XMail 1.21 - '-t' Command Line Option Local Buffer Overflow / Local Privilege Escalation

/ XMail 1.21 'sendmail' local exploit ret-into-libc Yields uid root || gid mail By qaaz at centrum dot cz, 2005 / include include include include include include include include define TARGET "/var/MailRoot/bin/sendmail" define NM "nm" define GREP "grep" define MKDIR "mkdir" define TMP "/tmp"...

FreeBSD : xshisen -- local buffer overflows (56971fa6-641c-11d9-a097-000854d03344)

Steve Kemp has found buffer overflows in the handling of the command line flag -KCONV and the XSHISENLIB environment variable. Ulf Harnhammer has detected an unbounded copy from the GECOS field to a char array. All overflows can be exploited to gain group games privileges. %NASLMINLEVEL 70300 C...

IBM AIX 5.x - Invscout Local Buffer Overflow

IBM AIX 5.x - Invscout Local Buffer Overflow source: https://www.securityfocus.com/bid/13909/info invscout is prone to a local buffer overflow vulnerability. This issue presents itself because the application fails to carry out boundary checks on user-supplied data from the command line...

IBM AIX 5.x - 'Invscout' Local Buffer Overflow

source: https://www.securityfocus.com/bid/13909/info invscout is prone to a local buffer overflow vulnerability. This issue presents itself because the application fails to carry out boundary checks on user-supplied data from the command line. /usr/sbin/invscout perl -e 'print "A" x 1024;'...

WinZip 8.1 - Command Line Local Buffer Overflow

WinZip 8.1 - Command Line Local Buffer Overflow / WinZip Command Line Local Buffer Overflow http://securitytracker.com/alerts/2004/Sep/1011132.html http://www.winzip.com/wz90sr1.htm Exploit coded By ATmaCA Web: atmacasoft.com && spyinstructors.com E-Mail: [email protected] Credit to kozan / /...

Linux Kernel 2.2.x/2.3.x/2.4.x/2.5.x/2.6.x - ELF Core Dump Local Buffer Overflow (PoC)

/ source: https://www.securityfocus.com/bid/13589/info The Linux kernel is susceptible to a local buffer-overflow vulnerability when attempting to create ELF coredumps. This issue is due to an integer-overflow flaw that results in a kernel buffer overflow during a 'copyfromuser' call. To exploit...

BitchX 1.0c20 - Local Buffer Overflow

/ Tested on BitchX-1.0c19 /str0ke / / P.o.C Exploit Code for BitchX made for Version BitchX-1.0c20cvs -- Date 20020325 C 2004. GroundZero Security Research and Software Development http://www.groundzero-security.com released under the GNU GPL - http://www.gnu.org/licenses/gpl.txt -- background...

Oracle Database Server 10.1.0.2 - Local Buffer Overflow

/ Advanced SQL Injection in Oracle databases Exploit for the buffer overflow vulnerability in procedure MDSYS.MD2.SDOCODESIZE of Oracle Database Server version 10.1.0.2 under Windows 2000 Server SP4. Fixes available at http://metalink.oracle.com. The exploit creates a SYSDBA user ERIC with a...

sash 3.7 - Local Buffer Overflow

sash 3.7 - Local Buffer Overflow / sash-3.7 buffer overflow in c argyment written by lammat for practice purposes http://grpower.ath.cx [email protected] gdb r -c perl -e 'print "A"x10256' The program being debugged has been started already. Start it from the beginning? y or n y Starting program:...

sash <= 3.7 Local Buffer Overflow Exploit

No description provided by source. / sash-3.7 buffer overflow in c argyment written by lammat for practice purposes http://grpower.ath.cx [email protected] gdb r -c perl -e 'print "A"x10256' The program being debugged has been started already. Start it from the beginning? y or n y Starting program...

sash <= 3.7 Local Buffer Overflow Exploit

Exploit for linux platform in category local exploits ========================================= sash include include static char shellcode= "\x31\xdb\x53\x8d\x43\x17\xcd\x80\x99\x68\x6e\x2f\x73\x68\x68" "\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"; define NOP 0x90 define LEN 10256...

SCO OpenServer 5.0.65.0.7 - NWPrint Command Line Argument Local Buffer Overflow

SCO OpenServer 5.0.65.0.7 - NWPrint Command Line Argument Local Buffer Overflow // source: https://www.securityfocus.com/bid/12986/info nwprint that is distributed with SCO OpenServer is prone to a local buffer overflow vulnerability. This issue arises because the application fails to perform...

BakBone NetVault 6.x/7.x Local Stack Buffer Overflow Exploit

Exploit for unknown platform in category local exploits ============================================================ BakBone NetVault 6.x/7.x Local Stack Buffer Overflow Exploit ============================================================ / for more informations class101.org/netv-locsbof.pdf /...

PostScript Utilities - psnup Local Buffer Overflow

PostScript Utilities - psnup Local Buffer Overflow !/usr/bin/perl PostScript Utilities - psnup all the utilities of the package are vulnerable written by lammat just for practice purposes tested against psutils-p17 gdb r -8 perl -e 'print "A"x250' The program being debugged has been started...

Apple Mac OSX 10.3.x - Multiple Vulnerabilities

Apple Mac OSX 10.3.x - Multiple Vulnerabilities // source: https://www.securityfocus.com/bid/12863/info Multiple security vulnerabilities are reported to affect Apple Mac OS X. These issues were disclosed in the referenced vendor advisory. Insecure permissions are reported to be set on certain...

PostScript Utilities - 'psnup' Local Buffer Overflow

!/usr/bin/perl PostScript Utilities - psnup all the utilities of the package are vulnerable written by lammat just for practice purposes tested against psutils-p17 gdb r -8 perl -e 'print "A"x250' The program being debugged has been started already. Start it from the beginning? y or n y Starting...

Frank McIngvale LuxMan 0.41 - Local Buffer Overflow

Frank McIngvale LuxMan 0.41 - Local Buffer Overflow !/usr/bin/perl -w luxman exploit ii luxman 0.41-19.1 Pac-Man clone svgalib based Tested with "security compat" set in /etc/vga/libvga.config on debian unstable 3.1 kfinisterre@jdam:$ ./luxmanex.pl LuxMan v0.41, Copyright c 1995 Frank McIngvale...

RealNetworks RealPlayer 10 - .smil Local Buffer Overflow

RealNetworks RealPlayer 10 - .smil Local Buffer Overflow / RealPlayer .smil file buffer overflow Coded by nolimit@CiSO & Buzzdee greets to COREiSO & news & flare & class101 & ESI & RVL & everyone else I forget This uses a seh overwrite method, which takes advantage of the SEH being placed in...

[Full-Disclosure] iDEFENSE Security Advisory 02.10.05: IBM AIX netpmon Local Buffer Overflow Vulnerability

IBM AIX netpmon Local Buffer Overflow Vulnerability iDEFENSE Security Advisory 02.10.05 www.idefense.com/application/poi/display?id=197&type=vulnerabilities February 10, 2005 I. BACKGROUND The netpmon program is a setuid root application, installed by default under multiple versions of IBM AIX,...

Funduc Search and Replace - Compressed File Local Buffer Overflow

/ Search and Replace Compressed File search Local Buffer Overflow Exploit Discoveried & Coded By ATmaCA Copyright ©2002-2005 AtmacaSoft Inc. All Rights Reserved. Web: http://www.atmacasoft.com E-Mail: [email protected] Greetings to: Tarako / / Search and Replace 5.0 and prior versions are...