CA-Common-Services-privilege-escalation-cve-2016-9795-revisited

CA Common Services privilege escalation CVE-2016-9795 revisited Description In one of my pentests, I stumbled across the casrvc SUID binary which is part of CA Common Services suite. As I found out, the binary is vulnerable to local privilege escalation. As a matter of fact, a public CVE...

CVE-2012-0056

Linux Local Privilege Escalation via SUID /proc/pid/mem Write Mempodipper Introducing Mempodipper, an exploit for CVE-2012-0056. /proc/pid /mem is an interface for reading and writing, directly, process memory by seeking around with the same addresses as the process's virtual memory space. In...

derpyc0w

Disclaimer I am not responsible for anything you do with this code. This code comes with no warranty. Description Exploit for CVE-2016-5195 which maps a readonly SUID executable to memory readonly and uses the race condition to overwrite it with an ELF of our choice. Payloads are available in NAS...

CVE-2022-37706

CVE-2022-37706 The CVE-2022-37706 vulnerability is related to the Enlightenment window manager, specifically the enlightenmentsys binary. This binary has the SUID Set User ID bit enabled, meaning it can be executed with elevated privileges usually as the root user. Summary: Vulnerability :...

dirtypipe

DISCLAIMER This code is for educational and research purposes only. Do not use it on systems you do not own or have permission to test. The author is not responsible for any misuse, damage, or legal consequences resulting from the use of this code. DirtyPipe CVE-2022-0847 View the writeup for thi...

CVE-2020-8248

CVE-2020-8248: Privilege Escalation via Zip Wildcard Exploit in Pulse Secure VPN Linux Client The root SUID executable pulsesvc, has a function “doupload” that unsafely calls a zip command with wildcards “”. By writing files with specifically crafted names, in a user- controlled folder...

perf-exploiter

perf-exploiter CVE-2014-2630 In one of our recent penetration tests we have abused a vulnerability affecting a suid binary called "xglance-bin". Part of HP Performance Monitoring solution , it allowed us to escalate our local unprivileged sessions on some Linux RHEL 7.x/8.x systems to root. To be...

CVE-2021-4034

CVE-2021-4034 pkexec The use of this python script exploits the vulnerability in the pkexec file to gain root access without providing credentials · Detects if the binary has SUID privileges, in which case it is vulnerable root@kitploit: usuario@gatogamer $ ls -la /usr/bin/pkexec .rwsr-xr-x 1 roo...

copyfail

Copy Fail CVE-2026-31431 – 漏洞利用使用指南 原始 Readme 取自 @painoob 自 2017 / 2016 年以来的所有内核版本均存在漏洞！内核 7 完全免疫，其他版本（5-7 之间可能仍然存在漏洞） ⚠️ 免责声明 本内容仅供教育和授权安全测试使用。请勿 在未经明确许可的系统上运行此内容。 📌 概述 Copy Fail CVE-2026-31431 是一个 Linux 本地权限提升（LPE）漏洞，通过 AFALG 影响内核加密 API。 它允许非特权用户覆盖 SUID 二进制文件（例如 /usr/bin/su）的页缓存数据，从而获得 root 访问权限...

DirtyClone

DirtyClone DirtyClone is a diagnostic, proof-of-concept local privilege escalation tool written in C. It targets a kernel/XFRM-related exploit path described in the source as CVE-2026-43503 and is intended only for authorized security research in controlled environments. Overview This repository...

CVE-2026-53613-poc

CVE-2026-53613 PoC mount8 中的 TOCTOU 漏洞，允许本地权限提升至 root。 受影响版本 util-linux 2.41.0 至 2.41.4 util-linux 2.42.0 至 2.42.1 漏洞利用 文件| 方法| 目标 ---|---|--- exploitshell.sh| SSH 密钥提取| /root exploitdirectshell.sh| 直接 shell| /bin 快速开始 root@kitploit: 方法 1：提取 SSH 密钥并以 root 身份 SSH 登录 bash exploitshell.sh 1000 方法 2：...

CVE-2026-31431

🔐 CVE-2026-31431 - 内核利用研究框架 用于研究 Linux 中基于 AFALG + Page Cache 注入 技术的权限提升（LPE）漏洞的模块化框架。 🎯 目标 本项目设计用于： Linux 内核漏洞研究 真实利用技术（LPE）教学 受控网络安全实验室执行 ⚙️ 这个项目做什么？ 该框架实现了一种技术，能够： 修改 SUID 二进制文件的内存内容（page cache ） 在运行时改变其行为 尝试在不修改磁盘上二进制文件的情况下将权限提升至 root 🧠 漏洞如何运作？ 该利用基于内核多种机制的组合： 1. AFALG（Linux 加密 API）...

copy-fail-CVE-2026-31431-shell

CVE-2026-31431 - copyfail shell 通过 AFALG 套接字 + splice 页缓存覆写实现本地权限提升。 将只读的 SUID 二进制文件（/usr/bin/su）覆写为一个调用 setuid0 + execve"/bin/sh" 的最小 ELF。无竞态条件，无发行版特定偏移，单次执行即可完成。 root@kitploit: $ ./copyfailexp.sh Kernel: 5.15.0-88-generic + Kernel 5.15 处于受影响窗口内（4.9 – 6.18）— 继续执行 正在编译... + 编译成功 — 启动 id uid=0root...

CVE-2021-4034

CVE-2021-4034 一个针对 CVE-2021-4034 的简单 PoC - 本地权限提升（pkexec SUID 二进制文件） 漏洞详情请参阅此处的公告 here...

copy-fail

Copy Fail PoC English Python PoC for CVE-2026-31431 , intended for controlled laboratory testing on authorized Linux systems. For use only in your own environments, labs, or systems where you have explicit permission. Do not run this code against third-party systems. Description copy-fail.py chec...

CVE-2026-31431-poc

Copy Fail 命令 PoC 包装器 一个针对 Copy Fail / CVE-2026-31431 的小型修改版概念验证包装器，允许从终端传入自定义命令，而不是始终启动交互式 root shell，以便在非交互式环境（如 Web shell）中运行。 本项目基于公开的 Copy Fail 研究和 PoC。 ⚠️ 免责声明 本仓库仅用于教育、研究和防御性验证目的 。 只能在您拥有或获得明确测试许可的系统上运行此代码。 此 PoC 可能会破坏目标二进制文件（如 /usr/bin/su）的内存页缓存。 请勿 在生产系统上运行此代码。 背景 Copy Fail ，编号为...

-Netdata-PrivEsc-CVE-2024-32019

CVE-2024-32019-Netdata-ndsudo-PrivEsc CVE-2024-32019: Netdata ndsudo PrivEsc HTB Editor Automated Bash script to exploit the PATH Hijacking vulnerability in Netdata's SUID ndsudo binary CVE-2024-32019. This exploit was specifically adapted to overcome common restrictions found in hardened...

CVE-2022-47952

Suggested description lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace...

CVE-2023-31443

CVE-2023-31443 nordugrid-arc-wn 6.14.0 DoS/LPE. Suggested description NorduGrid nordugrid-arc-wn 6.14.0 has the arc-job-cgroup SUID binary that is vulnerable to a path traversal attack. Combined with a race condition, the attacker can write the ppid to any file as long as the file is writable by...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...