CVE-2025-32463

README - sudo-chwoot.sh 描述 此脚本是一个概念验证（PoC），演示了一种利用 sudo 中理论漏洞（例如 CVE-2025-32463）的权限提升技术。 该 PoC 通过利用 -R（chroot）功能和自定义的 nsswitch.conf 配置，强制 sudo 加载一个被操纵的 .so 库。 注意：此脚本仅用于研究或在受控环境中测试。不得在生产系统或非自己拥有或管理的机器上执行。 目标 创建一个包含自定义 NSS 配置的临时环境。 在 chroot 结构中注入一个 .so 库。 使用 sudo -R 强制加载该库，并以高权限执行命令。 主要修改...

dlinject

dlinject.py Inject a shared library i.e. arbitrary code into a live linux process, without ptrace. Inspired by Cexigua and linux-inject, among other things. Usage root@kitploit: .. . | /| | || || / | .. / | | | | |/ \ | |/ / \ \ \ | \ | |/|| /| |\ \ | /| // | / /| / / /|| / source:...

nasm_linux_x86_64_pure_sharedlib

NASM Linux x8664 純粋（依存関係なし）共有ライブラリ .so 「Reflective SO injection」でテスト済み。リフレクティブプログラミングの概念を用いて、メモリからホストプロセスへのライブラリのロードを実行するライブラリインジェクション手法です。 https://github.com/infosecguerrilla/ReflectiveSOInjection Reflective ELF SO インジェクション Linux x8664 インジェクタのダウンロードとコンパイル root@kitploit: git clone...

POC-IngressNightmare-CVE-2025-1974

IngressNightmare CVE-2025-1974 のPOC 以下を基に開発: https://github.com/yoshino-s/CVE-2025-1974 https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities 口で言うのは簡単だ。コードを見てください。 詳細は https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities をご覧ください。 使用方法 1. shell.c 内のIPアドレスを変更する 2...

linux_injector

linuxinjector Un semplice iniettore di librerie condivise senza ptrace per Linux x64. Uso linuxinjector modalità 1. dlopen normale 2. memfd + dlopen per l'iniezione in container 3. shellcode grezzo pid ID del processo target. È necessario avere i diritti ptrace su di esso richiesto per accedere a...

CVE-2021-34398

NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared libraries into the DCGM server, which is usually running as root, which may lead to privilege escalation, total loss of confidentiality and integrity, and complete denial of...

CVE-2021-34398

CVE-2021-34398 affects NVIDIA DCGM (all versions before 2.2.9) with a vulnerability in the DIAG module that allows a user to inject shared libraries into the DCGM server, which typically runs with root privileges. This can lead to privilege escalation, complete loss of confidentiality and integri...

IBM DB2 - Shared Library Injection

source: https://www.securityfocus.com/bid/8346/info IBM DB2 ships with a number of shared libraries, stored in a directory owned by the user and group 'bin'. As setuid root utilities are linked to these libraries, their ownership by a user and group of a lower privilege level constitutes a...