linux_injector

linuxinjector A simple ptrace-less shared library injector for x64 Linux. Usage linuxinjector mode 1. normal dlopen 2. memfd + dlopen for injecting into containers 3. raw shellcode pid Target process id. Must have ptrace rights to it required for accessing /proc/$pid/mem. Not ptraced, so another...

LibTP_Gadget

LibTPGadget This is a generalisation of https://github.com/AlmondOffSec/LibTPLoadLib to proxy APIs with an arbitrary number 11 max actually, but good enough of arguments. Provided as a Crystal Palace shared library. API made compatible with @rasta-mouse's LibTP for easy switch using spec files...

CVE-2021-3156

CVE-2021-3156 PoC Introduction This is an exploit for the CVE-2021-3156 sudo vulnerability dubbed Baron Samedit by Qualys. Usage build: $ make list targets: $ ./sudo-hax-me-a-sandwich run: $ ./sudo-hax-me-a-sandwich manual mode: $ ./sudo-hax-me-a-sandwich Bruteforce target finding experimental Ma...

CVE-2015-0235-workaround

CVE-2015-0235-workaround aka GHOST glibc vulnerability A shared library wrapper with additional checks for the vulnerable functions gethostbyname2r and gethostbynamer . The proper solution for CVE-2015-0235 is to upgrade glibc to at least glibc-2.18. In some cases, an immediate glibc upgrade is n...

CVE-2025-32463

CVE-2025-32463 Exploit Overview This repository provides a Go-based exploit tool for CVE-2025-32463 , a critical local privilege escalation vulnerability CVSS 9.3 in sudo versions 1.9.14 to 1.9.17. It allows unauthorized local users to gain root access by exploiting a flaw in the --chroot -R...

CVE-2024-48990

CVE-2024-48990 Exploit for CVE-2024-48990 Local Privilege Escalation in needrestart 3.8 Background Read https://blog.qualys.com/vulnerabilities-threat-research/2024/11/19/qualys-tru-uncovers-five-local-privilege-escalation-vulnerabilities-in-needrestart. Qualys does a great job explaining it. TLD...

cve-2025-32463

cve-2025-32463 chroot sudo chroot Execute the command in the selected dir name. Principle This issue was introduced in sudo v1.9.14, which upgraded the matching handling code when the chroot feature is used. This new change modifies the root directory id before matching execution of the chroot...

exploit-CVE-2017-7494

SambaCry RCE exploit for Samba 4.5.9 Samba is a free software re-implementation of the SMB/CIFS networking protocol. Samba provides file and print services for various Microsoft Windows clients and can integrate with a Microsoft Windows Server domain, either as a Domain Controller DC or as a doma...

CVE-2017-7494_SambaCry

CVE-2017-7494 SambaCry Exploit Exploit SambaCry CVE-2017-7494 to exploit Samba bind shell without Metasploit If you need to change the port, just change line 68 of bindshell-samba.c and recompile: gcc -c -fpic bindshell-samba.c gcc -shared -o libbindshell-samba.so bindshell-samba.o How to exploit...

CVE-2026-3888-PoC

CVE-2026-3888-PoC compile payload gcc -shared -fPIC -o /tmp/libpayload.so payload.c...

CVE-2017-7494

CVE-2017-7494 hello i,am Gihad from Libya 17 C information On Exploit ========================================================================================== This module triggers an arbitrary shared library load vulnerability in Samba versions 3.5.0 to 4.4.14, 4.5.10, and 4.6.4. This module...

CVE-2025-32463_PoC

CVE-2025-32463 NVD CVE-2025-32463 In most cases, GCC is not installed by default on target servers. This proof of concept provides a precompiled version to ensure it can be executed immediately on affected systems. Usage 1. Compile the woot1337.c file: gcc -shared -fPIC -Wl,-init,woot -o...

CVE-2025-32463

README - sudo-chwoot.sh Description This script is a proof of concept PoC that demonstrates a privilege escalation technique exploiting a theoretical vulnerability in 'sudo' e.g. CVE-2025-32463. The PoC forces 'sudo' to load a manipulated .so library by leveraging the '-R' chroot functionality an...

LibTP

LibTP A shared Crystal Palace library for proxying Nt API calls via the Threadpool. Credits Raphael Mudge, Adversary Fan Fiction Writers Guild Chetan Nayak, Dark Vortex...

CVE-2021-4034

Proof of Concept PoC: CVE-2021-4034 PwnKit Note: This repository and its content are part of a Final Degree Project FDP, created solely for educational purposes and academic research. Description This repository contains a proof of concept PoC for the CVE-2021-4034 vulnerability, also known as...

CVE-2018-1207-better

Exploit PoC for CVE-2018-1207: Dell iDRAC7/iDRAC8 RCE Reverse Shell This repository contains a Proof of Concept python script to demonstrate a remote code execution exploit present in iDRAC7 and iDRAC8 devices with firmware versions 2.52.52.52 and below. This exploit allows attacks to run code as...

dlinject

dlinject.py Inject a shared library i.e. arbitrary code into a live linux process, without ptrace. Inspired by Cexigua and linux-inject, among other things. Usage .. . | /| | || || / | .. / | | | | |/ \ | |/ / \ \ \ | \ | |/|| /| |\ \ | /| // | / /| / / /|| / source:...

CVE-2021-4034

Python3 code to exploit CVE-2021-4034 PWNKIT. This was an exercise in "can I make this work in Python?", and not meant as a robust exploit. It Works For Me, there are problaby bugs. The default payload starts a shell as root, generated from msfvenom: msfvenom -p linux/x64/exec -f elf-so...

Blackash-CVE-2025-32463

CVE-2025-32463 Local Privilege Escalation to Root via Sudo chroot in Linux 🛑 Here's a summary of CVE-2025-32463 without links: 🔍 Vulnerability Overview CVE-2025-32463 is a local privilege escalation vulnerability in Sudo versions 1.9.14 through 1.9.17. It abuses the --chroot -R option by...

CVE-2021-4034-PwnKit-

CVE-2021-4034 PwnKit - Analysis and Exploitation This repository contains the source code to demonstrate the exploitation of the CVE-2021-4034 vulnerability, also known as PwnKit , discovered in pkexec part of the Polkit package. This flaw allows local privilege escalation to root through the use...