CVE-2017-11671

Under certain circumstances, the ix86expandbuiltin function in i386.c in GNU Compiler Collection GCC version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially...

CVE-2017-11671

CVE-2017-11671 affects GCC: the ix86_expand_builtin path in i386.c can generate RDRAND/RDSEED instruction sequences that clobber the status flag before being read, potentially causing reduced randomness. Documented in GCC bug reports and affected across GCC 4.6–4.9, 5 before 5.5, and 6 before 6.4...

PT-2017-12164 · Gnu +4 · Gcc +4

Name of the Vulnerable Software and Affected Versions: GNU Compiler Collection GCC versions 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 Description: The issue arises in the ix86 expand builtin function in i386.c, where under certain circumstances, it generates instruction sequences that...

Belkin F7D7601 NetCam - Multiple Vulnerabilities

Belkin F7D7601 NetCam - Multiple Vulnerabilities Exploit Title: Belkin NetCam F7D7601 | Remote Command Execution Date: 17/07/17 Exploit Author: Wadeek Vendor Homepage: http://www.belkin.com/ Tested on: Belkin NetCam F7D7601 WeMoNetCamWW2.00.10684.PVT ==============================================...

Linux/x86 - Reverse TCP Shellcode (67 bytes)

/ Tiny Shell Reverse TCP Shellcode - C Language Linux/x86 Written in 2013 by Geyslan G. Bem, Hacking bits http://hackingbits.com email protected This source is licensed under the Creative Commons Attribution-ShareAlike 3.0 Brazil License. To view a copy of this license, visit...

Linux Kernel (Debian 78910 Fedora 232425 CentOS 5.35.116.06.87.2.1511) - ldso_hwcap Stack Clash Local Privilege Escalation

Linux Kernel Debian 78910 Fedora 232425 CentOS 5.35.116.06.87.2.1511 - ldsohwcap Stack Clash Local Privilege Escalation / Linuxldsohwcap.c for CVE-2017-1000366, CVE-2017-1000370 Copyright C 2017 Qualys, Inc. myimportanthwcaps adapted from elf/dl-hwcaps.c, part of the GNU C Library: Copyright C...

Linux/x86_64 - execve("/bin/sh") Shellcode (24 bytes)

Linux/x8664 - execve"/bin/sh" Shellcode 24 bytes. Shellcode exploit for Linx86-64 platform / ;Category: Shellcode ;Title: GNU/Linux x8664 - execve /bin/sh ;Author: m4n3dw0lf ;Github: https://github.com/m4n3dw0lf ;Date: 14/06/2017 ;Architecture: Linux x8664 ;Tested on : 1 SMP Debian 4.9.18-1...

Linux Kernel keyctl_set_reqkey_keyring Denial Of Service

/ Source: https://bugzilla.novell.com/showbug.cgi?id=1034862 QA REPRODUCER: gcc -O2 -o CVE-2017-7472 CVE-2017-7472.c -lkeyutils ./CVE-2017-7472 will run the kernel out of memory / include include int main for ;; keyctlsetreqkeykeyringKEYREQKEYDEFLTHREADKEYRING;...

CVE-2016-4973

Binaries compiled against targets that use the libssp library in GCC for stack smashing protection SSP might allow local users to perform buffer overflow attacks by leveraging lack of the Object Size Checking feature...

CVE-2016-4973

Binaries compiled against targets that use the libssp library in GCC for stack smashing protection SSP might allow local users to perform buffer overflow attacks by leveraging lack of the Object Size Checking feature...

CVE-2016-4973

Binaries compiled against targets that use the libssp library in GCC for stack smashing protection SSP might allow local users to perform buffer overflow attacks by leveraging lack of the Object Size Checking feature...

CVE-2016-4973

CVE-2016-4973 concerns binaries built against targets using GCC’s libssp for stack smashing protection. The root cause is the lack of Object Size Checking in libssp, which may allow local users to trigger buffer overflows. Documented impacts include partial confidentiality, integrity, and availab...

shopify-scripts: heap-buffer-overflow (read outside of buffer) in mrb_vm_exec()

Triggered in 3231219 14 April 2017. Compiled with afl-gcc + asan. ./mirb test000 ==10555==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200001c920 at pc 0x52be2c bp 0x7ffe6751ada0 sp 0x7ffe6751ad98 READ of size 16 at 0x60200001c920 thread T0 0 0x52be2b in mrbvmexec...

PonyOS 4.0 fluttershy LD_LIBRARY_PATH Privilege Escalation

!/usr/bin/python PonyOS 4.0 has added several improvements over previous releases including support for setuid binaries and dynamic libraries. The run-time linker does not sanitize environment variables when running setuid files allowing for local root exploitation through manipulated...

Analysis of the EQGRP leakage

As you know, yesterday TheShadowBrokers group released EQGRP archive with some interesting data inside. As they mentioned, it’s a NSA leakage with a lot of “cyberweapon”. I analysed this data yesterday to find the answers to following questions: 1. When did the leak occur? 2. Who were the targets...

Dropbox: avrecode: global-buffer-overflow in get_neighbor()

Source: https://github.com/dropbox/avrecode Version: 2de743d Built using the Github instructions with afl-gcc and ASAN. Feeding this malformed .mp4 to recode triggers a global buffer overflow. ./recode roundtrip test003.mp4 mov,mp4,m4a,3gp,3g2,mj2 @ 0x61b00001f180 Protocol name not provided, cann...

shopify-scripts: Null pointer dereference in OP_ENTER

PoC === The following demonstrates a crash: class A def foo end end class B argv = ary-ptr; gdb p ary $1 = struct RArray 0x0 Test platform ============= Linux Mint 17.3 Cinnamon 64-bit, built with gcc version 4.8.4 Ubuntu 4.8.4-2ubuntu114.04.3 mruby SHA: a14a930c800aa50a191922580d53a2ce09287912...

AntiVirus Evasion Tool: AVET

AVET is an AntiVirus Evasion Tool, which was developed for making life easier for pentesters and for experimenting with antivirus evasion techniques. What & Why: when running an exe file made with msfpayload & co, the exe file will often be recognized by the antivirus software avet is a antivirus...

dev.thegcccoin.com XSS vulnerability

Vulnerable URL: https://dev.thegcccoin.com/registration-form/?pack=edu Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

shopify-scripts: Null pointer dereference in mrb_class

PoC === The following demonstrates a crash: if def class A ensure e rescue 0 end end .map.a Debug info ========== The crash happens due to a null pointer dereference in mrbclass, class.h:50. 50├ return mrbobjptrv-c; Valgrind shows several reads inside free'd blocks. Test platform =============...