nomisec
WORKING POC
991 stars
by timwr · local
https://github.com/timwr/CVE-2016-5195
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), demonstrating privilege escalation on vulnerable Android devices. The exploit leverages the race condition in the Linux kernel's memory management to overwrite read-only files, achieving root access.
Classification
Working Poc 95%
Target:
Linux kernel (Android devices)
No auth needed
Prerequisites:
Vulnerable Linux kernel (pre-patch for CVE-2016-5195) · ADB access to the target device
nomisec
WORKING POC
921 stars
by firefart · local
https://github.com/firefart/dirtycow
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), which leverages a race condition in the Linux kernel's memory subsystem to gain write access to read-only memory mappings. The exploit modifies the /etc/passwd file to create a new root user with a specified password, demonstrating a local privilege escalation (LPE) attack.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Compile the exploit with gcc
nomisec
WORKING POC
508 stars
by scumjr · local
https://github.com/scumjr/dirtycow-vdso
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), targeting the vDSO (virtual Dynamic Shared Object) to achieve local privilege escalation. The exploit uses a race condition in the Linux kernel's memory management to overwrite read-only memory mappings, specifically hijacking the `clock_gettime` function to execute arbitrary code.
Classification
Working Poc 95%
Target:
Linux kernel (versions prior to the fix for CVE-2016-5195)
No auth needed
Prerequisites:
Local access to the target system · Unpatched Linux kernel vulnerable to CVE-2016-5195
nomisec
WORKING POC
330 stars
by gbonacini · local
https://github.com/gbonacini/CVE-2016-5195
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit modifies the /etc/passwd file to grant root access with a predefined password, and includes both C++ and Golang implementations.
Classification
Working Poc 100%
Target:
Linux kernel (multiple versions, see README for details)
No auth needed
Prerequisites:
Vulnerable Linux kernel (pre-patch for CVE-2016-5195) · Unprivileged user access
nomisec
WORKING POC
280 stars
by r1is · local
https://github.com/r1is/CVE-2022-0847
This repository contains a proof-of-concept exploit for CVE-2022-0847 (Dirty Pipe), which allows overwriting any file contents in the page cache, even if the file is read-only or immutable. The exploit demonstrates privilege escalation by modifying the /etc/passwd file to gain root access without a password.
Classification
Working Poc 100%
Target:
Linux kernel 5.8 and later
No auth needed
Prerequisites:
Linux kernel 5.8 or later · Access to a local user account
nomisec
WORKING POC
271 stars
by hyln9 · poc
https://github.com/hyln9/VIKIROOT
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW) targeting 64-bit Android 6.0.1 Marshmallow. The exploit leverages the Dirty COW vulnerability to achieve local privilege escalation (LPE) by modifying the vDSO region in memory, bypassing SELinux, and providing a stable root shell without modifying the filesystem.
Classification
Working Poc 95%
Target:
Android 6.0.1 Marshmallow (64-bit)
No auth needed
Prerequisites:
A vulnerable Android device running 64-bit Android 6.0.1 Marshmallow · A patched sepolicy to allow init domain unconfined access · NDK standalone toolchain for building the exploit
nomisec
SUSPICIOUS
139 stars
by Brucetg · poc
https://github.com/Brucetg/DirtyCow-EXP
The repository claims to provide a precompiled exploit for CVE-2016-5195 (DirtyCow) but only contains a README with a link to an external blog post. No actual exploit code or technical details are included.
Classification
Suspicious 80%
Target:
Linux kernel (versions prior to 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites:
Local access to the target system
nomisec
WORKING POC
31 stars
by DavidBuchanan314 · poc
https://github.com/DavidBuchanan314/cowroot
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW) targeting Android devices. The PoC patches the `getuid` and `geteuid` functions in libc to return 0, effectively bypassing privilege checks on CyanogenMod devices.
Classification
Working Poc 95%
Target:
Android (32-bit, CyanogenMod with patched getuid/geteuid)
No auth needed
Prerequisites:
32-bit Android device · CyanogenMod with patched getuid/geteuid · Write access to /data/local/tmp
nomisec
SCANNER
16 stars
by aishee · poc
https://github.com/aishee/scan-dirtycow
This repository contains a bash script that scans for the presence of vulnerable kernel versions affected by CVE-2016-5195 (Dirty Cow). It checks the current kernel version against a hardcoded list of known vulnerable versions and reports whether the system is vulnerable, mitigated, or safe.
