3685 matches found
CVE-2026-6018-9-Local-Privilege-Escalation-Chain
CVE-2025-6018 + CVE-2025-6019：本地权限提升链 目标操作系统： openSUSE Leap 15.x / SUSE Linux Enterprise 15.x 所需访问权限： 具有 SSH 访问权限的非特权本地用户 结果： 完整 root shell 概述 本文档详细介绍了由 Qualys 威胁研究部门发现的两个链式本地权限提升漏洞的手动利用方法： CVE-2025-6018 — 通过 /.pamenvironment 进行 PAM 环境变量注入，允许远程 SSH 用户获得通常仅保留给物理在场的控制台用户的 allowactive Polkit 状态。...
CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit
CVE-2025-6018 + CVE-2025-6019 提权利用指南 📋 快速利用流程 步骤 1：准备 XFS 镜像（本地机器） root@kitploit: 创建 300MB XFS 镜像 dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image 挂载并安装 SUID bash mkdir mnt sudo mount -t xfs xfs.image mnt sudo cp /bin/bash mnt/bash sudo chmod 4755 mnt/bash sudo umount mnt rmdir...
Sudo-Security-Bypass-CVE-2019-14287
Sudo-Security-Bypass-CVE-2019-14287 =========================================================================== root@kitploit: ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██╗ █████╗ ██╗██╗ ██╗██████╗ █████╗ ███████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗███║██╔══██╗ ███║██║...
CVE-2020-14871-Exploit
CVE 2020-14871 Solaris 漏洞利用程序 这是一个基于 ROP 的 CVE 2020-14871 基础漏洞利用程序。CVE 2020-14871 是 Sun Solaris 系统中的一个漏洞。 该漏洞实际上是位于 PAM parseusername 函数中的一个经典栈缓冲区溢出漏洞。 攻击者可以通过操纵 SSH 客户端设置，强制使用键盘交互式身份验证来提示输入用户名， 然后向 PAM parseusername 函数传递无限制的输入。当输入达到 512 字节时， 用户名缓冲区将发生溢出。该漏洞是在 Mandiant 执行的一次入侵评估中在野外被发现的，...
Alibaba Cloud Linux 3 : 0274: pam (ALINUX3-SA-2026:0274)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0274 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-54411: Linux-PAM through 1.7.2 contains an...
RHSA-2026:61230 Red Hat Security Advisory: pam security update
Bulletin has no description...
RHSA-2026:61229 Red Hat Security Advisory: pam security update
Bulletin has no description...
RHSA-2026:61228 Red Hat Security Advisory: pam security update
Bulletin has no description...
RHSA-2026:61227 Red Hat Security Advisory: pam security update
Bulletin has no description...
RHSA-2026:61226 Red Hat Security Advisory: pam security update
Bulletin has no description...
RHSA-2026:61225 Red Hat Security Advisory: pam security update
Bulletin has no description...
RHSA-2026:61224 Red Hat Security Advisory: pam security update
Bulletin has no description...
RHSA-2026:61223 Red Hat Security Advisory: pam security update
Bulletin has no description...
Exploit-Chain-CVE-2025-6018-6019
https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt 该漏洞利用链结合了 CVE-2025-6018 和 CVE-2025-6019，实现从无特权的普通用户到拥有 root 权限的本地提权，针对存在漏洞的 SUSE/openSUSE 系统。CVE-2025-6018 是 PAM（可插拔认证模块）中的环境变量注入漏洞，存在于 pamenv.so（版本 1.3.0-1.6.0）中，允许用户通过 /.pamenvironment 文件使用 OVERRIDE 指令污染其会话环境。通过操纵 XDG...
CVE-2025-6018_CVE-2025-6019_autopwn
链式漏洞利用 CVE-2025-6018 与 CVE-2025-6019 Auto-Pwn 此仓库包含一个完整的漏洞利用链（"Auto-Pwn"），针对主要影响 openSUSE Leap 15.x / SUSE 系统的两个关键漏洞： 1. CVE-2025-6018 ：PAM 环境注入。允许用户通过 /.pamenvironment 修改敏感变量（如 XDGSEAT），欺骗 systemd-logind 授予扩展权限（allowactive 状态）。 2. CVE-2025-6019 ：通过 UDisks2...
Moderate: Red Hat Security Advisory: pam security update
An update for pam is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module
A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...
pam_pkcs11
此项目已不再维护 我 @LudovicRousseau 不再使用这个软件，也没有时间维护它。 参见 "Pam-pkcs11 很快需要新的维护者，否则它将消亡" https://sourceforge.net/p/opensc/mailman/message/35191905/ 如果你想成为新的维护者，只需让我 @LudovicRousseau 将你添加到 https://github.com/orgs/OpenSC/teams/pampkcs11-maintainers 组中。...
copyfail-rs
copyfail-rs 针对 CVE-2026-31431（CopyFail）的多向量 PoC + 配套检测。 包含一个新颖的 PAM 认证绕过向量，其他公开 PoC 均未提供。 检测模式能够捕获 AIDE / Wazuh / OSSEC / Tripwire 在结构上无法发现的内容。 单个静态二进制文件。约 108 KB。nostd musl。 演示 root@kitploit: noot@host:$ ./copyfail-rs --mode exploit sudo password for noot: root@host: id uid=0root gid=0root...
linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module
A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...