mosh

Mosh: the mobile shell Mosh is a remote terminal application that supports intermittent connectivity, allows roaming, and provides speculative local echo and line editing of user keystrokes. It aims to support the typical interactive uses of SSH, plus: Mosh keeps the session alive if the client...

meltdown-exploit

MELTDOWN EXPLOIT POC Speculative optimizations execute code in a non-secure manner leaving data traces in microarchitecture such as cache. Lipp et. al 2018 published their code 2018-01-09 at https://github.com/IAIK/meltdown. Look at their paper for details: https://meltdownattack.com/meltdown.pdf...

CVE-2018-3639-specter-v4-

CVE-2018-3639-specter-v4 spectre v4 : Speculative Store Bypass CVE-2018-3639 proof of concept for Linux build: gcc spectre-v4.cpp -o spectre run: ./spectre result: --------attack-------- low than threshold:155 low than threshold:144 low than threshold:133 low than threshold:0 low than threshold:1...

spectre-attack-demo

Spectre Attack Example Example of using revealed "Spectre" exploit from 2 Jan 2018 CVE-2017-5753 and CVE-2017-5715 Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the...

exploit-cve-2017-5715

Spectre attack Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications...

ghostrace

GhostRace: Exploiting and Mitigating Speculative Race Conditions This repository contains: A minimalistic PoC exemplifying the concept of Speculative Race Condition in a step-by-step single-threaded fashion. Coccinelle scripts used to scan the Linux kernel v5.15.83 for Speculative Concurrent...

SPOILER

SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks CVE-2019-0162 INTEL-SA-00238 https://www.usenix.org/system/files/sec19-islam.pdf @inproceedings 236252, author = Saad Islam and Ahmad Moghimi and Ida Bruhns and Moritz Krebbel and Berk Gulmezoglu and Thomas Eisenbarth and Berk...

spectre-attack-example

Spectre Attack Example January 2, 2018 CVE-2017-5753 and CVE-2017-5715 "Spectre" exploit example What is this? We place the text "The Magic Words are Squeamish Ossifrage." in memory, and then we attempt to read it using the vulnerability. If the system is vulnerable, you will see the same text on...

Jump-over-ASLR-BTB

Branch Predictors & ASLR Author: Byte Reaper Description This repository contains research C implementation that demonstrates concepts related to branch predictors, speculative execution, and cache-based side channels in the context of address space layout randomization ASLR. Requirements : Linux...

CTT-MICROSOFT-OFFICE-OLE-MANIFOLD-BYPASS-CVE-2026-21509

🏛️CTT -Microsoft Office OLE Manifold BYPASS CVE-2026-21509 Standardized CTT Implementation for 1096x Temporal Execution ! 📜 Vulnerability Overview CVE-2026-21509 is a critical bypass in the Microsoft Office OLE Object Linking and Embedding validation engine. While standard "laminar" exploits...

Hardware-Vulnerability-with-Proof-of-Concept-

🛡️ Spectre Variant 2 CVE-2017-5715 — Hardware Vulnerability Research An in-depth research paper and hands-on Proof-of-Concept PoC exploring speculative execution attacks on modern CPUs. 📖 Overview This project is a research and lab-based exploration of Spectre Variant 2 CVE-2017-5715 , also known...

Spectre-PoC

Spectre-PoC Not By Me. Collected from Book. Spectre Attacks: Exploiting Speculative Execution...

In-Spectre-Meltdown

In-Spectre-Meltdown This tool allows to check speculative execution side-channel attacks that affect many modern processors and operating systems designs. CVE-2017-5754 Meltdown and CVE-2017-5715 Spectre allows unprivileged processes to steal secrets from privileged processes. These attacks prese...

CVE-2021-29155

This is the Proof Of Concept code for CVE-2021-29155. The range tracking system for pointer arithmetic in the speculative domain was insufficient. It was possible to extract kernel data via a sidechannel. This is a proof of concept you can read up to 0x5fff bytes out of bounds from the last eleme...

retbleed-speculative-execution-poc

Retbleed: Arbitrary Speculative Code Execution via RSB Underflow A hands-on reproduction of Retbleed CVE-2022-29900 / CVE-2022-29901 — the 2022 micro-architectural attack that broke the "Retpoline" defense by proving that ret instructions, long assumed safe, can be hijacked when the CPU's Return...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment Assesses a system for the "speculative execution" vulnerabilities described in: CVE-2017-5715 branch target injection CVE-2017-5753 bounds check bypass CVE-2017-5754 rogue data cache load WARNING: Ensure that "Prefer 32-bit" is not checked in the build options...

spectreScope

spectreScope The demo of the speculative execution attack Spectre CVE-2017-5753, CVE-2017-5715. Tested On macOS Intel - Apple MacBook Pro Retina, 15-inch, Late 2013 - macOS High Sierra 10.13.2 - 1 IntelR CoreTM i7-4750HQ CPU @ 2.00GHz - git 2.14.3 - cmake 3.10.1 - Xcode 9.2 Linux Intel - HP...

spectre-attack

Spectre Attack Example Example of using revealed "Spectre" exploit from 2 Jan 2018 CVE-2017-5753 and CVE-2017-5715 Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the...

CVE-2018-3639

CVE-2018-3639 Speculative Store Bypass CVE-2018-3639 proof of concept for Linux Download git clone [email protected]:mmxsrup/CVE-2018-3639.git Build cd CVE-2018-3639 make Run ./specter Output $ ./spectre idx: 0, highest:P, hitrate:21.340000 idx: 1, highest:A, hitrate:15.520000 idx: 2,...

ssbd-tools

Tools for exercising Speculative Store Bypass Disable The ssbd-tools project is a collection of programs that makes use of the Speculative Store Bypass Disable SSBD functionality provided in x86 processors. SSBD is a processor based mitigation for the Speculative Store Bypass attack that is...