321 matches found
musicDaemon.txt
Discovered and Exploit Coded by: Tal0n [email protected] URL: http://musicdaemon.sourceforge.net Note: This was 0day for several months.. I decided to turn it in because there may be 10 whole boxes in the world running this.. and its not very handy sitting around on my box =p. / MusicDaemon...
MusicDaemon <= 0.0.3 v2 Remote DoS and /etc/shadow Stealer
Exploit for linux platform in category remote exploits ========================================================== MusicDaemon Hello ...... bin::9797:0::::: ftp::9797:0::::: sshd::9797:0::::: ...... email protected:/test Server Side View: email protected:/test/musicdaemon-0.0.3/src ./musicd -c...
MusicDaemon 0.0.3 - Remote Denial of Service etcshadow Stealer (2)
MusicDaemon 0.0.3 - Remote Denial of Service etcshadow Stealer 2 / MusicDaemon Hello ...... bin::9797:0::::: ftp::9797:0::::: sshd::9797:0::::: ...... root@vortex:/test Server Side View: root@vortex:/test/musicdaemon-0.0.3/src ./musicd -c ../musicd.conf -p 1234 Using configuration: ../musicd.conf...
Qt BMP Parsing Bug Heap Overflow Exploit
Exploit for linux platform in category remote exploits ========================================================== MusicDaemon Hello ...... bin::9797:0::::: ftp::9797:0::::: sshd::9797:0::::: ...... email protected:/test Server Side View: email protected:/test/musicdaemon-0.0.3/src ./musicd -c...
CVE-2002-0762
CVE-2002-0762 : The shadow package in SuSE 8.0 lets local users destroy /etc/passwd and /etc/shadow or grant extra group privileges by lowering the filesize limits before programs modify those files, indicating a local-privilege-impact scenario due to improper enforcement of file-size constraints...
Perl 5.6.0 (on Linux) getpwuid() leave /etc/shadow opened
I'm not sure how serious this issue is, but I think it may cause problems in some environments. The system is Linux, RedHat 7.0, Perl 5.6.0, glibc 2.2.4, latest updates. Recently I run 'lsof' on unprivileged Apache httpd process running modperl application and was pretty surprised to see...
CVE-2001-1175
CVE-2001-1175 : In vipw from the util-linux package, before version 2.10, editing /etc/shadow could leave the file world-readable in some cases, enabling local users to more easily perform brute-force password guessing. Supported details in connected docs show Red Hat advisories (RHSA-2001:95, 13...
Проблемы с vipw (weak permissons)
После редактирования /etc/shadow файл становится открытым на чтение...
Дырки в pkg-утилитах SCO
Можно получить доступ к содержимому /etc/shadow...
glibc-resolve-tr.sh
Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...
glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read
Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...
[SECURITY] [DSA-015-1] New version of sash released
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------------------------- Debian Security Advisory DSA-015-1 [email protected] http://www.debian.org/security/ Martin Schulze January 23, 2001 -...
Дырка в sash в Debian
При копировании /etc/shadow создаются файлы открытые на чтение...
CVE-1999-0712
CVE-1999-0712 affects Caldera Open Administration System (COAS). The vulnerability allows the /etc/shadow password file to be made world-readable, indicating a confidentiality impact. Exploitation details are not provided in the connected documents; sources (Red Hat, CVE entries, and PT Security)...
SCO Unixware 7.1 pkgcat - Local Buffer Overflow
SCO Unixware 7.1 pkgcat - Local Buffer Overflow // source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are...
SCO Unixware 7.1 pkginstall - Local Buffer Overflow
SCO Unixware 7.1 pkginstall - Local Buffer Overflow // source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are...
unixware.pkg.txt
Greetings, OVERVIEW Any user may read any file on the system. BACKGROUND Only UnixWare 7.1 has been tested. DETAILS As previously stated, UnixWare binaries gain additional privileges via standard suid/sgid AND /etc/security/tcb/privs. The majority of the UnixWare "pkg" command, such as pkginfo,...
SCO Unixware 7.1 pkgcat - Local Buffer Overflow
// source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in /etc/security/tcb/privs give them the...
unixware.pkg.exploits.txt
Greetings, OVERVIEW Most of UnixWare's pkg commands can be exploited to print /etc/shadow, leading to a probable root compromise. BACKGROUND Only tested on UnixWare 7.1. DETAILS The permissions for the UnixWare pkg commands are as follows: bash-2.02$ ls -la /usr/sbin/pkgchk /usr/bin/pkginfo...
SCO Unixware 7.1 pkginstall - Local Buffer Overflow
// source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in /etc/security/tcb/privs give them the...