324 matches found
linux/x86 chmod 666 /etc/shadow 41 bytes
linux/x86 chmod 666 /etc/shadow 41 bytes. Shellcode exploit for linx86 platform / [email protected] 0x04abril0x7d2 int syschmodconst char filename, modet mode ... Utilizando la interrupcion 15chmod, asignando el octal 0666 al archivo deseado. En este caso /etc/shadow Hice unas...
linux/x86 chmod 666 /etc/shadow 41 bytes
No description provided by source. / [email protected] 0x04abril0x7d2 int syschmodconst char filename, modet mode ... Utilizando la interrupcion 15chmod, asignando el octal 0666 al archivo deseado. En este caso /etc/shadow Hice unas modificaciones en el codigo y solo pude reducir la...
linux/x86 chmod 666 /etc/shadow 41 bytes
Exploit for linux/x86 platform in category shellcode ======================================== linux/x86 chmod 666 /etc/shadow 41 bytes ======================================== / email protected 0x04abril0x7d2 int syschmodconst char filename, modet mode ... Utilizando la interrupcion 15chmod,...
musicDaemon.txt
Discovered and Exploit Coded by: Tal0n [email protected] URL: http://musicdaemon.sourceforge.net Note: This was 0day for several months.. I decided to turn it in because there may be 10 whole boxes in the world running this.. and its not very handy sitting around on my box =p. / MusicDaemon...
MusicDaemon 0.0.3 - Remote Denial of Service etcshadow Stealer (2)
MusicDaemon 0.0.3 - Remote Denial of Service etcshadow Stealer 2 / MusicDaemon Hello ...... bin::9797:0::::: ftp::9797:0::::: sshd::9797:0::::: ...... root@vortex:/test Server Side View: root@vortex:/test/musicdaemon-0.0.3/src ./musicd -c ../musicd.conf -p 1234 Using configuration: ../musicd.conf...
MusicDaemon <= 0.0.3 v2 Remote DoS and /etc/shadow Stealer
Exploit for linux platform in category remote exploits ========================================================== MusicDaemon Hello ...... bin::9797:0::::: ftp::9797:0::::: sshd::9797:0::::: ...... email protected:/test Server Side View: email protected:/test/musicdaemon-0.0.3/src ./musicd -c...
Qt BMP Parsing Bug Heap Overflow Exploit
Exploit for linux platform in category remote exploits ========================================================== MusicDaemon Hello ...... bin::9797:0::::: ftp::9797:0::::: sshd::9797:0::::: ...... email protected:/test Server Side View: email protected:/test/musicdaemon-0.0.3/src ./musicd -c...
CVE-2002-0762
CVE-2002-0762 : The shadow package in SuSE 8.0 lets local users destroy /etc/passwd and /etc/shadow or grant extra group privileges by lowering the filesize limits before programs modify those files, indicating a local-privilege-impact scenario due to improper enforcement of file-size constraints...
Perl 5.6.0 (on Linux) getpwuid() leave /etc/shadow opened
I'm not sure how serious this issue is, but I think it may cause problems in some environments. The system is Linux, RedHat 7.0, Perl 5.6.0, glibc 2.2.4, latest updates. Recently I run 'lsof' on unprivileged Apache httpd process running modperl application and was pretty surprised to see...
CVE-2001-1175
CVE-2001-1175 : In vipw from the util-linux package, before version 2.10, editing /etc/shadow could leave the file world-readable in some cases, enabling local users to more easily perform brute-force password guessing. Supported details in connected docs show Red Hat advisories (RHSA-2001:95, 13...
Проблемы с vipw (weak permissons)
После редактирования /etc/shadow файл становится открытым на чтение...
Дырки в pkg-утилитах SCO
Можно получить доступ к содержимому /etc/shadow...
glibc-resolve-tr.sh
Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...
glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read
Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...
Дырка в sash в Debian
При копировании /etc/shadow создаются файлы открытые на чтение...
[SECURITY] [DSA-015-1] New version of sash released
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------------------------- Debian Security Advisory DSA-015-1 [email protected] http://www.debian.org/security/ Martin Schulze January 23, 2001 -...
CVE-1999-0712
CVE-1999-0712 affects Caldera Open Administration System (COAS). The vulnerability allows the /etc/shadow password file to be made world-readable, indicating a confidentiality impact. Exploitation details are not provided in the connected documents; sources (Red Hat, CVE entries, and PT Security)...
SCO Unixware 7.1 pkginstall - Local Buffer Overflow
SCO Unixware 7.1 pkginstall - Local Buffer Overflow // source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are...
SCO Unixware 7.1 pkgcat - Local Buffer Overflow
SCO Unixware 7.1 pkgcat - Local Buffer Overflow // source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are...
unixware.pkg.txt
Greetings, OVERVIEW Any user may read any file on the system. BACKGROUND Only UnixWare 7.1 has been tested. DETAILS As previously stated, UnixWare binaries gain additional privileges via standard suid/sgid AND /etc/security/tcb/privs. The majority of the UnixWare "pkg" command, such as pkginfo,...