Man-db 2.6.7.1 Privilege Escalation

/ EDB Note: man:man - man:root http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/ man:root - root:root http://www.halfdog.net/Security/2015/MandbSymlinkLocalRootPrivilegeEscalation/ CreateSetgidBinary.c...

OpenSSH 6.8 6.9 - PTY Local Privilege Escalation

OpenSSH 6.8 6.9 - PTY Local Privilege Escalation / notansshnuke.c Federico Bento up201407890 alunos dcc fc up pt https://twitter.com/uid1000 OpenSSH 6.8-6.9 local privilege escalation - CVE-2015-6565 Considered mostly to be a "DoS", turns out to be a priv esc vuln...

Man-db 2.6.7.1 - Privilege Escalation Exploit

Exploit for linux platform in category local exploits / EDB Note: man:man - man:root http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/ man:root - root:root http://www.halfdog.net/Security/2015/MandbSymlinkLocalRootPrivilegeEscalation/ CreateSetgidBinary.c...

OpenSSH 6.8 < 6.9 - PTY Privilege Escalation Exploit

Exploit for linux platform in category local exploits / notansshnuke.c Federico Bento up201407890 alunos dcc fc up pt https://twitter.com/uid1000 OpenSSH 6.8-6.9 local privilege escalation - CVE-2015-6565 Considered mostly to be a "DoS", turns out to be a priv esc vuln...

CVE-2016-10156

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229...

Firejail: Multiple vulnerabilities

Background A SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. Description Multiple vulnerabilities have been discovered in Firejail. Please review the CVE identifiers referenced below f...

CVE-2016-10156

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229...

CVE-2016-10156

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229...

DEBIAN-CVE-2016-10156

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229...

CVE-2016-10156

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229...

CVE-2016-10151

The hesiodinit function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the 1 HESIODCONFIG or 2 HESDOMAIN environment variable and leveraging certain SUID/SGUID binary...

Vesta Control Panel 0.9.8-16 - Local Privilege Escalation

!/bin/bash Exploit Title: Vesta Control Panel 0.9.7 suid.c PWN Make PWN shell script executable. chmod +x PWN Inject command to run PWN into v-get-web-domain-value paramet...

Linux application permissions incorrectly can provide the right series vulnerability analysis-vulnerability warning-the black bar safety net

Foreword linux to powerful file management system, in actual use, although able to work provide great convenience, but if the permissions improper handling, may cause a certain security risk, such as in the operation of the file, change some folder permissions, when the use of some can be freely...

Ubuntu 15.10 - USERNS Overlayfs Over Fuse Privilege Escalation

Ubuntu 15.10 - USERNS Overlayfs Over Fuse Privilege Escalation Source: http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/ Introduction Problem description: On Ubuntu Wily it is possible to place an USERNS overlayfs mount over a fuse mount. The fuse filesystem may contain...

Ubuntu 15.10 - 'USERNS ' Overlayfs Over Fuse Privilege Escalation

Source: http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/ Introduction Problem description: On Ubuntu Wily it is possible to place an USERNS overlayfs mount over a fuse mount. The fuse filesystem may contain SUID binaries, but those cannot be used to gain privileges due t...

AIX 5.3 / 6.1 / 7.1 / 7.2 lquerylv Local Root

!/usr/bin/sh AIX lquerylv 5.3, 6.1, 7.1, 7.2 local root exploit. Tested against latest patchset 7100-04 This exploit takes advantage of known issues with debugging functions within the AIX linker library. We are taking advantage of known functionality, and focusing on badly coded SUID binaries...

IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Privilege Escalation Exploit

Exploit for linux platform in category local exploits !/usr/bin/sh AIX lquerylv 5.3, 6.1, 7.1, 7.2 local root exploit. Tested against latest patchset 7100-04 This exploit takes advantage of known issues with debugging functions within the AIX linker library. We are taking advantage of known...

IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Local Privilege Escalation

!/usr/bin/sh AIX lquerylv 5.3, 6.1, 7.1, 7.2 local root exploit. Tested against latest patchset 7100-04 This exploit takes advantage of known issues with debugging functions within the AIX linker library. We are taking advantage of known functionality, and focusing on badly coded SUID binaries...

Apple OS XiOS Kernel - IOSurface Use-After-Free

Apple OS XiOS Kernel - IOSurface Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=831 IOSurfaceRootUserClient stores a task struct pointer passed in via IOServiceOpen in the field at +0xf0 without taking a reference. By killing the corrisponding task we can free th...

Apple macOS 10.12 - task_t Local Privilege Escalation

Apple macOS 10.12 - taskt Local Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=837 TL;DR you cannot hold or use a task struct pointer and expect the euid of that task to stay the same. Many many places in the kernel do this and there are a great many very...