chimera

Chimera Sandbox untrusted code with safe access to the host. Chimera is a userspace sandbox for code you don't fully trust — a natural fit for coding agents that run arbitrary, generated commands on a machine they share with you. It confines what a process can do to the host while still letting i...

CVE-2022-0847-eBPF

CVE-2022-0847-eBPF An eBPF program to detect and defense attacks on CVE-2022-0847. In the kernel space, the program detects splice system calls, if such a system call contains a pipe as the output fd, and the flags of the pipe buffer is set to PIPEBUFFLAGCANMERGE , then an event would be submitte...

CVE-2025-54110-Kernel-EoP-PoC

CVE-2025-54110-Kernel-EoP-PoC PoC implementation for CVE-2025-54110 a Kernel-Level Integer Overflow Vulnerability in the Windows NtQueryDirectoryObject system call. CVE-2025-54110 - Windows Kernel Integer Overflow Analysis CVE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54110...

poc-CVE-2025-38352

Exploit Details This repository only contains the proof-of-concept that triggers the vulnerability. I have since written a full exploit for this vulnerability. You can find the details in the link below. https://github.com/farazsth98/chronomaly Analysis Blog Posts Part 1 -...

zelos

Zelos Zelos Z eropoint E mulado L igero O perativo S istema es una plataforma de emulación de binarios basada en Python. Un uso de zelos es evaluar rápidamente el comportamiento dinámico de binarios mediante la línea de comandos o scripts de Python. Todas las llamadas al sistema se emulan para...

CVE-2019-11932

CVE-2019-11932 The address of system and the gadget must be replaced by the actual address found by an information disclosure vulnerability. After replacing address of system and gadget. Run the code to generate the corrupted GIF file: notroot@osboxes:/Desktop/gif$ make...

FstHook

FstHook A library for intercepting native functions by hooking KiFastSystemCall Note: KiFastSystemCall hooking only works on the following systems: Windows XP Service Pack 3 32-bit Windows Vista 32-bit Windows 7 32-bit...

frida-stalker-NtStrace

NtStrace frida-stalker based system call tracer on windowsx64. 483NtWaitForWorkViaWorkerFactory test.exe!0x7ff91fbaf262 35NtQueryVirtualMemory test.exe!0x7ff91fbaf262 35NtQueryVirtualMemory test.exe!0x7ff91fbaf262 35NtQueryVirtualMemory test.exe!0x7ff91fbb06d2 199NtCreateThreadEx + Following thre...

CVE-2026-75616

CVE-2026-75616 Authenticated OS command injection in the TP-Link Archer C20 v6 web management interface. BPA WAN configuration values are passed to system without adequate neutralization, allowing an authenticated administrator on the adjacent network to execute commands as root. Discovered and...

CVE-2015-7547-Research

Initial work on glibc exploit CVE-2015-7547. Currently just returns to libc and calls system to provide a shell. This version does not account for ASLR yet...

foreman: command injection in foreman-rake database tasks

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ru...

TriforceOpenBSDFuzzer

TriforceOpenBSDSyscallFuzzer 20160825 https://github.com/nccgroup/TriforceOpenBSDFuzzer Jesse Hertz [email protected] Tim Newsham [email protected] This is a collection of files used to perform system call fuzzing of OpenBSD amd64 using TriforceAFL i.e. AFL and QEMU. To use it you will...

TriforceLinuxSyscallFuzzer

TriforceLinuxSyscallFuzzer 20160613 https://github.com/nccgroup/TriforceLinuxSyscallFuzzer Jesse Hertz [email protected] Tim Newsham [email protected] New: For those looking to play with TriforceAFL and TLSF, Richard Johnson created a Dockerfile which installs both and even builds a Lin...

CVE-2026-31431-Check

CVE-2026-31431 Copy Fail Vulnerability Check Script Vulnerability Overview CVE-2026-31431 Copy Fail is a Linux kernel local privilege escalation vulnerability that exploits AFALG sockets address family 38 combined with the splice zero-copy system call to bypass file write permissions and tamper...

cve-2026-31431

CVE-2026-31431 This document describes a public Python exploit related to the CVE-2026-31431 vulnerability. The code demonstrates the exploitation of the flaw using primitives from the Linux AFALG subsystem, AEAD cryptographic operations, and memory manipulation via splice, with the goal of...

CVE-2026-31431

CopyFail CVE-2026-31431 Overview CopyFail is a proof-of-concept exploit for CVE-2026-31431, targeting a memory corruption vulnerability in the Linux Kernel Crypto API AFALG. The exploit leverages the splice system call to perform unauthorized page-cache patching of the /usr/bin/su binary, enablin...

CVE-2026-31431-Copy-Fail---Advanced-LPE-Proof-of-Concept---C-Rewrite

CVE-2026-31431 "Copy Fail" - Advanced LPE Proof-of-Concept - C Rewrite An advanced, byte-perfect Local Privilege Escalation LPE Proof-of-Concept PoC for CVE-2026-31431 , exploiting a logic flaw in the Linux kernel's cryptography subsystem algifaead. This repository contains a highly optimized C...

RK35xx-CopyFail-Hotfix

RK35xx Kernel Patch: CVE-2026-31431 "Copy Fail" RK35xx CopyFail Hotfix: CVE-2026-31431 Patch for Joshua Riek's Ubuntu 24.04 A community-provided, pre-compiled kernel patch for all RK35xx single-board computers Rock 5, Orange Pi 5, NanoPC, etc. running Joshua Riek's Ubuntu 24.04 Kernel...

CVE-2026-12541

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ru...

CVE-2026-12541

A flaw in Foreman allows for OS command injection within the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize the destination parameter during backups and the file parameter during imports before passing them to a Ruby system() call . An attacker with suff...