DynastyPersist

DynastyPersist 1.5 DynastyPersist: A streamlined tool for achieving Linux persistence effortlessly. Supports KoTH, Battlegrounds and Pentest Operations Install • Documentation • Usage Documentation FEATURES Features| Description ---|--- SSH Key Generation| Automatically generates SSH keys for...

PoC

Leveraging CVE-2018-19788 to dump protected files without root shell CVE-2018-19788 is an issue where any user with a UID over INTMAX IE 4000000000 can run any systemctl command on a systemd linux box, such as Ubuntu. There is already a writeup to gain a root shell found: here. The main differenc...

CVE-2025-6018

CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Guide 中文 📋 Quick Exploitation Steps Step 1: Prepare XFS Image Local Machine root@kitploit: Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image...

shim-review

This repo is for review of requests for signing shim. To create a request for review: clone this repo preferably fork it edit the template below add the shim.efi to be signed add build logs add any additional binaries/certificates/SHA256 hashes that may be needed commit all of that tag it with a...

CVE-2021-3560-Authentication-Agent

PolicyKit CVE-2021-3560 Exploit Authentication Agent Technology Details Blog posts about this exploit : https://ricterz.me/posts/2022-04-28-a-new-exploit-method-for-cve-2021-3560-polkit-linux-privilege-escalation.txt...

CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit

CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Guide 📋 Quick Exploitation Steps Step 1: Prepare XFS Image Local Machine root@kitploit: Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image mn...

writehat

WriteHat is a reporting tool which removes Microsoft Word and many hours of suffering from the reporting process. Markdown -- HTML -- PDF. Created by penetration testers, for penetration testers - but can be used to generate any kind of report. Written in Django Python 3. Features: Effortlessly...

tor-router

TOR Router Tor Router allow you to use TOR as a transparent proxy and send all your trafic under TOR INCLUDING DNS REQUESTS , the only that you need is: a system using systemd if you want to use the service and tor. TOR router doesn't touch system files as the rest of tools for routing your taffi...

uptux

uptux Specialized privilege escalation checks for Linux systems. Implemented so far: Writable systemd paths, services, timers, and socket units Disassembles systemd unit files looking for: References to executables that are writable References to broken symlinks pointing to writeable directories...

uptux

uptux 针对 Linux 系统的专门权限提升检查工具。 目前已实现： 可写的 systemd 路径、服务、定时器和套接字单元 反汇编 systemd 单元文件以查找： 指向可执行文件的可写引用 指向可写目录的损坏符号链接 相对路径语句 可写的 Unix 套接字文件（隐蔽 API） 可写的 D-Bus 路径 过度宽松的 D-Bus 服务设置 以 root 身份运行并在文件绑定的 Unix 域套接字上响应的 HTTP API 这些检查基于我自身研究中遇到的情况，此工具肯定不涵盖所有你应该关注的内容。别忘了经典方法！ 使用方法 所有功能都包含在一个文件中，因为在受限的 shell...

shh

Automatic systemd service hardening guided by strace profiling. SHH can generate an optimal set of hardening options for each of your services, so you can raise the security level of your system without sweating about random errors in production caused by too restrictive sandboxing. Official...

sidedoor

sidedoor sidedoor maintains an SSH connection or tunnel with a shell script daemon. The primary use case is maintaining a remote port forward to the local SSH server or another port. Thus, the local device can be accessed without using incoming connections that may be blocked by a NAT or firewall...

needrestart

needrestart Acerca de needrestart comprueba qué demonios necesitan reiniciarse después de actualizaciones de bibliotecas. Está inspirado en checkrestart del paquete debian-goodies. Hay algunos scripts hook en el directorio ex/ para usar con apt y dpkg. Los scripts llamarán a needrestart después d...

lxd_root

Escalada de privilegios en Linux mediante LXD Descripción general Los miembros del grupo local lxd en sistemas Linux tienen numerosas vías para escalar sus privilegios a root. Este repositorio contiene ejemplos de exploits locales totalmente automatizados. Puedes encontrar una explicación detalla...

CVE-2025-6018_CVE-2025-6019_autopwn

Chained Exploit CVE-2025-6018 & CVE-2025-6019 Auto-Pwn This repository contains a full exploit chain "Auto-Pwn" targeting two critical vulnerabilities primarily affecting openSUSE Leap 15.x / SUSE systems: 1. CVE-2025-6018 : PAM Environment Injection. Allows a user to modify sensitive variables...

ROS-20260922-73-0136

The vulnerability in the Systemd service initialization and management subsystem is related to insecure handling of privileges. Exploiting this vulnerability could allow an attacker to cause a service failure...

dracon-utilities

Dracon Utilities Three small Rust CLI tools that look after a Linux development machine: one keeps your git repos committed and backed up, one keeps your disk and memory from falling over, and one stops secrets from landing in your git history. They run as ordinary user-level systemd services — n...

Persistnux

Persistnux A comprehensive Linux persistence detection tool for Digital Forensics and Incident Response DFIR investigations. Overview Persistnux is a bash-based tool designed to identify known Linux persistence mechanisms used by attackers to maintain access to compromised systems. It performs...

cs50-cybersecurity-final-project

Technical Analysis of the XZ Utils Backdoor CVE-2024-3094 Video URL: https://www.youtube.com/watch?v=6hpVp7prlO8 Overview This repository contains the final project for CS50's Introduction to Cybersecurity. The project provides a thorough technical analysis of the supply chain attack on XZ Utils...

abrt: unsanitized systemd journal content written to dump directory files enables content injection

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A...