Classification
Scanner 100%
Target:
Linux Kernel (various versions)
No auth needed
Prerequisites:
Access to the target system to run the script
nomisec
WORKING POC
13 stars
by xlucas · local
https://github.com/xlucas/dirtycow.cr
This repository contains a Crystal language implementation of the Dirty COW (CVE-2016-5195) exploit, which leverages a race condition in the Linux kernel's memory subsystem to achieve local privilege escalation. The exploit allows writing to read-only memory mappings, enabling an attacker to modify critical system files.
Classification
Working Poc 90%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Write access to a file or memory mapping
nomisec
WORKING POC
10 stars
by pgporada · poc
https://github.com/pgporada/ansible-role-cve
This repository contains an Ansible role that mitigates CVE-2016-5195 (Dirty COW) by deploying a SystemTap module to patch the vulnerability. It includes tasks to check for the module, install dependencies, generate and load the module, and clean up afterward.
Classification
Working Poc 90%
Target:
Linux Kernel ( Dirty COW vulnerability)
Auth required
Prerequisites:
Root access to deploy the SystemTap module · SystemTap and kernel debug symbols installed
nomisec
WORKING POC
9 stars
by imust6226 · local
https://github.com/imust6226/dirtcow
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a Linux kernel privilege escalation vulnerability. The exploit modifies the /etc/passwd file to create a new root user with a specified password, leveraging a race condition in the kernel's memory handling.
Classification
Working Poc 100%
Target:
Linux kernel versions before 4.8.3, 4.7.9, and 4.4.26
No auth needed
Prerequisites:
Access to a vulnerable Linux system · GCC compiler to build the exploit
nomisec
WORKING POC
9 stars
by whu-enjoy · local
https://github.com/whu-enjoy/CVE-2016-5195
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), specifically targeting the vDSO (virtual Dynamic Shared Object) to achieve local privilege escalation. The exploit leverages a race condition in the Linux kernel's memory management to overwrite read-only memory mappings.
Classification
Working Poc 95%
Target:
Linux kernel (versions prior to the fix for CVE-2016-5195)
No auth needed
Prerequisites:
Local access to a vulnerable Linux system · Compilation tools (gcc, make, etc.)
github
WORKING POC
8 stars
by codecat007 · cpoc
https://github.com/codecat007/cvehub/tree/main/android/kernel/cve-2016-5195
This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The provided PoC demonstrates the race condition between madvise and write operations to achieve local privilege escalation.
Classification
Working Poc 100%
Target:
Linux kernel (versions before the fix)
No auth needed
Prerequisites:
Local access to the target system · Write permissions to a file
nomisec
WORKING POC
7 stars
by sideeffect42 · local
https://github.com/sideeffect42/DirtyCOWTester
This repository contains a functional exploit PoC for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The code demonstrates the race condition between the `madvise` and `write` system calls to achieve arbitrary write access to read-only memory mappings.
Classification
Working Poc 95%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Access to a vulnerable Linux system · Ability to compile and run C code
nomisec
WORKING POC
7 stars
by jas502n · local
https://github.com/jas502n/CVE-2016-5195
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit modifies the /etc/passwd file to create a new root user with a specified password, leveraging a race condition in the kernel's memory management.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Compilation tools (gcc)
nomisec
WORKING POC
6 stars
by oleg-fiksel · poc
https://github.com/oleg-fiksel/ansible_CVE-2016-5195_check
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. It includes an Ansible playbook to automate the compilation and execution of the exploit, which leverages a race condition in the copy-on-write mechanism to gain write access to read-only memory mappings.
Classification
Working Poc 95%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
Auth required
Prerequisites:
Local user access with sudo privileges · GCC compiler for exploit compilation
nomisec
WORKING POC
4 stars
by droidvoider · local
https://github.com/droidvoider/dirtycow-replacer
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), specifically designed for Android devices. It includes a tool to replace files using the Dirty COW vulnerability, with a focus on educational and testing purposes.
Classification
Working Poc 95%
Target:
Linux kernel (Android devices)
No auth needed
Prerequisites:
Android device with USB debugging enabled · Android SDK & NDK · Linux environment for compilation
nomisec
WORKING POC
4 stars
by talsim · local
https://github.com/talsim/root-dirtyc0w
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a race condition vulnerability in the Linux kernel's copy-on-write mechanism. The exploit overwrites a SUID binary (e.g., /bin/ping) with shellcode to achieve root privilege escalation.
