4353 matches found
dislocate 1.3 - Local i386
/ MasterSecuritY dislocate.c - Local i386 exploit in v1.3 Updated versions of this exploit and the corresponding advisory will be made available at: ftp://maxx.via.ecp.fr/dislocate/ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public...
GLIBC - '/bin/su' Local Privilege Escalation
/ Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of /bin/su program with the address of the shellcode, so, the program executes it when main returns or exit is called Thanks a lot to rwxrwxrwx for explaining me this technique...
CVE-2000-1028
CVE-2000-1028 describes a buffer overflow in the HP-UX 11.0 cu program that may allow local users to gain privileges through a long -l command line argument. The vulnerability is local and occurs due to an unchecked or improperly sized argument input, enabling privilege escalation if exploited. N...
BSDi 3.04.0 - rcvtty[mh] Local Privilege Escalation
BSDi 3.04.0 - rcvttymh Local Privilege Escalation / BSDi3.0/4.0rcvttymh local exploit, by [email protected]. this exploit is for the rcvtty of the mh package, which is setgid=4tty on BSDi. this exploit gives you egid/group=4tty access. example: -------------------------------------------------...
BSDi 3.0 / 4.0 rcvtty[mh] Local Exploit
Exploit for bsd platform in category local exploits ======================================= BSDi 3.0 / 4.0 rcvttymh Local Exploit ======================================= / BSDi3.0/4.0rcvttymh local exploit, by v9email protected. this exploit is for the rcvtty of the mh package, which is setgid=4t...
BSDi SUIDPerl - Local Stack Buffer Overflow
/ BSDisuidperl buffer overflow, by [email protected]. this is that old buffer overflow in suidperl, but i never saw any version of it for BSDi. so, here it is. this gives euid=0. BSDi/3.0 / define PATH "/usr/bin/suidperl" / path to suidperl on BSDi/3.0. / define DEFAULTOFFSET -5000 / general...
[SECURITY] New version of modutils released
Package: modutils Vulnerability: local exploit Debian-specific: no Sebastian Krahmer found a problem in the modprobe utility that could be exploited by local users to run arbitrary commands as root if the machine is running a kernel with kmod enabled. The kmod kernel feature allows the kernel to...
[SECURITY] New version of modutils released
------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman November 20, 2000 - ------------------------------------------------------------------------ Package: modutils Vulnerability:...
dump 0.4b15 Local Root Exploit
Exploit for linux platform in category local exploits ============================== dump 0.4b15 Local Root Exploit ============================== !/bin/sh Redhat 6.2 dump command executes external program with suid priviledge. Discovered by Mat Written for and by a scriptkid Tasc ;P Remember,...
xsplumber - 'strcpy()' Local Buffer Overflow
/ linuxsplumberversion2 buffer overflow, by [email protected]. this is a misc. exploit for the linux-SVGAlib space plumber game. which, as you know needs to be installed setuid root. this overflow is due to a simple oversight in the command line parser. uses strcpy to copy to an unchecked 250 byt...
Oracle (oidldapd connect) Local Command Line Overflow Exploit
Exploit for linux platform in category local exploits ============================================================= Oracle oidldapd connect Local Command Line Overflow Exploit ============================================================= / Exploit Code for oidldapd in Oracle 8.1.6 8ir2 for Linux....
Joe's Own Editor File Link Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TITLE: Joe's Own Editor File Link Vulnerability ADVISORY ID: WSIR-00/11-01 CONTACT: Patrik Birgersson, Wkit Security AB CLASS: File Handling Error OBJECT: joe1 exec VENDOR: Josef H. Allen STATUS: Vendor not reachable REMOTE: No LOCAL: Yes DATE:...
[SECURITY] New version of tcsh released
Package: tcsh Vulnerability: local exploit Debian-specific: no Proton reported on bugtraq that tcsh did not handle in-here documents correctly. The version of tcsh that is distributed with Debian GNU/Linux 2.2r0 also suffered from this problem. When using in-here documents using the syntax tcsh...
[SECURITY] New version of tcsh released
------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman November 11, 2000 - ------------------------------------------------------------------------ Package: tcsh Vulnerability: local...
mandrake.urpmi.txt
Local Exploit Issue with: /usr/bin/urpmi The urpmi executable perl script root@localhost /root ls -al /usr/bin/urpmi -rwsr-x--- 1 root urpmi 9352 Apr 4 2000 /usr/bin/urpmi This requires an account in the urpmi group. Possibly physical access to the box as well. On Mandrake 7.1 the package urpmi w...
IIS ASP $19.95 hack - IISHack 1.5
IIS ASP $19.95 hack - IISHack 1.5 Release Date: November 3rd, 2000 Systems Affected: Windows NT 4.0 IIS 4.0 sp6 vulnerable Windows NT 5.0 IIS 5.0 not vulnerable Description: There exists a buffer overflow, that can be exploited to gain SYSTEM level access, within the IIS Internet Information Serv...
ntop 1.x - i Local Format String
ntop 1.x - i Local Format String source: https://www.securityfocus.com/bid/1840/info ntop network top is a unix program used for displaying network usage statistics. It is often installed setuid root because it uses privileged ports. ntop is vulnerable to a format string vulnerability that can...
ntop 1.x - i Local Format String
source: https://www.securityfocus.com/bid/1840/info ntop network top is a unix program used for displaying network usage statistics. It is often installed setuid root because it uses privileged ports. ntop is vulnerable to a format string vulnerability that can compromise root access locally. If...
[SECURITY] New version of nis released
-----BEGIN PGP SIGNED MESSAGE----- - ------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman October 14, 2000 - ------------------------------------------------------------------------...
[SECURITY] New version of nis released
------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman October 14, 2000 - ------------------------------------------------------------------------ Package : nis Problem type : local...