{"vulnerability": "cve-2022-34918", "sightings": [{"uuid": "486aea0f-2c55-4579-ac6e-3945548a761b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "e2ac07ad-cf2f-472e-bc14-413921c36ca3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:47.000000Z"}, {"uuid": "bf3308e4-7795-470a-be0c-adbf3117bf88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-9d1c9d9f-675cdbc3d8f48478", "content": "", "creation_timestamp": "2025-03-01T00:19:17.019382Z"}, {"uuid": "5367293d-0fc8-49b4-aac1-52b61c134a8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lj6s25awbk2n", "content": "", "creation_timestamp": "2025-02-27T21:02:01.868341Z"}, {"uuid": "38cc1937-6752-4b96-a0e3-32d686ed108d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_nft_set_elem_init_privesc.rb", "content": "", "creation_timestamp": "2022-09-27T22:01:50.000000Z"}, {"uuid": "d3ae78e8-499c-4e18-96e5-7d302f5dafb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:06.000000Z"}, {"uuid": "86b568a3-19fc-4b6d-95b0-3f3255c2f9bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2850", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-34918 netfilter nf_tables \u672c\u5730\u63d0\u6743 POC\nURL\uff1ahttps://github.com/veritas501/CVE-2022-34918\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-08-04T10:47:33.000000Z"}, {"uuid": "ec778af0-0f76-4bf0-97c8-0d76f4c8c432", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/hackingbra/11", "content": "https://github.com/randorisec/CVE-2022-34918-LPE-PoC\n\n@hackingbra", "creation_timestamp": "2022-07-24T15:30:21.000000Z"}, {"uuid": "978ea504-1fa4-4d79-be14-ecd8bc8460c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/poxek/2064", "content": "CVE-2022-34918: Linux Kernel LPE PoC\n\nhttps://github.com/randorisec/CVE-2022-34918-LPE-PoC\n\n+ \u0440\u0435\u0441\u0435\u0440\u0447: https://randorisec.fr/crack-linux-firewall/\n\n#exploit #git", "creation_timestamp": "2022-07-22T08:30:32.000000Z"}, {"uuid": "4a6d75c5-75d7-4308-acb6-98e4d53341e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/poxek/2145", "content": "LPE exploit for CVE-2022-34918\nThis exploit has been written for the kernel Linux ubuntu 5.15.0-39-generic\nhttps://github.com/randorisec/CVE-2022-34918-LPE-PoC\n\u25b6\ufe0f \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "creation_timestamp": "2022-07-31T15:00:48.000000Z"}, {"uuid": "b1e95fbd-0109-46b4-970b-e6814a7f1c11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/poxek/2205", "content": "LPE exploit for CVE-2022-34918\nexploit kernel\u00a0Linux ubuntu 5.15.0-39-generic\n\nhttps://github.com/randorisec/CVE-2022-34918-LPE-PoC\n\nArticle\n[CVE-2022-34918] A crack in the Linux firewall\nhttps://www.randorisec.fr/crack-linux-firewall/", "creation_timestamp": "2022-08-13T21:01:39.000000Z"}, {"uuid": "5341e2e9-7963-433e-973f-c28e4aaefdde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/linkersec/177", "content": "[CVE-2022-34918] A crack in the Linux firewall\n\nAn article by Arthur Mongodin about exploiting a slab-buffer-overflow in the netfilter subsystem.\n\nThe exploit uses the unlinking technique from Lam Jun Rong's io_uring exploit.", "creation_timestamp": "2022-08-03T04:52:24.000000Z"}, {"uuid": "bc7e04c9-e542-4aed-a6ae-0e4039296a7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "Telegram/TXmZ8EBGvdc4uufvEqu6hfgyjEc7K_gjD1Jpp8Uzvu6-KK0", "content": "", "creation_timestamp": "2023-03-23T09:18:19.000000Z"}, {"uuid": "7aefaa2d-9971-4361-9adc-4294d2a800c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "Telegram/lJQH4YjVkyA2usWSgfNDCKKM1SMUQPbukQqfHOjh8fKsbQ", "content": "", "creation_timestamp": "2022-07-21T12:17:08.000000Z"}, {"uuid": "a1537988-7218-4618-9f91-11302e094002", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/926", "content": "CVE-2022-34918\nA crack in the Linux firewall\n\u0420\u0430\u0437\u0431\u043e\u0440 \u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430 \u0442\u0443\u0442\n\n\n#linux #poc #exploit #lpe", "creation_timestamp": "2022-07-21T10:35:57.000000Z"}, {"uuid": "3ac24eea-6c6e-4921-bcff-89827332dd5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/1427", "content": "kernel-linux-factory\n*\n\u0423\u0434\u043e\u0431\u043d\u043e \u0442\u0435\u043c, \u0447\u0442\u043e \u043d\u0435 \u043d\u0443\u0436\u043d\u043e \u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043b\u0438 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c \u0441\u0440\u0435\u0434\u0443, \u0433\u043b\u044f\u043d\u0443\u043b \u043a\u0430\u043a\u043e\u0435 \u044f\u0434\u0440\u043e, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u0441\u043f\u043b\u043e\u0435\u0442, \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043f\u043e \u043c\u043e\u0440\u0434\u0435 #root\n*\n\u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 exploits \u0434\u043b\u044f:\nCVE-2016-9793\n4-20-BPF-integer\nCVE-2017-5123\nCVE-2017-6074\nCVE-2017-7308\nCVE-2017-8890\nCVE-2017-11176\nCVE-2017-16995\nCVE-2017-1000112\nCVE-2018-5333\nCVE-2019-9213 & CVE-2019-8956\nCVE-2019-15666\nCVE-2020-8835\nCVE-2020-27194\nCVE-2021-3156\nCVE-2021-31440\nCVE-2021-3490\nCVE-2021-22555\nCVE-2021-41073\nCVE-2021-4154\nCVE-2021-42008\nCVE-2021-43267\nCVE-2022-0185\nCVE-2022-0847\nCVE-2022-0995\nCVE-2022-1015\nCVE-2022-2588\nCVE-2022-2639\nCVE-2022-25636\nCVE-2022-27666\nCVE-2022-32250\nCVE-2022-34918\n\ndownload\n\n#linux #exploits #kernel", "creation_timestamp": "2023-03-23T06:30:43.000000Z"}, {"uuid": "cfb771c2-ac51-4c38-82ed-228620b09554", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "Telegram/ilGwqtoR942kCEN4VHW1I8j3V1o_UPdcgKq5uWhMt2eGfA", "content": "", "creation_timestamp": "2022-07-22T00:03:30.000000Z"}, {"uuid": "9baae80e-e39d-4305-93e5-4235ab5bf686", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "Telegram/6PgG1jna3SSTTQmu6Bbd073fVa6QDWjxsA1I-2nGrEBSvw", "content": "", "creation_timestamp": "2022-08-06T05:24:31.000000Z"}, {"uuid": "b02883b4-5880-4b90-80ec-204c4843e98e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/MrVGunz/345", "content": "CVE-2022-34918 : LPE POC , This exploit has been written for the kernel\u00a0Linux ubuntu 