433 matches found
Linux Kernel 2.6.29 - ptrace_attach() Local Root Race Condition Exploit
No description provided by source. / GNU/Linux kernel 2.6.29 ptraceattach local root race condition exploit. ========================================================================== This is a local root exploit for the 2.6.29 ptraceattach race condition that allows a process to gain elevated...
Rocks Clusters <= 4.1 (umount-loop) Local Root Exploit
No description provided by source. !/usr/bin/env python rocksumountdirty.py: Rocks release =4.1 local root exploit quick and nasty version of the exploit. make sure the . is writable and you clean up afterwards. ; coded by: [email protected] http://xavsec.blogspot.com x=import'os';c=x.getcwd...
FreeBSD <= 6.1 kqueue() NULL pointer Dereference Local Root Exploit
No description provided by source. / FreeBSD = 6.1 suffers from classical check/use race condition on SMP systems in kevent syscall, leading to kernel mode NULL pointer dereference. It can be triggered by spawning two threads: 1st thread looping on open and close syscalls, and the 2nd thread...
hztty 2.0 - Local root exploit (Tested on Red Hat 9.0)
No description provided by source. / 0x333hztty = hztty 2.0 local root exploit more info : Debian Security Advisory DSA 385-1 note I adjusted some part of hztty's code since there were some errors. hope this will not influence exploitation : tested against Red Hat 9.0 : c0wboy@0x333 c0wboy$ gcc...
Xcode OpenBase <= 10.0.0 (unsafe system call) Local Root Exploit (OSX)
No description provided by source. !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom = ftp://www.openbase.com/pub/OpenBase10.0 vulnerable ? This is some fairly blatant and retarded use of system cd cp chmod chown rm mkdir and killall appear as strings in t...
Tunnelblick - Local Root Exploit
No description provided by source. / ==== Pwnnel Blicker ==== = = = zx2c4 = = = ======================== Tunnel Blick, a widely used OpenVPN manager for OSX comes with a nice SUID executable that has more holes than you care to count. It's a treasure chest of local roots. I picked one that looked...
dbus-glib pam_fprintd - Local Root Exploit
No description provided by source. / darklena. fprintd/pamfprintd local root PoC. However dbus-glib plays an important role. C 2013 Sebastian Krahmer, all rights reversed. pamfprintd uses net.reactivated.Fprint service to trigger finger swiping and registers DBUS signal inside the PAM...
Tolis Group BRU 17.0 - Local Root Exploit (1)
No description provided by source. source: http://www.securityfocus.com/bid/8215/info It has been reported that BRU may not properly parse commandline arguments, potentially leading to at least two vectors of exploitation. It may be possible for local attackers to conduct format string-based...
Android 1.x/2.x HTC Wildfire - Local Root Exploit
No description provided by source. / android 1.x/2.x the real youdev feat. init local root exploit. Modifications to original exploit for HTC Wildfire Stage 1 soft-root c 2010 Martin Paul Eve Changes: -- Will not remount /system rw NAND protection renders this pointless -- Doesn't copy self, mere...
Linux Kernel 2.x - sock_sendpage() Local Root Exploit (2)
No description provided by source. Linux NULL pointer dereference due to incorrect protoops initializations ------------------------------------------------------------------------- Quick and dirty exploit for this one: http://www.frasunek.com/protoops.tgz back:...
Exim <= 4.42 Local Root Exploit
No description provided by source. !/bin/sh Local Lame R00T sploit for exim = 4.42 by Dark Eagle My First Coding Release In bash Unl0ck Research Team More Effective than C-code. @env.c content: include stdio.h include string.h int mainint argc, char argv char addrptr; addrptr = getenvargv1;...
kon2 Local Buffer Overflow Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/7790/info A buffer overflow vulnerability has been reported for the kon2 utility shipped with various Linux distributions. Exploitation of this vulnerability may result in a local attacker obtaining elevated privileges on...
Linux Kernel 2.4.22 "do_brk()" local Root Exploit (PoC)
No description provided by source. ; Christophe Devine devine at cr0.net and Julien Tinnes julien at cr0.org ; ; This exploit uses sysbrk directly to expand his break and doesn't rely ; on the ELF loader to do it. ; ; To bypass a check in sysbrk against available memory, we use a high ; virtual...
Adobe Version Cue 1.0/1.0.1 - (-lib) Local Root Exploit (OSX)
No description provided by source. / Adobe Version Cue VCNativeOSX: local root exploit. dyld by: vade79/v9 [email protected] fakehalo/realhalo Adobe Version Cue's VCNative program allows un-privileged local users to load arbitrary librariesbundles while running setuid root. this is done via the -lib...
Xcode OpenBase <= 9.1.5 (root file create) Local Root Exploit (OSX)
No description provided by source. !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom http://docs.info.apple.com/article.html?artnum=61798 This won't help ftp://www.openbase.com/pub/OpenBase10.0 This will Create a new file anywhere on the filesystem with...
Tolis Group BRU 17.0 - Local Root Exploit (2)
No description provided by source...
Linux Kernel < 2.4.20 Module Loader Local Root Exploit
No description provided by source. / Linux Kernel Module Loader Local R00t Exploit Up to 2.4.20 By anonymous KuRaK include stdio.h include stdlib.h include signal.h include fcntl.h include errno.h include unistd.h include sys/types.h include sys/stat.h include sys/ptrace.h include sys/wait.h...
Linux Kernel 2.4/2.6 - sock_sendpage() Local Root Exploit (PPC Edition)
No description provided by source. / Linux socksendpage NULL pointer dereference Copyright 2009 Ramon de Carvalho Valle [email protected] This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Softwar...
Rocks Clusters <= 4.1 (mount-loop) Local Root Exploit
No description provided by source. !/bin/sh rocksmountdirty.sh: Rocks release =4.1 local root exploit make sure 'mount-loop' is in your path for this to work. coded by: [email protected] http://xavsec.blogspot.com echo Rocks Clusters =4.1 mount-loop local root exploit by [email protected]...
Mac OS X <= 10.2.4 DirectoryService (PATH) Local Root Exploit
No description provided by source. / OS X = 10.2.4 DirectoryService local root PATH exploit DirectoryService must be crashed prior to execution, per @stake advisory. If you discover how to crash DirectoryService e-mail me at [email protected] Neeko Oni -- Assuming DirectoryService has been...