Twenty Year Anniversary
Showing 1 - 25 of 3,098 RSS Feed

Root Files

Solaris libnspr NSPR_LOG_FILE Privilege Escalation
Posted Sep 18, 2018
Authored by Marco Ivaldi, Brendan Coles | Site

This Metasploit module exploits an arbitrary file write vulnerability in the Netscape Portable Runtime library (libnspr) on unpatched Solaris systems prior to Solaris 10u3 which allows users to gain root privileges. libnspr versions prior to 4.6.3 allow users to specify a log file with the `NSPR_LOG_FILE` environment variable. The log file is created with the privileges of the running process, resulting in privilege escalation when used in combination with a SUID executable. This Metasploit module writes a shared object to the trusted library directory `/usr/lib/secure` and runs the specified SUID binary with the shared object loaded using the `LD_LIBRARY_PATH` environment variable. This Metasploit module has been tested successfully with libnspr version 4.5.1 on Solaris 10u1 (01/06) (x86) and Solaris 10u2 (06/06) (x86).

tags | exploit, arbitrary, x86, root
systems | solaris
advisories | CVE-2006-4842
MD5 | 0f80a93992c7fdfbc617a2b680a3059e
HiScout GRC Suite File Upload
Posted Sep 13, 2018
Authored by Sebastian Auwaerter

HiScout GRC Suite versions prior to 3.1.5 suffer from a file upload vulnerability. An authenticated attacker with the permission to edit or add a "WebSiteElement" to the "content" pages is able to upload any file with any file extension to the data directory of the application. This directory is in the web root and the uploaded file is executed on the server if ".aspx" is chosen as the file extension and if the file contains aspx source code. Any commands can be executed with the permissions of the web server user on the server by exploiting this vulnerability.

tags | exploit, web, root, file upload
advisories | CVE-2018-16796
MD5 | a35fd22828c02d235e1b374dd87de2af
Network Manager VPNC Username Privilege Escalation
Posted Aug 31, 2018
Authored by Brendan Coles, Denis Andzakovic | Site

This Metasploit module exploits an injection vulnerability in the Network Manager VPNC plugin to gain root privileges. This Metasploit module uses a new line injection vulnerability in the configured username for a VPN network connection to inject a `Password helper` configuration directive into the connection configuration. The specified helper is executed by Network Manager as root when the connection is started. Network Manager VPNC versions prior to 1.2.6 are vulnerable. This Metasploit module has been tested successfully with VPNC versions: 1.2.4-4 on Debian 9.0.0 (x64); and 1.1.93-1 on Ubuntu Linux 16.04.4 (x64).

tags | exploit, root
systems | linux, debian, ubuntu
advisories | CVE-2018-10900
MD5 | 37f40fef98e4c4b4a836d2e93622bc7f
Mandos Encrypted File System Unattended Reboot Utility 1.7.20
Posted Aug 20, 2018
Authored by Teddy | Site

The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.

Changes: Various updates.
tags | tool, remote, root
systems | linux, unix
MD5 | 0bba68e11c8427696515793eaef2d6cc
Linux/x64 Add Root User (toor/toor) Shellcode
Posted Aug 13, 2018
Authored by epi

99 bytes small Linux/x64 add root user (toor/toor) shellcode.

tags | root, shellcode
systems | linux
MD5 | 9775537f5f6c148127aac7a712b5fdbb
Linux Kernel UDP Fragmentation Offset (UFO) Privilege Escalation
Posted Aug 3, 2018
Authored by h00die, Brendan Coles, Andrey Konovalov | Site