Classification
Working Poc 100%
Target:
Linux kernel (versions before the fix for CVE-2016-5195)
No auth needed
Prerequisites:
Access to a vulnerable Linux system · SUID binary to overwrite
nomisec
WORKING POC
3 stars
by LinuxKernelContent · local
https://github.com/LinuxKernelContent/DirtyCow
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit uses a race condition in the copy-on-write mechanism to gain root access by overwriting a SUID binary.
Classification
Working Poc 100%
Target:
Linux Kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Compilation environment with gcc and pthread support
nomisec
STUB
3 stars
by esc0rtd3w · poc
https://github.com/esc0rtd3w/org.cowpoop.moooooo
This repository contains an incomplete Android APK project based on CVE-2016-5195 (DirtyCOW) but lacks functional exploit code. The README explicitly states it is non-working and under development.
Target:
Linux kernel (Android devices)
No auth needed
Prerequisites:
Android device with vulnerable kernel
nomisec
WORKING POC
3 stars
by arttnba3 · local
https://github.com/arttnba3/CVE-2016-5195
This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. It includes a proof-of-concept for arbitrary file writes and two exploits for gaining root access via /etc/passwd manipulation or SUID binary overwriting.
Classification
Working Poc 95%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites:
Local access to a vulnerable Linux system · Readable target file for arbitrary write PoC
nomisec
WORKING POC
2 stars
by FloridSleeves · poc
https://github.com/FloridSleeves/os-experiment-4
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit uses race conditions between madvise and /proc/self/mem writes to overwrite the getuid function in libc, achieving root privileges.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites:
Local access to a vulnerable Linux system · Compiler (gcc) to build the exploit
nomisec
WORKING POC
2 stars
by LiEnby · local
https://github.com/LiEnby/PSSRoot
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The code includes native C implementations of the exploit (dirtycow.c) and a C# wrapper for executing the exploit via ADB on Android devices.
Classification
Working Poc 95%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Android device with ADB access · Vulnerable Linux kernel version
nomisec
SCANNER
1 stars
by titanhp · poc
https://github.com/titanhp/Dirty-COW-CVE-2016-5195-Testing
This repository contains a script to detect the presence of the Dirty COW vulnerability (CVE-2016-5195) by checking the kernel version against a list of known vulnerable versions. It does not include an exploit but provides a mitigation status check.
Classification
Scanner 95%
Target:
Linux Kernel (various versions)
No auth needed
Prerequisites:
Access to the target system to run the script
nomisec
WORKING POC
1 stars
by arbll · poc
https://github.com/arbll/dirtycow
This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition in the copy-on-write mechanism to gain root access by overwriting the SUID binary `/usr/bin/passwd`.
Classification
Working Poc 95%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Access to a vulnerable Linux system · Ability to compile and execute C code
nomisec
WORKING POC
1 stars
by ASRTeam · local
https://github.com/ASRTeam/CVE-2016-5195
The repository contains a functional exploit for CVE-2016-5195 (Dirty COW), demonstrating a race condition in the Linux kernel's memory management subsystem to achieve local privilege escalation by modifying read-only files.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Read-only file to modify
nomisec
WORKING POC
1 stars
by DanielEbert · local
https://github.com/DanielEbert/CVE-2016-5195
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), demonstrating a local privilege escalation vulnerability in the Linux kernel. The exploit uses a race condition in the copy-on-write mechanism to gain write access to read-only memory mappings, allowing an attacker to overwrite files and escalate privileges.
Classification
Working Poc 95%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Compilation tools (e.g., Android NDK for Android targets)
nomisec
WORKING POC
1 stars
by TotallyNotAHaxxer · local
https://github.com/TotallyNotAHaxxer/CVE-2016-5195
This repository contains a functional Go implementation of the Dirty COW (CVE-2016-5195) exploit, which leverages a race condition in the Linux kernel's memory subsystem to achieve local privilege escalation. The exploit overwrites the SUID binary `/usr/bin/passwd` with a payload that spawns a root shell.
