VMware Horizon Client for Linux Elevation of Privilege Vulnerability

VMware Horizon Client for Linux is a Linux-based client software from VMware that allows access to VMware Horizon desktops from any location. An extraction vulnerability exists in Mware Horizon Client for Linux prior to version 4.8.0, which stems from the program's unsafe use of SUID binaries. An...

Privilege escalation

VMware Horizon Client for Linux 4.x before 4.8.0 and prior contains a local privilege escalation vulnerability due to insecure usage of SUID binary. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on a Linux machine where Horizon Client is...

CVE-2018-6964

VMware Horizon Client for Linux 4.x before 4.8.0 and prior contains a local privilege escalation vulnerability due to insecure usage of SUID binary. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on a Linux machine where Horizon Client is...

CVE-2018-6964

CVE-2018-6964 affects VMware Horizon Client for Linux (4.x before 4.8.0) and is a local privilege escalation due to insecure use of an SUID binary. An unprivileged user can escalate to root on a system where Horizon Client is installed. The issue is documented by VMware in VMSA-2018-0014, which n...

VMware Horizon Client update addresses a privilege escalation vulnerability

VMware Horizon Client for Linux Horizon Client VMware Horizon Client privilege escalation vulnerability VMware Horizon Client contains a local privilege escalation vulnerability due to insecure usage of SUID binary. Successful exploitation of this issue may allow unprivileged users to escalate...

glibc 'realpath()' Privilege Escalation

This module attempts to gain root privileges on Linux systems by abusing a vulnerability in GNU C Library glibc version 2.26 and prior. This module uses halfdog's RationalLove exploit to exploit a buffer underflow in glibc realpath and create a SUID root shell. The exploit has offsets for glibc...

Linux Enumeration And Privilege Escalation – LinEnum

LinEnum will automate many Local Linux Enumeration & Privilege Escalation checks documented in this cheat sheet . It’s a very basic shell script that performs over 65 checks, getting anything from kernel information to locating possible escalation points such as potentially useful SUID/GUID files...

Holey Beep: Linux 提权漏洞分析与利用(CVE-2018-0492)

Introduction Back in the old days, people were using the \a character to emit a horrible 'beep' sound from their speaker. It was a bit annoying, especially if you wanted more complicated stuff to do 8bits-like musics. That's why Johnathan Nightingale made the beep software. A very simple and shor...

CVE-2017-16873

It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges...

CVE-2017-16873

It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges...

Code injection

It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges...

CVE-2017-16873

It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges...

CVE-2017-16873

CVE-2017-16873 affects vagrant-vmware-fusion versions 4.0.25 through 5.0.4. A vulnerability in an unsanitized PATH within the suid binary can be exploited to escalate to root privileges locally. Connected sources corroborate a local privilege escalation without details on exploitation vectors bey...

The vulnerability of the getcwd and realpath functions in libraries that provide system calls and the core glibc functions allows a hacker to execute arbitrary code.

The vulnerability of the getcwd and realpath functions in libraries that provide system calls and the main glibc functions arises from operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially crafted SU...

MagniComp SysInfo - mcsiwrapper Privilege Escalation Exploit

Exploit for multiple platform in category local exploits This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MagniComp SysInfo mcsiwrapper Privilege Escalation', 'Description' = %q This module...

glibc - '$ORIGIN' Expansion Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/local/linux' require 'msf/core/exploit/exe' class MetasploitModule "glibc '$ORIGIN' Expansion Privilege Escalation", 'Description' = %q This...

glibc LD_AUDIT Arbitrary DSO Load Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/local/linux' require 'msf/core/exploit/exe' class MetasploitModule 'glibc LDAUDIT Arbitrary DSO Load Privilege Escalation', 'Description' = %q...

MagniComp SysInfo mcsiwrapper Privilege Escalation

This module attempts to gain root privileges on systems running MagniComp SysInfo versions prior to 10-H64. The .mcsiwrapper suid executable allows loading a config file using the '--configfile' argument. The 'ExecPath' config directive is used to set the executable load path. This module abuses...

Libc Realpath缓冲区下溢漏洞(CVE-2018-1000001)

Introduction The vulnerability described here is caused by Linux kernel behaviour change in the syscall API returning relative pathnames in getcwd and non-defensive function implementation in libc failing to process that pathname correctly. Other libraries are very likely to be affected as well. ...

Linux/x86 - fork() + setreuid(0, 0) + execve(cp /bin/sh /tmp/sh; chmod 4755 /tmp/sh) Shellcode (126

/ linux/x86 shamelessly ripped from one of my unpublished exploits / / fork's, does setreuid0, 0; then execve's: /bin/sh -c "cp /bin/sh /tmp/sh; chmod 4755 /tmp/sh" hence dropping a SUID root shell in /tmp. / char shellc = / Shellcode to drop a SUID root shell in /tmp/sh. Forgive the Intel syntax...