This Metasploit module attempts to gain root privileges on Linux systems by abusing UDP Fragmentation Offload (UFO). This exploit targets only systems using Ubuntu (Trusty / Xenial) kernels 4.4.0-21 <= 4.4.0-89 and 4.8.0-34 <= 4.8.0-58, including Linux distros based on Ubuntu, such as Linux Mint. The target system must have unprivileged user namespaces enabled and SMAP disabled. Bypasses for SMEP and KASLR are included. Failed exploitation may crash the kernel. This Metasploit module has been tested successfully on various Ubuntu and Linux Mint systems, including: Ubuntu 14.04.5 4.4.0-31-generic x64 Desktop; Ubuntu 16.04 4.8.0-53-generic; Linux Mint 17.3 4.4.0-89-generic; Linux Mint 18 4.8.0-58-generic

tags | exploit, kernel, root, udp
systems | linux, ubuntu
advisories | CVE-2017-1000112
MD5 | 365cc8e31e8378f416a359810066fcda
Sun Solaris 11.3 AVS Local Kernel Root
Posted Aug 2, 2018
Authored by mu-b

Sun Solaris versions 10 and 11.3 and below local kernel root exploit.

tags | exploit, kernel, local, root
systems | solaris
advisories | CVE-2018-2892
MD5 | e87115e82276d32408f82a68e1b2de6f
SecureSphere SealMode Shell Escape
Posted Aug 2, 2018
Authored by 0x09AL | Site

This Metasploit module exploits a vulnerability in SecureSphere cli to escape the sealed-mode of Imperva and execute code as the root user. This Metasploit module requires credentials of a user to login to the SSH or can be exploited by a less privileged user.

tags | exploit, root
MD5 | dc4e5753e6a22352b8fc80287a6a39a8
CoSoSys Endpoint Protector Remote Root Command Injection
Posted Aug 2, 2018
Authored by 0x09AL

CoSoSys Endpoint Protector version suffers from an authenticated remote root command injection vulnerability.

tags | exploit, remote, root
MD5 | 55e44da31aa68dc41af25b68ebbeb0bb
Charles Proxy 4.2 Local Root Privilege Escalation
Posted Jul 30, 2018
Authored by Mark Wadham

Charles Proxy version 4.2 suffers from a local root privilege escalation vulnerability.

tags | exploit, local, root
advisories | CVE-2017-15358
MD5 | 96d52f648a1dd6a9a475dd5d37ec6868
Axis Network Camera Remote Command Execution
Posted Jul 26, 2018
Authored by sinn3r, Chris Lee, wvu, Matthew Kienow, Or Peles, Jacob Robles, Shelby Pace, Cale Black, Brent Cook | Site

This Metasploit module exploits an authentication bypass in .srv functionality and a command injection in parhand to execute code as the root user.

tags | exploit, root
advisories | CVE-2018-10660, CVE-2018-10661, CVE-2018-10662
MD5 | 66359d0727b130b0477a2848942c2518
Debian Security Advisory 4253-1
Posted Jul 23, 2018
Authored by Debian | Site

Debian Linux Security Advisory 4253-1 - Denis Andzakovic discovered that network-manager-vpnc, a plugin to provide VPNC support for NetworkManager, is prone to a privilege escalation vulnerability. A newline character can be used to inject a Password helper parameter into the configuration data passed to vpnc, allowing a local user with privileges to modify a system connection to execute arbitrary commands as root.

tags | advisory, arbitrary, local, root
systems | linux, debian
advisories | CVE-2018-10900
MD5 | f2b2e08caa80832ea6c4dd74046f2fe7
Protecting Apps Against Jailbreaking And Rooting
Posted Jul 23, 2018
Authored by Haboob Team

Whitepaper called Protecting Apps Against Jailbreaking And Rooting. Written in Arabic.

tags | paper, root
MD5 | d3a4658f89d1a4cec29023fc05fc7223
Microhard Systems 3G/4G Cellular Ethernet And Serial Gateway Backdoor Jailbreak
Posted Jul 16, 2018
Authored by LiquidWorm | Site

