LKM rootkit в современных Linux

В этой статье мы научимся собирать LKM-rootkit под современные ядра Linux, не смотря на то, что многие пишут, что это неактуально. Попробую опровергнуть это. В данной статье использованны вещи, доступные в паблике и некоторые мои наработки. Руткиты подразделяют на ядерные уровня ядра и неядерные...

Ubuntu: Security Advisory (USN-1054-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 10.04 LTS / 10.10 : linux, linux-ec2 vulnerabilities (USN-1054-1)

Gleb Napatov discovered that KVM did not correctly check certain privileged operations. A local attacker with access to a guest kernel could exploit this to crash the host system, leading to a denial of service. CVE-2010-0435 Dan Rosenberg discovered that the Linux kernel TIPC implementation...

bsd/x86 - connect back Shellcode (81 bytes)

Exploit for bsd/x86 platform in category shellcode / -------------- FreeBSD/x86 - connect back /bin/sh. 81 bytes ---------------- AUTHOR : Tosh OS : BSDx86 Tested on FreeBSD 8.1 EMAIL : email protected / include include include char shellcode =...

Linux Kernel 2.6.32 (Ubuntu 10.04) - proc Handling SUID Privilege Escalation

Linux Kernel 2.6.32 Ubuntu 10.04 - proc Handling SUID Privilege Escalation Source: http://www.halfdog.net/Security/2011/SuidBinariesAndProcInterface/ proc Handling of Already Opened Files: Subvert The Stack Base Address Randomization With Suid-Binaries Problem description: Latest ubuntu lucid sto...

Linux Kernel 2.6.32 (Ubuntu 10.04) - '/proc' Handling SUID Privilege Escalation

Source: http://www.halfdog.net/Security/2011/SuidBinariesAndProcInterface/ proc Handling of Already Opened Files: Subvert The Stack Base Address Randomization With Suid-Binaries Problem description: Latest ubuntu lucid stock kernel 2.6.32-27-generic contains a bug that allows to keep attached to...

PT-2011-1485 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.37 Description: The issue allows local users to cause a denial of service due to memory consumption via a crafted exec system call. This is related to the handling of stack memory by arrays representing...

SGI Irix kernel integer overflow

Integer overflow in SGIXLVATTRGET syscall...

Adobe Flash Player "Button" Remote Code Execution

This module exploits a vulnerability in the handling of certain SWF movies within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially...

FreeBSD - pseudofs Null Pointer Dereference Privilege Escalation

FreeBSD - pseudofs Null Pointer Dereference Privilege Escalation / source: https://www.securityfocus.com/bid/43060/info 18.08.2010, babcia padlina FreeBSD 7.0 - 7.2 pseudofs null ptr dereference exploit to obtain SYSENT8SYCALLADDR, run: $ kgdb /boot/kernel/kernel kgdb print &sysent8.sycall / defi...

Linux/x86-64 - setuid0 & chmod "/etc/passwd", 0777 & exit0 63 bytes

Linux/x86-64 - setuid0 & chmod "/etc/passwd", 0777 & exit0 - 63 bytes. Shellcode exploit for linx86-64 platform / Title: Linux/x86-64 - setuid0 & chmod "/etc/passwd", 0777 & exit0 - 63 bytes Date: 2010-06-17 Tested: Archlinux x8664 k2.6.33 Author: Jonathan Salwan Web: http://shell-storm.org |...

linux/x86 sys_setuid(0) & sys_setgid(0) & execve ("/bin/sh") 39 bytes

Exploit for linux/x86 platform in category shellcode ===================================================================== linux/x86 syssetuid0 & syssetgid0 & execve "/bin/sh" 39 bytes ===================================================================== /...

linux/x86 change mode 0777 of "/etc/shadow" sys_chmod syscall 39 bytes

Exploit for linux/x86 platform in category shellcode =========================================================================== linux/x86 change mode 0777 of "/etc/shadow" with syschmod syscall 39 bytes =========================================================================== /...

change mode 0777 of "/etc/passwd" with sys_chmod syscall

change mode 0777 of "/etc/passwd" with syschmod syscall. Shellcode exploit for linux platform 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 //...

linux/x86 sys_chmod("/etc/passwd",599) shellcode 39 bytes

Exploit for linux/x86 platform in category shellcode ========================================================= linux/x86 syschmod"/etc/passwd",599 shellcode 39 bytes ========================================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 ...

change mode 0777 of "/etc/shadow" with sys_chmod syscall

change mode 0777 of "/etc/shadow" with syschmod syscall. Shellcode exploit for linux platform / 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 //...

linux/x86-64 sethostname() & killall 33 bytes shellcode

Exploit for linux/x86-64 platform in category shellcode ======================================================= linux/x86-64 sethostname & killall shellcode 33 bytes ======================================================= Linux/x8664 sethostname & killall 33 bytes shellcode Date: 2010-04-26 Autho...

Linux/x86_64 - rebootPOWER_OFF shellcode 19 bytes

Linux/x8664 rebootPOWEROFF 19 bytes shellcode. Shellcode exploit for linx86-64 platform Linux/x8664 rebootPOWEROFF 19 bytes shellcode Date: 2010-04-25 Author: zbt Tested on: x8664 Debian GNU/Linux / ; rebootLINUXREBOOTMAGIC1, LINUXREBOOTMAGIC2, LINUXREBOOTCMDPOWEROFF section .text global start...

Linux Kernel 2.6.18 - 'move_pages()' Information Leak

/ sieve because the Linux kernel leaks like one, get it? Bug NOT discovered by Marcus Meissner of SuSE security This bug was discovered by Ramon de Carvalho Valle in September of 2009 The bug was found via fuzzing, and on Sept 24th I was sent a POC DoS for the bug but had forgotten about it until...

kernel: x86-64: syscall-audit: 32/64 syscall hole

The auditsyscallentry function in the Linux kernel 2.6.28.7 and earlier on the x8664 platform does not properly handle 1 a 32-bit process making a 64-bit syscall or 2 a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted...