Linux Kernel 2.0/2.0.33 - i_count Overflow (PoC)

/ source: https://www.securityfocus.com/bid/388/info The icount member in the Linux inode structure is an unsigned short integer. It can be overflowed by mapping a single file too many times, allowing for a local user to possibly gain root access on the target machine or cause a denial of service...

IRIX 5.36.x - usrbinmail Local Buffer Overflow

IRIX 5.36.x - usrbinmail Local Buffer Overflow / source: https://www.securityfocus.com/bid/1542/info The mail1 program, also know as mailatt, is used to read or send email. A buffer overflow condition exists in code that handles the LOGNAME environment variable. This could be exploited to elevate...

IBM AIX 4.2 - 'ping' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/387/info A buffer overflow condition exists in some versions of /usr/sbin/ping under AIX. Given that ping is SUID root, this overflow allows malicious users to gain root from it. / /usr/sbin/ping exploit kinda' coded by BeastMaster V CREDITS: this is...

IBM AIX 4.2 - ping Local Buffer Overflow

IBM AIX 4.2 - ping Local Buffer Overflow // source: https://www.securityfocus.com/bid/387/info A buffer overflow condition exists in some versions of /usr/sbin/ping under AIX. Given that ping is SUID root, this overflow allows malicious users to gain root from it. / /usr/sbin/ping exploit kinda'...

IBM AIX 4.2 - usrsbinlchangelv Local Buffer Overflow

IBM AIX 4.2 - usrsbinlchangelv Local Buffer Overflow / source: https://www.securityfocus.com/bid/389/info A buffer overflow can occur in lchangelv under some versions of AIX. Note that an attacker must already have the GID or EGID of 'system' to execute lchangelv. Because lchangelv is SUID root,...

Solaris 2.4 passwd yppasswd nispasswd - Local Overflow

Solaris 2.4 passwd yppasswd nispasswd - Local Overflow ---------------------------- file newpass.c ------------------------------- include include define hiddenpasswd "/bin/hpasswd" /change here .../ define MAXLENGTH 32 void mainint argc, char argv int i; char args10; ifargc MAXLENGTH printf"You...

zgv $HOME overflow

Exploit for linux platform in category local exploits ================== zgv $HOME overflow ================== / zgv exploit coded by BeastMaster V on June 20, 1997 USAGE: For some strage reason, the filename length of this particular exploit must me one character long, otherwise you will be drop...

Dan Bernstein QMail 1.0 3 - RCPT Denial of Service (1)

Dan Bernstein QMail 1.0 3 - RCPT Denial of Service 1 source: https://www.securityfocus.com/bid/2237/info qmail is an e-mail server package developed by Dan Bernstein. The qmail smtp server is subject to a denial of service. By specifying a large number of addresses in the recipient field RCPT,...

Dan Bernstein QMail 1.0 3 - RCPT Denial of Service (2)

// source: https://www.securityfocus.com/bid/2237/info qmail is an e-mail server package developed by Dan Bernstein. The qmail smtp server is subject to a denial of service. By specifying a large number of addresses in the recipient field RCPT, qmail will stop responding. This behaviour is due to...

Slackware Linux 3.13.2 - color_xterm Local Buffer Overflow (2)

Slackware Linux 3.13.2 - colorxterm Local Buffer Overflow 2 / source: https://www.securityfocus.com/bid/369/info In Slackware Linux 3.1 and 3.2, the version of color xterm included is vulnerable to a buffer overflow attack that allows for a local user to gain root access. / / colorxterm buffer...

Slackware Linux 3.1/3.2 - 'color_xterm' Local Buffer Overflow (1)

source: https://www.securityfocus.com/bid/369/info In Slackware Linux 3.1 and 3.2, the version of color xterm included is vulnerable to a buffer overflow attack that allows for a local user to gain root access. / exploit for colorxterm, modified by zgv / / original exploit coded by Ming Zhang for...

AIX 4.2 /usr/dt/bin/dtterm Local Buffer Overflow Exploit

Exploit for aix platform in category local exploits ======================================================== AIX 4.2 /usr/dt/bin/dtterm Local Buffer Overflow Exploit ======================================================== include include include char prog100="/usr/dt/bin/dtterm"; char...

Slackware Linux 3.13.2 - color_xterm Local Buffer Overflow (1)

Slackware Linux 3.13.2 - colorxterm Local Buffer Overflow 1 source: https://www.securityfocus.com/bid/369/info In Slackware Linux 3.1 and 3.2, the version of color xterm included is vulnerable to a buffer overflow attack that allows for a local user to gain root access. / exploit for colorxterm,...

Slackware Linux 3.1/3.2 - 'color_xterm' Local Buffer Overflow (2)

/ source: https://www.securityfocus.com/bid/369/info In Slackware Linux 3.1 and 3.2, the version of color xterm included is vulnerable to a buffer overflow attack that allows for a local user to gain root access. / / colorxterm buffer overflow exploit for Linux with non-executable stack Copyright...

SGI IRIX 6.2 - eject Local Privilege Escalation (1)

SGI IRIX 6.2 - eject Local Privilege Escalation 1 // source: https://www.securityfocus.com/bid/351/info A vulnerability exists in the eject program shipped with Irix 6.2 from Silicon Graphics. By supplying a long argument to the eject program, it is possible to overwrite the return address on the...

Solaris 2.5.0/2.5.1 ps / chkey - Data Buffer

cat psexpl.po psexpl.c include include include define BUFLENGTH 632 define EXTRA 256 int mainint argc, char argv char bufBUFLENGTH + EXTRA; / ps will grok this file for the exploit code / char envp="NLSPATH=/tmp/foo",0; ulong longp; uchar charp; / This will vary depending on your libc / ulong...

SGI IRIX 6.2 - day5notifier Local Privilege Escalation

SGI IRIX 6.2 - day5notifier Local Privilege Escalation !/bin/sh source: https://www.securityfocus.com/bid/345/info A vulnerability exists in the day5notifier program, shipped with Irix 6.2 from Silicon Graphics Inc. This program will allow any user to run any command as root. day5notifier wisely...

SGI IRIX 6.3 - cgi-bin 'webdist.cgi' Command Execution

source: https://www.securityfocus.com/bid/374/info A vulnerability exists in the webdist.cgi program, as shipped by Silicon Grpahics Inc with the Irix operating system. This vulnerability will allow any remote user to execute arbitrary commands on an affected machine. Commands will be executed wi...

SGI IRIX 6.5.4 Solaris 2.5.1 - ps(1) Buffer Overflow

SGI IRIX 6.5.4 Solaris 2.5.1 - ps1 Buffer Overflow source: https://www.securityfocus.com/bid/220/info The ps command prints information about active processes on a system. Due to insufficient bounds checking on arguments supplied to ps, it is possible to overwrite the internal data space of the p...

BSDOS 2.1 DGUX 7.0 Debian 1.3 HP-UX 10.34 IBM AIX 4.2 SGI IRIX 6.4 Solaris 2.5.1 - usrbinX11xlock Local Privilege Escalation (2)

BSDOS 2.1 DGUX 7.0 Debian 1.3 HP-UX 10.34 IBM AIX 4.2 SGI IRIX 6.4 Solaris 2.5.1 - usrbinX11xlock Local Privilege Escalation 2 / source: https://www.securityfocus.com/bid/224/info The xlock program is used to lock the local X display until the user supplies the correct password. A buffer overflow...