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway systems have a web shell application that includes a service called Microhard Sh that is documented only as 'reserved for internal use'. This service can be enabled by an authenticated user within the Services menu in the web admin panel. This can also be enabled via CSRF attack. When the service is enabled, a user 'msshc' is created on the system with password 'msshc' for SSH shell access on port 22. When connected, the user is dropped into a NcFTP jailed environment, that has limited commands for file transfer administration. One of the commands is a custom added 'ping' command that has a command injection vulnerability that allows the attacker to escape the restricted environment and enter into a root shell terminal that can execute commands as the root user. Many versions are affected.

tags | exploit, web, shell, root
MD5 | 3679d738983dec17aa3243aa408c3212
Microhard Systems 3G/4G Cellular Ethernet And Serial Gateway Remote Root
Posted Jul 16, 2018
Authored by LiquidWorm | Site

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway systems suffer from multiple authenticated arbitrary remote code execution vulnerabilities with highest privileges. This is due to multiple hidden and undocumented features within the admin interface that allows an attacker to create crontab jobs and/or modify the system startup script that allows execution of arbitrary code as root user. Many versions are affected.

tags | exploit, remote, arbitrary, root, vulnerability, code execution
MD5 | 21e4fe6dfbdca8fc7b0eeebde7b04dd1
Microhard Systems 3G/4G Cellular Ethernet And Serial Gateway Default Credentials
Posted Jul 16, 2018
Authored by LiquidWorm | Site

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway systems utilize hard-coded credentials within its Linux distribution image. These sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the gateway. Another vulnerability could allow an authenticated attacker to gain root access. The vulnerability is due to default credentials. An attacker could exploit this vulnerability by logging in using the default credentials. Many versions are affected.

tags | exploit, root
systems | linux
MD5 | 4e3004d8f3c50bedebecb9cbb12651ff
Ubuntu Security Notice USN-3716-1
Posted Jul 12, 2018
Authored by Ubuntu | Site

Ubuntu Security Notice 3716-1 - This update adds the latest DNSSEC validation trust anchor required for the upcoming Root Zone KSK Rollover.

tags | advisory, root
systems | linux, ubuntu
MD5 | 313171cab8d2270f41c28916b6501e47
Ubuntu Security Notice USN-3715-1
Posted Jul 12, 2018
Authored by Ubuntu | Site

Ubuntu Security Notice 3715-1 - This update adds the latest DNSSEC validation trust anchor required for the upcoming Root Zone KSK Rollover and refreshes the list of root hints.

tags | advisory, root
systems | linux, ubuntu
MD5 | 7b2a6c35406bb911afd0cff37bc8cfda
IBM QRadar SIEM Unauthenticated Remote Code Execution
Posted Jul 11, 2018
Authored by Pedro Ribeiro | Site

IBM QRadar SIEM has three vulnerabilities in the Forensics web application that when chained together allow an attacker to achieve unauthenticated remote code execution. The first stage bypasses authentication by fixating session cookies. The second stage uses those authenticated sessions cookies to write a file to disk and execute that file as the "nobody" user. The third and final stage occurs when the file executed as "nobody" writes an entry into the database that causes QRadar to execute a shell script controlled by the attacker as root within the next minute. Details about these vulnerabilities can be found in the advisories listed in References. The Forensics web application is disabled in QRadar Community Edition, but the code still works, so these vulnerabilities can be exploited in all flavors of QRadar. This Metasploit module was tested with IBM QRadar CE 7.3.0 and 7.3.1. IBM has confirmed versions up to 7.2.8 patch 12 and 7.3.1 patch 3 are vulnerable. Due to payload constraints, this module only runs a generic/shell_reverse_tcp payload.

tags | exploit, remote, web, shell, root, vulnerability, code execution
advisories | CVE-2016-9722, CVE-2018-1418, CVE-2018-1612
MD5 | 221b05c8f4d9bb44521c8ebfe10f771d
Debian Security Advisory 4242-1
Posted Jul 9, 2018
Authored by Debian | Site

