Create a New User with UID 0 - ARM (Meta)

No description provided by source. Exploit Title: Linux/ARM - Create a new user with UID 0 MSF Date: 2010-11-25 Author: Jonathan Salwan - twitter @jonathansalwan Tested on: ARM926EJ-S rev 5 v5l Issue link: https://metasploit.com/redmine/issues/3254 This file is part of the Metasploit Framework an...

Linux/ARM - Polymorphic execve("/bin/sh", ["/bin/sh"], NULL); - XOR 88 encoded - 78 bytes

No description provided by source. / Title: Linux/ARM - Polymorphic execve/bin/sh, /bin/sh, NULL; - XOR 88 encoded - 78 bytes Date: 2010-06-28 Tested on: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Database of shellcodes...

Linux ARM - Local Root Exploit

No description provided by source. / Just a lame binder local root exploit stub. Somewhat messy but whatever. The bug was reported in CVE-2013-6282. Tested on Android 4.2.2 and 4.4. Kernels 3.0.57, 3.4.5 and few more. All up to 3.4.5 unpatched should be vulnerable. You need to customize the...

ARM Polymorphic execve("/bin/sh", ["/bin/sh"], NULL) Shellcode Generator

No description provided by source. / Title: Generator polymorphic shellcode on ARM architecture Date: 2010-07-07 Tested on: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Database of shellcodes http://www.shell-storm.org/shellcode/...

Buffalo TeraStation TS-Series - Multiple Vulnerabilities

No description provided by source. Title: Buffalo TeraStation TS-Series multiple vulnerabilities Version affected: firmware version = 1.5.7 Vendor: http://www.buffalotech.com/products/network-storage Discovered by: Andrea Fabrizi Email: andrea.fabrizi gmail com Web: http://www.andreafabrizi.it...

ARM Loader Port 0x1337

No description provided by source. / Title: arm-loader Brief: Bind port 0x1337 on any local interface, listen for a connection receive a payload, and pass execution to it Author: Daniel Godas-Lopez gmail account dgodas / / socdes = socketAFINET, SOCKSTREAM, IPPROTOTCP; / mov %r0, $2 / AFINET / mo...

Linux/ARM - Disable ASLR Security - 102 bytes

No description provided by source. / Title: Linux/ARM - Disable ASLR Security - 102 bytes Date: 2010-06-20 Tested: Linux ARM9 2.6.28-6-versatile Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Database of shellcodes http://www.shell-storm.org/shellcode/...

[Raspberry Pi] Linux/ARM - execve("/bin/sh", [0], [0 vars]) - 30 bytes

No description provided by source. / Title: Linux/ARM - execve/bin/sh, 0, 0 vars - 30 bytes Date: 2012-09-08 Tested on: ARM1176JZF-S v6l Author: midnitesnake 00008054 start: 8054: e28f6001 add r6, pc, 1 8058: e12fff16 bx r6 805c: 4678 mov r0, pc 805e: 300a adds r0, 10 8060: 9001 str r0, sp, 4 806...

Linux/ARM - setuid(0) & execve("/bin/sh","/bin/sh",0) - 38 bytes

No description provided by source. / Title: Linux/ARM - setuid0 & execve/bin/sh,/bin/sh,0 - 38 bytes Date: 2010-06-29 Tested: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Dtabase of shellcodes http://www.shell-storm.org/shellcode/...

Linux/ARM chmod("/etc/shadow", 0777) Shellcode 35 Bytes

No description provided by source. / | Title: Linux/ARM chmod/etc/shadow, 0777 Shellcode 35 Bytes | Type: Shellcode | Author: Florian Gaultier [email protected] | Platform: Linux ARM ARM926EJ-S rev 5 v51 | + http://www.shell-storm.org / include stdio.h char shellcode =...

Linux/ARM - polymorphic chmod("/etc/shadow", 0777) - 84 Bytes

No description provided by source. / | Title: Linux/ARM - polymorphic chmod/etc/shadow, 0777 - 84 Bytes | Type: Shellcode | Author: Florian Gaultier [email protected] | Platform: Linux ARM ARM926EJ-S rev 5 v51 | + http://www.shell-storm.org / include stdio.h char shellcode =...

Linux/ARM - add root user with password - 151 bytes

No description provided by source. / Title: Linux/ARM - add root user with password - 151 bytes Date: 2010-11-25 Tested on: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan - twitter: @shellstorm http://shell-storm.org Informations: ------------- - user: shell-storm - pswd: toor - uid : 0 / include...

Linux/ARM - execve("/bin/sh","/bin/sh",0) - 30 bytes

No description provided by source. / Title: Linux/ARM - execve/bin/sh,/bin/sh,0 - 30 bytes Date: 2010-06-28 Tested: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Dtabase of shellcodes http://www.shell-storm.org/shellcode/ 8054:...

Linux/ARM - execve("/bin/sh", [0], [0 vars]) - 27 bytes

No description provided by source. / Title: Linux/ARM - execve/bin/sh, 0, 0 vars - 27 bytes Date: 2010-08-31 Tested on: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan - twitter: @jonathansalwan shell-storm.org Shellcode ARM with not a 0x20, 0x0a and 0x00 Disassembly of section .text: 00008054 start...

information leak via gnttab_setup_table on ARM

ISSUE DESCRIPTION When initialising an internal data structure on ARM platform Xen was not correctly initialising the memory containing the list of a domain's grant table pages. This list is returned by the GNTTABOPsetuptable subhypercall, leading to an information leak. IMPACT Malicious guest...

[oss-security] Xen Security Advisory 98 (CVE-2014-3969) - insufficient permissions checks accessing guest memory on ARM

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Xen Security Advisory CVE-2014-3969 / XSA-98 version 3 insufficient permissions checks accessing guest memory on ARM UPDATES IN VERSION 3 ==================== CVE assigned. ISSUE DESCRIPTION ================= When accessing guest memory Xen does not...

unexpected pitfall in xenaccess API

ISSUE DESCRIPTION A test/example program, for exercising the Xen memaccess API, does not take all necessary precautions against hostile guest behaviour. As a result, software developers using it as an example or template might have written and deployed vulnerable code. See the patch for technical...

Adobe Reader for Android < 11.2.0 - 'addJavascriptInterface' Local Overflow (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/fileformat' require 'msf/core/exploit/pdf' require 'msf/core/exploit/android' class Metasploit3 'Adobe Reader for Android...

openSUSE Security Update : kernel (openSUSE-SU-2013:0951-1)

The openSUSE 12.3 kernel was updated to fix a critical security issue, other security issues and several bugs. Security issues fixed: CVE-2013-2094: The perfsweventinit function in kernel/events/core.c in the Linux kernel used an incorrect integer data type, which allowed local users to gain...

openSUSE Security Update : chromium (openSUSE-SU-2014:0601-1)

This chromium version update fixes the following security and non-security issues : - Add patch chromium-fix-arm-skia-memset.patch to resolve a linking issue on ARM with regards to missing symbols. - Add patch armusegold.patch to use the right gold binaries on ARM. Hopefully this resolves the bui...