Classification
Working Poc 95%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Write access to `/proc/self/mem` · SUID binary to overwrite (e.g., `/usr/bin/passwd`)
nomisec
WORKING POC
1 stars
by th3-5had0w · local
https://github.com/th3-5had0w/DirtyCOW-PoC
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (DirtyCOW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition in the copy-on-write mechanism to gain write access to read-only memory mappings, allowing an attacker to modify files they would otherwise not have permission to write to.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Access to a vulnerable Linux system · Ability to compile and execute the exploit code
nomisec
WORKING POC
1 stars
by 0x3n19m4 · local
https://github.com/0x3n19m4/CVE-2016-5195
This is a functional exploit for CVE-2016-5195 (Dirty COW), a race condition in the Linux kernel's memory subsystem. It uses concurrent threads to trigger a race between madvise(MADV_DONTNEED) and write operations to gain write access to read-only memory mappings, allowing privilege escalation by modifying /etc/passwd.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Write access to /proc/self/mem
nomisec
STUB
by passionchenjianyegmail8 · poc
https://github.com/passionchenjianyegmail8/scumjrs
The repository contains only a README file with a brief mention of CVE-2016-5195 (Dirty COW) but no actual exploit code or technical details. It appears to be a placeholder or incomplete repository.
Target:
Linux kernel (versions prior to fix for Dirty COW)
No auth needed
nomisec
STUB
by sakilahamed · poc
https://github.com/sakilahamed/Linux-Kernel-Exploit-LAB
The repository contains only a README.md file with minimal information about CVE-2016-5195 (Dirty COW) but no actual exploit code or technical details. It appears to be a placeholder or incomplete repository.
Target:
Linux Kernel (versions prior to fix for Dirty COW)
No auth needed
Prerequisites:
Access to a vulnerable Linux system
nomisec
WRITEUP
by h1n4mx0 · poc
https://github.com/h1n4mx0/Research-CVE-2016-5195
This repository provides a detailed technical analysis of CVE-2016-5195 (Dirty Cow), explaining the race condition vulnerability in Linux kernel memory management and how it can be exploited for local privilege escalation. It includes a conceptual exploit code example and a walkthrough of the attack mechanism.
Classification
Writeup 95%
Target:
Linux Kernel (versions prior to fix)
Auth required
Prerequisites:
Local access to a vulnerable Linux system · User-level permissions
nomisec
WORKING POC
by MarioAlejos-Cs · local
https://github.com/MarioAlejos-Cs/dirtycow-lab
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), demonstrating privilege escalation by modifying /etc/passwd to insert a root user with a known password. The exploit uses a race condition in the Linux kernel's memory management to achieve write access to read-only memory mappings.
Classification
Working Poc 100%
Target:
Linux kernel versions before 4.8.3, 4.7.9, and 4.4.26
No auth needed
Prerequisites:
Access to a vulnerable Linux system with a kernel version affected by CVE-2016-5195 · Compilation environment to build the exploit binary
nomisec
WORKING POC
by mohammadamin382 · poc
https://github.com/mohammadamin382/dirtycow-lab
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition in the copy-on-write mechanism to modify read-only files, potentially allowing local privilege escalation.
Classification
Working Poc 95%
Target:
Linux Kernel versions 2.6.22 to 4.8.2
No auth needed
Prerequisites:
Vulnerable Linux kernel version · Local access to the system
nomisec
WRITEUP
by istenrot · poc
https://github.com/istenrot/centos-dirty-cow-ansible
This repository provides an Ansible playbook for mitigating CVE-2016-5195 (Dirty COW) on CentOS/Scientific Linux systems using SystemTap. It automates the installation of kernel debuginfo packages and SystemTap, then deploys a SystemTap module to mitigate the vulnerability.
Classification
Writeup 90%
Target:
Linux Kernel (CentOS/Scientific Linux)
Auth required
Prerequisites:
CentOS/Scientific Linux system · Ansible · SystemTap · Kernel debuginfo packages
nomisec
STUB
by dulanjaya23 · poc
https://github.com/dulanjaya23/Dirty-Cow-CVE-2016-5195-
The repository contains only a README with a brief description of CVE-2016-5195 (Dirty Cow) but no actual exploit code or technical details. It appears to be a placeholder or incomplete repository.
Target:
Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites:
Local access to a vulnerable Linux system
github
WRITEUP
by OscarYR · poc
https://github.com/OscarYR/CVE_Reproduction/tree/main/Dirty Cow/CVE-2016-5195.md
This repository provides a detailed technical analysis of CVE-2016-5195 (Dirty Cow), including the root cause, exploitation steps, and mitigation strategies. It includes screenshots and references to external PoC exploits but does not contain functional exploit code itself.
