copy-fail-CVE-2026-31431-detection-probe

Linux Kernel LPE Probe Suite — Copy Fail & Dirty Frag Safe detection tooling for two related Linux kernel local privilege escalation vulnerability families — Copy Fail CVE-2026-31431 and Dirty Frag CVE-2026-43284 / CVE-2026-43500 — both affecting all major distributions since 2017, both exploitab...

cve-2024-31317

Exploration of CVE-2024-31317 CVE-2024-31317 provides unpriviledged access to any uid and SELinux scope available to proper Android apps. This provides access to uid 1000 system and uid 2000 shell, and can be triggered entirely from an unpriviledged app, allowing for persistence of any...

CVE-2025-32463

CVE-2025-32463 Local Privilege Escalation in Sudo via Malicious nsswitch.conf with sudo -R. Affected versions 1.9.14 – 1.9.17 📘 Introduction Sudo is a widely used command-line utility on Unix-like systems that allows permitted users to execute commands with elevated privileges. It plays a critica...

below-log-race-poc

below-log-race-poc CVE-2025-27591 Exploit Below privilege escalation Description This repository contains a proof-of-concept exploit for CVE-2025-27591 , a privilege escalation vulnerability in the below utility. The issue arises because below mishandles log files under /var/log/below/, allowing...

CVE-2025-26125

Description The PoC program exploits the IMFForceDelete driver which exposes an ioctl that allows unprivileged users to delete files and folders. We can turn this into a privilege escalation by using a technique explained by ZDI and Halov, which exploits the MSI rollback mechanism which is design...

CVE-2021-3560

CVE-2021-3560 CVE-2021-3560のための信頼性の高いCベースのエクスプロイトです。 概要: 昨日、Kevin Backhouse氏によるこのブログ記事に出くわしました（この脆弱性を発見した方です）。そのブログ記事で提供されていたbashコマンドを試してみたところ、驚いたことに私のKali Linuxボックスで動作しました！...

CVE-2026-40369-EXPLOIT

Full Blog - https://pwn2nimron.com/blog CVE-2026-40369: Arbitrary Kernel Address Increment via NtQuerySystemInformation Class 253 Summary Type: Arbitrary kernel write increment — PRIVILEGE ESCALATION PRIMITIVE Component: ntoskrnl.exe — ExpGetProcessInformation Trigger:...

CVE-2025-32463

Reference: https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot Executing the PoC on Ubuntu 24.04.2 LTS server with Sudo v1.9.15p5, using an unprivileged user with no Sudo rules defined, results in a root shell outside of the chrooted environment. lowpriv@prod:/CVE-2025-3246...

pspy

pspy - 非特権Linuxプロセススヌーピング pspyは、root権限を必要とせずにプロセスを監視するために設計されたコマンドラインツールです。他のユーザーが実行したコマンドやcronジョブなどを、実行時に確認できます。CTFでのLinuxシステムの列挙に最適です。また、コマンドライン引数としてシークレットを渡すことがなぜ悪いアイデアかを同僚に示すのにも最適です。 このツールは、procfsスキャンから情報を収集します。ファイルシステムの選択された部分に配置されたInotifyウォッチャーがこれらのスキャンをトリガーし、短命なプロセスをキャッチします。 はじめに ダウンロード...

WebminRCE-exploit

WebminRCE-exploit CVE-2022-0824, CVE-2022-0829 - File Manger privilege exploit Vulnerable application to test this PoC can be found here as a docker image. Prerequisites: Python3 Requests module Description Vulnerability Improper Access Control to Remote Code Execution Safe users Unpriviledged us...

Vulnerable-Docker-Engine

CVE-2021-41091 This exploit offers an in-depth look at the CVE-2021-41091 security vulnerability and provides a step-by-step guide on how to utilize the exploit script to achieve privilege escalation on a host. Vulnerability Summary CVE-2021-41091 is a flaw in Moby Docker Engine that allows...

bubblewrap

Bubblewrap 许多容器运行时工具，如 systemd-nspawn、docker 等，专注于为系统管理员和编排工具（例如 Kubernetes）提供运行容器的基础设施。 这些工具不适合提供给非特权用户，因为将此类访问权限转化为宿主机上完全特权级的 root shell 是轻而易举的。 用户命名空间 Linux 内核中有一个名为用户命名空间的特性，它允许非特权用户使用容器功能。Bubblewrap 利用这些特性来构建沙箱，从而允许任何用户使用该工具。 从历史上看，bubblewrap 还曾为不支持非特权用户命名空间的系统提供 setuid 模式。然而，该模式已被移除。 最初的...

CVE-2020-8290

CVE-2020-8290 – Elevation of Privilege in Backblaze Summary Name: Elevation of Privilege in Backblaze CVE: CVE-2020-8290 Discoverer: Jason Geffner Vendor: Backblaze Product: Backblaze for Windows and Backblaze for macOS Risk: High Discovery Date: 2020-03-13 Publication Data: 2020-09-09 Fixed...

CVE-2022-22706-poc

CVE-2022-22706 - Page-Cache Write The Arm Mali GPU driver hands userspace a CPU-writable mapping of pages it pinned read-only, so an unprivileged process gets a writable alias of the page cache backing a file it can only open ORDONLY. exploit.c blanks root's password field in the /etc/passwd page...

CVE-2026-31431

CVE-2026-31431 Copy Fail — PoC en C Escalada de privilegios local LPE trivial sin privilegios escribiendo 4 bytes controlados en la caché de páginas de cualquier archivo legible mediante un fallo lógico en AFALG kernel 4.14 → principios de 2026. Corrompe /usr/bin/su en memoria y luego ejecútalo →...

cve-2026-31431-ansible

CVE-2026-31431（“Copy Fail”）— Ansible 缓解方案 使用 Ansible 在 Debian / Ubuntu / RHEL 系列主机群中检测并应用针对 CVE-2026-31431 （“Copy Fail”）的内核命令行缓解措施。 该 CVE 是 Linux 内核 algifaead AFALG 接口中的一个本地权限提升漏洞。任何非特权本地用户——包括 www-data、mysql 等服务账户，或已被 RCE 的 Web 应用中的进程——都可以通过几次系统调用将其串联为 root 权限。该漏洞影响自 2017 年以来发布的所有主流发行版。 本方案的功能 检...

CVE-2026-31431-Copy-Fail

CVE-2026-31431-Copy-Fail xpl0ited by infrar3d This repository contains a proof‑of‑concept exploit for CVE-2026-31431 Copy Fail. CVE-2026-31431, known as "Copy Fail", is a high-severity Local Privilege Escalation LPE flaw in the Linux kernel that has been present for nearly a decade. It allows an...

PoC_CVE-2017-0807

Proof of concept of CVE-2017-0807 This is a demo application with deliberately sloppy interface for the CVE-2017-0807 reported by Efthimios Alepis and Constantinos Patsakis. The vulnerability illustrates that due to security issues in every Android version up to Nougat, an unprivileged user can...

GeoServer Demo Request Endpoint - Server Side Request Forgery

It is possible to achieve Server Side Request Forgery SSRF via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to...

CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script

CVE-2026-31431 — Copy Fail — Vulnerability Detection Script Detection only. A working PoC already exists at copy.fail/exploit. This script is for sysadmins and security teams determining where they are vulnerable — or still vulnerable after patching. What's this about? On April 29th 2026, a...