Trail of Bits Exploits & PoCs

This repository contains public exploits, proof-of-concepts, and security research from Trail of Bits. These are primarily developed for security research, penetration testing, and educational purposes.

Usage

Each directory contains its own README with detailed setup instructions and usage examples. Most exploits require specific hardware or virtualized environments to run properly.

Disclaimer

These exploits are provided for educational and research purposes only. Use only on systems you own or have explicit permission to test. Trail of Bits is not responsible for any misuse of these tools.

Contributing

For questions or contributions, please open an issue or pull request on this repository.

License

Apache 2.0

See LICENSE file for more details.

Table of Contents

obts-2025-macos-lpe

User-to-root LPE for macOS, exploits traceroute6. Presented at ObjectiveByTheSea#8.

junkyard-2025-beacon-prism

BitDefender Box 1 firmware downgrade and command injection exploit chain. Exploits unauthenticated firmware downgrade vulnerability to upload older signed firmware containing command injection vulnerability.

junkyard-2025-cloudy-wrench

Netgear WGR614v9 router exploit chains. Multiple vulnerability chains including authentication bypass, BSS overflow, and stack-based buffer overflows for remote code execution.

Sleepy pickle

Sleepy pickle exploit implementation. It demonstrates ML model compromission using malicious pickle files leading to user data theft, harmful content generation, and phishing. The repository also demonstrates how to make the exploit self-replicating accross local pickle files.

junkyard-2026-ubuntu-xenial-lpe

Local privilege escalation for Ubuntu Xenial (16.04). Exploits a refcount overflow for use-after-free, which gets turned into a arbitrary write targeting modprobe_path for privesc.