socks5 remote exploit / linux x86

/ !!!! Private do not distribute !!!! 1080r.c socks5 remote exploit / linux x86 Usage: $ ./1080r host command offset Vulnerables: socks5-v1.0r10 compiled on a turbolinux 4.0.5 = 0 socks5-v1.0r9 compiled on a turbolinux 4.0.5 = 0 socks5-v1.0r8 compiled on a turbolinux 4.0.5 = 0 socks5-v1.0r10...

RedHat 6.2 - '/sbin/restore' Local Privilege Escalation

!/bin/sh /sbin/restore exploit for rh6.2 I did not find this weakness my self, all i did was writing this script and some more to make it automatic and easy to use. This exploit should work on all redhat 6.2 systems with /sbin/restore not "fucked up". May work on other distros too, but only teste...

RedHat 6.2 Restore and Dump - Local Privilege Escalation

!/usr/bin/perl perl exploit of restore and dump redhat linux 6.2 written by tlabs Use at your discretion $EXPORT1="TAPE=garbage:garbage" ; $EXPORT2="RSH=./hey" ; sub USAGE print "$0 \n1=dump 2=dump.static 3=restore 4=restore.staic\nYour choice innit;\nWritten by Tlabs\n" ; exit 0 ; sub ERROR prin...

RedHat 7.0 (and SuSE): modutils + netkit = root compromise. (fwd)

Motto from the modprobe manpage: "BUGS: Naah..." ------------------------------------------------ This vulnerability has been found by Sebastian Krahmer some time ago he is posting an advisory right now. Stupid shell command execution within userspace kernel helper application, modprobe, is...

Linux modutils 2.3.9 - modprobe Arbitrary Command Execution

Linux modutils 2.3.9 - modprobe Arbitrary Command Execution source: https://www.securityfocus.com/bid/1936/info Modutils is a component of many linux systems that includes tools for using loadable kernel modules. One of these tools, modprobe, loads a set of modules that correspond to a provided...

vlock vulnerability in RedHat 7.0

I've tried to lock all virtual consoles in RedHat 7.0 using vlock, which is delivered with this release of RedHat. If user root locks all consoles - it's no problem, but if normal user locks consoles then anybody can unlock without typing a password. Try to use it in the following way: 1. logon a...

RedHat 0.4 b15 restore - Insecure Environment Variables

RedHat 0.4 b15 restore - Insecure Environment Variables source: https://www.securityfocus.com/bid/1914/info restore is a program for backup and recovery procedures, distributed with the RedHat Linux Operating System. A vulnerability exists that could allow a user elevated permissions. The problem...

Linux news 4.11.00

Linux 2.4 Todo Вышла новая редакция текста Linux 2.4 Todo - списка того, чего должно быть сделано до выхода новой серии стабильных ядер - Linux 2.4. Эта редакция соответствует ядру Linux 2.4.0test10. Подробнее: http://linuxtoday.com/newsstory.php3?ltsn=2000-11-03-011-04-NW-KN NetCraft расширяет...

RedHat 0.4 b15 restore - Insecure Environment Variables

source: https://www.securityfocus.com/bid/1914/info restore is a program for backup and recovery procedures, distributed with the RedHat Linux Operating System. A vulnerability exists that could allow a user elevated permissions. The problem occurs in the RSH environment variable. restore is...

Linux news 24.10.00

2.4.0-test10-pre5 is out Вышла очередная пре версия тестового ядра 2.4.0-test10, в этой версии по сравнению с предыдущей много мелких фиксов, как минимум еще одна проблема остается открытой. Подробнее: http://dredd.crimea.edu/linuxnews/test10-pre5.txt Mandrake 7.2 выйдет 28 октября Выход следующе...

Linux news 20.10.00

Очередное обновление ветки 2.4 - test10-pre4 Новая патчь проходит под кодовым название "ещё куча небольших фиксов". Подробнее: http://linuxtoday.com/newsstory.php3?ltsn=2000-10-18-016-04-NW-KN AC Kernel Patch 2.2.x 2.2.18pre17 Вышел семнадцатый пререлиз нового ядра Linux - Linux Kernel Patch...

BSD 'lpr' 0.54 -4 - Arbitrary Command Execution

source: https://www.securityfocus.com/bid/1834/info lpr is a set of printing tools for unix systems. The lpr package that ships with RedHat Linux 6.2 and possibly earlier versions contains a vulnerability that will allow an attacker to execute arbitrary commands with the privileges of group 'lp'...

Linux news 1.09.00

Ядро 2.4.0-test10-pre2 В этом патче для ядра содержатся исправления в функциях vmalloc и ioremap с удаленийм функции setpgdir. Исправления включены только для одной архитектуры x86. Разработчикам для других платформ также рекомендуется просмотреть код этих изменений и исправить свой код. Подробне...

Extent RBS directory Transversal.

Advisory Title: Extent RBS directory Transversal. Release Date: 09/21/2000 Application: Extent RBS Platform: Windows NT4 Windows 2000 RedHat Linux 6.x Sun Solaris 2.6+ Version: 2.63. Possibly older versions as well. have also tested 2.5 and found it vulnerable Severity: Any user can get any file ...

Linux news 13.09.00

2.2.18pre6 Похоже, Кокс решил закончить пятилетку за три года. Что ни день, то новая пре-версия стабильной ветки. Пофиксил несколько глупых багов, добавил несколько небольших фиксов, не компилируется только поддержка AGP. Похоже, Кокс готовится к большому прыжку. NFS? Подробнее:...

tmpwatch: local DoS : fork()bomb as root

sent through bugzilla.redhat.com no reply from responsible person. here it goes. Local DoS in /usr/sbin/tmpwatch. root forkbombs himself. tmpwatch is a bad boy Summary Local people can stop things working, and force you to reboot.  Longer summary Any user with write access to /tmp or /var/tmp ca...

RedHat 6 GLIBClocale - Subsystem Format String

RedHat 6 GLIBClocale - Subsystem Format String / source: https://www.securityfocus.com/bid/1634/info Conectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems...

RedHat 6 GLIBC/locale - Subsystem Format String

/ source: https://www.securityfocus.com/bid/1634/info Conectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provide internationalization support according to t...

Remote vulnerability in Gopherd 2.x

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 G U A R D E N T GUARDENT SECURITY ADVISORY secure digital infrastructure A0208102000 - ------------------------------------------------------------------------------ - Remote Vulnerability in Gopherd v2.x University of Minnesota August 10, 2000...

sperl 5.00503 (and newer ;) exploit

Not much to say except I feel little bit stupid posting it ... This exploit gives instant root, at least on RedHat 6.x/7.0 Linux boxes I have available for tests... And for sure, all other systems are vulnerable as well - it's just maybe this code will need some refining / tuning / minor changes...