Skip to content

Instantly share code, notes, and snippets.

View brant-ruan's full-sized avatar
🍁
独立寒秋

Bonan Ruan brant-ruan

🍁
独立寒秋
563 followers · 602 following
View GitHub Profile
@brant-ruan
brant-ruan / exploit_double_fetch_krop.c
Last active January 9, 2023 02:30
Pawnyable LK03
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
@brant-ruan
brant-ruan / double_fetch_poc.c
Created December 7, 2022 06:37
Pawnyable LK03
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
@brant-ruan
brant-ruan / exploit_race_uaf_krop.c
Last active December 3, 2022 07:40
Pawnyable LK01-4
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
@brant-ruan
brant-ruan / race_poc.c
Created December 1, 2022 08:31
Pawnyable LK01-4
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
int win = 0;
void *race(void *arg) {
@brant-ruan
brant-ruan / exploit_userland_pivoting.c
Created November 28, 2022 13:49
Pawnyable LK01-3 (bypass KASLR, SMEP with SMAP disabled)
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
@brant-ruan
brant-ruan / exploit_aar_aaw_cred.c
Created November 28, 2022 11:08
Pawnyable LK01-3
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
@brant-ruan
brant-ruan / exploit_aaw_modprobe.c
Last active November 28, 2022 09:05
Pawnyable LK01-3
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
@brant-ruan
brant-ruan / exploit_bypass_kaslr_smap_smep.c
Created November 28, 2022 07:24
Pawnyable LK01-3
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
@brant-ruan
brant-ruan / leak_kbase_and_heap.c
Last active November 28, 2022 00:55
Pawnyable LK01-3
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#define ofs_tty_ops 0xc39c60
unsigned long kbase;
@brant-ruan
brant-ruan / exploit_aar_aaw_cred.c
Last active November 26, 2022 04:10
Pawnyable LK01-2
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/prctl.h>
#include <sys/types.h>
#include <unistd.h>