This patch for OpenSSH 6.0 Portable adds a hardcoded skeleton key, removes connection traces in the log files, usernames and passwords both in and out are logged, and more.
7753b7580751d604a864a09175a5945c
This patch is a backdoor to bash that will create a setuid backdoor shell in /tmp if run as root.
80a9346667b79669e3db8cb7e2ef3d24
This patch for OpenSSH 6.0 Portable is a lightweight version of the full patch. This version strictly allows for the addition of a hard-coded password.
76830af90bed3531d0db957c8b264924
A shellcode that automatically obtains the highest available uid to setuid().
f4136d365f3f880656449a228fe0c963
Smart shellcode which prompts the user for the uid to setuid() with.
7af85660b4523017e97a29918ef2e49b
Exploit for Yahoo Messenger, Yahoo Module that allows for remote command execution on a victim machine via bad URI handling. Requires the victim to view the html.
1f8a1f0189da4662ead77ad7254d271a
Yahoo Messenger 5.5 and below suffers from a buffer overflow that was originally discovered and fixed in May of 2002, but has since resurfaced. Systems Affected: Windows NT/2000/SP1/SP2/SP3, Windows ME, Windows 95/98, Windows XP.
6f46595fb8f8c9ab9e7d127ab94b1f67
A paper that details the manipulation of the destructor when utilizing a buffer overflow, a format string attack, or corrupting a malloc chunk.
cf655444e6c3559bebdf6fd69d4b4aeb
Firebird has 3 binaries: gds_inet_server, gds_drop, and gds_lock_mgr, which all use insufficent bounds checking in conjunction with getenv(), making each one susceptible to local exploitation. Enclosed are two local root exploits tested against versions 1.0.0 and 1.0.2 on FreeBSD.
3b1e72930195b5834044974c51c259aa
Cpanel 5 and below remote exploit which allows users to view any file or execute remote commands due to an insecure open call in guestbook.cgi. Local root vulnerabilities also exist.
3b3e532e3718324aaa6fa16ed89e63f2
Nethack v3.4.0 local buffer overflow exploit which spawns a shell as uid=games. Runs /usr/games/lib/nethackdir/nethack.
3b81d062cf1cb44bc672fbd44da2173e
Buffer Overflows for Kids part 2 - This is part two, the follow on from bofs4kids. In this tutorial I am going to attempt to give you the knowledge to be able to e exploit a program, without coding in C. But we will need to use gdb quite a bit, so any prior knowledge would be helpful but not necessary.
4cfd9785b13c35dc81b71b93e26cb49f
This tutorial is not going to teach you how to code an exploit, but what it is going to do is give you a good understanding of what a buffer overflow is, what types of buffer overflows there are, how we would go about exploiting a buffer overflow, and how to identify a buffer overflow. C and ASM knowledge is not required.
7fbf27ec6573ab0c860055f326755bf1
Bish.c is multi-platform shellcode tested on FreeBSD 4.6-PRERELEASE, FreeBSD 4.5-RELEASE, OpenBSD 3.0, NetBSD 1.5.2, Linux 2.0.36, Linux 2.2.12-20, and Linux 2.2.16-22. Based on code by Zillion, added setuid().
d5f1336e3d3ab4c064e0960020fef945
Finding Vulnerabilities - This paper explains the auditing of C source code to find application exploits. Includes a practical example of how to hack an IDS that was coded for a website.
6e349f14320160b2b874d172bdb12a94
Shellcoding - How to write shellcode for Linux/x86. Includes parts I + II.
f6ce6ce0746488247aaaf2c3ee8e867c
Linux x86 shellcode which does a chmod("//bin/sh" ,04775); set sh +s.
a75dfc85d1fde7f2ab86831345102ea3
Linux x86 shellcode which does a write(stdout,"bob from DSR", 15); exit;.
8ac3413ff94cd12251c9a92492424611
Linux x86 shellcode which does a setuid(); execve(); exit();.
007db61a364ebbf79c5ea83f6dc86f09
Linux x86 shellcode, to open() write() close() and exit(), adds a root user no-passwd to /etc/passwd.
117ee3f5b27628302449296f1ecf6f4c
Linux x86 shellcode which does execve()/bin/ash; exit; in 34 bytes.
be081400dca64065855add976aa3369e
Linux x86 29 byte shellcode.
04c5b3189e0bc231736eb5285b0c3874
This Proof of Concept exploit for the current directory traversal design flaw in apache 2.0.x - 2.0.39 allows any attacker to view any file on the target machine. Original vulnerability found by Luigi Auriemma. Affected Systems: Windows [win32], Netware, OS2, Cygwin.
2ba457a832be506c17d2c9da5e1d72ab
PHP v4.2.0 and 4.2.1 with Apache 1.3.26 POST bug proof of concept exploit for x86. Produces a segmentation violation (signal 11).
58ecc56a105c84c16cacabb2d7b4ba2c
Backdoors Bash-2.05 for local root.
c6edcabbcd0ade055d43a041c42f2c50