Debian Linux Security Advisory 4242-1 - Orange Tsai discovered a path traversal flaw in ruby-sprockets, a Rack-based asset packaging system. A remote attacker can take advantage of this flaw to read arbitrary files outside an application's root directory via specially crafted requests, when the Sprockets server is used in production.

tags | advisory, remote, arbitrary, root, ruby
systems | linux, debian
advisories | CVE-2018-3760
MD5 | 106d6b21a5ae2a721cddf96019f8467d
HP VAN SDN Controller Root Command Injection
Posted Jul 7, 2018
Authored by Matthew Bergin, wvu | Site

This Metasploit module exploits a hardcoded service token or default credentials in HPE VAN SDN Controller versions and below to execute a payload as root. A root command injection was discovered in the uninstall action's name parameter, obviating the need to use sudo for privilege escalation. If the service token option TOKEN is blank, USERNAME and PASSWORD will be used for authentication. An additional login request will be sent.

tags | exploit, root
MD5 | eec355d89388bd58e1fea9ab22452024
RSA Identity Governance And Lifecycle Uncontrolled Search Path
Posted Jul 5, 2018

RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system. Many versions are affected and are listed in this advisory.

tags | advisory, local, root
advisories | CVE-2018-11049
MD5 | c9abebdfa165d45d25739fa25d9e128c
ADB Local Root Jailbreak
Posted Jul 4, 2018
Authored by Johannes Greil | Site

ADB broadband gateways and routers suffer from a local root jailbreak vulnerability via a network file sharing flaw. Versions affected include ADB P.RG AV4202N, DV2210, VV2220, and VV5522.

tags | exploit, local, root
advisories | CVE-2018-13108
MD5 | e1b1a79ae21d1cb9f872306500296cf4
Geutebruck simple_loglistjs.cgi Remote Command Execution
Posted Jul 2, 2018
Authored by Davy Douhine, Nicolas Mattiocco | Site

This Metasploit module exploits a an arbitrary command execution vulnerability. The vulnerability exists in the /uapi-cgi/viewer/simple_loglistjs.cgi page and allows an anonymous user to execute arbitrary commands with root privileges. Firmware <= are concerned. Tested on 5.02024 G-Cam/EFD-2250 running firmware.

tags | exploit, arbitrary, cgi, root
advisories | CVE-2018-7520
MD5 | 3c493d70dda3e9875442ed78bc1db5d8
Nagios XI Chained Remote Code Execution
Posted Jun 29, 2018
Authored by Benny Husted, Cale Smith, Jared Arave | Site

This Metasploit module exploits a few different vulnerabilities in Nagios XI 5.2.6-5.4.12 to gain remote root access. The steps are: 1. Issue a POST request to /nagiosql/admin/settings.php which sets the database user to root. 2. SQLi on /nagiosql/admin/helpedit.php allows us to enumerate API keys. 3. The API keys are then used to add an administrative user. 4. An authenticated session is established with the newly added user 5. Command Injection on /nagiosxi/backend/index.php allows us to execute the payload with nopasswd sudo, giving us a root shell. 6. Remove the added admin user and reset the database user.

tags | exploit, remote, shell, root, php, vulnerability
advisories | CVE-2018-8733, CVE-2018-8734, CVE-2018-8735, CVE-2018-8736
MD5 | f275b1da0c15a7e7e5fae8036578d5d8
Page 1 of 124

File Archive:

September 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    3 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    18 Files
  • 6
    Sep 6th
    18 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    2 Files
  • 9
    Sep 9th
    2 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    17 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    29 Files
  • 14
    Sep 14th
    21 Files
  • 15
    Sep 15th
    3 Files
  • 16
    Sep 16th
    1 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    16 Files
  • 19
    Sep 19th
    29 Files
  • 20
    Sep 20th
    18 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2018 Packet Storm. All rights reserved.

Security Services
Hosting By