CVE-2025-6018_CVE-2025-6019_autopwn

Chained Exploit CVE-2025-6018 & CVE-2025-6019 Auto-Pwn This repository contains a full exploit chain "Auto-Pwn" targeting two critical vulnerabilities primarily affecting openSUSE Leap 15.x / SUSE systems: 1. CVE-2025-6018 : PAM Environment Injection. Allows a user to modify sensitive variables...

threat-intel-cve-2024-3094

Threat Intelligence Report: CVE-2024-3094 – XZ Utils Backdoor This repository contains a threat intelligence report analyzing CVE-2024-3094 , a high-profile backdoor vulnerability discovered in the xz-utils compression tool in 2024. CVE-2024-3094 is a severe supply chain compromise where a...

shim-review

This repo is for review of requests for signing shim. To create a request for review: clone this repo preferably fork it edit the template below add the shim.efi to be signed add build logs add any additional binaries/certificates/SHA256 hashes that may be needed commit all of that tag it with a...

CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit

CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Guide 中文 📋 Quick Exploitation Steps Step 1: Prepare XFS Image Local Machine Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image mnt sudo cp...

writehat

WriteHat is a reporting tool which removes Microsoft Word and many hours of suffering from the reporting process. Markdown -- HTML -- PDF. Created by penetration testers, for penetration testers - but can be used to generate any kind of report. Written in Django Python 3. Features: Effortlessly...

CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE

CVE-2026-3888 — snap-confine / systemd-tmpfiles Local Privilege Escalation Local privilege escalation from unprivileged user to full root on Ubuntu Desktop 24.04+ by exploiting a TOCTOU race condition between snap-confine and systemd-tmpfiles. Two variants are provided: SUID and Capabilities. CVS...

CVE-2024-3094-backdoor-env-container

CVE-2024-3094 SSH Backdoor Container Env This is an environment running CVE-2024-3094 sshd backdoor instance, working with this exploit: https://github.com/amlweems/xzbot. Experiments Test in Docker IT IS NOT a Docker container. I had tried making this vulnerability env with docker but failed: 1...

shh

Automatic systemd service hardening guided by strace profiling. SHH can generate an optimal set of hardening options for each of your services, so you can raise the security level of your system without sweating about random errors in production caused by too restrictive sandboxing. Official...

dracon-utilities

Dracon Utilities Three small Rust CLI tools that look after a Linux development machine: one keeps your git repos committed and backed up, one keeps your disk and memory from falling over, and one stops secrets from landing in your git history. They run as ordinary user-level systemd services — n...

sidedoor

sidedoor sidedoor maintains an SSH connection or tunnel with a shell script daemon. The primary use case is maintaining a remote port forward to the local SSH server or another port. Thus, the local device can be accessed without using incoming connections that may be blocked by a NAT or firewall...

uptux

uptux Specialized privilege escalation checks for Linux systems. Implemented so far: Writable systemd paths, services, timers, and socket units Disassembles systemd unit files looking for: References to executables that are writable References to broken symlinks pointing to writeable directories...

remediate_cesa_2019_2091

cesa20192091 This module contains a Bolt Task that will remediate CVEs described in CESA-2019:2091 and parallel issues present on other Enterprise Linux 7 EL7 platforms. Table of Contents 1. Description 2. Setup - The basics of getting started with cesa20192091 Beginning with cesa20192091 3. Usag...

CVE-2026-3888

CVE-2026-3888 - snap-confine + systemd-tmpfiles Local Privilege Escalation Disclaimer: This repository is for educational purposes only. All content is based on the original security advisory published by Qualys on March 17, 2026. The vulnerability has been patched-always ensure your systems are ...

tor-router

TOR Router Tor Router allow you to use TOR as a transparent proxy and send all your trafic under TOR INCLUDING DNS REQUESTS , the only that you need is: a system using systemd if you want to use the service and tor. TOR router doesn't touch system files as the rest of tools for routing your taffi...

DynastyPersist

DynastyPersist 1.5 DynastyPersist: A streamlined tool for achieving Linux persistence effortlessly. Supports KoTH, Battlegrounds and Pentest Operations Install • Documentation • Usage Documentation FEATURES Features| Description ---|--- SSH Key Generation| Automatically generates SSH keys for...

advisories

LinnemanLabs Research and Advisories Security research, advisories, and proof-of-concept code from LinnemanLabs. Advisories and Research Links to write-ups, disclosures, and reproducible PoCs. Project| Findings / Techniques| CVEs| Result| Write-up| PoC ---|---|---|---|---|--- bluez| ?| ?| LPE to...

CVE-2026-3888-POC-all-from-the-Qualys-platform.

CVE-2026-3888: snapd Local Privilege Escalation PoC Proof of concept for the local privilege escalation vulnerability in snapd CVE-2026-3888. This flaw allows an unprivileged local attacker to elevate their privileges to root on affected Ubuntu systems by recreating the private directory /tmp/.sn...

PoC

Leveraging CVE-2018-19788 to dump protected files without root shell CVE-2018-19788 is an issue where any user with a UID over INTMAX IE 4000000000 can run any systemctl command on a systemd linux box, such as Ubuntu. There is already a writeup to gain a root shell found: here. The main differenc...

Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-

Nexus — Local Privilege Escalation PoC Gitea template-sync path traversal via forged Git objects → root A proof-of-concept privilege-escalation exploit for the HackTheBox machine Nexus. A root-owned systemd service synchronizes Gitea template repositories to disk without sanitizing entry names,...

Malicious code in @walknpm/todo-cli (npm)

@walknpm/[email protected] is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with...