Atftpd 0.6 - 'atftpdx.c' Remote Command Execution

/ PoC linux/86 remote exploit against atftpd c gunzip FIXED / include include include include include include include include include include define HEAPSTART 0x080514b4 define HEAPEND 0x080594b4 define BACKDOOR "rfe" / port MUST be 1024 / define NOPNUM 128 / number of nops / define PORT 69 / tft...

Atftpd 0.6 - atftpdx.c Remote Command Execution

Atftpd 0.6 - atftpdx.c Remote Command Execution / PoC linux/86 remote exploit against atftpd c gunzip FIXED / include include include include include include include include include include define HEAPSTART 0x080514b4 define HEAPEND 0x080594b4 define BACKDOOR "rfe" / port MUST be 1024 / define...

WsMp3d 0.x Remote Root Heap Overflow Exploit

Exploit for linux platform in category remote exploits ============================================ WsMp3d 0.x Remote Root Heap Overflow Exploit ============================================ / Title: Remote Heap Corruption Overflow vulnerability in WsMp3d + Exploit: 0x82-Remote.WsMp3d.again.c bash...

PoPToP PPTP server remotely exploitable buffer overflow

Versions older than 1.1.4-b3 and 1.1.3-20030409 affected. This seems to be exploitable only with Linux. PPTP? ----- PPTP-over-IPSEC is commonly used to create VPNs. Windows plays quite nicely with it. problem ------- PPTP packet header contain 16bit length which specifies the full size of the...

Oracle 8i - TNS Listener Local Command Parameter Buffer Overflow

Oracle 8i - TNS Listener Local Command Parameter Buffer Overflow / source: https://www.securityfocus.com/bid/4413/info Oracle 8i is a powerful relational database product. It is available for Windows, Linux, and a wide range of Unix operating systems. A vulnerability has been reported with some...

CDRDAO 1.1.x - Home Directory Configuration File Symbolic Link (4)

source: https://www.securityfocus.com/bid/3865/info CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller. When CDRDAO saves it's configuration to the .cdrdao file in a user's home directory,...

rsync 2.5.1 - Remote (1)

rsync 2.5.1 - Remote 1 / 7350fuqnut - rsync include include include include include include include include include define MAXPATHLEN 4096 define VERSION "@RSYNCD: 26\n" define PORT 873 define NULLOFFSET -48 define STARTNULLBRUTE -44 define ENDNULLBRUTE -56 define BRUTEBASE 0xbfff7777 define...

[!H] Tcpdump 3.5.2 remote root vulnerability

!Hispahack Research Team ------------------------ Program: Tcpdump 3.5 3.4, 3.6. and the CVS version are not vulnerable Platform: nix, Windoze Risk: Remote root access Author: Zhodiac [email protected] Date: 4/1/2001 - Problem: ----------- Tcpdump is a network packet analizer, capabel to decod...

Linux xsoldier-0.96 exploit (Red Hat 6.2)

Exploit for linux platform in category local exploits ========================================= Linux xsoldier-0.96 exploit Red Hat 6.2 ========================================= include include define NOP 0x90 define BUFSIZE 4408 define OFFSET 0 define RANGE 20 unsigned char blah =...

TalentSoft Web+ Application Server (Linux) 4.6 - Example Script File Disclosure

TalentSoft Web+ Application Server Linux 4.6 - Example Script File Disclosure source: https://www.securityfocus.com/bid/1725/info Web+ is a development language for use in creating web-based client/server applications. In Linux versions of the product, an example script installed in Web+ Web+Ping...

Gopher2.3.1p0 and below remote buffer overflow.

Gopher2.3.1p0 and below has many overflowable functions in the daemon. Most of them overflow with hardcoded data that gets passed along - making it not possible to change any pointers. The "halidate" function is not one of those. If sent the request "halidate large buffer" you will overwrite a 51...

linux/x86 break chroot setuid0 + /bin/sh 132 bytes

linux/x86 break chroot setuid0 + /bin/sh 132 bytes. Shellcode exploit for linx86 platform / Linux/x86 - setreuid0, 0; - chroot-break make a temp dir with mkdir, chroot to tempdir, go through a loop of chdir".."; then a final chroot"."; - execve of /bin/sh used in several wu-ftpd, beroftpd and...

Canna Canna 3.5 b2 - Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/1445/info A vulnerability exists in the 'canna' package, as distributed with a number of free operating systems, and available for other systems. Version 3.5b2 is vulnerable. It is assumed versions prior to this are also vulnerable. By supplying an...

KDE 1.11.1.11.1.21.2 - kdesud DISPLAY Environment Variable Overflow

KDE 1.11.1.11.1.21.2 - kdesud DISPLAY Environment Variable Overflow // source: https://www.securityfocus.com/bid/1274/info /usr/bin/kdesud has a DISPLAY environment variable overflow which could allow for the execution of arbitrary code. / KDE: /usr/bin/kdesud exploit by noir x86/Linux...

KDE 1.1/1.1.1/1.1.2/1.2 - kdesud DISPLAY Environment Variable Overflow

// source: https://www.securityfocus.com/bid/1274/info /usr/bin/kdesud has a DISPLAY environment variable overflow which could allow for the execution of arbitrary code. / KDE: /usr/bin/kdesud exploit by noir x86/Linux [email protected] | [email protected] DISPLAY env overflow this script will...

Majordomo 1.94.4/1.94.5 - Local -C Parameter (2)

// source: https://www.securityfocus.com/bid/903/info It is possible for a local user to gain majordomo privileges through a vulnerability which allows privileged arbitrary commands to be executed. If the -C parameter is passed to majordomo or one of several other scripts when run with the setuid...

Qualcomm qpopper 3.0/3.0 b20 - Remote Buffer Overflow (2)

source: https://www.securityfocus.com/bid/830/info There is a buffer overflow vulnerability present in current 3.x versions of Qualcomm popper daemon. These vulnerabilities are remotely exploitable and since the daemon runs as root, the host running qpopper can be completely compromised...

Knox Arkeia 4.0 Backup - Local Overflow

Knox Arkeia 4.0 Backup - Local Overflow / source: https://www.securityfocus.com/bid/661/info Knox Software Arkeia 4.0 Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow A local buffer overflow in the handling of the HOME environment variable by the rlserver and rnavc binaries that...

LPRng.txt

Subject: Security problem with LPRng To: [email protected] Hi all, During some recent work I've been doing with LPRng, I found that is is possible on a default LPRng installation to control the print queues on the LPRng server. Most default installations allow the root user at the localhost to...

LibXt - 'XtAppInitialize()' Local Overflow *xterm

/ cxterm buffer overflow exploit for Linux. This code is tested on both Slackware 3.1 and 3.2. Ming Zhang [email protected] / include include include include define CXTERMPATH "/usr/X11R6/bin/cxterm" define BUFFERSIZE 1024 define DEFAULTOFFSET 50 define NOPSIZE 1 char nop = "\x90"; char shellcod...