CVE-2026-47215

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...

CVE-2026-47215

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...

EUVD-2026-78779

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...

CopyFail-CVE-2026-31431

CopyFail: CVE-2026-31431 Python による copy.fail の実装です。AFALG + splice を介して setuid-root バイナリのページキャッシュを上書きし、root を取得します。競合状態もオフセットも不要で、2017 年以降のあらゆる Linux ディストリビューションで動作します。 要件 Python 3.6+ 3.12+ は os.splice をネイティブに使用、それ以前のバージョンは ctypes にフォールバック Linux カーネルが authencesnhmacsha256,cbcaes に対応していること。ない場合:...

CVE-2022-37706

CVE-2022-37706 概述 CVE-2022-37706 是一个本地权限提升 LPE 漏洞，存在于 Linux 的 Enlightenment 桌面环境的 enlightenmentsys 组件中。该漏洞允许具有低权限的本地用户在易受攻击的系统上将权限提升为 root。 CVE ID: CVE-2022-37706 严重性: High CVSS v3.1: 7.8 攻击向量: Local 受影响组件: enlightenmentsys CWE: CWE-269 Improper Privilege Management 描述 该漏洞的产生原因是二进制文件...

CVE-2021-4034

CVE-2021- polkit의 pkexec 유틸리티에서 로컬 권한 상승 취약점이 발견되었습니다. pkexec 애플리케이션은 미리 정의된 정책에 따라 권한이 없는 사용자가 권한 있는 사용자로 명령을 실행할 수 있도록 설계된 setuid 도구입니다. 현재 버전의 pkexec는 호출 매개변수 개수를 올바르게 처리하지 않으며, 환경 변수를 명령어로 실행하려고 시도합니다. 공격자는 환경 변수를 조작하여 pkexec가 임의 코드를 실행하도록 유도함으로써 이를 악용할 수 있습니다. 성공적으로 실행되면 이 공격은 로컬 권한 상승을 유발하여...

CVE-2026-31431

🔥 CVE-2026-31431 - "复制失败 ！！!" 一个出奇简单却又致命的 Linux 内核本地提权漏洞 📌 概述 CVE-2026-31431 （别名 "复制失败" ）是 Linux 内核加密子系统中的一个本地提权漏洞，具体影响 algifaead 接口。 未授权的本地用户可利用此漏洞对系统中 任意可读文件 （包括 setuid 二进制文件）的页缓存执行 受控的 4 字节写入 ，最终实现 以 root 权限执行任意代码 。 🛠️ 根因 该漏洞由 2017 年的提交 72548b093ee3（"crypto: algifaead - support in-place...

ctf

CTF Related stuff Table of Contents The challs are linked in the table below. Description| Event/Game| Solution ---|---|--- Smash The Stack| ---| --- Blackbox| Level 1| An exe with a "login" functionality with the password in plain text in the memory. Blackbox| Level 2| An exe with setuid for...

CVE-2025-24118

TRAVERTINE CVE-2025-24118 설명서: https://jprx.io/cve-2025-24118 사용법 root@kitploit: gcc TRAVERTINE.c -o travertine chgrp everyone travertine chmod g+s travertine ./travertine...

CVE-2021-41091

CVE-2021-41091 このエクスプロイトは、CVE-2021-41091 のセキュリティ脆弱性について詳しく解説し、エクスプロイトスクリプトを利用してホスト上で権限昇格を達成するための手順を段階的に説明します。 脆弱性の概要 CVE-2021-41091 は Moby（Docker Engine）の欠陥で、権限の制限が適切でないため、特権のない Linux ユーザーがデータディレクトリ（通常は /var/lib/docker）内を移動し、プログラムを実行できるようになります。この脆弱性は、コンテナ内に setuid...

Vulnerable-Docker-Engine

CVE-2021-41091 이 익스플로잇은 CVE-2021-41091 보안 취약점에 대한 심층 분석을 제공하며, 호스트에서 권한 상승을 달성하기 위해 익스플로잇 스크립트를 활용하는 방법에 대한 단계별 가이드를 제공합니다. 취약점 요약 CVE-2021-41091은 MobyDocker Engine의 결함으로, 부적절하게 제한된 권한으로 인해 권한이 없는 Linux 사용자가 데이터 디렉터리일반적으로 /var/lib/docker에 위치를 탐색하고 프로그램을 실행할 수 있습니다. 이 취약점은 컨테이너에 setuid와 같은 확장 권한이 ...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

CVE-2026-82429

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

CVE-2021-3156

CVE-2021-3156 PoC 소개 이것은 Qualys가 Baron Samedit이라고 명명한 CVE-2021-3156 sudo 취약점에 대한 익스플로잇입니다. 사용법 빌드: root@kitploit: $ make 대상 목록: root@kitploit: $ ./sudo-hax-me-a-sandwich 실행: root@kitploit: $ ./sudo-hax-me-a-sandwich 수동 모드: root@kitploit: $ ./sudo-hax-me-a-sandwich 무차별 대입 대상 찾기 실험적 GNU parallel이...

CVE-2023-42931

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 우리는 테러 단체 하마스에 의해 인질로 잡힌 모든 시민의 안전한 귀환을 요구합니다. 모든 인질이 석방되어 안전하게 집으로 돌아올 때까지 우리는 쉬지 않을 것입니다. 여러분도 그들을 집으로 데려오는 데 도움을 줄 수 있습니다.https://stories.bringthemhomenow.net/ macOS 권한 상승 익스플로잇 💻 이 PoC는 다음 기사를 기반으로 작성했습니다:...

CVE-2026-82429

Apache Storm's setuid-root worker-launcher binary contains a time-of-check, time-of-use (TOCTOU) race: it walks worker directory trees with FTS to classify entries, then calls lchown and chmod on the full pathname of each entry while running as root. Because the walked trees are owned and writabl...

EUVD-2026-77528

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

CVE-2026-82429 Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime that emphasizes simplicity, robustness, and portability. A bug was discovered in Containerd where container root directories and certain plugins had insufficiently restricted permissions, allowing unprivileged Linux users to access the contents of...

Astra Linux - Vulnerability in Golang-1.19

On Unix platforms, the Go runtime behaves differently when a binary is run with the setuid/setgid bits enabled. This can be dangerous in certain situations, such as when dumping memory state or assuming the status of standard I/O file descriptors. If a setuid/setgid binary is executed with standa...