5.15.0-39\nhttps://github.com/randorisec/CVE-2022-34918-LPE-PoC", "creation_timestamp": "2022-07-22T01:41:21.000000Z"}, {"uuid": "96e7c1bd-219c-4bc8-8bb8-1b8b709f1fd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/RalfHackerChannel/1232", "content": "CVE-2022-34918: Linux Kernel LPE PoC\n\nhttps://github.com/randorisec/CVE-2022-34918-LPE-PoC\n\n+ \u0440\u0435\u0441\u0435\u0440\u0447: https://randorisec.fr/crack-linux-firewall/\n\n#exploit #git", "creation_timestamp": "2022-07-21T21:51:18.000000Z"}, {"uuid": "c9ba083a-85c8-40bf-8d7d-c6e5734afb5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/crackcodes/873", "content": "Updates On Hackbyte Forum:-\n\n\ud83d\udcccLPE exploit for CVE-2022-34918\n\ud83d\udcccvscan\n\ud83d\udcccKF/x \u2013 Kernel Fuzzer for Xen Project\n\ud83d\udcccPHP-jpeg-injector\n\ud83d\udcccHiddenWall - HiddenWall is a Linux kernel module generator for custom rules with netfilter\n\ud83d\udcccSubDomz - The All in One Subdomain Enumeration Tool\n\ud83d\udcccNiCOFF - NiCOFF is a COFF and BOF file loader written in Nim\n\ud83d\udcccKoviD LKM - Rootkit is a full-feature LKM intended for use against\n\ud83d\udcccWindows10 Exploits\n\ud83d\udcccSilentETHMiner\n\ud83d\udcccAcunetix_14.9.220713150 For Windows/Linux\n\ud83d\udcccCloud is more fun with an SSRF\n\ud83d\udcccDNS-over-HTTP/3 in Android\n\ud83d\udcccPwn2Own Miami 2022: OPC UA .NET Standard Trusted Application Check Bypass\n\ud83d\udccc8teenxxx.com Leak\n\ud83d\udcccAngoc.org Leak\n\ud83d\udcccpconline.com.cn Leak\n\ud83d\udcccTomsk State University\u2019s main system source code Leak\n\ud83d\udcccIxigo.com Leak\n\ud83d\udcccStockx.com Leak\n\ud83d\udcccNeurotech Telecom Mexico Leak\n\ud83d\udcccThe Surreal Case of a C.I.A.- Hacker\u2019s Revenge\n\ud83d\udcccBotnix.net Leak\n\ud83d\udcccPaybito.com Leak\n\n\ud83d\udc49\ud83c\udffb\ud83d\udc49\ud83c\udffb Updates:- https://bit.ly/3yRyah3 \ud83d\udc48\ud83c\udffb\ud83d\udc48\ud83c\udffb", "creation_timestamp": "2022-07-21T12:14:33.000000Z"}, {"uuid": "e7f79607-ec0c-43c1-a4d9-a2c9aecf2469", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/2619", "content": "[CVE-2022-34918] A crack in the Linux firewall\nhttps://www.randorisec.fr/crack-linux-firewall/", "creation_timestamp": "2026-08-03T00:26:58.751658Z"}, {"uuid": "6ca35924-3461-46e9-a167-42871e51e191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/167", "content": "https://github.com/veritas501/CVE-2022-34918", "creation_timestamp": "2022-08-06T15:56:07.000000Z"}, {"uuid": "74b4e270-3dd8-46e6-aca1-a35272b0b439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/6466", "content": "#tools\n#Offensive_security\n1. GoodbyeDPI - Deep Packet Inspection circumvention utility (for Windows)\nhttps://github.com/ValdikSS/GoodbyeDPI\n2. A crack in the Linux firewall (CVE-2022-34918)\nhttps://www.randorisec.fr/crack-linux-firewall\n]-> https://github.com/randorisec/CVE-2022-34918-LPE-PoC", "creation_timestamp": "2022-07-26T11:17:59.000000Z"}, {"uuid": "783455e2-503c-4ff1-9d88-e67fb1b92247", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/club31337/1138", "content": "https://github.com/randorisec/CVE-2022-34918-LPE-PoC", "creation_timestamp": "2024-11-09T11:31:16.000000Z"}, {"uuid": "647f81e7-aaf0-4d32-9469-e5adde332f88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://t.me/EchelonEyes/474", "content": "\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 Linux\n\n\u041d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0418\u0411 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Netfilter \u044f\u0434\u0440\u0430 Linux (\u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 5.18.9) \u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u043d\u0435\u0435. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u0442\u0438\u043f\u043e\u0432 \u0432 nft_set_elem_init, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u0432 Ubuntu 22.04.\n\n\u041e\u0431 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Linux, \u0438 \u0435\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043d\u043e\u043c\u0435\u0440 CVE-2022-34918, \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS: 7.8. \u0412\u0435\u043d\u0434\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u043f\u0430\u0442\u0447, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043d\u0430 GitHub.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.randorisec.fr/crack-linux-firewall/\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #Linux", "creation_timestamp": "2026-07-26T02:02:46.451724Z"}, {"uuid": "62267e68-135c-4f14-9985-f02acbef6ef3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://t.me/EchelonEyes/474", "content": "\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 Linux\n\n\u041d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0418\u0411 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Netfilter \u044f\u0434\u0440\u0430 Linux (\u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 5.18.9) \u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u043d\u0435\u0435. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u0442\u0438\u043f\u043e\u0432 \u0432 nft_set_elem_init, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u0432 Ubuntu 22.04.\n\n\u041e\u0431 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Linux, \u0438 \u0435\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043d\u043e\u043c\u0435\u0440 CVE-2022-34918, \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS: 7.8. \u0412\u0435\u043d\u0434\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u043f\u0430\u0442\u0447, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043d\u0430 GitHub.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.randorisec.fr/crack-linux-firewall/\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #Linux", "creation_timestamp": "2026-07-27T00:01:20.666372Z"}, {"uuid": "02c8b8f8-df71-476d-91b3-0d1cffbfc001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/474", "content": "\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 Linux\n\n\u041d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0418\u0411 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Netfilter \u044f\u0434\u0440\u0430 Linux (\u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 5.18.9) \u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u043d\u0435\u0435. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u0442\u0438\u043f\u043e\u0432 \u0432 nft_set_elem_init, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u0432 Ubuntu 22.04.\n\n\u041e\u0431 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Linux, \u0438 \u0435\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043d\u043e\u043c\u0435\u0440 CVE-2022-34918, \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS: 7.8. \u0412\u0435\u043d\u0434\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u043f\u0430\u0442\u0447, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043d\u0430 GitHub.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.randorisec.fr/crack-linux-firewall/\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #Linux", "creation_timestamp": "2026-07-28T12:00:05.021082Z"}, {"uuid": "1c30597d-e029-4492-9a18-e9f1479e3f8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/474", "content": "\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 Linux\n\n\u041d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0418\u0411 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Netfilter \u044f\u0434\u0440\u0430 Linux (\u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 5.18.9) \u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u043d\u0435\u0435. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u0442\u0438\u043f\u043e\u0432 \u0432 nft_set_elem_init, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u0432 Ubuntu 22.04.\n\n\u041e\u0431 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Linux, \u0438 \u0435\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043d\u043e\u043c\u0435\u0440 CVE-2022-34918, \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS: 7.8. \u0412\u0435\u043d\u0434\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u043f\u0430\u0442\u0447, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043d\u0430 GitHub.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.randorisec.fr/crack-linux-firewall/\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #Linux", "creation_timestamp": "2026-07-29T00:00:37.565718Z"}, {"uuid": "c0e85732-01d5-473d-bb88-04719e555ebe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://t.me/reverseame/2619", "content": "[CVE-2022-34918] A crack in the Linux firewall\nhttps://www.randorisec.fr/crack-linux-firewall/", "creation_timestamp": "2026-07-29T12:02:39.141429Z"}, {"uuid": "8456f93b-02c4-44ed-872b-2e959941f6aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://t.me/reverseame/2619", "content": "[CVE-2022-34918] A crack in the Linux firewall\nhttps://www.randorisec.fr/crack-linux-firewall/", "creation_timestamp": "2026-07-30T00:02:35.403622Z"}, {"uuid": "538eeaf1-c5f6-44b3-aa07-2df1db9be714", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://t.me/cissp/6023", "content": "tools\nOffensive_security\n1. GoodbyeDPI - Deep Packet Inspection circumvention utility (for Windows)\nhttps://github.com/ValdikSS/GoodbyeDPI\n2. A crack in the Linux firewall (CVE-2022-34918)\nhttps://www.randorisec.fr/crack-linux-firewall", "creation_timestamp": "2026-09-01T17:00:26.378185Z"}, {"uuid": "934a410a-5e58-4e0d-8b10-00d665d786b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://t.me/hacking_Attack/110003", "content": "Black Hat Ethical Hacking\nFake PoC Exploit Targets Cybersecurity Researchers with Linux Malware\n\nFake PoC Exploit Targets Cybersecurity Researchers with Linux MalwarePost Views: 5 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent development, cybersecurity researchers and threat actors have become targets of a fake proof of concept (PoC) exploit, known as CVE-2023-35829, which installs a Linux password-stealing malware. This malicious PoC was discovered by Uptycs analysts during routine scans when anomalies such as unauthorized system access attempts, unexpected network connections, and unusual data transfers were flagged by detection systems.\n\nThe malicious PoC exploit was found in three repositories, with two already removed from GitHub while one still remains active. Uptycs reports that this fake PoC has been widely shared among members of the security research community, suggesting that numerous computers might have already been infected.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/github-repo.jpg A malicious GitHub repository pushing the malware (BleepingComputer) PoC DetailsThe deceptive PoC claims to be an exploit for CVE-2023-35829, a high-severity use-after-free vulnerability affecting the Linux kernel before version 6.3.2. However, upon closer inspection, it is revealed that the PoC is actually a copy of an old legitimate exploit targeting another Linux kernel vulnerability, CVE-2022-34918.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/poc-copy.png Code comparison between the two PoCs (Uptycs)\n\nThe malicious code takes advantage of Linux namespaces, a feature that partitions kernel resources, to create the illusion of a root shell while operating within the limitations of the user namespace. This tactic aims to deceive victims into believing that the exploit is genuine and functioning as expected, granting the attackers more time to freely navigate the compromised system.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/fake-shell.png Code part for creating a fake shell (Uptycs)\n\nUpon execution, the PoC creates a \u2018kworker\u2019 file and adds its path to the \u2018/etc/bashrc\u2019 file for persistence. It then establishes communication with the attacker\u2019s command-and-control (C2) server to download and execute a Linux bash script from an external URL. This downloaded script gains unauthorized access to the system by modifying the \u2018/etc/passwd\u2019 file, granting the attacker remote access through unauthorized modifications to the \u2018~/.ssh/authorized_keys\u2019 file. The stolen data includes the victim\u2019s username, hostname, and contents of their home directory, which are exfiltrated using \u2018transfer.sh\u2019 via the curl command.