CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

subpath-exploit

Sample Kubernetes Escape via CVE-2017-1002101 Description After hearing about the issue and following this guide, I wanted to explore things a bit more. This repo contains a couple pod deployments and helper shell scripts that demonstrate the attack mechanism in the simplest way possible so that...

CVE-2022-25365

CVE-2022-25365 The privilege escalation vulnerability in Docker Desktop for Windows reference: https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-1 File list poc.py Coded by followboy1999 createsymlink.exe...

below-log-race-poc

below-log-race-poc CVE-2025-27591 Exploit Below privilege escalation Description This repository contains a proof-of-concept exploit for CVE-2025-27591 , a privilege escalation vulnerability in the below utility. The issue arises because below mishandles log files under /var/log/below/, allowing...

deepin-linux_reader_RCE-exploit

CVE-2023-50254 - Deepin Linux's default document viewer deepin-reader RCE CVE-2023-50254: PoC Exploit for Deepin-reader RCE that affects unpatched Deepin Linux Desktops. Deepin Linux's default document reader "deepin-reader" software suffers from a serious vulnerability due to a design flaw that...

RegPwnBOF

RegPwn BOF Cobalt Strike BOF port of the RegPwn exploit by Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. This is a sloppy BOF reimplementation of the original C exploit. All credit for the vulnerability research and exploit goes to Filip Dragovic and MDSec. Blog post :...

CVE-2025-47181

CVE-2025-47181 Concept: Microsoft Edge Link Following Privilege Escalation Project Overview This repository presents the CVE-2025-47181 Concept , a Python program designed to illustrate the mechanism and impact of CVE-2025-47181. This is a Privilege Escalation vulnerability in Microsoft Edge...

CVE-2018-1000117-Exploit

CVE-2018-1000117 Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python...

CVE-2025-27591-PoC

CVE-2025-27591 PoC: Local Privilege Escalation in Below v0.9.0 Proof of Concept for CVE-2025-27591, a vulnerability that allows to local unprivileged users to escalate their privileges to root through symlink attacks. 🕵️‍♂️ Technical Details The vulnerability affects the Below service versions...

hook

amalmurali47/hook This repository is part of the PoC for exploiting CVE-2024-32002, a vulnerability in Git that allows RCE during a git clone operation. This repository contains the malicious hook used in the exploit. Overview For detailed instructions and an explanation of how the exploit works,...

CVE-2025-24104

CVE-2025-24104 Writeup: Reading Files Out-of-Sandbox I reported a bug that Apple later tracked as CVE-2025-24104. In my original report, I demonstrated how a malicious backup could be used to bypass sandbox restrictions. However, Apple’s initial description stated that this vulnerability could le...

CVE-2023-40028

CVE-2023-40028 PoC Exploit Symlink Upload Vulnerability in Ghost CMS Leading to Arbitrary File Read POC Image Vulnerability Details CVE-2023-40028 is a vulnerability in Ghost CMS versions prior to 5.59.1 , where authenticated users can upload symbolic links symlinks that lead to arbitrary file...

CVE-2024-21626

CVE-2024-21626 For detailed explanation for this vulnerability, plz refer to my article. Exploit Exploit via Running a Container No need to build a custom image, just run a container with -w parameter: docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm Exploit via Execin...

CVE-2020-1337

CVE-2020-1337 CVE-2020-1337 is a bypass of PrintDemon CVE-2020-1048 ’s patch via a Junction Directory, made to remediate an Elevation of Privileges EoP\Local Privilege Escalation LPE vulnerability affecting the Windows’ Print Spooler Service. The vulnerability does require low privilege access an...

CVE-2007-4559

demonstration of CVE-2007-4559 what is this? This is a demonstration of how python's default handling of tar file extraction prior to python v3.11.4 is vulnerable to a simple symlink attack. The instructions below describe how to craft a malicious payload. The script untar.py demonstrates how and...

CVE-2024-32002-Reverse-Shell

CVE-2024-32002-Reverse-Shell This script demonstrates how to exploit CVE-2024-32002 to obtain a reverse shell, providing remote access to the affected system. Use it with caution in controlled environments and only for educational or security testing purposes. Blog Post This script is inspired by...

CVE-2024-31771

CVE-2024-31771 TotalAV Arbitrary File Write TotalAV version 6.0.x https://github.com/restdone/CVE-2024-31771/assets/42227817/ffe0c2ec-4ea6-4c29-852f-456b2e62f5b1 Timeline: 13th Feb, 2024 : Discovered 6.0.740 vulnerable and reported to TotalAV. 15th Feb, 2024: TotalAV confirmed and reproduced the...

CVE-2024-32002-poc

Bash Script: !/bin/bash Set Git configuration options git config --global protocol.file.allow always git config --global core.symlinks true Avoid warning messages set default branch to main git config --global init.defaultBranch main Define tell-tale path telltalepath="$PWD/tell.tale" Initialize...

CVE-2024-32002-Exploit

!/bin/bash git init hook cd hook mkdir -p y/hooks cat y/hooks/post-checkout dotgit.txt git hash-object -w --stdin dot-git.hash printf "120000 %s 0\ta\n" "$cat dot-git.hash" index.info git update-index --index-info index.info git commit -m "add-symlink" git remote add origin...

CVE-2025-27591-below-

CVE-2025-27591 – Privilege Escalation in Below 1 Introduction Below is a Linux tool for recording and displaying system data such as hardware utilization and cgroup metrics. In versions prior to v0.9.0 , Below’s systemd service runs with root privileges and creates world-writable log directories...