ignorance isn't always an option

Register | Login

FilesNewsUsersAuthors

Home Files News About Contact Add New

Showing 1 - 24 of 24

Files from Venglin

Linux Kernel ia32syscall Emulation Local Root

Posted Sep 16, 2010

Authored by Venglin, Wojciech Purczynski, Robert Swiecki, Pawel Pisarczyk, Ben Hawkes

Local root exploit for the x86_64 Linux kernel ia32syscall emulation vulnerability. This is a variant of a vulnerability found back in 2007.

tags | exploit, kernel, local, root

systems | linux

advisories | CVE-2007-4573, CVE-2010-3301

MD5 | 2f03e8832849e0defbb98ca079107559

Download | Favorite | Comments (0)

linux-syscall.txt

Posted Sep 28, 2007

Authored by Venglin, Wojciech Purczynski, Robert Swiecki, Pawel Pisarczyk | Site atm-lab.pl

Local root exploit for the x86_64 Linux kernel ia32syscall emulation bug.

tags | exploit, kernel, local, root

systems | linux

MD5 | 5d14ec4f80a173aed4a21dadebd3c189

Download | Favorite | Comments (0)

ldsoWhoops.txt

Posted Jun 29, 2005

Authored by Venglin

ld.so from Solaris 9 and 10 does not check the LD_AUDIT environment variable when running setuid and setgid binaries, allowing a malicious party to run arbitrary code with elevated privileges.

tags | exploit, arbitrary

systems | solaris

MD5 | 02b0fa3de66ae2c25e511bb747ec86a9

Download | Favorite | Comments (0)

traceSolaris.txt

Posted Jun 25, 2005

Authored by Venglin | Site frasunek.com

traceroute under Solaris 10 is susceptible to a buffer overflow in the handling of the -g argument. Sample exploitation included.

tags | exploit, overflow

systems | solaris

MD5 | 12bfb0bfe843c6f3aff37ac9ae831254

Download | Favorite | Comments (0)

googleSegFault.txt

Posted Dec 31, 2004

Authored by Venglin

Amusing tidbit showing Google segfaulting.

tags | advisory

MD5 | a266eb1e1ba9d8b983438ccfe0843248

Download | Favorite | Comments (0)

mtroff-by-one.txt

Posted Dec 30, 2004

Authored by Venglin

mtr is susceptible to raw socket hijacking, allowing for the spoofing of ICMP packets.

tags | advisory, spoof

MD5 | 3cba2beb8ae7f282ff09a6215b7d27fb

Download | Favorite | Comments (0)

zyxelP681.txt

Posted Sep 15, 2004

Authored by Venglin

Zyxel P681 SDSL routers disclose random portions of memory in ARP requests.

tags | advisory

MD5 | 6048d02b855c73c8f0589db01f868203

Download | Favorite | Comments (0)

NetBSD-SA2004-009.txt

Posted Aug 19, 2004

Authored by Venglin | Site netbsd.org

NetBSD Security Advisory 2004-009 - A set of flaws in the ftpd source code can be used together to achieve root access within an ftp session. With root file manipulation ability, mechanisms to gain a shell are numerous, so this issue should be considered a remote root situation.

tags | advisory, remote, shell, root

systems | netbsd

MD5 | 60a69638e2b72d77727e6df6111bd434

Download | Favorite | Comments (0)

obsd-cron.c

Posted Apr 15, 2002

Authored by Venglin

OpenBSD 3.0 cron / mail local root exploit. Creates a suid shell after /etc/daily runs.

tags | exploit, shell, local, root

systems | openbsd

MD5 | 72d35ea6ab315d9c96c3184343dee252

Download | Favorite | Comments (0)

plogd2.c

Posted Nov 22, 2001

Authored by Venglin | Site freebsd.lublin.pl

Plogd v2 - syn/udp/icmp packet logger (freebsd version).

tags | udp, system logging

systems | unix, freebsd

MD5 | 8acf703296d17b76edc2716398aa9b38

Download | Favorite | Comments (0)

globulka.pl

Posted Apr 17, 2001

Authored by Venglin

FreeBSD-4.2-Stable ftpd GLOB remote root exploit in perl. This version requires user access and writeable home dir without chroot.

tags | exploit, remote, root, perl

systems | freebsd

MD5 | 21542904375f11b565ae7d3ffa7495eb

Download | Favorite | Comments (0)

bobek.c

Posted Dec 6, 2000

Authored by Venglin | Site b0f.freebsd.lublin.pl

Bobek.c is a Wu-Ftpd 2.6.0 remote root exploit (updated 05/08/2000). Bug is in the SITE EXEC command, an account is not required as anonymous access is enough. Tested against Redhat 6.2, FreeBSD 3.4-STABLE, and FreeBSD 5.0-CURRENT.

tags | exploit, remote, root

systems | linux, redhat, freebsd

MD5 | 72aa028cb868dcaf240a98d147e3f193

Download | Favorite | Comments (0)

freebsd-systat.c

Posted Oct 11, 2000

Authored by Venglin

FreeBSD 4.X local /usr/bin/systat exploit. Gives a sgid kmem shell by exploiting the .terminfo bug in ncurses.

tags | exploit, shell, local

systems | freebsd

MD5 | 814c885a5a67051785ba29eee6076b4b

Download | Favorite | Comments (0)

hpux.ftpd.txt

Posted Aug 10, 2000

Authored by Venglin | Site freebsd.lublin.pl

HPUX's ftpd contains a remotely exploitable format string vulnerability in the PASS command.

tags | exploit

systems | hpux

MD5 | 52757625c75bb68c6c403710d078bc99

Download | Favorite | Comments (0)

sms.c

Posted May 31, 2000

Authored by Venglin | Site b0f.freebsd.lublin.pl

sms.c is a remote SMS 1.8.2 (mail2sms gateway) long subject line remote buffer overflow exploit. Send the mail generated by this program and a shell will be listening on port 2222. Offsets adjusted for redhat.

tags | exploit, remote, overflow, shell

systems | linux, redhat

MD5 | 836481971d25cd24f48a3187fca55303

Download | Favorite | Comments (0)

sqlsyslogd.c

Posted Apr 26, 2000

Authored by Venglin | Site freebsd.lublin.pl

syslogd-to-MySQL wrapper v0.1 prebeta. Stores syslog messages in a MySQL database. Written for FreeBSD.

systems | freebsd

MD5 | 9a055ca5347884d3708e659ce3ae8a55

Download | Favorite | Comments (0)

plogd2.c

Posted Apr 26, 2000

Authored by Venglin | Site freebsd.lublin.pl

Plogd v2 (Revision 1.5) is a syn/udp/icmp packet logger for freebsd.

Changes: Fixed fd leak, misc bugfixes.

tags | udp

systems | freebsd

MD5 | eef674504b75af8c3aa2b70b04a1ae7d

Download | Favorite | Comments (0)

b0f3-ncurses.txt

Posted Apr 24, 2000

Authored by Venglin | Site b0f.com

BufferOverflow Security Advisory #3 - libncurses buffer overflow in NCURSES 1.8.6 on FreeBSD 3.4-STABLE. Setuid programs linked with libncurses can be exploited to obtain root access.

tags | overflow, root

systems | freebsd

MD5 | 6498cacb6f034cf8c3e1a0d842966aaa

Download | Favorite | Comments (0)

freebsd.mtr.c

Posted Apr 24, 2000

Authored by Venglin | Site freebsd.lublin.pl

FreeBSD mtr-0.41 local root exploit.

tags | exploit, local, root

systems | freebsd

MD5 | 7b6ccfe86d1f9d39294cd7b5818c56f8

Download | Favorite | Comments (0)

mars.c

Posted Apr 4, 2000

Authored by Venglin | Site b0f.freebsd.lublin.pl

mars_nwe 0.99pl14 root exploit (linux).

tags | root

systems | linux

MD5 | 5b6fce38150f1e31d683c4dd22ff898e

Download | Favorite | Comments (0)

www.c

Posted Apr 3, 2000

Authored by Venglin | Site b0f.freebsd.lublin.pl

Novell NetWare webservers remote denial of service - Tested on Novell NetWare 4.11 with Novell-HTTP-Server/3.1R1, Novell NetWare 4.1 with Novell-HTTP-Server/2.51R1, Novell NetWare ?.? with YAWN/1.05.

tags | remote, web, denial of service

MD5 | 576b4950d530b2d4e4aec61b212f3cdc

Download | Favorite | Comments (0)

umount.c

Posted Mar 29, 2000

Authored by Venglin | Site b0f.freebsd.lublin.pl

FreeBSD 3.3 /sbin/umount exploit.

systems | freebsd

MD5 | 9771ba0845affa761cd9b94dea51b1b1

Download | Favorite | Comments (0)

proftpd.c

Posted Mar 25, 2000

Authored by Venglin | Site b0f.freebsd.lublin.pl

Your ultimate proftpd pre0-3 exploiting toolkit based on adm-wuftpd by duke and kombajn do czere^vni by Lam3rZ.

MD5 | 980e949baa7fff05ee7b182a7eff1270

Download | Favorite | Comments (0)

redhat-man.c

Posted Feb 29, 2000

Authored by Venglin | Site freebsd.lublin.pl

Redhat /usr/bin/man exploit (gid=15 leads to potential root compromise).

tags | exploit, root

systems | linux, redhat

MD5 | 534219ec78ffa72e140fa46ef0859a02

Download | Favorite | Comments (0)