\n\nTo evade detection, the bash script camouflages its operations as kernel-level processes, leveraging the trust placed in such entries by system administrators. This allows the attackers to navigate the compromised system undetected.\n\nUptycs advises researchers who have downloaded and utilized the fake PoC to take specific actions, including removing any unauthorized SSH keys, deleting the \u2018kworker\u2019 file, eliminating the \u2018kworker\u2019 path from the bashrc file, and checking \u2018/tmp/.iCE-unix.pid\u2019 for potential threats.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Recon Tool: Logsensor Extra caution when using downloaded PoCsIt is essential for researchers to exercise caution when using PoCs downloaded from the internet, preferably testing them in isolated environments like virtual machines and inspecti[...]", "creation_timestamp": "2026-09-01T20:00:54.109751Z"}, {"uuid": "25e9687c-30ec-4fed-ae70-2da35216e321", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://t.me/hacking_Attack/110402", "content": "Black Hat Ethical Hacking\nFake PoC Exploit Targets Cybersecurity Researchers with Linux Malware\n\nFake PoC Exploit Targets Cybersecurity Researchers with Linux MalwarePost Views: 1,504 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent development, cybersecurity researchers and threat actors have become targets of a fake proof of concept (PoC) exploit, known as CVE-2023-35829, which installs a Linux password-stealing malware. This malicious PoC was discovered by Uptycs analysts during routine scans when anomalies such as unauthorized system access attempts, unexpected network connections, and unusual data transfers were flagged by detection systems.\n\nThe malicious PoC exploit was found in three repositories, with two already removed from GitHub while one still remains active. Uptycs reports that this fake PoC has been widely shared among members of the security research community, suggesting that numerous computers might have already been infected.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/github-repo.jpg A malicious GitHub repository pushing the malware (BleepingComputer) PoC DetailsThe deceptive PoC claims to be an exploit for CVE-2023-35829, a high-severity use-after-free vulnerability affecting the Linux kernel before version 6.3.2. However, upon closer inspection, it is revealed that the PoC is actually a copy of an old legitimate exploit targeting another Linux kernel vulnerability, CVE-2022-34918.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/poc-copy.png Code comparison between the two PoCs (Uptycs)\n\nThe malicious code takes advantage of Linux namespaces, a feature that partitions kernel resources, to create the illusion of a root shell while operating within the limitations of the user namespace. This tactic aims to deceive victims into believing that the exploit is genuine and functioning as expected, granting the attackers more time to freely navigate the compromised system.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/fake-shell.png Code part for creating a fake shell (Uptycs)\n\nUpon execution, the PoC creates a \u2018kworker\u2019 file and adds its path to the \u2018/etc/bashrc\u2019 file for persistence. It then establishes communication with the attacker\u2019s command-and-control (C2) server to download and execute a Linux bash script from an external URL. This downloaded script gains unauthorized access to the system by modifying the \u2018/etc/passwd\u2019 file, granting the attacker remote access through unauthorized modifications to the \u2018~/.ssh/authorized_keys\u2019 file. The stolen data includes the victim\u2019s username, hostname, and contents of their home directory, which are exfiltrated using \u2018transfer.sh\u2019 via the curl command.\n\nTo evade detection, the bash script camouflages its operations as kernel-level processes, leveraging the trust placed in such entries by system administrators. This allows the attackers to navigate the compromised system undetected.\n\nUptycs advises researchers who have downloaded and utilized the fake PoC to take specific actions, including removing any unauthorized SSH keys, deleting the \u2018kworker\u2019 file, eliminating the \u2018kworker\u2019 path from the bashrc file, and checking \u2018/tmp/.iCE-unix.pid\u2019 for potential threats.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Recon Tool: Logsensor Extra caution when using downloaded PoCsIt is essential for researchers to exercise caution when using PoCs downloaded from the internet, preferably testing them in isolated environments like virtual machines and [...]", "creation_timestamp": "2026-09-01T20:00:54.196018Z"}, {"uuid": "e5ee09c7-b450-4311-83ab-401b29bf20a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://t.me/hacking_Attack/110003", "content": "Black Hat Ethical Hacking\nFake PoC Exploit Targets Cybersecurity Researchers with Linux Malware\n\nFake PoC Exploit Targets Cybersecurity Researchers with Linux MalwarePost Views: 5 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent development, cybersecurity researchers and threat actors have become targets of a fake proof of concept (PoC) exploit, known as CVE-2023-35829, which installs a Linux password-stealing malware. This malicious PoC was discovered by Uptycs analysts during routine scans when anomalies such as unauthorized system access attempts, unexpected network connections, and unusual data transfers were flagged by detection systems.\n\nThe malicious PoC exploit was found in three repositories, with two already removed from GitHub while one still remains active. Uptycs reports that this fake PoC has been widely shared among members of the security research community, suggesting that numerous computers might have already been infected.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/github-repo.jpg A malicious GitHub repository pushing the malware (BleepingComputer) PoC DetailsThe deceptive PoC claims to be an exploit for CVE-2023-35829, a high-severity use-after-free vulnerability affecting the Linux kernel before version 6.3.2. However, upon closer inspection, it is revealed that the PoC is actually a copy of an old legitimate exploit targeting another Linux kernel vulnerability, CVE-2022-34918.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/poc-copy.png Code comparison between the two PoCs (Uptycs)\n\nThe malicious code takes advantage of Linux namespaces, a feature that partitions kernel resources, to create the illusion of a root shell while operating within the limitations of the user namespace. This tactic aims to deceive victims into believing that the exploit is genuine and functioning as expected, granting the attackers more time to freely navigate the compromised system.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/fake-shell.png Code part for creating a fake shell (Uptycs)\n\nUpon execution, the PoC creates a \u2018kworker\u2019 file and adds its path to the \u2018/etc/bashrc\u2019 file for persistence. It then establishes communication with the attacker\u2019s command-and-control (C2) server to download and execute a Linux bash script from an external URL. This downloaded script gains unauthorized access to the system by modifying the \u2018/etc/passwd\u2019 file, granting the attacker remote access through unauthorized modifications to the \u2018~/.ssh/authorized_keys\u2019 file. The stolen data includes the victim\u2019s username, hostname, and contents of their home directory, which are exfiltrated using \u2018transfer.sh\u2019 via the curl command.\n\nTo evade detection, the bash script camouflages its operations as kernel-level processes, leveraging the trust placed in such entries by system administrators. This allows the attackers to navigate the compromised system undetected.\n\nUptycs advises researchers who have downloaded and utilized the fake PoC to take specific actions, including removing any unauthorized SSH keys, deleting the \u2018kworker\u2019 file, eliminating the \u2018kworker\u2019 path from the bashrc file, and checking \u2018/tmp/.iCE-unix.pid\u2019 for potential threats.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Recon Tool: Logsensor Extra caution when using downloaded PoCsIt is essential for researchers to exercise caution when using PoCs downloaded from the internet, preferably testing them in isolated environments like virtual machines and inspecti[...]", "creation_timestamp": "2026-09-02T01:01:14.538757Z"}, {"uuid": "6a8601dc-d287-4bb2-a5d8-d7e7e772113a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://t.me/hacking_Attack/110402", "content": "Black Hat Ethical Hacking\nFake PoC Exploit Targets Cybersecurity Researchers with Linux Malware\n\nFake PoC Exploit Targets Cybersecurity Researchers with Linux MalwarePost Views: 1,504 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent development, cybersecurity researchers and threat actors have become targets of a fake proof of concept (PoC) exploit, known as CVE-2023-35829, which installs a Linux password-stealing malware. This malicious PoC was discovered by Uptycs analysts during routine scans when anomalies such as unauthorized system access attempts, unexpected network connections, and unusual data transfers were flagged by detection systems.\n\nThe malicious PoC exploit was found in three repositories, with two already removed from GitHub while one still remains active. Uptycs reports that this fake PoC has been widely shared among members of the security research community, suggesting that numerous computers might have already been infected.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/github-repo.jpg A malicious GitHub repository pushing the malware (BleepingComputer) PoC DetailsThe deceptive PoC claims to be an exploit for CVE-2023-35829, a high-severity use-after-free vulnerability affecting the Linux kernel before version 6.3.2. However, upon closer inspection, it is revealed that the PoC is actually a copy of an old legitimate exploit targeting another Linux kernel vulnerability, CVE-2022-34918.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/poc-copy.png Code comparison between the two PoCs (Uptycs)\n\nThe malicious code takes advantage of Linux namespaces, a feature that partitions kernel resources, to create the illusion of a root shell while operating within the limitations of the user namespace. This tactic aims to deceive victims into believing that the exploit is genuine and functioning as expected, granting the attackers more time to freely navigate the compromised system.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/fake-shell.png Code part for creating a fake shell (Uptycs)\n\nUpon execution, the PoC creates a \u2018kworker\u2019 file and adds its path to the \u2018/etc/bashrc\u2019 file for persistence. It then establishes communication with the attacker\u2019s command-and-control (C2) server to download and execute a Linux bash script from an external URL. This downloaded script gains unauthorized access to the system by modifying the \u2018/etc/passwd\u2019 file, granting the attacker remote access through unauthorized modifications to the \u2018~/.ssh/authorized_keys\u2019 file. The stolen data includes the victim\u2019s username, hostname, and contents of their home directory, which are exfiltrated using \u2018transfer.sh\u2019 via the curl command.\n\nTo evade detection, the bash script camouflages its operations as kernel-level processes, leveraging the trust placed in such entries by system administrators. This allows the attackers to navigate the compromised system undetected.\n\nUptycs advises researchers who have downloaded and utilized the fake PoC to take specific actions, including removing any unauthorized SSH keys, deleting the \u2018kworker\u2019 file, eliminating the \u2018kworker\u2019 path from the bashrc file, and checking \u2018/tmp/.iCE-unix.pid\u2019 for potential threats.