Linux/x86 - EggHunter + access() Shellcode (38 bytes)

/ ; Filename: egghunter.nasm ; Author: Paolo Perego ; Website: https://codiceinsicuro.it ; Blog post: https://codiceinsicuro.it/slae/ ; Twitter: @thesp0nge ; SLAE-ID: 1217 ; Purpose: This is the first stage of our payload. An egg-hunter shellcode ; looping through memory and jumping on the payloa...

linux/x86 add user 104 bytes

No description provided by source. / Source to this is pass.s This will append a root line to the passwd file see the source. Shok Matt Conover, [email protected] / char shellcode= "\xeb\x03\x5f\xeb\x05\xe8\xf8\xff\xff\xff\x31\xdb\xb3\x35\x01\xfb"...

MySQL 3.23.x/4.0.x Remote Exploit

Exploit for linux platform in category remote exploits ================================= MySQL 3.23.x/4.0.x Remote Exploit ================================= / Mysql 3.23.x/4.0.x remote exploit proof of concept using jmp eax bkbll bkbll cnhonker.net,bkbll tom.com 2003/09/12 compile:gcc -o mysql...

OpenBSD 3.1 sshd remote root exploit

Download openssh-3.2.2p1.tar.gz and untar it $ tar -xvzf openssh-3.2.2p1.tar.gz 2. Apply the patch provided below by running: /openssh-3.2.2p1 $ patch pathtodifffile 3. Compile the patched client /openssh-3.2.2p1 $ ./configure && make ssh 4. Run the evil ssh: /openssh-3.2.2p1 $ ./ssh...

GLIBC (via /bin/su) Local Root Exploit

Exploit for linux platform in category local exploits ====================================== GLIBC via /bin/su Local Root Exploit ====================================== / Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of...

Solaris 7 x86 lpset exploit.

Solaris 7 x86 /usr/bin/lpset overflow, there is a small overflow32 bytes in lpset which will yield root access if properly exploited. There is a sparc version avail for this bug, the bug was discovered by duke some time ago. I am releasing this exploit because of a copy-cat exploit on hack.co.za...