kernel: watch queue race condition can lead to privilege escalation

A race condition was found in the Linux kernel's watch queue due to a missing lock in the piperesizering. The race condition occurs when a thread uses ioctlIOCWATCHQUEUESETSIZE to resize the pipe buffer and free the old pipe buffer, while another thread uses keyctl to trigger a notification in th...

kernel: watch queue race condition can lead to privilege escalation

A race condition was found in the Linux kernel's watch queue due to a missing lock in the piperesizering. The race condition occurs when a thread uses ioctlIOCWATCHQUEUESETSIZE to resize the pipe buffer and free the old pipe buffer, while another thread uses keyctl to trigger a notification in th...

PT-2022-35977 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: A memory leak was discovered in the tracing read pipe function. The issue was introduced in version v5.12 and is fixed in version v6.0.10. The actual impact and attack plausibility of this...

PT-2022-36153 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.12 through v5.15.79 Description: A memory leak was discovered in the tracing read pipe function. The issue was introduced in version v5.12 and is fixed in version v5.15.80. Recommendations: For Linux Kernel versions...

CVE-2022-45873

A flaw was found in the systemd-coredump utility of systemd. When an application crashes, the systemd-coredump utility is called twice, once by the kernel and the second time in the [email protected] to write the data, process, and save the core file. Communication between the programs is...

Trojan.Win32.DarkNeuron.gen MVID-2022-0661 Named Pipe NULL DACL

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/d891c9374ccb2a4cae2274170e8644d8.txt Contact: [email protected] Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Trojan.Win32.DarkNeuron.gen Vulnerability: Named...

CVE-2020-23584

Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diagtracertadmin.asp " in the "PingTest" parameter that leads to command execution...

Exploit for Improper Initialization in Linux Linux_Kernel

!Dirty Pipehttps://forum.hackersploit.org/uploads/default/ori...

SharpNamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation

This project is a C tool to use Pass-the-Hash for authentication on a local Named Pipe for user Impersonation. You need a local administrator or SEImpersonate rights to use this. There is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code...

USN-5616-1: Linux kernel (Intel IoTG) vulnerabilities

Asaf Modelevsky discovered that the IntelR 10GbE PCI Express ixgbe Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. CVE-2021-33061 Moshe Kol, Amit Klein and Yossi Gilad discovered that the I...

Fortinet FortiClient Privilege Escalation via directory traversal attack (FG-IR-21-190)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-190 advisory. - A relative path traversal vulnerability CWE-23 in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior and...

Exploit for Improper Initialization in Linux Linux_Kernel

CVE-2022-0847 Exploits Dirty Pipe O que é ? Divulga...

Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager

Custom shellcode stage. Connect back to the attacker via a named pipe pivot Module Options msf use payload/windows/x64/custom/reversenamedpipe msf payloadreversenamedpipe show actions ...actions... msf payloadreversenamedpipe set ACTION msf payloadreversenamedpipe show options ...show and set...

Windows shellcode stage, Windows x64 Bind Named Pipe Stager

Custom shellcode stage. Listen for a pipe connection Windows x64 Module Options msf use payload/windows/x64/custom/bindnamedpipe msf payloadbindnamedpipe show actions ...actions... msf payloadbindnamedpipe set ACTION msf payloadbindnamedpipe show options ...show and set options... msf...

Windows shellcode stage, Windows x86 Bind Named Pipe Stager

Custom shellcode stage. Listen for a pipe connection Windows x86 Module Options msf use payload/windows/custom/bindnamedpipe msf payloadbindnamedpipe show actions ...actions... msf payloadbindnamedpipe set ACTION msf payloadbindnamedpipe show options ...show and set options... msf...

Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager

Custom shellcode stage. Connect back to the attacker via a named pipe pivot Module Options msf use payload/windows/custom/reversenamedpipe msf payloadreversenamedpipe show actions ...actions... msf payloadreversenamedpipe set ACTION msf payloadreversenamedpipe show options ...show and set...

Powershell Exec, Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager

Execute an x86 payload from a command via PowerShell. Custom shellcode stage. Connect back to the attacker via a named pipe pivot Module Options msf use payload/cmd/windows/powershell/custom/reversenamedpipe msf payloadreversenamedpipe show actions ...actions... msf payloadreversenamedpipe set...

Powershell Exec, Windows shellcode stage, Windows x64 Bind Named Pipe Stager

Execute an x64 payload from a command via PowerShell. Custom shellcode stage. Listen for a pipe connection Windows x64 Module Options msf use payload/cmd/windows/powershell/x64/custom/bindnamedpipe msf payloadbindnamedpipe show actions ...actions... msf payloadbindnamedpipe set ACTION msf...

Powershell Exec, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager

Execute an x64 payload from a command via PowerShell. Custom shellcode stage. Connect back to the attacker via a named pipe pivot Module Options msf use payload/cmd/windows/powershell/x64/custom/reversenamedpipe msf payloadreversenamedpipe show actions ...actions... msf payloadreversenamedpipe se...

Powershell Exec, Windows shellcode stage, Windows x86 Bind Named Pipe Stager

Execute an x86 payload from a command via PowerShell. Custom shellcode stage. Listen for a pipe connection Windows x86 Module Options msf use payload/cmd/windows/powershell/custom/bindnamedpipe msf payloadbindnamedpipe show actions ...actions... msf payloadbindnamedpipe set ACTION msf...