Linux Kernel 2.2.252.4.242.6.2 - mremap() Local Privilege Escalation

Linux Kernel 2.2.252.4.242.6.2 - mremap Local Privilege Escalation / mremap missing domunmap return check kernel exploit gcc -O3 -static -fomit-frame-pointer mremappte.c -o mremappte ./mremappte suid shell Vulnerable kernel versions are all include include include include include include include...

Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Privilege Escalation

/ Linux kernel mremap bound checking bug exploit. Bug found by Paul Starzetz Copyright c 2004 iSEC Security Research. All Rights Reserved. THIS PROGRAM IS FOR EDUCATIONAL PURPOSES ONLY IT IS PROVIDED "AS IS" AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION WITHOUT PERMISSIO...

Linux Kernel 2.4.x mremap() bound checking Root Exploit

Exploit for linux platform in category local exploits ======================================================= Linux Kernel 2.4.x mremap bound checking Root Exploit ======================================================= / Linux kernel mremap bound checking bug exploit. Bug found by Paul Starzetz...

Cross Site Scripting vulnerability in miniBB 1.7 (latest) and earlier

==================================================================== Advisory by Eye On Security Research Group - India www.eos-india.net ==================================================================== 1...............................................................Product...

Cross Site Scripting in VP-ASP

Advisory Name: Cross Site Scripting in VP-ASP Release Date: December 05st, 2003 Application: VP-ASP Version Affected: 4.50 Platform: ASP Severity: Low Discover: Xnuxer Research Lab. [email protected], [email protected] Vendor URL: http://www.vp-asp.com Reference: http://infosekuriti.com Proof Of...

Linux Kernel 2.4.22 - do_brk() Local Privilege Escalation (2)

Linux Kernel 2.4.22 - dobrk Local Privilege Escalation 2 / hatorihanzo.c Linux kernel dobrk vma overflow exploit. The bug was found by Paul IhaQueR Starzetz Further research and exploit development by Wojciech Purczynski and Paul Starzetz. c 2003 Copyright by IhaQueR and cliph. All Rights Reserve...

Linux Kernel 2.4.22 - 'do_brk()' Local Privilege Escalation (2)

/ hatorihanzo.c Linux kernel dobrk vma overflow exploit. The bug was found by Paul IhaQueR Starzetz Further research and exploit development by Wojciech Purczynski and Paul Starzetz. c 2003 Copyright by IhaQueR and cliph. All Rights Reserved. COPYING, PRINTING, DISTRIBUTION, MODIFICATION,...

HPUX dtmailpr buffer overflow vulnerability

======================================================= HPUX dtmailpr buffer overflow vulnerability ======================================================= Davide Del Vecchio Adv8 Discovered in: 14/07/2003 Date: 19/11/2003 Tested on HP-UX B.11.00 Description: The dtmailpr program reads a...

Microsoft Windows - Workstation Service WKSSVC Remote (MS03-049)

/ Author: snooq Date: 14 November 2003 +++++++++++++ THIS IS A PRIVATE VERSION +++++++++++++++ This is just slightly better than the one I posted to packetstorm.... The public version will crash 'services.exe' immediately while this one crash it only when u exit from shell.... I'm still trying to...

EORF2003-04: sbox path disclosure problem

--------------------------- EightOne Research Facility --------------------------- EORF2003-04 security advisory Title: sbox has a information disclosure problems Author: Julio "e2fsck" Cesar Vendor: http://stein.cshl.org/WWW/software/sbox Versions: sbox 1.04 and later Date: 18 Sep 2003 1...

IBM DB2 Universal Database 7.2 (db2licm) Local Exploit

Exploit for linux platform in category local exploits ====================================================== IBM DB2 Universal Database 7.2 db2licm Local Exploit ====================================================== / Local Exploit for db2licm IBM db2 v 7.1 Linux/x86 vulnerability researched by...

IBM DB2 - Universal Database 7.2 'db2licm' Local Overflow

/ Local Exploit for db2licm IBM db2 v 7.1 Linux/x86 vulnerability researched by Juan Manuel Pascual Escriba pask at uninet.edu / char sc= "\x31\xc0" / begin setuid 0 / "\x31\xdb" "\xb0\x17" "\xcd\x80" "\xeb\x1f" "\x5e" "\x89\x76\x08" "\x31\xc0" "\x88\x46\x07" "\x89\x46\x0c" "\xb0\x0b" "\x89\xf3"...

rpcHeap.txt

The Analysis of RPC Long Filename Heap Overflow AND a Way to Write Universal Heap Overflow of Windows Create: 2003-09-21 Author: flashsky flashsky1atsina.com The Analysis of RPC Long Filename Heap Overflow AND a Way to Write Universal Heap Overflow of Windows Author:FLASHSKY...

MyServer 0.4.3 Remote Denial of Service Exploit

Exploit for unknown platform in category dos / poc =============================================== MyServer 0.4.3 Remote Denial of Service Exploit =============================================== / MyServer 0.4.3 DoS vendor: http://myserverweb.sourceforge.net Written and found by badpack3t at...

Samba 2.2.8 - Brute Force Method Remote Command Execution

Samba 2.2.8 - Brute Force Method Remote Command Execution / Mass Samba Exploit by Schizoprenic Xnuxer-Research c 2003 This code just for eduction purpose / include include include void usagechar s printf"Usage: %s \n",s; exit-1; int mainint argc, char argv printf"Mass Samba Exploit by...

Samba 2.2.8 (Bruteforce Method) Remote Root Exploit

Exploit for linux platform in category remote exploits =================================================== Samba 2.2.8 Bruteforce Method Remote Root Exploit =================================================== / Mass Samba Exploit by Schizoprenic Xnuxer-Research c 2003 This code just for eduction...

Samba 2.2.8 - Brute Force Method Remote Command Execution

/ Mass Samba Exploit by Schizoprenic Xnuxer-Research c 2003 This code just for eduction purpose / include include include void usagechar s printf"Usage: %s \n",s; exit-1; int mainint argc, char argv printf"Mass Samba Exploit by Schizoprenic\n"; ifargc != 3 usageargv0; scanargv1, argv2; return 0;...

Domain User Credentials access via OWA XSS

On my previous post about OWA XSS I talked about Cross Site Scripting in the attachment field of a mail. The XSS is not in the attachment, is in the body of the message. Sorry, I need to sleep... Please notice: not in the attachment, in the BODY. To make it clear to understand I have just publish...

Yahoo Messenger 5.5 - DSR-ducky.c Remote Overflow

Yahoo Messenger 5.5 - DSR-ducky.c Remote Overflow / --- Remote yahoo Messenger V5.5 exploiter on Windows XP --- Dtors Security Research DSR Code by: Rave The buffer looks like this |- ^^ / include include include include include / These are the usual header files / include include include define...

Yahoo Messenger 5.5 Remote Exploit (DSR-ducky.c)

No description provided by source. / --- Remote yahoo Messenger V5.5 exploiter on Windows XP --- Dtors Security Research DSR Code by: Rave The buffer looks like this |-----| Fillup x offsetJMP 0x3EIPNOPSSHELLCODE ^^ / include windows.h include stdio.h include stdlib.h include string.h include...