VMWare Setuid vmware-mount Unsafe popen(3)

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require...

Sun VirtualBox <= 3.0.6 - Privilege Escalation

No description provided by source. !/bin/sh CVE-2009-3692 Sun VirtualBox = 3.0.6 local root exploit ======================================================== Exploits popen meta char shell injection vulnerability in Sun VirtualBox. E.g. admin@sundevil:/test$ id uid=101admin gid=10staff...

PHP <= 3.0.13 'safe_mode' Failure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/911/info PHP Version 3.0 is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web...

Cacti <= 0.8.6i cmd.php popen() Remote Injection Exploit

No description provided by source. ?php printr' -------------------------------------------------------------------------------- Cacti = 0.8.6i cmd.php popen injection by rgod dork: intitle:login to cacti mail: retrog at alice dot it site: http://retrogod.altervista.org...

BSD bmon <= 1.2.1_2 - Local Exploit

No description provided by source. !/usr/local/bin/bash Written by Idan Nahoum. [email protected] local exploit for FreeBSD/OpenBSD with bmon 1.2.12 installed. when bmon is executed with the -n parameter it popens netcat but fail to provide an absoluth path. some bsds are configured with acls that...

Srun3000命令执行第4弹

简要描述： 第4弹 详细说明： getonlineuser.php 这回有个key需算MD5 不用登陆。 $key = "oeit&^df"; $uname = $GET'uname'; $action = $GET'action'; if $GET'k' != md5 $action.$uname.$key //有个验证 算一下就好。 exit ; switch $action case "show4" : $pfd = popen "/srun3/bin/onlineuser -4 -u ".$uname, "r" ; //这里 if $pfd while $con = fgets...

VMWare Setuid vmware-mount Unsafe popen(3)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...

VMWare Setuid vmware-mount Unsafe popen(3)

VMWare Workstation up to and including 9.0.2 build-1031769 and Player have a setuid executable called vmware-mount that invokes lsbrelease in the PATH with popen3. Since PATH is user-controlled, and the default system shell on Debian-derived distributions does not drop privs, we can put an...

VMware - Setuid VMware-mount Unsafe popen(3) (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...

CVE-2013-1662

vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsbrelease binary in a directory in the PATH, related to use of the popen library function...

Design/Logic Flaw

vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsbrelease binary in a directory in the PATH, related to use of the popen library function...

CVE-2013-1662

CVE-2013-1662 affects VMware Workstation (8.x/9.x) and VMware Player (4.x/5.x) on Debian-based systems. A local attacker can escalate privileges to root by exploiting a crafted lsb_release binary in PATH via vmware-mount’s use of popen(3). The issue is rooted in how vmware-mount handles PATH and ...

CVE-2013-1662

vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsbrelease binary in a directory in the PATH, related to use of the popen library function...

CVE-2013-1662: Undefined Security Weakness

vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsbrelease binary in a directory in the PATH, related to use of the popen library function...

VMware - Setuid VMware-mount Popen lsb_release Privilege Escalation

VMware - Setuid VMware-mount Popen lsbrelease Privilege Escalation // Source: http://blog.cmpxchg8b.com/2013/08/security-debianisms.html On most modern Linux systems, /bin/sh is provided by bash, which detects that it's being invoked as sh, and attempts to mimic traditional sh. As everyone who...

VMWare Setuid vmware-mount Unsafe popen(3)

VMWare Workstation up to and including 9.0.2 build-1031769 and Player have a setuid executable called vmware-mount that invokes lsbrelease in the PATH with popen3. Since PATH is user-controlled, and the default system shell on Debian-derived distributions does not drop privs, we can put an...

Ruby Command Shell, Reverse TCP SSL

Connect back and create a command shell via Ruby, uses SSL This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 444 include Msf::Payload::Single include Msf::Payload::Ruby include...

Zenoss 3 showDaemonXMLConfig Command Execution

This module exploits a command execution vulnerability in Zenoss 3.x which could be abused to allow authenticated users to execute arbitrary code under the context of the 'zenoss' user. The showdaemonxmlconfigs function in the 'ZenossInfo.py' script calls Popen with user controlled data from the...

PHP-Barcode 0.3pl1 - Remote Code Execution

PHP-Barcode 0.3pl1 - Remote Code Execution PHP-Barcode 0.3pl1 Remote Code Execution The input passed to the code parameter is not sanitized and is used on a popen function. This allows remote command execution and also allows to see environment vars: Windows...

PHP-Barcode 0.3pl1 - Remote Code Execution

PHP-Barcode 0.3pl1 Remote Code Execution The input passed to the code parameter is not sanitized and is used on a popen function. This allows remote command execution and also allows to see environment vars: Windows http://www.site.com/php-barcode/barcode.php?code=%TMP% Linux...