Privilege Escalation in Oracle VM VirtualBox Core (CVE-2018-2844)

This repository contains a working exploit for CVE-2018-2844, a VirtualBox VM escape vulnerability. The exploit is implemented in C and assembly, with a Makefile for building the binary. The main entry point is 'exploit.c', which orchestrates the attack by mapping the VRAM buffer via /dev/mem, crafting malicious data structures in VRAM, and racing a jump table to trigger the vulnerability. The exploit requires root privileges and direct access to /dev/mem, and is intended to be run on a Linux host with the vulnerable VirtualBox version and the vboxvideo driver blacklisted. The payload is a reverse shell implemented in 'shellcode.c', which connects back to an attacker-supplied IP and port (provided as arguments to the exploit). The shellcode closes standard file descriptors, opens /dev/tty, forks, and in the child process creates a socket, connects to the attacker, redirects I/O, and executes /bin/sh. The exploit is operational and provides a real shell if successful. The repository is well-structured, with separate files for helpers, shellcode, data structures, and assembly routines. No hardcoded network endpoints are present; the attacker supplies the target IP and port at runtime. The exploit demonstrates a deep understanding of VirtualBox internals and low-level memory manipulation.