Apple Mac OSX 10.5.x - ptrace Mutex Handling Local Denial of Service

Apple Mac OSX 10.5.x - ptrace Mutex Handling Local Denial of Service // source: https://www.securityfocus.com/bid/36915/info Apple Mac OS X is prone to a local denial-of-service vulnerability that is caused by a race condition. Exploiting this issue allows local, unprivileged users to crash...

Apple Mac OSX 10.5.x - 'ptrace' Mutex Handling Local Denial of Service

// source: https://www.securityfocus.com/bid/36915/info Apple Mac OS X is prone to a local denial-of-service vulnerability that is caused by a race condition. Exploiting this issue allows local, unprivileged users to crash affected kernels, denying further service to legitimate users. / Mac OS X...

Mail.app Image Attachment Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Mail.app Ima...

Java JSP Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 1593 include Msf::Payload::Single include Msf::Payload::JSP include...

Sun VirtualBox <= 3.0.6 privilege escalation

No description provided by source. !/bin/sh CVE-2009-3692 Sun VirtualBox = 3.0.6 local root exploit ======================================================== Exploits popen meta char shell injection vulnerability in Sun VirtualBox. E.g. admin@sundevil:/test$ id uid=101admin gid=10staff...

Sun VirtualBox 3.0.6 Local Root

!/bin/sh CVE-2009-3692 Sun VirtualBox runme.c include include include include include int mainint argc, char argv FILE from, to; int fd; char ch; setuid0; setgid0; from = fopen"/bin/sh","rb"; to = fopen"./sh","wb"; while!feoffrom ch = fgetcfrom; if!feoffrom fputcch, to; fclosefrom; fcloseto; fd =...

Sun VirtualBox 3.0.6 - Local Privilege Escalation

!/bin/sh CVE-2009-3692 Sun VirtualBox runme.c include include include include include int mainint argc, char argv FILE from, to; int fd; char ch; setuid0; setgid0; from = fopen"/bin/sh","rb"; to = fopen"./sh","wb"; while!feoffrom ch = fgetcfrom; if!feoffrom fputcch, to; fclosefrom; fcloseto; fd =...

Java JSP Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 1501 include Msf::Payload::Single include Msf::Payload::JSP include...

Mozilla Firefox 3.5 (Font tags) Remote Buffer Overflow Exploit (osx)

No description provided by source. !/usr/bin/env python FireFox 3.5 Heap Spray OS X Exploit Modified by: DrIDE Originally Discovered by: Simon Berry-Bryne Pythonized by: David Kennedy ReL1K @ SecureState Thanks to HDM Tested on OS X 10.5.7 from BaseHTTPServer import HTTPServer from BaseHTTPServer...

Mozilla Firefox 3.5 (OSX) - Font Tags Remote Buffer Overflow

Mozilla Firefox 3.5 OSX - Font Tags Remote Buffer Overflow !/usr/bin/env python FireFox 3.5 Heap Spray OS X Exploit Modified by: DrIDE Originally Discovered by: Simon Berry-Bryne Pythonized by: David Kennedy ReL1K @ SecureState Thanks to HDM Tested on OS X 10.5.7 from BaseHTTPServer import...

Mozilla Firefox 3.5 (OSX) - Font Tags Remote Buffer Overflow

!/usr/bin/env python FireFox 3.5 Heap Spray OS X Exploit Modified by: DrIDE Originally Discovered by: Simon Berry-Bryne Pythonized by: David Kennedy ReL1K @ SecureState Thanks to HDM Tested on OS X 10.5.7 from BaseHTTPServer import HTTPServer from BaseHTTPServer import BaseHTTPRequestHandler impo...

Apple Mac OSX xnu 1228.9.59 - Kernel Privilege Escalation

/ xnu-workq-v2-64.c Copyright c 2008 by Apple MACOS X xnu include include include include include include / profil defines / define PROFILITEMSIZE 64 define PROFILBLKSIZE 65536 define PROFILBLKNUM 84 / workq defines / define WQOPSQUEUEADD 1 define WORKQUEUEPRIOSMIN -2 define WORKQUEUEPRIOSMAX 2 /...

Adobe Acrobat <= 9.1.1 Stack Overflow Crash PoC (osx/win)

No description provided by source. Acrobat = 9.1.1 Stack Overflow Crashy PoC http://milw0rm.com/sploits/2009-crashytheclown.pdf http://sebug.net/local/2009-exploits/0905-exploits/2009-crashytheclown.pdf...

Adobe Acrobat 9.1.1 (OSX/Windows) - Stack Overflow Crash (PoC)

Acrobat = 9.1.1 Stack Overflow Crashy PoC https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33017.pdf 2009-crashytheclown.pdf milw0rm.com 2009-05-29...

Adobe Acrobat 9.1.1 (OSXWindows) - Stack Overflow Crash (PoC)

Adobe Acrobat 9.1.1 OSXWindows - Stack Overflow Crash PoC Acrobat = 9.1.1 Stack Overflow Crashy PoC https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/8826.pdf 2009-crashytheclown.pdf milw0rm.com 2009-05-29...

Adobe Acrobat <= 9.1.1 Stack Overflow Crash PoC (osx/win)

Exploit for multiple platform in category dos / poc ========================================================= Adobe Acrobat = 9.1.1 Stack Overflow Crash PoC osx/win ========================================================= Acrobat = 9.1.1 Stack Overflow Crashy PoC...

Lighttpd 1.4.23 Source Code Disclosure Vulnerability (FreeBSD/OSX bug)

No description provided by source. Severe vulnerability in FreeBSD/OSX with Lighttpd 1.4.23 latest version Most httpd daemons are probably vulnerable to this with FreeBSD/OSX as the OS. http://redmine.lighttpd.net/issues/1989 Description If you put a trailing slash / after the .php and that file ...

Lighttpd 1.4.23 Code Disclosure

Severe vulnerability in FreeBSD/OSX with Lighttpd 1.4.23 latest version Most httpd daemons are probably vulnerable to this with FreeBSD/OSX as the OS. http://redmine.lighttpd.net/issues/1989 Description If you put a trailing slash / after the .php and that file is a link, it will just display the...

Lighttpd 1.4.23 Source Code Disclosure Vulnerability (FreeBSD/OSX bug)

Exploit for multiple platform in category remote exploits ====================================================================== Lighttpd 1.4.23 Source Code Disclosure Vulnerability FreeBSD/OSX bug ====================================================================== Severe vulnerability in...

[Full-disclosure] FreeBSD/OS X kernel bug dump

All - the following are the exploits from the recent demonstrations at Apple Mac OSX = 10.4.0 local kernel root http://www.digit-labs.org/files/exploits/xnu-hfs-fcntl.c http://www.digit-labs.org/files/exploits/xnu-hfs-fcntl.sh FreeBSD = 7.0 ktimer local kernel root...