Skip to content

Instantly share code, notes, and snippets.

View brant-ruan's full-sized avatar
🍁
独立寒秋

Bonan Ruan brant-ruan

🍁
独立寒秋
607 followers · 562 following
View GitHub Profile
@brant-ruan
brant-ruan / exploit_bypass_kpti.c
Last active November 15, 2022 15:46
Pawnyable LK01
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <signal.h>
char *VULN_DRV = "/dev/holstein";
void spawn_shell();
@brant-ruan
brant-ruan / exploit_bypass_kaslr.c
Last active November 21, 2022 13:18
Pawnyable LK01
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <signal.h>
char *VULN_DRV = "/dev/holstein";
void spawn_shell();
@brant-ruan
brant-ruan / heap_overflow_demo.c
Last active November 25, 2022 01:20
Pawnyable LK01-2
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
int main() {
int spray[100];
for (int i = 0; i < 50; i++) {
@brant-ruan
brant-ruan / leak_kernel_base.c
Last active November 25, 2022 01:21
Pawnyable LK01-2
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#define ofs_tty_ops 0xc38880
unsigned long kbase;
@brant-ruan
brant-ruan / leak_heap_and_craft_fake_func_table.c
Last active November 25, 2022 01:21
Pawnyable LK01-2
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#define ofs_tty_ops 0xc38880
#define SPRAY_NUM 100
@brant-ruan
brant-ruan / exploit_bypass_kaslr_smap.c
Last active November 25, 2022 10:49
Pawnyable LK01-2
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
@brant-ruan
brant-ruan / exploit_try_to_bypass_smap_nokaslr.c
Last active November 25, 2022 10:50
Pawnyable LK01-2
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
@brant-ruan
brant-ruan / exploit_bypass_kaslr_smap_smep.c
Last active November 25, 2022 10:49
Pawnyable LK01-2
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
@brant-ruan
brant-ruan / exploit_aaw_modprobe.c
Created November 25, 2022 11:14
Pawnyable LK01-2
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
@brant-ruan
brant-ruan / exploit_aar_aaw_cred.c
Last active November 26, 2022 04:10
Pawnyable LK01-2
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/prctl.h>
#include <sys/types.h>
#include <unistd.h>