CVE-2018-0052 Junos OS: Unauthenticated remote root access possible when RSH service is enabled

If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH service is disabled by default on Junos. There is no documented CLI command to enable this service. However, an undocumented CLI command...

DEBIAN-CVE-2017-17853

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging incorrect BPFRSH signed bounds calculations...

UBUNTU-CVE-2017-17853

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging incorrect BPFRSH signed bounds calculations...

Oracle Solaris 11.111.3 (RSH) - Stack Clash Local Privilege Escalation

Oracle Solaris 11.111.3 RSH - Stack Clash Local Privilege Escalation / Solarisrsh.c for CVE-2017-3630, CVE-2017-3629, CVE-2017-3631 Copyright C 2017 Qualys, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published ...

Solaris RSH Stack Clash Privilege Escalation

This module exploits a vulnerability in RSH on unpatched Solaris systems which allows users to gain root privileges. The stack guard page on unpatched Solaris systems is of insufficient size to prevent collisions between the stack and heap memory, aka Stack Clash. This module uploads and executes...

BruteSpray - Brute-Forcing from Nmap output (Automatically attempts default creds on found services)

BruteSpray takes nmap GNMAP output and automatically brute-forces services with default credentials using Medusa. BruteSpray can even find non-standard ports by using the -sV inside Nmap. Usage First do an nmap scan with '-oA nmap.gnmap'. Command: python brutespray.py -h Example: python...

Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation Exploit

Exploit for windows platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation', 'Descriptio...

Mac OS X 10.9.5 / 10.10.5 rsh/libmalloc Privilege Escalation

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation', 'Description' = %q This module writes to the sudoers file without...

Apple Mac OSX 10.9.5/10.10.5 - 'rsh/libmalloc' Local Privilege Escalation (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation', 'Description' = %q This module writes to the sudoers file without...

Immunity Canvas: OSX_RSH_LIBMALLOC

Name| osxrshlibmalloc ---|--- CVE| CVE-2015-5889 Exploit Pack| CANVAS Description| OS X rsh/libmalloc local privilege escalation Notes| Repeatability: Multiple Times Notes: Exploit should work on many different versions of MacOS X 64bit, but it has been specifically tested on: - 10.10.3 - 10.10.1...

CVE-2015-5889

CVE-2015-5889 affects Apple macOS prior to 10.11, where the rsh component in the remote_cmds area allows local users to elevate privileges to root via environment variable vectors. Public details confirm a local-privilege-escalation path, with exploit-publications and PoC modules targeting the OS...

issetugid() + rsh + libmalloc OS X Local Root

CVE-2015-5889: issetugid + rsh + libmalloc osx local root tested on osx 10.9.5 / 10.10.5 jul/2015 by rebel import os,time,sys env = s = os.stat"/etc/sudoers".stsize env'MallocLogFile' = '/etc/crontab' env'MallocStackLogging' = 'yes' env'MallocStackLoggingDirectory' = 'a\n root echo "ALL ALL=ALL...

issetugid() + rsh + libmalloc OS X Local Root Exploit

The default root-suid binary /usr/bin/rsh on Mac OS X uses execv in an insecure manner. /usr/bin/rsh will invoke /usr/bin/rlogin if launched with only a host argument, without dropping privileges or clearing the environment. This exploit will pass "MallocLogFile" to /usr/bin/rsh, which is then...

Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation

This module writes to the sudoers file without root access by exploiting rsh and malloc log files. Makes sudo require no password, giving access to su even if root is disabled. Works on OS X 10.9.5 to 10.10.5 patched on 10.11. Module Options msf use exploit/osx/local/rsh/libmalloc msf...

Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation

Exploit for macOS platform in category local exploits CVE-2015-5889: issetugid + rsh + libmalloc osx local root tested on osx 10.9.5 / 10.10.5 jul/2015 by rebel import os,time,sys env = s = os.stat"/etc/sudoers".stsize env'MallocLogFile' = '/etc/crontab' env'MallocStackLogging' = 'yes'...

Medusa - Speedy, Parallel and Modular Login Brute-Forcer

Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer. The goal is to support as many services which allow remote authentication as possible. The author considers following items as some of the key features of this application: Thread-based parallel testing. Brute-for...

The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the integrity of protected information.

The vulnerability of the rsh-0.17 package for the Red Hat Enterprise Linux operating system can lead to a breach of protected information. Exploiting this vulnerability can be done remotely...

The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the integrity of protected information.

The vulnerability of the rsh-server-0.17 package for the Red Hat Enterprise Linux operating system can lead to a breach of protected information. Exploiting this vulnerability can be done remotely...

IT-Grundschutz M5.020: Einsatz der Sicherheitsmechanismen von rlogin, rsh und rcp

IT-Grundschutz M5.020: Einsatz der Sicherheitsmechanismen von rlogin, rsh und rcp. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM5020.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 5.020 Authors: Thomas Rotter Copyright: Copyright c 2015...

IT-Grundschutz M5.020: Einsatz der Sicherheitsmechanismen von rlogin, rsh und rcp

IT-Grundschutz M5.020: Einsatz der Sicherheitsmechanismen von rlogin, rsh und rcp. Stand: 14. Ergaenzungslieferung 14. EL. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...