Exploit the possiblities
Showing 1 - 8 of 8 RSS Feed

Files Date: 2018-02-10

glibc '$ORIGIN' Expansion Privilege Escalation
Posted Feb 10, 2018
Authored by Tavis Ormandy, Brendan Coles | Site metasploit.com

This Metasploit module attempts to gain root privileges on Linux systems by abusing a vulnerability in the GNU C Library (glibc) dynamic linker. glibc ld.so in versions before 2.11.3, and 2.12.x before 2.12.2 does not properly restrict use of the LD_AUDIT environment variable when loading setuid executables which allows control over the $ORIGIN library search path resulting in execution of arbitrary shared objects. This Metasploit module opens a file descriptor to the specified suid executable via a hard link, then replaces the hard link with a shared object before instructing the linker to execute the file descriptor, resulting in arbitrary code execution. The specified setuid binary must be readable and located on the same file system partition as the specified writable directory. This Metasploit module has been tested successfully on glibc version 2.5 on CentOS 5.4 (x86_64), 2.5 on CentOS 5.5 (x86_64) and 2.12 on Fedora 13 (i386). RHEL 5 is reportedly affected, but untested. Some versions of ld.so hit a failed assertion in dl_open_worker causing exploitation to fail.

tags | exploit, arbitrary, root, code execution
systems | linux, fedora, centos
advisories | CVE-2010-3847
MD5 | e8b55dc3fe5f3080c962d9dabae028c4
WordPress Bookly Lite 13.2 Cross Site Scripting
Posted Feb 10, 2018
Authored by Luigi Gubello

WordPress Bookly Lite plugin version 13.2 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2018-6891
MD5 | 112e7dd3b55bbb6e67772fd4f3728bd9
glibc LD_AUDIT Arbitrary DSO Load Privilege Escalation
Posted Feb 10, 2018
Authored by Marco Ivaldi, Tavis Ormandy, Todor Donev, zx2c4, Brendan Coles | Site metasploit.com

This Metasploit module attempts to gain root privileges on Linux systems by abusing a vulnerability in the GNU C Library (glibc) dynamic linker. glibc ld.so in versions before 2.11.3, and 2.12.x before 2.12.2 does not properly restrict use of the LD_AUDIT environment variable when loading setuid executables. This allows loading arbitrary shared objects from the trusted library search path with the privileges of the suid user. This Metasploit module uses LD_AUDIT to load the libpcprofile.so shared object, distributed with some versions of glibc, and leverages arbitrary file creation functionality in the library constructor to write a root-owned world-writable file to a system trusted search path (usually /lib). The file is then overwritten with a shared object then loaded with LD_AUDIT resulting in arbitrary code execution. This Metasploit module has been tested successfully on glibc version 2.11.1 on Ubuntu 10.04 x86_64 and version 2.7 on Debian 5.0.4 i386. RHEL 5 is reportedly affected, but untested. Some glibc distributions do not contain the libpcprofile.so library required for successful exploitation.

tags | exploit, arbitrary, root, code execution
systems | linux, debian, ubuntu
advisories | CVE-2010-3847, CVE-2010-3856
MD5 | 2bf9e1106acf9e1f0a7b618fe7f2da3f
Multi Language Olx Clone Script 2.0.7 Cross Site Scripting
Posted Feb 10, 2018
Authored by Varun Bagaria

Multi Language Olx Clone Script version 2.0.6 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2018-6845
MD5 | f5303b02545e56876afd1f56c5992390
Multi Religion Responsive Matrimonial 4.7.2 Cross Site Scripting
Posted Feb 10, 2018
Authored by Prasenjit Kanti Paul

Multi Religion Responsive Matrimonial version 4.7.2 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2018-6864
MD5 | c06076acc62d5cf5cb9cee36808810d2
Select Your College Script 2.0.2 Authentication Bypass
Posted Feb 10, 2018
Authored by Prasenjit Kanti Paul

Select Your College Script version 2.0.2 suffers from an authentication bypass vulnerability.

tags | exploit, bypass
advisories | CVE-2018-6863
MD5 | bba3e3b5a0aff683b276373acd2a7be5
SSLsplit 0.5.2
Posted Feb 10, 2018
Site roe.ch

SSLsplit is a tool for man-in-the-middle attacks against SSL/TLS encrypted network connections. Connections are transparently intercepted through a network address translation engine and redirected to SSLsplit. SSLsplit terminates SSL/TLS and initiates a new SSL/TLS connection to the original destination address, while logging all data transmitted. SSLsplit is intended to be useful for network forensics and penetration testing.

Changes: Add support for SSLv2 ClientHello handshake format for SSLv3/TLS connections and while there, essentially fixing autossl for clients using SSLv2 ClientHello handshake format with SSLv3/TLS. Suppress Upgrade header added in order to prevent upgrading connections to WebSockets or HTTP/2. Various other updates and additions.
tags | tool, encryption
MD5 | 19354e23b46e06b034d15a76a5559baf
DNS Spider Multithreaded Bruteforcer 0.9
Posted Feb 10, 2018
Authored by noptrix | Site noptrix.net

DNS Spider is a multi-threaded bruteforcer of subdomains that leverages a wordlist and/or character permutation.

Changes: Uses async multithreading via concurrent.futures module. Logs only the subdomains to logfile when '-r' was chosen. Various other updates.
tags | tool, scanner
systems | unix
MD5 | ff8421ed941c7dcad43b91be5cad4007
Page 1 of 1
Back1Next

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

February 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    15 Files
  • 2
    Feb 2nd
    15 Files
  • 3
    Feb 3rd
    15 Files
  • 4
    Feb 4th
    13 Files
  • 5
    Feb 5th
    16 Files
  • 6
    Feb 6th
    15 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    15 Files
  • 9
    Feb 9th
    18 Files
  • 10
    Feb 10th
    8 Files
  • 11
    Feb 11th
    8 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    15 Files
  • 14
    Feb 14th
    15 Files
  • 15
    Feb 15th
    17 Files
  • 16
    Feb 16th
    18 Files
  • 17
    Feb 17th
    37 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close