Skip to content
Nick Bulischeck edited this page Apr 9, 2019 · 51 revisions

Table of PoCs

Note: if you experience crashes or locks take a look at this fix.

Link Usage Description Family
dirtyc0w.c ./dirtyc0w file content Read-only write /proc/self/mem
cowroot.c ./cowroot SUID-based root /proc/self/mem
dirtycow-mem.c ./dirtycow-mem libc-based root /proc/self/mem
pokemon.c ./d file content Read-only write PTRACE_POKEDATA
dirtycow.cr dirtycow --target --string --offset Read-only write /proc/self/mem
dirtyc0w.c ./dirtycow file content Read-only write (Android) /proc/self/mem
dirtycow.rb use exploit/linux/local/dirtycow and run SUID-based root /proc/self/mem
0xdeadbeef.c ./0xdeadbeef vDSO-based root PTRACE_POKEDATA
naughtyc0w.c ./c0w suid SUID-based root /proc/self/mem
c0w.c ./c0w SUID-based root PTRACE_POKEDATA
dirty_pass[...].c ./dirty_passwd_adjust_cow /etc/passwd based root /proc/self/mem
mucow.c ./mucow destination < payload.exe Read-only write (multi page) PTRACE_POKEDATA
cowpy.c r2pm -i dirtycow Read-only write (radare2) /proc/self/mem
dirtycow.fasm ./main SUID-based root /proc/self/mem
dcow.cpp ./dcow /etc/passwd based root /proc/self/mem
dirtyc0w.go go run dirtyc0w.go -f=file -c=content Read-only write /proc/self/mem
dirty.c ./dirty /etc/passwd based root PTRACE_POKEDATA

List of PoCs

Clone this wiki locally