Classification
Writeup 100%
Target:
Linux Kernel (versions < 4.8.3)
Auth required
Prerequisites:
Local access to a vulnerable Linux system · Low-privileged user account
nomisec
WORKING POC
by ramahmdr · local
https://github.com/ramahmdr/dirtycow
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a Linux kernel privilege escalation vulnerability. The exploit modifies the /etc/passwd file to create a new root user by leveraging a race condition in the kernel's memory handling.
Classification
Working Poc 100%
Target:
Linux kernel versions 2.x to 4.x before 4.8.3
No auth needed
Prerequisites:
Local access to the target system · Compilation tools (gcc)
nomisec
WORKING POC
by zakariamaaraki · local
https://github.com/zakariamaaraki/Dirty-COW-CVE-2016-5195-
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit uses a race condition between `madvise` and `proc/self/mem` to gain write access to read-only memory mappings, allowing an attacker to modify `/etc/group` and escalate privileges to root.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Access to a vulnerable Linux system · Ability to compile and execute the exploit binary
nomisec
WORKING POC
by theo543 · poc
https://github.com/theo543/OSDS_Paper_CVE-2016-5195
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), a Linux privilege escalation vulnerability. The exploit demonstrates the race condition in the copy-on-write mechanism but lacks post-exploit steps to prevent kernel crashes due to writeback.
Classification
Working Poc 90%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites:
Local access to a vulnerable Linux system
nomisec
WRITEUP
by elhaddadalaa788-alt · poc
https://github.com/elhaddadalaa788-alt/kernel-exploit-dirtycow-project-subm
This repository provides a detailed writeup of a privilege escalation exploit using CVE-2016-5195 (Dirty COW) on Ubuntu 16.04. It includes high-level steps, proof of execution, and screenshots but does not contain actual exploit code.
Classification
Writeup 90%
Target:
Linux Kernel (Ubuntu 16.04)
Auth required
Prerequisites:
Vulnerable kernel version · Compilation environment matching victim libraries · Access to a limited user account on the victim system
nomisec
WORKING POC
by fei9747 · local
https://github.com/fei9747/CVE-2016-5195
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), which leverages a race condition in the Linux kernel's memory subsystem to gain write access to read-only memory mappings. The exploit modifies the /etc/passwd file to create a new user with root privileges.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Compilation tools (gcc)
nomisec
WORKING POC
by ASUKA39 · local
https://github.com/ASUKA39/CVE-2016-5195
This repository contains a functional exploit for CVE-2016-5195 (DirtyCOW), demonstrating a race condition in the Linux kernel's memory management that allows privilege escalation by writing to read-only files. The PoC includes a detailed technical analysis of the exploit mechanism and kernel internals.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Access to a vulnerable Linux system · Ability to compile and execute C code
gitlab
WRITEUP
by nu11secur1ty · poc
https://gitlab.com/nu11secur1ty/Protect-CVE-2016-5195-DirtyCow
This repository provides a detailed technical writeup on mitigating CVE-2016-5195 (Dirty Cow), including patching instructions, temporary fixes using systemtap, and testing methods. It does not contain exploit code but offers in-depth guidance on protection and verification.
Classification
Writeup 95%
Target:
Linux Kernel (multiple distributions)
No auth needed
Prerequisites:
Access to a vulnerable Linux system · Root privileges for mitigation steps
nomisec
WORKING POC
by ldenevi · local
https://github.com/ldenevi/CVE-2016-5195
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), a race condition vulnerability in the Linux kernel's Copy-on-Write mechanism. The exploit leverages a race between madvise and /proc/self/mem writes to achieve local privilege escalation.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to a vulnerable Linux system · Compilation tools (gcc, make)
nomisec
WORKING POC
by sribaba · local
https://github.com/sribaba/android-CVE-2016-5195
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW) targeting Android devices. It includes compiled binaries and scripts to demonstrate privilege escalation by overwriting the 'run-as' binary to gain root access.
Classification
Working Poc 100%
Target:
Linux kernel (Android devices)
No auth needed
Prerequisites:
Vulnerable Android device with ADB access · NDK for compilation
nomisec
WORKING POC
by Nathanloupy · poc
https://github.com/Nathanloupy/42adv_boot2root
This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), including multiple variants targeting /etc/crontab, /etc/passwd, and other files. The exploits leverage the race condition in the Linux kernel's memory subsystem to gain write access to read-only memory mappings.
Classification
Working Poc 95%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites:
Local access to the vulnerable system · Compilation tools (gcc)
nomisec
WORKING POC
by EDLLT · local
https://github.com/EDLLT/CVE-2016-5195-master
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW) targeting Android devices. It includes compiled binaries and scripts to demonstrate privilege escalation by overwriting the 'run-as' binary to gain root access.
Classification
Working Poc 95%
Target:
Linux kernel (Android devices)
No auth needed
Prerequisites:
ADB access to the target device · Vulnerable Linux kernel (pre-patch for CVE-2016-5195)
nomisec
WORKING POC
by xpcmdshell · poc
https://github.com/xpcmdshell/derpyc0w
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), which leverages a race condition to overwrite a read-only SUID executable with a custom ELF payload. The payload elevates privileges via setuid(0), modifies kernel parameters to prevent crashes, and spawns a root shell.
Classification
Working Poc 100%
Target:
Linux kernel (versions prior to the fix for CVE-2016-5195)
No auth needed
Prerequisites:
A root-owned SUID executable with read access · ptrace not restricted on the target system
nomisec
WORKING POC
by ZhiQiAnSecFork · local
https://github.com/ZhiQiAnSecFork/DirtyCOW_CVE-2016-5195
This repository contains functional exploit code for CVE-2016-5195 (DirtyCOW), a Linux kernel privilege escalation vulnerability. It includes multiple PoC exploits (e.g., cowroot.c, dirtycow-mem.c) and detection scripts for various distributions.
Classification
Working Poc 95%
Target:
Linux kernel (versions before 2016-10-18, specifically 2.6.22 and later)
No auth needed
Prerequisites:
Local access to a vulnerable Linux system · GCC compiler to build the exploit
nomisec
WORKING POC
by KaviDk · local
https://github.com/KaviDk/dirtyCow
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition between madvise and procselfmem to gain write access to read-only memory mappings, allowing local users to escalate privileges.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
Auth required
Prerequisites:
Local user access · Read-only file to modify
nomisec
SCANNER
by ndobson · poc
https://github.com/ndobson/inspec_CVE-2016-5195
This repository contains an Inspec profile for detecting CVE-2016-5195 (Dirty COW), a Linux kernel privilege escalation vulnerability. It downloads and compiles a known exploit script to test for vulnerability by attempting to modify a read-only file.
Classification
Scanner 95%
Target:
Linux kernel 2.x through 4.x before 4.8.3
No auth needed
Prerequisites:
Local access to the target system · GCC compiler installed
nomisec
SUSPICIOUS
by KasunPriyashan · poc
https://github.com/KasunPriyashan/Y2S1-Project-Linux-Exploitaion-using-CVE-2016-5195-Vulnerability
The repository contains no exploit code or technical details, only a vague description of exploiting CVE-2016-5195 (Dirty COW) for root access. It appears to be a placeholder or academic project summary without actionable content.
Classification
Suspicious 90%
Target:
Linux kernel < 4.8.3
No auth needed
Prerequisites:
Local access to a vulnerable Linux system
nomisec
WRITEUP
by pardhu045 · poc
https://github.com/pardhu045/linux-privilege-escalation
This repository provides a detailed technical walkthrough of exploiting CVE-2016-5195 (Dirty COW) for local privilege escalation on Metasploitable2, including step-by-step commands, troubleshooting, and validation steps.
Classification
Writeup 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
Auth required
Prerequisites:
Access to a vulnerable Linux system with a low-privileged account · Compilation tools (gcc) on the target system
nomisec
WRITEUP
by Samuel-G3 · poc
https://github.com/Samuel-G3/Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow
This repository provides a detailed writeup on exploiting CVE-2016-5195 (Dirty Cow), a Linux kernel vulnerability allowing local privilege escalation via a race condition. It includes steps for verification, compilation, and execution but lacks actual exploit code.
Classification
Writeup 90%
Target:
Linux kernel ≤ 4.8.3
Auth required
Prerequisites:
Local access to vulnerable system · Compilation tools (g++) · Transfer mechanism (scp)
nomisec
WORKING POC
by acidburnmi · poc
https://github.com/acidburnmi/CVE-2016-5195-master
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), demonstrating privilege escalation on vulnerable Android devices via ADB. The exploit leverages the race condition in the Linux kernel's memory subsystem to overwrite read-only memory mappings, allowing arbitrary code execution as root.
