29 matches found
CVE-2025-6019-udisks-lpe-no-image
CVE-2025-6019-udisks-lpe-no-image 仅使用脚本的权限提升利用链，基于 CVE-2025-6019 与 UDisks2（不包含文件系统镜像）。 鸣谢、背景与利用链 本仓库并未引入新的漏洞。 此处实现的权限提升技术完全基于先前已发表的研究。 我未能找到一种无需在目标上创建镜像即可运行的现有脚本，这促使我编写了此自动化脚本。 原始研究与公告 根本原因分析、利用流程和缓解指导均由原始 CVE 作者研究并披露： 🔗 https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt...
CVE-2024-48990
CVE-2024-48990 — needrestart 本地权限提升 通过 PYTHONPATH 注入，针对 Ubuntu/Debian 系统上 needrestart /environ 继承进程的完整环境 ——包括 PYTHONPATH。一个无特权的本地用户可以利用这一点： 1. 将 PYTHONPATH 设置为包含恶意 importlib 包的目录 2. 保持一个 Python 进程运行，以便 needrestart 在扫描时发现它 3. 等待 needrestart 执行——它会以 root 身份加载攻击者的 importlib/init.py 受影响版本 包| 受影响| 已修复...
pterodactyl
Pterodactyl — HackTheBox ウォークスルー プラットフォーム: HackTheBox | OS: Linux 攻撃チェーン サブドメイン上に Pterodactyl Panel が公開されていた。CVE-2025-49132 のパストラバーサルにより、認証なしで Laravel アプリケーションキーとデータベース認証情報が漏洩する。抽出したハッシュをクラックすることで SSH アクセスを取得する。権限昇格は CVE-2025-6018（PAM 環境変数ポイズニングにより偽のグラフィカル polkit セッションを作り出す）と CVE-2025-6019（XFS...
EulerOS 2.0 SP11 : udisks2 (EulerOS-SA-2025-2249)
According to the versions of the udisks2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the 'allowactive' setting in Polkit permits a physically...
Astra Linux – Vulnerability in libblockdev
A Local Privilege Escalation LPE vulnerability was discovered in libblockdev. Typically, the “allowactive” setting in Polkit allows a physically present user to perform certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, a “allowactive” user on ...
OESA-2025-1688 udisks2 security update
Security Fixes: A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive...
libblockdev: LPE from allow_active to root in libblockdev via udisks
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
libblockdev: LPE from allow_active to root in libblockdev via udisks
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
libblockdev: LPE from allow_active to root in libblockdev via udisks
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
libblockdev: LPE from allow_active to root in libblockdev via udisks
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
libblockdev: LPE from allow_active to root in libblockdev via udisks
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
AZL-64190 CVE-2025-6019 affecting package libblockdev 3.2.0-1
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
SUSE CVE-2025-6019
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
UBUNTU-CVE-2025-6019
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
OpenSSH 6.8 < 6.9 - PTY Privilege Escalation Exploit
Exploit for linux platform in category local exploits / notansshnuke.c Federico Bento up201407890 alunos dcc fc up pt https://twitter.com/uid1000 OpenSSH 6.8-6.9 local privilege escalation - CVE-2015-6565 Considered mostly to be a "DoS", turns out to be a priv esc vuln...
OpenSSH 6.8 6.9 - PTY Local Privilege Escalation
OpenSSH 6.8 6.9 - PTY Local Privilege Escalation / notansshnuke.c Federico Bento up201407890 alunos dcc fc up pt https://twitter.com/uid1000 OpenSSH 6.8-6.9 local privilege escalation - CVE-2015-6565 Considered mostly to be a "DoS", turns out to be a priv esc vuln...
Martin Stover Mars NWE 0.99 Buffer Overflow Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/617/info There are several buffer overflows in the setuid root components of the Mars Netware Emulator package. They allow for a local root compromise through the overflowing of buffers without bounds checking. It is to b...
Joe Text Editor 2.8 .joerc Arbitrary Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2437/info Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools. A problem in the...
QNX 6.4.x/6.5.x ifwatchd - Local root Exploit
No description provided by source. !/bin/sh QNX 6.4.x/6.5.x ifwatchd local root exploit by cenobyte 2013 [email protected] - vulnerability description: Setuid root ifwatchd watches for addresses added to or deleted from network interfaces and calls up/down scripts for them. Any user can...
Create a UNIX back door for primary articles intermediate articles advanced article-vulnerability warning-the black bar safety net
The primary article The most simple method, is in the password file passwd to add a UID 0 account. But the best don't do it, because as long as the system administrator to check the password file will“drain the filling”. The following is in /etc/passwd password file, add a UID 0 account C Program...