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Recon Tool: Logsensor Extra caution when using downloaded PoCsIt is essential for researchers to exercise caution when using PoCs downloaded from the internet, preferably testing them in isolated environments like virtual machines and [...]", "creation_timestamp": "2026-09-02T01:01:14.646674Z"}, {"uuid": "fdaf1153-8098-491d-a123-d39182f4ebbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://t.me/cissp/6023", "content": "tools\nOffensive_security\n1. GoodbyeDPI - Deep Packet Inspection circumvention utility (for Windows)\nhttps://github.com/ValdikSS/GoodbyeDPI\n2. A crack in the Linux firewall (CVE-2022-34918)\nhttps://www.randorisec.fr/crack-linux-firewall", "creation_timestamp": "2026-09-02T01:04:08.696828Z"}, {"uuid": "bfa3fc8f-b00f-4e89-87fa-0a25c5a0b7e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/110402", "content": "Black Hat Ethical Hacking\nFake PoC Exploit Targets Cybersecurity Researchers with Linux Malware\n\nFake PoC Exploit Targets Cybersecurity Researchers with Linux MalwarePost Views: 1,504 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent development, cybersecurity researchers and threat actors have become targets of a fake proof of concept (PoC) exploit, known as CVE-2023-35829, which installs a Linux password-stealing malware. This malicious PoC was discovered by Uptycs analysts during routine scans when anomalies such as unauthorized system access attempts, unexpected network connections, and unusual data transfers were flagged by detection systems.\n\nThe malicious PoC exploit was found in three repositories, with two already removed from GitHub while one still remains active. Uptycs reports that this fake PoC has been widely shared among members of the security research community, suggesting that numerous computers might have already been infected.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/github-repo.jpg A malicious GitHub repository pushing the malware (BleepingComputer) PoC DetailsThe deceptive PoC claims to be an exploit for CVE-2023-35829, a high-severity use-after-free vulnerability affecting the Linux kernel before version 6.3.2. However, upon closer inspection, it is revealed that the PoC is actually a copy of an old legitimate exploit targeting another Linux kernel vulnerability, CVE-2022-34918.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/poc-copy.png Code comparison between the two PoCs (Uptycs)\n\nThe malicious code takes advantage of Linux namespaces, a feature that partitions kernel resources, to create the illusion of a root shell while operating within the limitations of the user namespace. This tactic aims to deceive victims into believing that the exploit is genuine and functioning as expected, granting the attackers more time to freely navigate the compromised system.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/fake-shell.png Code part for creating a fake shell (Uptycs)\n\nUpon execution, the PoC creates a \u2018kworker\u2019 file and adds its path to the \u2018/etc/bashrc\u2019 file for persistence. It then establishes communication with the attacker\u2019s command-and-control (C2) server to download and execute a Linux bash script from an external URL. This downloaded script gains unauthorized access to the system by modifying the \u2018/etc/passwd\u2019 file, granting the attacker remote access through unauthorized modifications to the \u2018~/.ssh/authorized_keys\u2019 file. The stolen data includes the victim\u2019s username, hostname, and contents of their home directory, which are exfiltrated using \u2018transfer.sh\u2019 via the curl command.\n\nTo evade detection, the bash script camouflages its operations as kernel-level processes, leveraging the trust placed in such entries by system administrators. This allows the attackers to navigate the compromised system undetected.\n\nUptycs advises researchers who have downloaded and utilized the fake PoC to take specific actions, including removing any unauthorized SSH keys, deleting the \u2018kworker\u2019 file, eliminating the \u2018kworker\u2019 path from the bashrc file, and checking \u2018/tmp/.iCE-unix.pid\u2019 for potential threats.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Recon Tool: Logsensor Extra caution when using downloaded PoCsIt is essential for researchers to exercise caution when using PoCs downloaded from the internet, preferably testing them in isolated environments like virtual machines and [...]", "creation_timestamp": "2026-09-04T11:00:04.801856Z"}, {"uuid": "c6ea93d1-33d5-4e30-9ac0-45258ecd31b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/110003", "content": "Black Hat Ethical Hacking\nFake PoC Exploit Targets Cybersecurity Researchers with Linux Malware\n\nFake PoC Exploit Targets Cybersecurity Researchers with Linux MalwarePost Views: 5 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent development, cybersecurity researchers and threat actors have become targets of a fake proof of concept (PoC) exploit, known as CVE-2023-35829, which installs a Linux password-stealing malware. This malicious PoC was discovered by Uptycs analysts during routine scans when anomalies such as unauthorized system access attempts, unexpected network connections, and unusual data transfers were flagged by detection systems.\n\nThe malicious PoC exploit was found in three repositories, with two already removed from GitHub while one still remains active. Uptycs reports that this fake PoC has been widely shared among members of the security research community, suggesting that numerous computers might have already been infected.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/github-repo.jpg A malicious GitHub repository pushing the malware (BleepingComputer) PoC DetailsThe deceptive PoC claims to be an exploit for CVE-2023-35829, a high-severity use-after-free vulnerability affecting the Linux kernel before version 6.3.2. However, upon closer inspection, it is revealed that the PoC is actually a copy of an old legitimate exploit targeting another Linux kernel vulnerability, CVE-2022-34918.