libuser: multiple issues

CVE-2015-3245 denial of service It was found that libuser, as used by the chfn userhelper functionality, did not properly filter out newline characters in GECOS fields. A local, authenticated user could use this flaw to corrupt the /etc/passwd file, resulting in a denial-of-service on the system...

Amazon Linux AMI : usermode / libuser (ALAS-2015-572)

It was found that libuser, as used in the chfn userhelper functionality, does not properly filter out newline characters, which allows an authenticated local attacker to corrupt the /etc/passwd file and cause denial-of-service against the system. CVE-2015-3245 A flaw was found in the way the...

Important: Red Hat Security Advisory: libuser security update

Updated libuser packages that fix two security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for...

linux/x86 - chmod() 777 /etc/shadow & exit() - 33 bytes

Linux/x86 - chmod 777 /etc/shadow & exit - 33 bytes Greetz : BombermanLeader Author : B3mB4m Concat : email protected Disassembly of section .text: 08048060 : 8048060: 31 c0 xor %eax,%eax 8048062: 50 push %eax 8048063: 68 61 64 6f 77 push $0x776f6461 8048068: 68 63 2f 73 68 push $0x68732f63...

linux/x86 chmod('/etc/passwd',0777) - shellcode 42 bytes

/ Title: Linux/x86 chmod'/etc/passwd',0777 - shellcode 42 bytes Platform: linux/x8664 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes , reza.esparghamatgmaildotcom Website : www.reza.es Twitter : https://twitter.com/rezesp FaceBook :...

linux/x86 chmod('/etc/shadow','0777') - shellcode 42 bytes

/ Title: Linux/x86 chmod'/etc/shadow','0777' - shellcode 42 bytes Platform: linux/x8664 Date: 2015-06-15 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes , reza.esparghamatgmaildotcom Website : www.reza.es Twitter : https://twitter.com/rezesp...

linux/x86 chmod('/etc/gshadow') - shellcode 37 bytes

/ Title: Linux/x86 chmod'/etc/gshadow' - shellcode 37 bytes Platform: linux/x8664 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes , reza.esparghamatgmaildotcom Website : www.reza.es Twitter : https://twitter.com/rezesp FaceBook :...

Linux/x86 - chmod'/etc/gshadow' shellcode 37 bytes

Linux/x86 - chmod'/etc/gshadow' shellcode 37 bytes. Shellcode exploit for linx86 platform / Title: Linux/x86 chmod'/etc/gshadow' - shellcode 37 bytes Platform: linux/x8664 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes ,...

Linux/x86 - chmod'/etc/passwd',0777 shellcode 42 bytes

Linux/x86 - chmod'/etc/passwd',0777 shellcode 42 bytes. Shellcode exploit for linx86 platform / Title: Linux/x86 chmod'/etc/passwd',0777 - shellcode 42 bytes Platform: linux/x8664 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes ,...

Linux/x86 chmod'/etc/shadow','0777' shellcode 42 bytes

Linux/x86 chmod'/etc/shadow','0777' shellcode 42 bytes. Shellcode exploit for linx86 platform / Title: Linux/x86 chmod'/etc/shadow','0777' - shellcode 42 bytes Platform: linux/x8664 Date: 2015-06-15 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadote...

Dreambox WebInfo Authentication Bypass Vulnerability

This exploit is caused by systems files , they are writable , so i check them and i was able to cat or download the /etc/shadow user file , and bypass auth by fetching the user and cracking password. This is private exploit. You can buy it at https://0day.today...

mailman security and bug fix update

3:2.1.15-21 - fix CVE-2015-2775 - directory traversal in MTA transports 3:2.1.15-20 - fix 1107652 - do not install patch backup files in documentation 3:2.1.15-19 - fix 1188043 - set 2775 permission only for /etc/mailman 3:2.1.15-18 - fix 1107652 - add support for DMARC - fix 1180981 - install...

Linux/x86 - /etc/passwd Reader 58 bytes

Linux/x86 - /etc/passwd Reader 58 bytes. Shellcode exploit for linux platform Linux/x86 - /etc/passwd Reader - 58 bytes Greetz : BombermanLeader,wiremask.eu Author : B3mB4m Concat : Do not disturb - Bomberman Bu adamı geçmeden konuşmaya iznim yok.Iki yıl sonra görüşmek üzre : Info File descriptor...

linux/x86 - /etc/passwd Reader - 58 bytes

Linux/x86 - /etc/passwd Reader - 58 bytes Greetz : BombermanLeader,wiremask.eu Author : B3mB4m Concat : Do not disturb - Bomberman Bu adamı geçmeden konuşmaya iznim yok.Iki yıl sonra görüşmek üzre : Info File descriptor on EBX Buffer on ECX Bytes to read on EDX Disassembly of section .text:...

Linux/x86 - chmod 777 /etc/shadow & exit 33 bytes

Linux/x86 - chmod 777 /etc/shadow & exit 33 bytes. Shellcode exploit for linx86 platform Linux/x86 - chmod 777 /etc/shadow & exit - 33 bytes Greetz : BombermanLeader Author : B3mB4m Concat : [email protected] Disassembly of section .text: 08048060 : 8048060: 31 c0 xor %eax,%eax 8048062: 50 push %e...

ceph-deploy admin command copies keyring file to /etc/ceph which is world readable

It was discovered that ceph-deploy, a utility for deploying Red Hat Ceph Storage, would create the keyring file with world readable permissions, which could possibly allow a local user to obtain authentication credentials from the keyring file...

WordPress RobotCPA Plugin V5 - Local File Inclusion Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin RobotCPA V5 - Local File Include Google Dork: inurl:"/wp-content/plugins/robotcpa/" Date: 09.06.2015 Exploit Author: T3N38R15 Vendor Homepage: http://robot-cpa.good-info.co/ Version: 5V Tested on: Windows Firefo...

SUSE SLES11 Security Update : glibc (SUSE-SU-2014:1129-1)

This glibc update fixes a critical privilege escalation problem and two additional issues : - bnc892073: An off-by-one error leading to a heap-based buffer overflow was found in gconvtranslitfind. An exploit that targets the problem is publicly available. CVE-2014-5119 - bnc836746: Avoid race...

linux/x86 setuid(0) + setgid(0) + execve("/bin/cat", "/etc//shadow") - 52 by

// linux/x86 setuid0 + setgid0 + execve"/bin/cat", "/etc//shadow" - 52 bytes // Febriyanto Nugroho include char shellcode = "\x6a\x17\x58\xcd\x80\x6a\x2e" "\x58\xcd\x80\x6a\x0b\x58\x99" "\x52\x68\x61\x64\x6f\x77\x68" "\x2f\x2f\x73\x68\x68\x2f\x65" "\x74\x63\x89\xe1\x52\x68\x2f"...

linux/x86 execve("/bin/cat", "/etc/gshadow") - 44 bytes

/ Exploit Title : linux/x86 execve"/bin/cat", "/bin/cat", "/etc/gshadow", NULL - 44 bytes Exploit Author : Febriyanto Nugroho Tested on : Linux Debian 5.0.5 / include char shellcode = "\x31\xdb" "\x8d\x43\x0b" "\x99" "\x52" "\x68\x2f\x63\x61\x74" "\x68\x2f\x62\x69\x6e" "\x89\xe3" "\x52"...