CARVIEW |
Select Language
HTTP/2 200
date: Thu, 31 Jul 2025 07:10:27 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With,Accept-Encoding, Accept, X-Requested-With
x-robots-tag: none
etag: W/"65663c543f228201858d67fbaeac3afc"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
server: github.com
content-encoding: gzip
accept-ranges: bytes
set-cookie: _gh_sess=JHOEdBSnnagZcm9K3R77wzFBNqO7uTbPaGq1TBOqcnU4d9kv%2BHQl10LRKJ9sBrCGmdZfll2aFVWgVzRRxarxtLgt%2ByVfc8X5AZ3ztGKG9SnsYSgi4JK3gta8LoF6q1cwB9zVCniXklqO5gqOPRwH8iZrD0tyJuIZgnCC8Iq7Mc6nUdGtZ3N2m6TywuJFjcMCvLNQjF797LDyoQdEHIC4fd9EsAoez4pXMGO753G2BuhbQFdinJd3%2FNvnnB1Apx0kp4P0nwOut7t8jAgXQCQQrw%3D%3D--aUXjN6M6%2Fc0TcbeU--6P2zi29roPI2awlnaFPMJA%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.424603029.1753945827; Path=/; Domain=github.com; Expires=Fri, 31 Jul 2026 07:10:27 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Fri, 31 Jul 2026 07:10:27 GMT; HttpOnly; Secure; SameSite=Lax
x-github-request-id: 9614:1E01C6:4C8BE4:6104BF:688B16E3
PoCs · dirtycow/dirtycow.github.io Wiki · GitHub
Skip to content
Navigation Menu
{{ message }}
-
Notifications
You must be signed in to change notification settings - Fork 938
PoCs
Nick Bulischeck edited this page Apr 9, 2019
·
51 revisions
Note: if you experience crashes or locks take a look at this fix.
Link | Usage | Description | Family |
---|---|---|---|
dirtyc0w.c | ./dirtyc0w file content |
Read-only write | /proc/self/mem |
cowroot.c | ./cowroot |
SUID-based root | /proc/self/mem |
dirtycow-mem.c | ./dirtycow-mem |
libc-based root | /proc/self/mem |
pokemon.c | ./d file content |
Read-only write | PTRACE_POKEDATA |
dirtycow.cr | dirtycow --target --string --offset |
Read-only write | /proc/self/mem |
dirtyc0w.c | ./dirtycow file content |
Read-only write (Android) | /proc/self/mem |
dirtycow.rb |
use exploit/linux/local/dirtycow and run
|
SUID-based root | /proc/self/mem |
0xdeadbeef.c | ./0xdeadbeef |
vDSO-based root | PTRACE_POKEDATA |
naughtyc0w.c | ./c0w suid |
SUID-based root | /proc/self/mem |
c0w.c | ./c0w |
SUID-based root | PTRACE_POKEDATA |
dirty_pass[...].c | ./dirty_passwd_adjust_cow |
/etc/passwd based root | /proc/self/mem |
mucow.c | ./mucow destination < payload.exe |
Read-only write (multi page) | PTRACE_POKEDATA |
cowpy.c | r2pm -i dirtycow |
Read-only write (radare2) | /proc/self/mem |
dirtycow.fasm | ./main |
SUID-based root | /proc/self/mem |
dcow.cpp | ./dcow |
/etc/passwd based root | /proc/self/mem |
dirtyc0w.go | go run dirtyc0w.go -f=file -c=content |
Read-only write | /proc/self/mem |
dirty.c | ./dirty |
/etc/passwd based root | PTRACE_POKEDATA |
-
https://github.com/dirtycow/dirtycow.github.io/blob/master/dirtyc0w.c
- Allows user to write on files meant to be read only.
-
https://gist.github.com/rverton/e9d4ff65d703a9084e85fa9df083c679
- Gives the user root by overwriting
/usr/bin/passwd
or a suid binary.
- Gives the user root by overwriting
-
https://gist.github.com/scumjr/17d91f20f73157c722ba2aea702985d2
- Gives the user root by patching libc's getuid call and invoking
su
.
- Gives the user root by patching libc's getuid call and invoking
-
https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c
- Allows user to write on files meant to be read only.
-
https://github.com/xlucas/dirtycow.cr
- Allows a user to write on files meant to be read only.
-
https://github.com/timwr/CVE-2016-5195
- Allows user to write on files meant to be read only (android).
-
https://github.com/rapid7/metasploit-framework/pull/7476
- Metasploit module based on the
cowroot
PoC.
- Metasploit module based on the
-
https://github.com/scumjr/dirtycow-vdso
- Gives the user root by patching the vDSO escapes containers/SELinux doesn't need suid.
-
https://gist.github.com/mak/c36136ccdbebf5ecfefd80c0f2ed6747
- Gives the user root by injecting shellcode into a SUID file.
-
https://gist.github.com/KrE80r/42f8629577db95782d5e4f609f437a54
- Gives the user root by injecting shellcode into a SUID file using PTRACE_POKEDATA .
-
https://gist.github.com/ngaro/05e084ca638340723b309cd304be77b2
- Gives the user root by replacing /etc/passwd
-
https://gist.github.com/chriscz/f1aca56cf15cfb7793db0141c15718cd
- Allows user to write on files meant to be read only. Supports writing to multiple pages, not just the first
-
https://github.com/nowsecure/dirtycow
- Allows the user to write on files meant to be read only, implemented as a radare2 IO plugin.
-
https://github.com/sivizius/dirtycow.fasm
- Gives the user root by injecting shellcode into a SUID file. implemented for amd64 in flatassembly.
-
https://github.com/gbonacini/CVE-2016-5195
- Gives the user root by replacing /etc/passwd
-
https://github.com/mengzhuo/dirty-cow-golang/blob/master/dirtyc0w.go
- Allows user to write on files meant to be read only. implemented for arm32/x86/amd64 in Golang faster than c implement.
-
https://github.com/FireFart/dirtycow/blob/master/dirty.c
- Generates a new password hash on the fly and modifies /etc/passwd automatically. Just run and pwn.
You can’t perform that action at this time.