Vulnerable-Docker-Engine

CVE-2021-41091 This exploit offers an in-depth look at the CVE-2021-41091 security vulnerability and provides a step-by-step guide on how to utilize the exploit script to achieve privilege escalation on a host. Vulnerability Summary CVE-2021-41091 is a flaw in Moby Docker Engine that allows...

CVE-2025-26125

Description The PoC program exploits the IMFForceDelete driver which exposes an ioctl that allows unprivileged users to delete files and folders. We can turn this into a privilege escalation by using a technique explained by ZDI and Halov, which exploits the MSI rollback mechanism which is design...

CVE-2025-32463

Reference: https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot Executing the PoC on Ubuntu 24.04.2 LTS server with Sudo v1.9.15p5, using an unprivileged user with no Sudo rules defined, results in a root shell outside of the chrooted environment. lowpriv@prod:/CVE-2025-3246...

CVE-2025-32463

CVE-2025-32463 Local Privilege Escalation in Sudo via Malicious nsswitch.conf with sudo -R. Affected versions 1.9.14 – 1.9.17 📘 Introduction Sudo is a widely used command-line utility on Unix-like systems that allows permitted users to execute commands with elevated privileges. It plays a critica...

CVE-2026-40369-EXPLOIT

Full Blog - https://pwn2nimron.com/blog CVE-2026-40369: Arbitrary Kernel Address Increment via NtQuerySystemInformation Class 253 Summary Type: Arbitrary kernel write increment — PRIVILEGE ESCALATION PRIMITIVE Component: ntoskrnl.exe — ExpGetProcessInformation Trigger:...

CVE-2023-26083

CVE-2023-26083 – Mali GPU Kernel Address Leak via Timeline Stream This repository contains a proof-of-concept PoC exploit for CVE-2023-26083 , a vulnerability in the Mali GPU driver Arm Mali GPU Kernel Driver that allows an unprivileged user to leak kernel pointers and sensitive internal...

CVE-2023-2002

Linux Bluetooth: Unauthorized management command execution CVE-2023-2002 An insufficient permission check has been found in the Bluetooth subsystem of the Linux kernel when handling ioctl system calls of HCI sockets. This causes tasks without the proper CAPNETADMIN capability can easily mark HCI...

CVE-2018-17182

CVE-2018-17182 Linux kernel VMA-UAF privilege escalation vulnerability CVE-2018-17182 About Google Project Zero cybersecurity researchers have released details and a proof-of-concept PoC exploit for a high-severity vulnerability in the Linux kernel that has been present since kernel versions 3.16...

pspy

pspy - unprivileged Linux process snooping pspy is a command line tool designed to snoop on processes without need for root permissions. It allows you to see commands run by other users, cron jobs, etc. as they execute. Great for enumeration of Linux systems in CTFs. Also great to demonstrate you...

rosenbridge

project:rosenbridge : hardware backdoors in x86 CPUs github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax Overview project:rosenbridge reveals a hardware backdoor in some desktop, laptop, and embedded x86 processors. The backdoor allows ring 3 userland code to circumvent processor...

CVE-2026-90231

A flaw was found in AppArmor, a Linux kernel security module. This vulnerability allows a local attacker to bypass security confinement. The issue arises from an incorrect application of unprivileged transition restrictions on tasks already confined by a stack, enabling an escape if two transitio...

cve-2024-31317

Exploration of CVE-2024-31317 CVE-2024-31317 provides unpriviledged access to any uid and SELinux scope available to proper Android apps. This provides access to uid 1000 system and uid 2000 shell, and can be triggered entirely from an unpriviledged app, allowing for persistence of any...

cve-2022-0185-crash-poc

Container running cve-2022-0185 crash POC This is a docker container that runs the crash POC from https://www.willsroot.io/2022/01/cve-2022-0185.html. The container runs unprivileged as UID 65534. You can also use docker run -u or set a security context with RunAsUser additionally, all should yie...

ipv6_frag_escape

IPV6FRAGESCAPE A reliable unprivileged container / jail escape proof of concept for CentOS / RHEL 10. It rides a now fixed IPv6 fragmentation bug in ip6appenddata closed upstream by 38becddc, no CVE, an in-slab linear overflow into the skbsharedinfo at the tail of a packet's own head object. This...

CVE-2021-3560

CVE-2021-3560 a reliable C based exploit for CVE-2021-3560. Summary: Yestreday i stumbled upon this blog post by Kevin Backhouse discovered this vulnerability, i tried the bash commands provided in the blogpost and to my surpise it worked on my Kali Linux box! CVE-2021-3560 is an authentication...

copy-fail-CVE-2026-31431-detection-probe

Linux Kernel LPE Probe Suite — Copy Fail & Dirty Frag Safe detection tooling for two related Linux kernel local privilege escalation vulnerability families — Copy Fail CVE-2026-31431 and Dirty Frag CVE-2026-43284 / CVE-2026-43500 — both affecting all major distributions since 2017, both exploitab...

CVE-2020-16938

CVE-2020-16938 CVE-2020-16938 is a vulnerability that allows you to get unrestricted file read capabilities on the entire disk as unprivileged user. The bug was originally found and reported by my friend Jonas. His PoC can be found here. My version of the exploit consists of a bunch of Windows AP...

below-log-race-poc

below-log-race-poc CVE-2025-27591 Exploit Below privilege escalation Description This repository contains a proof-of-concept exploit for CVE-2025-27591 , a privilege escalation vulnerability in the below utility. The issue arises because below mishandles log files under /var/log/below/, allowing...

CVE-2020-8835

CVE-2020-8835 In the Linux kernel 5.5.0 and newer, the bpf verifier kernel/bpf/verifier.c does not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. This vulnerability also affects the Linux 5.4 stable series, starting with...

secpub

Cisco Nexus OS NX-OS - Command "injection" / sanitization issues. Discovered by: Peter Adkins [email protected] Access: Local; authenticated access is required. Tracking and identifiers: CVE - CVE-2011-2569 OS' Affected: Cisco Nexus OS NX-OS Vendor involvement: Alerted - patches available /...