Classification
Working Poc 100%
Target:
Linux kernel (Android devices)
No auth needed
Prerequisites:
Vulnerable Linux kernel (pre-patch for CVE-2016-5195) · ADB access to the target Android device
exploitdb
WORKING POC
VERIFIED
by FireFart · clocallinux
https://www.exploit-db.com/exploits/40839
This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to overwrite the /etc/passwd file, allowing privilege escalation by adding a new root user. It uses the ptrace_pokedata method to achieve a race condition and modify the file.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Compilation of the exploit code with gcc
exploitdb
WORKING POC
VERIFIED
by Phil Oester · clocallinux
https://www.exploit-db.com/exploits/40611
This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to achieve local privilege escalation by racing the madvise(MADV_DONTNEED) system call while writing to /proc/self/mem, allowing an attacker to overwrite read-only files.
Classification
Working Poc 100%
Target:
Linux kernel versions before 4.8.3, 4.7.9, and 4.4.26
No auth needed
Prerequisites:
Local access to the target system · Read-only file to overwrite
exploitdb
WORKING POC
VERIFIED
by Gabriele Bonacini · c++locallinux
https://www.exploit-db.com/exploits/40847
This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to gain root privileges by modifying the /etc/passwd file via a race condition in the Linux kernel's memory management. It spawns a root shell with a predefined password.
Classification
Working Poc 100%
Target:
Linux Kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Write access to /etc/passwd
exploitdb
WORKING POC
by Phil Oester · clocallinux
https://www.exploit-db.com/exploits/40838
This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to perform a race condition attack between madvise and ptrace system calls, allowing local privilege escalation by overwriting read-only files.
Classification
Working Poc 100%
Target:
Linux Kernel < 4.8.3
No auth needed
Prerequisites:
Local access to the target system · Read access to a target file
exploitdb
WORKING POC
VERIFIED
by Robin Verton · clocallinux
https://www.exploit-db.com/exploits/40616
This exploit leverages the DirtyCow vulnerability (CVE-2016-5195) to achieve local privilege escalation by racing the madvise system call with writes to /proc/self/mem, overwriting a SUID binary (e.g., /usr/bin/passwd) with a shellcode payload that spawns a root shell.
Classification
Working Poc 100%
Target:
Linux kernel < 4.8.3 (with specific configurations)
No auth needed
Prerequisites:
Local access to the target system · SUID binary with read permissions · Vulnerable Linux kernel version
vulncheck_xdb
SUSPICIOUS
local
https://github.com/l0veormiss/l0veormiss.github.io
The repository claims to be a reverse shell generator but lacks actual exploit code for CVE-2026-5195. It contains a web-based tool for generating reverse shells, which is unrelated to the specified CVE.
Classification
Suspicious 90%
Target:
N/A
No auth needed
Prerequisites:
N/A
vulncheck_xdb
WORKING POC
local
https://github.com/B1ackCat/cve-2016-5195-DirtyCOW
This repository contains functional exploit code for CVE-2016-5195 (DirtyCOW), a privilege escalation vulnerability in the Linux kernel. The exploit modifies /etc/passwd to create a new user with root privileges using race conditions between ptrace and /proc/self/mem.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites:
local access to the target system · ability to compile and execute the exploit
vulncheck_xdb
WORKING POC
local
https://github.com/Jekyll-Hyde2022/PrivEsc-Linux
This repository contains a functional exploit for CVE-2016-5195 (DirtyCow), a privilege escalation vulnerability in the Linux kernel. The exploit uses PTRACE_POKEDATA to overwrite a SUID binary with shellcode, granting root access. The code is well-documented and includes both x86 and x64 payloads.
Classification
Working Poc 95%
Target:
Linux kernel (versions vulnerable to DirtyCow)
No auth needed
Prerequisites:
Access to a vulnerable Linux system · Compilation tools (gcc)
vulncheck_xdb
WORKING POC
local
https://github.com/Danyw24/dirtycow2-
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit manipulates the /etc/passwd file to gain root access by leveraging a race condition in the copy-on-write mechanism.
Classification
Working Poc 100%
Target:
Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites:
Local access to the target system · Write access to /etc/passwd