rsync 2.5.7 - Local Stack Overflow / Local Privilege Escalation

/ rsync / Includes for code to daemonize / include include include include // define PATH "/usr/local/bin/rsync" define BUFFSIZE 100 //define RET 0xbffffdfb / 88 bytes portbinding shellcode - linux-x86 - by bighawk bighawk warfare com This shellcode binds a shell on port 10000 stdin, stdout and...

Samba 2.2.8 Remote Root Exploit - sambal.c

Exploit for linux platform in category remote exploits ========================================== Samba 2.2.8 Remote Root Exploit - sambal.c ========================================== / Remote root exploit for Samba 2.2.x and prior that works against Linux all distributions, FreeBSD 4.x, 5.x,...

Samba 2.2.8 (LinuxBSD) - Remote Code Execution

Samba 2.2.8 LinuxBSD - Remote Code Execution / Remote root exploit for Samba 2.2.x and prior that works against Linux all distributions, FreeBSD 4.x, 5.x, NetBSD 1.x and OpenBSD 2.x, 3.x and 3.2 non-executable stack. sambal.c is able to identify samba boxes. It will send a netbios name packet to...

Samba < 2.2.8 (Linux/BSD) - Remote Code Execution

/ Remote root exploit for Samba 2.2.x and prior that works against Linux all distributions, FreeBSD 4.x, 5.x, NetBSD 1.x and OpenBSD 2.x, 3.x and 3.2 non-executable stack. sambal.c is able to identify samba boxes. It will send a netbios name packet to port 137. If the box responds with the mac...

SIGCHLD problem in Stunnel

Date: Sun, 12 Jan 2003 16:57:02 +0100 From: Michal Trojnara [email protected] To: [email protected], [email protected], [email protected] Subject: Stunnel 4.04 released -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Version 4.04, 2003.01.12, urgency: MEDIUM: New feature...

Microsoft IIS 4.05.0 - Chunked Encoding Transfer Heap Overflow (2)

Microsoft IIS 4.05.0 - Chunked Encoding Transfer Heap Overflow 2 // source: https://www.securityfocus.com/bid/4485/info A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS Internet Information Services. This...

Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (2)

// source: https://www.securityfocus.com/bid/4485/info A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS Internet Information Services. This condition affects IIS 4.0 and IIS 5.0. Exploitation of this...

DistCC Daemon Command Execution

This module uses a documented security weakness to execute arbitrary commands on any system running distccd. Module Options msf use exploit/unix/misc/distcc/exec msf undefinedexec show actions ...actions... msf undefinedexec set ACTION msf undefinedexec show options ...show and set options... msf...

Irix LPD tagprinter Command Execution

This module exploits an arbitrary command execution flaw in the in.lpd service shipped with all versions of Irix. Module Options msf use exploit/irix/lpd/tagprinter/exec msf undefinedexec show actions ...actions... msf undefinedexec set ACTION msf undefinedexec show options ...show and set...

Solaris LPD Command Execution

This module exploits an arbitrary command execution flaw in the in.lpd service shipped with all versions of Sun Solaris up to and including 8.0. This module uses a technique discovered by Dino Dai Zovi to exploit the flaw without needing to know the resolved name of the attacking system. Module...

vvfreebsd.txt

Georgi Guninski security advisory 48, 2001 FreeBSD 4.3 local root, yet Linux and BSD much better than Windows Systems affected: FreeBSD 4.3 and probably earlier versions. Risk: High Date: 10 July 2001 Legal Notice: This Advisory is Copyright c 2001 Georgi Guninski. You may distribute it unmodifie...

Security Advisory FreeBSD-SA-01:

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:42 Security Advisory FreeBSD, Inc. Topic: signal handling during exec may allow local root compromise Category: core Module: kernel Announced: 2001-07-10 Credits: Georgi...

FreeBSD 4.3 local root, yet Linux and *BSD much better than Windows

Georgi Guninski security advisory 48, 2001 FreeBSD 4.3 local root, yet Linux and BSD much better than Windows Systems affected: FreeBSD 4.3 and probably earlier versions. Risk: High Date: 10 July 2001 Legal Notice: This Advisory is Copyright c 2001 Georgi Guninski. You may distribute it unmodifie...

FreeBSD-SA-01:42.signal

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:42 Security Advisory FreeBSD, Inc. Topic: signal handling during exec may allow local root compromise Category: core Module: kernel Announced: 2001-07-10 Revised:...

Microsoft Index Server 2.0 Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (2)

Microsoft Index Server 2.0 Indexing Service Windows 2000 - ISAPI Extension Buffer Overflow 2 / source: https://www.securityfocus.com/bid/2880/info Windows Index Server ships with Windows NT 4.0 Option Pack; Windows Indexing Service ships with Windows 2000. An unchecked buffer resides in the...

Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (2)

/ source: https://www.securityfocus.com/bid/2880/info Windows Index Server ships with Windows NT 4.0 Option Pack; Windows Indexing Service ships with Windows 2000. An unchecked buffer resides in the 'idq.dll' ISAPI extension associated with each service. A maliciously crafted request could allow...

WU-FTPD SITE EXEC/INDEX Format String Vulnerability

This module exploits a format string vulnerability in versions of the Washington University FTP server older than 2.6.1. By executing specially crafted SITE EXEC or SITE INDEX commands containing format specifiers, an attacker can corrupt memory and execute arbitrary code. Module Options msf use...

Microsoft SQL Server Payload Execution via SQL Injection

This module will execute an arbitrary payload on a Microsoft SQL Server, using a SQL injection vulnerability. Once a vulnerability is identified this module will use xpcmdshell to upload and execute Metasploit payloads. It is necessary to specify the exact point where the SQL injection...

Microsoft SQL Server Database Link Crawling Command Execution

This module can be used to crawl MS SQL Server database links and deploy Metasploit payloads through links configured with sysadmin privileges using a valid SQL Server Login. If you are attempting to obtain multiple reverse shells using this module we recommend setting the "DisablePayloadHandler"...

The Matt Wright Guestbook.pl 2.3.1 - Server-Side Include

The Matt Wright Guestbook.pl 2.3.1 - Server-Side Include $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...