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/poc-copy.png Code comparison between the two PoCs (Uptycs)\n\nThe malicious code takes advantage of Linux namespaces, a feature that partitions kernel resources, to create the illusion of a root shell while operating within the limitations of the user namespace. This tactic aims to deceive victims into believing that the exploit is genuine and functioning as expected, granting the attackers more time to freely navigate the compromised system.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/fake-shell.png Code part for creating a fake shell (Uptycs)\n\nUpon execution, the PoC creates a \u2018kworker\u2019 file and adds its path to the \u2018/etc/bashrc\u2019 file for persistence. It then establishes communication with the attacker\u2019s command-and-control (C2) server to download and execute a Linux bash script from an external URL. This downloaded script gains unauthorized access to the system by modifying the \u2018/etc/passwd\u2019 file, granting the attacker remote access through unauthorized modifications to the \u2018~/.ssh/authorized_keys\u2019 file. The stolen data includes the victim\u2019s username, hostname, and contents of their home directory, which are exfiltrated using \u2018transfer.sh\u2019 via the curl command.\n\nTo evade detection, the bash script camouflages its operations as kernel-level processes, leveraging the trust placed in such entries by system administrators. This allows the attackers to navigate the compromised system undetected.\n\nUptycs advises researchers who have downloaded and utilized the fake PoC to take specific actions, including removing any unauthorized SSH keys, deleting the \u2018kworker\u2019 file, eliminating the \u2018kworker\u2019 path from the bashrc file, and checking \u2018/tmp/.iCE-unix.pid\u2019 for potential threats.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Recon Tool: Logsensor Extra caution when using downloaded PoCsIt is essential for researchers to exercise caution when using PoCs downloaded from the internet, preferably testing them in isolated environments like virtual machines and inspecti[...]", "creation_timestamp": "2026-09-04T11:00:04.996309Z"}, {"uuid": "4ba75f24-38da-4d17-9c15-9027b102dc7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/110402", "content": "Black Hat Ethical Hacking\nFake PoC Exploit Targets Cybersecurity Researchers with Linux Malware\n\nFake PoC Exploit Targets Cybersecurity Researchers with Linux MalwarePost Views: 1,504 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent development, cybersecurity researchers and threat actors have become targets of a fake proof of concept (PoC) exploit, known as CVE-2023-35829, which installs a Linux password-stealing malware. This malicious PoC was discovered by Uptycs analysts during routine scans when anomalies such as unauthorized system access attempts, unexpected network connections, and unusual data transfers were flagged by detection systems.\n\nThe malicious PoC exploit was found in three repositories, with two already removed from GitHub while one still remains active. Uptycs reports that this fake PoC has been widely shared among members of the security research community, suggesting that numerous computers might have already been infected.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/github-repo.jpg A malicious GitHub repository pushing the malware (BleepingComputer) PoC DetailsThe deceptive PoC claims to be an exploit for CVE-2023-35829, a high-severity use-after-free vulnerability affecting the Linux kernel before version 6.3.2. However, upon closer inspection, it is revealed that the PoC is actually a copy of an old legitimate exploit targeting another Linux kernel vulnerability, CVE-2022-34918.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/poc-copy.png Code comparison between the two PoCs (Uptycs)\n\nThe malicious code takes advantage of Linux namespaces, a feature that partitions kernel resources, to create the illusion of a root shell while operating within the limitations of the user namespace. This tactic aims to deceive victims into believing that the exploit is genuine and functioning as expected, granting the attackers more time to freely navigate the compromised system.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/fake-shell.png Code part for creating a fake shell (Uptycs)\n\nUpon execution, the PoC creates a \u2018kworker\u2019 file and adds its path to the \u2018/etc/bashrc\u2019 file for persistence. It then establishes communication with the attacker\u2019s command-and-control (C2) server to download and execute a Linux bash script from an external URL. This downloaded script gains unauthorized access to the system by modifying the \u2018/etc/passwd\u2019 file, granting the attacker remote access through unauthorized modifications to the \u2018~/.ssh/authorized_keys\u2019 file. The stolen data includes the victim\u2019s username, hostname, and contents of their home directory, which are exfiltrated using \u2018transfer.sh\u2019 via the curl command.\n\nTo evade detection, the bash script camouflages its operations as kernel-level processes, leveraging the trust placed in such entries by system administrators. This allows the attackers to navigate the compromised system undetected.\n\nUptycs advises researchers who have downloaded and utilized the fake PoC to take specific actions, including removing any unauthorized SSH keys, deleting the \u2018kworker\u2019 file, eliminating the \u2018kworker\u2019 path from the bashrc file, and checking \u2018/tmp/.iCE-unix.pid\u2019 for potential threats.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Recon Tool: Logsensor Extra caution when using downloaded PoCsIt is essential for researchers to exercise caution when using PoCs downloaded from the internet, preferably testing them in isolated environments like virtual machines and [...]", "creation_timestamp": "2026-09-05T01:00:31.745070Z"}, {"uuid": "809bd751-88ed-4bc5-9170-d66a49cd6187", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/110003", "content": "Black Hat Ethical Hacking\nFake PoC Exploit Targets Cybersecurity Researchers with Linux Malware\n\nFake PoC Exploit Targets Cybersecurity Researchers with Linux MalwarePost Views: 5 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent development, cybersecurity researchers and threat actors have become targets of a fake proof of concept (PoC) exploit, known as CVE-2023-35829, which installs a Linux password-stealing malware. This malicious PoC was discovered by Uptycs analysts during routine scans when anomalies such as unauthorized system access attempts, unexpected network connections, and unusual data transfers were flagged by detection systems.