-memory payload making an extensive use of ROP. This crate comes with the following characteristics: AES-128 encryption. Whole PE encryption capability. Removal of execution permission durin...