// the find
thezdi/PoC
Proofs-of-concept
ZDI's official PoC repository for vulnerabilities they've discovered and disclosed — SCADA/ICS systems, Windows kernel EoPs, DirectX, SharePoint, VMware, and more. This is the research arm of Trend Micro's bug bounty program publishing their own findings after vendor patch windows close. Useful to security researchers and defenders who want to understand exactly how a disclosed bug works.
Each PoC is tied to a specific CVE or ZDI advisory, so you can trace it straight to a patch and affected versions. The SCADA coverage (Advantech, Rockwell FactoryTalk, Ignition) is genuinely rare — most public vuln repos ignore ICS entirely. The FilesystemEoPs folder includes a README explaining the folder-delete-to-SYSTEM primitive, which is a better explanation of that class of bug than most blog posts. The MySQL CodeQL queries are a nice touch — static analysis artifacts alongside the PoC.
Last push was September 2024 and the most recent CVEs are from 2022, so this isn't tracking current ZDI disclosures — newer advisories get published on their blog, not here. No unified documentation: some entries are well-commented C++, others are a zip file with no explanation whatsoever (CVE-2018-16044, Drupal). Several PoCs are environment-specific (hardcoded kernel offsets for FreeBSD 12.2/13.0 in CVE-2022-23088, specific SharePoint farm configs) with no guidance on adapting them. Binaries checked in alongside source (hfs.exe, .msi, compiled kernel blobs) is a trust issue for anyone cloning this on a shared machine.