218 matches found
CVE-2026-31431-poc
Wrapper de PoC de comando Copy Fail Un pequeño wrapper de prueba de concepto modificado para Copy Fail / CVE-2026-31431 que permite pasar un comando personalizado desde la terminal en lugar de lanzar siempre un shell root interactivo, para que pueda ejecutarse en un entorno no interactivo como un...
-Netdata-PrivEsc-CVE-2024-32019
CVE-2024-32019-Netdata-ndsudo-PrivEsc CVE-2024-32019: Netdata ndsudo PrivEsc HTB Editor Automated Bash script to exploit the PATH Hijacking vulnerability in Netdata's SUID ndsudo binary CVE-2024-32019. This exploit was specifically adapted to overcome common restrictions found in hardened...
CVE-2022-47952
Descripción sugerida lxc-user-nic en lxc hasta 5.0.1 se instala con setuid root, y puede permitir a usuarios locales inferir si existe algún archivo, incluso dentro de un árbol de directorios protegido, porque "Failed to open" a menudo indica que un archivo no existe, mientras que "does not refer...
CVE-2023-31443
CVE-2023-31443 nordugrid-arc-wn 6.14.0 DoS/LPE. Descripción sugerida NorduGrid nordugrid-arc-wn 6.14.0 tiene el binario SUID arc-job-cgroup que es vulnerable a un ataque de recorrido de rutas. Combinado con una condición de carrera, el atacante puede escribir el ppid en cualquier archivo siempre...
CVE-2026-43494-PinTheft-PoC
SLEY — PinTheft PoC CVE-2026-43494 概念验证 — uid=1000raken → uid=0root 在 WSL2 6.6.87.2-microsoft-standard-WSL2 上执行 ./sley 后 针对 CVE-2026-43494 （ PinTheft ）的单文件概念验证：一种 Linux 内核本地权限提升漏洞，它利用 RDS 零拷贝引用计数错误 与 iouring 固定缓冲区 链式攻击，覆写 SUID-root 二进制文件的页面缓存。 免责声明： 本仓库仅限 授权的安全研究、教育和防御性测试...
CVE-2023-3519
Citrix ADC RCE CVE-2023-3519 Este exploit utiliza direcciones y shellcode para Citrix VPX 13.1-48.47. Para el artículo completo, haga clic aquí. Uso Se requiere NASM para compilar el shellcode. root@kitploit: $ sudo apt install nasm El shellcode incluido descargará y ejecutará un script de shell...
copy-fail-python
copy-fail-python A compact, zero-dependency Python proof-of-concept for Copy Fail CVE-2026-31431, a Linux kernel local privilege escalation through AFALG and splice that corrupts the page cache of a readable file such as /usr/bin/su. This is a port of the Theori PoC with two practical changes: th...
cve-2024-32019-PoC
CVE-2024-32019 — Netdata ndsudo 本地权限提升 摘要 Netdata 的 ndsudo 辅助程序（安装时为 setuid root）限制它可以运行的命令，但使用调用者的PATH 来解析这些命令。在受影响版本中，本地用户可以将恶意二进制文件放在 PATH 中更靠前的位置，并让 ndsudo 以 root 权限执行它。已在 Netdata 1.45.3 和 1.45.0-169 中修补。 受影响 / 已修补 受影响： = 1.44.0-60, = 1.45.0, 来打印解析后的命令而不实际执行 （请谨慎使用，先阅读代码）。GitHub ⚠️ 不包含武器化 PoC...
CVE-2026-56135
A flaw was found in NTFS-3G. This vulnerability involves a heap-based buffer overflow, which occurs when the software attempts to write more data to a memory block than it can hold. An attacker can exploit this by creating a specially crafted NTFS image and then creating a file within a malicious...
CVE-2026-53614
A flaw was found in util-linux. The mount8 SUID binary does not sanitize the LIBMOUNTFORCEMOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount8 to use the legacy two-step mount2 code path, which applies security restrictions such as nosuid and...
CVE-2026-49415
During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...
CVE-2026-49415
FreeBSD kernel is affected by a TOCTOU race in execve(2): when executing a SUID binary, the new address space is installed before credentials are updated, so a same-user process can read or modify memory via procfs/linprocfs during the window. An unprivileged local user can exploit this to gain r...
EUVD-2026-62236
During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...
CVE-2026-56135
In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function buildinheritedid in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted...
PT-2026-60534
Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2026.2.25 Description A heap-based buffer overflow occurs in the build inherited id function within libntfs-3g/security.c. An attacker can corrupt heap memory in the SUID-root ntfs-3g binary by creating a file within ...
Exploit for Improper Ownership Management in Debian Debian_Linux
CVE-2023-0386 - OverlayFS / FUSE Original CVE source written...
Exploit for CVE-2026-43494
SLEY — PinTheft PoC CVE-2026-43494 Proof o...
xfrm-ESP Page-Cache Write via CVE-2026-43284
CVE-2026-43284 is a Linux kernel page-cache write vulnerability in the IPsec/xfrm subsystem affecting ESP Encapsulating Security Payload fragmentation. Dubbed "DirtyFrag", the bug allows a local unprivileged user to gain write access to read-only page-cache pages by triggering a race condition in...