kernel: exit_notify: kill the wrong capable(CAP_KILL) check

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

Joomla RSGallery2 Backdoor

Vulnerability: Remote code execution back doors Software: RSGallery2 - Gallery Extension for Joomla! We are currently working on a new website. All files are still available at the JoomlaCode project page. Severity: Not a big deal. Joomla components contain all sorts of obfuscated junk all the...

Soulseek 157 NS Remote Buffer Overflow Exploit (SEH)

No description provided by source. !/usr/bin/python x Bug :Soulseek 157 NS Remote Seh Overwrite Exploit x Credits & poc from : http://www.milw0rm.com/exploits/8777 x Tested on : Windows Xp sp3, Soulseek 157 NS 12d x The exploit attacks the user :"test4321" import struct import sys, socket from ti...

freebsd/x86-64 exec(""/bin/sh"") shellcode 31 bytes

No description provided by source. / | | | | | | | \ | | | | || |/ |/ | |/ / ' \ | | / | | | | | | | | | | | | | | | | || ||,|||\| || || \/||| http://www.hacknroll.com Description: FreeBSD x86-64 exec"/bin/sh" Shellcode - 31 bytes Authors: Maycon M. Vitali 0ut0fBound Milw0rm .:...

CastRipper 2.50.70 - .m3u Universal Stack Overflow (Python)

CastRipper 2.50.70 - .m3u Universal Stack Overflow Python !/usr/bin/python print "" print " CastRipper 2.50.70 .m3u Universal Stack Overflow Exploit\n" print " Refer: http://www.milw0rm.com/exploits/8660\n" print " Exploit code: super-cristal\n" print " Tested on: Windows XP Pro SP3\n" print "...

32bit FTP (09.04.24) (CWD Response) Universal Seh Overwrite Exploit

No description provided by source. !/usr/bin/python | || | / \ | | | | | | | | | - | | | / / | | |||| || // / |\ || Bug : 32bit FTP 09.04.24 CWD Response Universal Seh Overwrite Exploit Refer : http://www.milw0rm.com/exploits/8611 Tested on : Xp sp3 ENVB Exploited by : His0k4 Greetings : All...

CVE-2009-1527

Race condition in the ptraceattach function in kernel/ptrace.c in the Linux kernel before 2.6.30-rc4 allows local users to gain privileges via a PTRACEATTACH ptrace call during an exec system call that is launching a setuid application, related to locking an incorrect credexecmutex object...

Race condition

Race condition in the ptraceattach function in kernel/ptrace.c in the Linux kernel before 2.6.30-rc4 allows local users to gain privileges via a PTRACEATTACH ptrace call during an exec system call that is launching a setuid application, related to locking an incorrect credexecmutex object...

kernel: exit_notify: kill the wrong capable(CAP_KILL) check

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

Steamcast - HTTP Request Remote Buffer Overflow (SEH) (1)

Steamcast - HTTP Request Remote Buffer Overflow SEH 1 !/usr/bin/python Usage : steamcast.py victimeip Bug : SteamcastHTTP Request Remote Buffer Overflow Exploit SEH 1 Founder : Luigi Auriemma, thx to overflow3r for informing me about the vuln. Tested on : Xp sp2 fr Exploited by : His0k4 Greetings...

Gravity Board X 2.0 Beta - SQL Injection / (Authenticated) Code Execution

================================================================================ Found : brainpillow Dork : "Powered By Gravity Board X v2.0 BETA" Visit : brainpillow.cc, forum.antichat.ru, raz0r.name Mail : [email protected]...

BS.Player <= 2.34 Build 980 (.bsl) Local Buffer Overflow Exploit (SEH)

Exploit for unknown platform in category local exploits ====================================================================== BS.Player = 2.34 Build 980 .bsl Local Buffer Overflow Exploit SEH ====================================================================== ?php / Bs.Player = 2.34 Build 980...

Mediacoder 0.6.2.4275 - '.m3u' Universal Stack Overflow

!/usr/bin/perl MediaCoder 0.6.2.4275 Universal Stack Based Overflow By Stack Mountassif Moad cat Greatz.txt Jadi-Chel7 & Mr.Safa7 & Houssamix & Simo-Soft & DDos & Simo64 & G0rillaz & Issam & Sec-Alert & & Bohayra & j0rd4n14n.r1z Webug & Travis-Barker & Keyo & General l0s3r & NeoCoderz & welahima...

WFTPD Explorer Pro 1.0 - Remote Heap Overflow

!/usr/bin/perl WFTPD Explorer Pro 1.0 Remote Heap Overflow Exploit --------------------------------------------------- Exploit by SkD [email protected] This is a remote heap overflow exploit for WFTPD Explorer Pro 1.0 by Texas Imperial Software. Vendors website = http://www.wftpd.com Tested on...

Zinf Audio Player 2.2.1 - '.pls' Universal Local Buffer Overflow

!/usr/bin/perl -w Author : Houssamix Zinf Audio Player 2.2.1 PLS File Universal Local Buffer Overflow exploit tested in windows pro Sp 2 french print "===================================================================== \n"; print "Author : Houssamix \n"; print...

VUPlayer 2.49 .ASX Local Buffer Overflow

VUPlayer 2.49 .ASX File Universal Local Buffer Overflow Exploit By:Encrypt3d.M!nd This is an exploit for this Proof of Concept: http://milw0rm.com/exploits/7709 very easy one : Well i've Sent this since the poc published but str0ke had a brain fart : Greetz:Str0keGod Bless You bro,-=Mizo=-,L!0N,E...

BSD/x86 - setreuid(geteuid(), geteuid()) + execve("/bin/sh") Shellcode (36 bytes)

BSD/x86 - setreuidgeteuid, geteuid + execve"/bin/sh" Shellcode 36 bytes. Shellcode exploit for BSDx86 platform / bsd/x86 setreuid/exec shellcode setreuidgeteuid, geteuid and execve"/bin/sh", "/bin/sh", 0 shellcode based on hkpco's setreuid/exec shellcode for linux Tested on FreeBSD / include...

MS Internet Explorer XML Parsing Buffer Overflow Exploit (allinone)

Exploit for unknown platform in category remote exploits =================================================================== MS Internet Explorer XML Parsing Buffer Overflow Exploit allinone =================================================================== x // windows/exec - 148 bytes //...

CVE-2008-5407

Multiple unspecified vulnerabilities in the Backup Exec remote-agent logon process in Symantec Backup Exec for Windows Servers 11.0 aka 11d builds 6235 and 7170, 12.0 build 1364, and 12.5 build 2213 allow remote attackers to bypass authentication, and read or delete files, via unknown vectors...

CVE-2008-5408

Buffer overflow in the data management protocol in Symantec Backup Exec for Windows Servers 11.0 aka 11d builds 6235 and 7170, 12.0 build 1364, and 12.5 build 2213 allows remote authenticated users to cause a denial of service application crash and possibly execute arbitrary code via unknown...