NetBSD - 'mail.local(8)' Local Privilege Escalation (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "msf/core" class MetasploitModule 'NetBSD mail.local Privilege Escalation', 'Description' = %q This module attempts to exploit a race condition in mail.local with...

NetBSD mail.local - Privilege Escalation (Metasploit)

Exploit for bsd platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "msf/core" class MetasploitModule 'NetBSD mail.local Privilege Escalation', 'Description' = %q This module...

NetBSD mail.local Privilege Escalation

This module attempts to exploit a race condition in mail.local with SUID bit set on: NetBSD 7.0 - 7.0.1 verified on 7.0.1 NetBSD 6.1 - 6.1.5 NetBSD 6.0 - 6.0.6 Successful exploitation relies on a crontab job with root privilege, which may take up to 10min to execute. This module requires...

NetBSD Local Privilege Vulnerability

NetBSD is a free and open source Unix-like operating system. NetBSD suffers from a local elevation of privilege vulnerability, which allows a local attacker to exploit the vulnerability to elevate privileges and gain root privileges...

NetBSD mail.local(8) Local Root

// Source: http://akat1.pl/?id=2 include include include include include include include include define ATRUNPATH "/usr/libexec/atrun" define MAILDIR "/var/mail" static int overwriteatrunvoid char script = "! /bin/sh\n" "cp /bin/ksh /tmp/ksh\n" "chmod +s /tmp/ksh\n"; sizet size; FILE fh; int rv =...

NetBSD - mail.local(8) Local Privilege Escalation

NetBSD - mail.local8 Local Privilege Escalation // Source: http://akat1.pl/?id=2 include include include include include include include include define ATRUNPATH "/usr/libexec/atrun" define MAILDIR "/var/mail" static int overwriteatrunvoid char script = "! /bin/sh\n" "cp /bin/ksh /tmp/ksh\n" "chm...

NetBSD mail.local(8) - Privilege Escalation (NetBSD-SA2016-006)

Exploit for bsd platform in category local exploits // Source: http://akat1.pl/?id=2 include include include include include include include include define ATRUNPATH "/usr/libexec/atrun" define MAILDIR "/var/mail" static int overwriteatrunvoid char script = "! /bin/sh\n" "cp /bin/ksh /tmp/ksh\n"...

NetBSD - 'mail.local(8)' Local Privilege Escalation

// Source: http://akat1.pl/?id=2 include include include include include include include include define ATRUNPATH "/usr/libexec/atrun" define MAILDIR "/var/mail" static int overwriteatrunvoid char script = "! /bin/sh\n" "cp /bin/ksh /tmp/ksh\n" "chmod +s /tmp/ksh\n"; sizet size; FILE fh; int rv =...

NetBSD bozohttpd CGI Processor Arbitrary Code Execution Vulnerability

NetBSD is a free and open source Unix-like operating system. A security vulnerability in NetBSD's bozohttpd CGI processor allows remote attackers to submit special requests to execute arbitrary code...

Lynis 2.2.0 - Security Auditing Tool for Unix/Linux Systems

Lynis is an open source security auditing tool. Commonly used by system administrators, security professionals and auditors, to evaluate the security defenses of their Linux/Unix based systems. It runs on the host itself, so it can perform very extensive security scans. Supported operating system...

paravirtualized drivers incautious about shared memory contents

ISSUE DESCRIPTION The compiler can emit optimizations in the PV backend drivers which can lead to double fetch vulnerabilities. Specifically the shared memory between the frontend and backend can be fetched twice during which time the frontend can alter the contents possibly leading to arbitrary...

Operating System (OS) Detection (Telnet)

Telnet banner based Operating System OS detection. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH SPDX-FileCopyrightText: Reworked, improved and extended detection code and pattern since 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...

CVE-2008-2476

The IPv6 Neighbor Discovery Protocol NDP implementation in 1 FreeBSD 6.3 through 7.1, 2 OpenBSD 4.2 and 4.3, 3 NetBSD, 4 Force10 FTOS before E7.7.1.1, 5 Juniper JUNOS, and 6 Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attacke...

[CVE-2015-4624] Predictable CSRF tokens in WiFi Pineapple firmware <= 2.3.0

Overview =============== WiFi Pineapples are a penetration testing tool used in offensive wireless activities. These devices run on a modified OpenWRT based on netBSD operating system. They include a web-based management interface. It has been discovered they have predictable anti-CSRF tokens bas...

RaspBSD – FreeBSD distribution for Raspberry Pi

Raspberry Pi is gaining new heights by rapidly maturing as; after Microsoft made Windows 10 IoT core supporting the Raspberry Pi 2, now a new version FreeBSD operating system is also deployable on Raspberry Pi devices, called RaspBSD. FreeBSD Berkeley Software Distribution is an open source...

Amazon Linux AMI : php55 (ALAS-2015-507)

A use-after-free flaw was found in the way PHP's unserialize function processed data. If a remote attacker was able to pass crafted input to PHP's unserialize function, they could cause the PHP interpreter to crash or, possibly, execute arbitrary code. CVE-2015-0231 An integer overflow flaw,...

CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

DEBIAN-CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

CVE-2015-2305

CVE-2015-2305 describes an integer/heap overflow in the Henry Spencer BSD regex library (rxspencer), specifically in regcomp on 32-bit platforms. The issue can be triggered by a very large regular expression, potentially allowing context-dependent attackers to execute arbitrary code via a heap-ba...