\n\nThe malicious PoC exploit was found in three repositories, with two already removed from GitHub while one still remains active. Uptycs reports that this fake PoC has been widely shared among members of the security research community, suggesting that numerous computers might have already been infected.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/github-repo.jpg A malicious GitHub repository pushing the malware (BleepingComputer) PoC DetailsThe deceptive PoC claims to be an exploit for CVE-2023-35829, a high-severity use-after-free vulnerability affecting the Linux kernel before version 6.3.2. However, upon closer inspection, it is revealed that the PoC is actually a copy of an old legitimate exploit targeting another Linux kernel vulnerability, CVE-2022-34918.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/poc-copy.png Code comparison between the two PoCs (Uptycs)\n\nThe malicious code takes advantage of Linux namespaces, a feature that partitions kernel resources, to create the illusion of a root shell while operating within the limitations of the user namespace. This tactic aims to deceive victims into believing that the exploit is genuine and functioning as expected, granting the attackers more time to freely navigate the compromised system.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/fake-shell.png Code part for creating a fake shell (Uptycs)\n\nUpon execution, the PoC creates a \u2018kworker\u2019 file and adds its path to the \u2018/etc/bashrc\u2019 file for persistence. It then establishes communication with the attacker\u2019s command-and-control (C2) server to download and execute a Linux bash script from an external URL. This downloaded script gains unauthorized access to the system by modifying the \u2018/etc/passwd\u2019 file, granting the attacker remote access through unauthorized modifications to the \u2018~/.ssh/authorized_keys\u2019 file. The stolen data includes the victim\u2019s username, hostname, and contents of their home directory, which are exfiltrated using \u2018transfer.sh\u2019 via the curl command.\n\nTo evade detection, the bash script camouflages its operations as kernel-level processes, leveraging the trust placed in such entries by system administrators. This allows the attackers to navigate the compromised system undetected.\n\nUptycs advises researchers who have downloaded and utilized the fake PoC to take specific actions, including removing any unauthorized SSH keys, deleting the \u2018kworker\u2019 file, eliminating the \u2018kworker\u2019 path from the bashrc file, and checking \u2018/tmp/.iCE-unix.pid\u2019 for potential threats.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Recon Tool: Logsensor Extra caution when using downloaded PoCsIt is essential for researchers to exercise caution when using PoCs downloaded from the internet, preferably testing them in isolated environments like virtual machines and inspecti[...]", "creation_timestamp": "2026-09-05T01:00:31.848676Z"}, {"uuid": "3208bedd-261a-4f30-aef7-330f9a1796cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_nft_set_elem_init_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x64\", \"author\": [\"Arthur Mongodin  (@_Aleknight_)>\", \"Redouane NIBOUCHA \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"An issue was discovered in the Linux kernel through 5.18.9.\\n          A type confusion bug in nft_set_elem_init (leading to a buffer overflow)\\n          could be used by a local attacker to escalate privileges.\\n          The attacker can obtain root access, but must start with an unprivileged\\n          user namespace to obtain CAP_NET_ADMIN access.\\n          The issue exists in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.\", \"disclosure_date\": \"2022-02-07\", \"fullname\": \"exploit/linux/local/netfilter_nft_set_elem_init_privesc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:34 +0000\", \"name\": \"Netfilter nft_set_elem_init Heap Overflow Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unreliable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"os-resource-loss\", \"crash-os-down\"]}, \"path\": \"/modules/exploits/linux/local/netfilter_nft_set_elem_init_privesc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 200, \"ref_name\": \"linux/local/netfilter_nft_set_elem_init_privesc\", \"references\": [\"CVE-2022-34918\", \"URL-https://nvd.nist.gov/vuln/detail/CVE-2022-34918\", \"URL-https://ubuntu.com/security/CVE-2022-34918\", \"URL-https://www.randorisec.fr/crack-linux-firewall/\", \"URL-https://github.com/randorisec/CVE-2022-34918-LPE-PoC\"], \"rport\": null, \"session_types\": [\"meterpreter\", \"shell\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:09.863603Z"}, {"uuid": "f92dcf03-1d3e-443f-a88e-5cccb97b1cd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6023", "content": "tools\nOffensive_security\n1. GoodbyeDPI - Deep Packet Inspection circumvention utility (for Windows)\nhttps://github.com/ValdikSS/GoodbyeDPI\n2. A crack in the Linux firewall (CVE-2022-34918)\nhttps://www.randorisec.fr/crack-linux-firewall", "creation_timestamp": "2026-09-10T07:00:04.414895Z"}, {"uuid": "c53ddca2-b24d-457a-ab8d-0066a877b74d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6023", "content": "tools\nOffensive_security\n1. GoodbyeDPI - Deep Packet Inspection circumvention utility (for Windows)\nhttps://github.com/ValdikSS/GoodbyeDPI\n2. A crack in the Linux firewall (CVE-2022-34918)\nhttps://www.randorisec.fr/crack-linux-firewall", "creation_timestamp": "2026-09-11T00:00:48.906541Z"}]}