235 matches found
SUIDGuard
SUIDGuard - A kernel extension adding mitigations to OS X to make exploitation harder Copyright c Stefan Esser / SektionEins GmbH, 2015. All rights reserved. [email protected] - https://www.sektioneins.de/ OFFICIAL WEBSITE If you came here from a media article please checkout the official...
CVE-2022-0847_dirty-pipe
CVE-2022-0847 / Dirty Pipe Hacked up Dirty Pipe CVE-2022-0847 PoC that hijacks a SUID binary to spawn a root shell. and attempts to restore the damaged binary as well Score CVSS : 7.8 HIGH A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper...
CVE-2022-37706-SUID
CVE-2022-37706-SUID CVE-2022-37706-Enlightenment v0.25.3 - Escalada de privilegios ./exploit.sh CVE-2022-37706 Buscando el archivo SUID vulnerable... Esto puede tomar unos segundos... + Ā”Binario SUID vulnerable encontrado! + Intentando obtener un shell de root... + Ā”Disfruta del shell de root :...
CVE-2022-37703
DescripciĆ³n sugerida En Amanda 3.5.1, se encontrĆ³ una vulnerabilidad de fuga de informaciĆ³n en el binario SUID calcsize. El atacante puede abusar de la vulnerabilidad para saber si un directorio existe o no en cualquier parte del sistema de archivos. El binario usarĆ” opendir como root directament...
CVE-2023-4911-Lab
Entorno de anĆ”lisis de CVE-2023-4911 "Looney Tunables" Entorno de prĆ”cticas basado en Docker para el anĆ”lisis de la vulnerabilidad de desbordamiento de bĆŗfer Local Privilege Escalation en el cargador dinĆ”mico de GNU C Library glibc y el desarrollo de exploits. InformaciĆ³n de CVE Elemento| Conteni...
CVE-2023-4911
Vulnerabilidad de desbordamiento del bĆŗfer del montĆ³n de glibc CVE-2023-4911 Elemento| Contenido ---|--- ID CVE| CVE-2023-4911 Tipo de ataque| Desbordamiento del bĆŗfer del montĆ³n ā Escalada de privilegios local CVSS 3.1| 7.8 Alta Fecha de divulgaciĆ³n| 2023-10-03 Punto vulnerable| Analizador...
Dirtypipe-exploit
Dirtypipe-exploit Dirty Pipe CVE-2022-0847 PoC que secuestra un binario SUID para generar. un shell root. y tambiƩn intenta restaurar el binario daƱado...
CA-Common-Services-privilege-escalation-cve-2016-9795-revisited
CA Common Services privilege escalation CVE-2016-9795 revisited Description In one of my pentests, I stumbled across the casrvc SUID binary which is part of CA Common Services suite. As I found out, the binary is vulnerable to local privilege escalation. As a matter of fact, a public CVE...
CVE-2012-0056
Linux Local Privilege Escalation via SUID /proc/pid/mem Write Mempodipper Introducing Mempodipper, an exploit for CVE-2012-0056. /proc/pid /mem is an interface for reading and writing, directly, process memory by seeking around with the same addresses as the process's virtual memory space. In...
derpyc0w
Descargo de responsabilidad No soy responsable de nada de lo que hagas con este cĆ³digo. Este cĆ³digo se proporciona sin garantĆa alguna. DescripciĆ³n Exploit para CVE-2016-5195 que mapea un ejecutable SUID de solo lectura en memoria solo lectura y utiliza la condiciĆ³n de carrera para sobrescribirlo...
CVE-2022-37706
CVE-2022-37706 La vulnerabilidad CVE-2022-37706 estĆ” relacionada con el gestor de ventanas Enlightenment , especĆficamente el binario enlightenmentsys. Este binario tiene el bit SUID Set User ID activado, lo que significa que puede ejecutarse con privilegios elevados normalmente como el usuario...
dirtypipe
DISCLAIMER This code is for educational and research purposes only. Do not use it on systems you do not own or have permission to test. The author is not responsible for any misuse, damage, or legal consequences resulting from the use of this code. DirtyPipe CVE-2022-0847 View the writeup for thi...
CVE-2020-8248
CVE-2020-8248: Privilege Escalation via Zip Wildcard Exploit in Pulse Secure VPN Linux Client The root SUID executable pulsesvc, has a function ādouploadā that unsafely calls a zip command with wildcards āā. By writing files with specifically crafted names, in a user- controlled folder...
perf-exploiter
perf-exploiter CVE-2014-2630 In one of our recent penetration tests we have abused a vulnerability affecting a suid binary called "xglance-bin". Part of HP Performance Monitoring solution , it allowed us to escalate our local unprivileged sessions on some Linux RHEL 7.x/8.x systems to root. To be...
CVE-2021-4034
CVE-2021-4034 pkexec El uso de este script en python aprovecha la vulnerabilidad en el archivo pkexec para ganar acceso a root sin proporcionar credenciales Ā· Detecta si el binario tiene los privilegios SUID, en este caso es vulnerable usuario@gatogamer $ ls -la /usr/bin/pkexec .rwsr-xr-x 1 root...
copyfail
Copy Fail CVE-2026-31431 ā Exploit Usage Guide Original Readme taken from @painoob All Kernel versions since 2017 / 2016 are vulnerable ! Kernel 7 is fully immune, others between 5-7 may still be vulnerable ā ļø Disclaimer This content is for educational and authorized security testing purposes only...
DirtyClone
DirtyClone DirtyClone es una herramienta de escalada de privilegios local de diagnĆ³stico y prueba de concepto escrita en C. Apunta a una ruta de explotaciĆ³n relacionada con kernel/XFRM descrita en la fuente como CVE-2026-43503 y estĆ” destinada Ćŗnicamente a investigaciĆ³n de seguridad autorizada en...
CVE-2026-53613-poc
CVE-2026-53613 PoC TOCTOU vulnerability in mount8 allowing local privilege escalation to root. Vulnerable Versions util-linux 2.41.0 through 2.41.4 util-linux 2.42.0 through 2.42.1 Exploits File| Method| Target ---|---|--- exploitshell.sh| SSH key extraction| /root exploitdirectshell.sh| Direct...
CVE-2026-31431
š CVE-2026-31431 - Kernel Exploitation Research Framework Modular framework for studying a Linux privilege escalation LPE vulnerability based on AFALG + Page Cache Injection techniques. šÆ Objective This project is designed for: Research of Linux kernel vulnerabilities Teaching real exploitation...
copy-fail-CVE-2026-31431-shell
CVE-2026-31431 - copyfail shell Local privilege escalation via AFALG socket + splice page-cache overwrite. Overwrites a read-only SUID binary /usr/bin/su with a minimal ELF that calls setuid0 + execve"/bin/sh". No race condition, no per-distro offsets, single shot. $ ./copyfailexp.sh Kernel:...