Linux/x86-64 - Subtle Probing Reverse Shell, Timer, Burst, Password, Multi-Terminal Shellcode (84, 1

include include //| //| Exploit Title: linux x8664 Subtle Probing Reverse Shell, Timer, Burst, Password, multi-Terminal 84, 122, 172 bytes //| Date: 07/20/2016 //| Exploit Author: CripSlick //| Tested on: Kali 2.0 Linux x8664 //| Version: No program being used or exploited; I only relied syscalls...

Linux/x86-64 - Continuously-Probing Reverse Shell via Socket + Port-range + Password Shellcode (172

include include // Exploit Title: Continuously-Probing Reverse Shell via Socket + port-range + password 172 bytes // Date: 07/10/2016 // Exploit Author: CripSlick // Tested on: Kali 2.0 // Version: No program being used or exploited; I only relied on syscalls...

FreeBSD : openssh -- command injection when X11Forwarding is enabled (e4644df8-e7da-11e5-829d-c80aa9043978)

The OpenSSH project reports : Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth1. Injection of xauth commands grants the ability to read arbitrary files under the authenticated user's privilege, Other xauth...

openssh -- command injection when X11Forwarding is enabled

The OpenSSH project reports: Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth1. Injection of xauth commands grants the ability to read arbitrary files under the authenticated user's privilege, Other xauth comman...

Ethernet MAC Addresses

This plugin gathers MAC addresses discovered from both remote probing of the host e.g. SNMP and Netbios and from running local checks e.g. ifconfig. It then consolidates the MAC addresses into a single, unique, and uniform list. TRUSTED...

kernel security, bug fix, and enhancement update

2.6.32-573 - security selinux: dont waste ebitmap space when importing NetLabel categories Paul Moore 1130197 - x86 Revert Add driver auto probing for x86 features v4 Prarit Bhargava 1231280 - net bridge: netfilter: dont call iptables on vlan packets if sysctl is off Florian Westphal 1236551 - ne...

UDP Empty Prober

Detect UDP services that reply to empty probes This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'UDP Empty Prober', 'Description' = 'Detect UDP services that reply to empty probes', 'Author' = 'J...

Smartcard Undocumented Commands: THC-SmartBrute

This tools finds undocumented and secret commands implemented in a smartcard. An instruction is divided into Class CLA, Instruction-Number INS and the parameters or arguments P1, P2, P3. … iterates through all the possible values of CLA and INS to find a valid combination. Furthermore it tries to...

openSUSE Security Update : libvirt (openSUSE-SU-2011:0643-1)

A regression re-introduced automatic disk probing again which potentially allowed to uses to access arbitrary files CVE-2011-2178. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libvirt-4712...

pacemaker security update

CentOS Errata and Security Advisory CESA-2013:1635 Updated pacemaker packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common...

[Http-enum] Automated HTTP Enumeration Tool

Null Security Team writing a python script for Automated HTTP Enumeration. currently only in the initial beta stage, but includes basic checking of files including the Apache server-status as well as well IIS WebDAV and Microsoft FrontPage Extensions, many more features will be added to this tool...

Design/Logic Flaw

runtime/staprun/staprunfuncs.c in the systemtap runtime tool staprun in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search pat...

CVE-2011-2502

runtime/staprun/staprunfuncs.c in the systemtap runtime tool staprun in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search pat...

CVE-2011-2502

runtime/staprun/staprunfuncs.c in the systemtap runtime tool staprun in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search pat...

CVE-2011-2502

runtime/staprun/staprunfuncs.c in the systemtap runtime tool staprun in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search pat...

CVE-2011-2502

runtime/staprun/staprunfuncs.c in the systemtap runtime tool staprun in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search pat...

CVE-2011-2502

The CVE-2011-2502 issue affects SystemTap’s staprun component (runtime/staprun/staprun_funcs.c). The flaw arises when a user-specified module path for user-space probing (staprun -u) is not properly validated, enabling local stapusr group members to escalate privileges via a crafted module found ...

CVE-2011-2502

runtime/staprun/staprunfuncs.c in the systemtap runtime tool staprun in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search pat...

Fedora 15 : kernel-2.6.41.4-1.fc15 (2011-16621)

Update from kernel 3.1.1 to 3.1.4 : - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3. 1.4 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog- 3.1.3 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog- 3.1.2 Additional changes : - Fix virtualbox: use a different method to fake...

CVE-2011-2178

The virSecurityManagerGetPrivateData function in security/securitymanager.c in libvirt 0.8.8 through 0.9.1 uses the wrong argument for a sizeof call, which causes incorrect processing of "security manager private data" that "reopens disk probing" and might allow guest OS users to read arbitrary...