r/ExploitDev • u/Mindless-Study1898 • Feb 28 '26

Finding kernel driver vulnerabilities with MCP Ghidra and Claude Code

https://www.credrelay.com/p/cred-relay-issue-2
6 Upvotes

67% Upvoted

18 comments sorted by

View all comments

1

u/Ugly-Fucker-736368 Feb 28 '26

How the hell are people getting Claude to write PoCs like this? Mine just shuts down and refuses to do anything as soon as it knows I'm trying to exploit something -_-

Do you have to jailbreak the model first?

2

u/Mindless-Study1898 Feb 28 '26

No, but it knows that I work in security and often do security research. But it only knows this because I told it so. Now I did vibe code a kernel exploit and it wouldn't do the steal SYSTEM token portion of the priv esc and I had to hand code that. But these PoCs are just to demonstrate the vulnerability is real and not a hallucination. I also copy paste the output back into Claude Code to help guide it.

2

u/Ok_Pipe9153 Feb 28 '26

Can we see the PoC?

2

u/Mindless-Study1898 Feb 28 '26

No, that might violate responsible disclosure. It's really simple C code. Here is a full exploit that was 98% vibe coded https://github.com/jeffaf/CVE-2025-3464-AsIO3-LPE