Exploit the possiblities
Showing 1 - 25 of 2,561 RSS Feed

Shell Files

Gentoo Linux Security Advisory 201711-16
Posted Nov 20, 2017
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201711-16 - Multiple vulnerabilities have been found in CouchDB, the worst of which could lead to the remote execution of arbitrary shell commands. Versions less than 1.7.1 are affected.

tags | advisory, remote, arbitrary, shell, vulnerability
systems | linux, gentoo
advisories | CVE-2017-12635, CVE-2017-12636
MD5 | a083aed437a012f431a19805566e8eaa
CoolPlayer+ Portable 2.19.6 Stack Overflow
Posted Nov 6, 2017
Authored by 1N3

CoolPlayer+ Portable version 2.19.6 stack overflow exploit with ASLR bypass and a bind shell.

tags | exploit, overflow, shell
MD5 | 7aaf5691cd3da9557d896e0e81599b4f
Oracle Java SE Wv8u131 Information Disclosure
Posted Nov 2, 2017
Authored by mr_me

Oracle Java SE installs a protocol handler in the registry as "HKEY_CLASSES_ROOT\jnlp\Shell\Open\Command\Default" 'C:\Program Files\Java\jre1.8.0_131\bin\jp2launcher.exe" -securejws "%1"'. This can allow allow an attacker to launch remote jnlp files with little user interaction. A malicious jnlp file containing a crafted XML XXE attack can be leveraged to disclose files, cause a denial of service or trigger SSRF. Versions v8u131 and below are affected.

tags | exploit, java, remote, denial of service, shell, registry, protocol, info disclosure
advisories | CVE-2017-10309
MD5 | 1e5c74e4370cfb11bd675efce53eb688
Debian Security Advisory 4009-1
Posted Nov 1, 2017
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4009-1 - Niklas Abel discovered that insufficient input sanitising in the the ss-manager component of shadowsocks-libev, a lightweight socks5 proxy, could result in arbitrary shell command execution.

tags | advisory, arbitrary, shell
systems | linux, debian
advisories | CVE-2017-15924
MD5 | f7d370565938725f8e57e51913e2916c
Gentoo Linux Security Advisory 201710-29
Posted Oct 29, 2017
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201710-29 - Multiple vulnerabilities have been found in Asterisk, the worst of which allows remote execution of arbitrary shell commands. Versions less than 11.25.3 are affected.

tags | advisory, remote, arbitrary, shell, vulnerability
systems | linux, gentoo
advisories | CVE-2017-14098, CVE-2017-14099, CVE-2017-14100, CVE-2017-14603
MD5 | dc6664f1f4febce3a1ec19be4fbf4607
Infoblox NetMRI VM-AD30-5C6CE Factory Reset Persistence
Posted Oct 25, 2017
Authored by Matthew Bergin | Site korelogic.com

Infoblox NetMRI version VM-AD30-5C6CE suffers from an administration shell factory reset persistence vulnerability.

tags | exploit, shell
MD5 | 3d645a515c1de250781ae9cab7fd9d5c
Infoblox NetMRI 7.1.4 Shell Escape / Privilege Escalation
Posted Oct 25, 2017
Authored by Hank Leininger, Matthew Bergin | Site korelogic.com

Infoblox NetMRI versions 7.1.2 through 7.1.4 suffer from administration shell escape and privilege escalation vulnerabilities.

tags | exploit, shell, vulnerability
MD5 | b723ed326bd04aa156050b80d0b7a39f
osTicket 1.10.1 Shell Upload
Posted Oct 25, 2017
Authored by Rajwinder Singh

osTicket version 1.10.1 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell
advisories | CVE-2017-15580
MD5 | 91d3007b10106697abc4881dc25ab268
Polycom Command Shell Authorization Bypass
Posted Oct 21, 2017
Authored by Paul Haas, h00die | Site metasploit.com

The login component of the Polycom Command Shell on Polycom HDX video endpoints, running software versions 3.0.5 and earlier, is vulnerable to an authorization bypass when simultaneous connections are made to the service, allowing remote network attackers to gain access to a sandboxed telnet prompt without authentication. Versions prior to 3.0.4 contain OS command injection in the ping command which can be used to execute arbitrary commands as root.

tags | exploit, remote, arbitrary, shell, root
MD5 | 19e483d20fd0e5d1252e6caf45e27fba
TP-Link WR940N Remote Code Execution
Posted Oct 21, 2017
Authored by Tim Carrington | Site fidusinfosec.com

Numerous remote code execution paths were discovered in TP-Link's WR940N home WiFi router. Valid credentials are required for this attack path. It is possible for an authenticated attacker to obtain a remote shell with root privileges.

tags | exploit, remote, shell, root, code execution
advisories | CVE-2017-13772
MD5 | 6bceaa1fe350d1c27550d6f8f857b131
Afian AB FileRun 2017.03.18 CSRF / Shell Upload / XSS / Redirection
Posted Oct 17, 2017
Authored by Roman Ferdigg | Site sec-consult.com

Afian AB FileRun version 2017.03.18 suffers from cross site request forgery, cross site scripting, open redirection, remote shell upload, and various other vulnerabilities.

tags | exploit, remote, shell, vulnerability, xss, csrf
MD5 | 3ff1edbfd9d2d8fe8f706e14236d4010
Windows Escalate UAC Protection Bypass (In Memory Injection) Abusing WinSXS
Posted Oct 12, 2017
Authored by Ernesto Fernandez | Site metasploit.com

This Metasploit module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off by abusing the way "WinSxS" works in Windows systems. This Metasploit module uses the Reflective DLL Injection technique to drop only the DLL payload binary instead of three separate binaries in the standard technique. However, it requires the correct architecture to be selected, (use x64 for SYSWOW64 systems also).

tags | exploit, shell
systems | windows
MD5 | 168e1d24d366b109430b6a8f6c85ad79
Ubuntu Security Notice USN-3438-1
Posted Oct 5, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3438-1 - It was discovered that Git incorrectly handled certain subcommands such as cvsserver. A remote attacker could possibly use this issue via shell metacharacters in modules names to execute arbitrary code. This update also removes the cvsserver subcommand from git-shell by default.

tags | advisory, remote, arbitrary, shell
systems | linux, ubuntu
advisories | CVE-2017-14867
MD5 | dceb7916acf33e0993fb0e947b68f140
Qmail SMTP Bash Environment Variable Injection (Shellshock)
Posted Sep 29, 2017
Authored by Kyle George, Gabriel Follon, Mario Ledo | Site metasploit.com

This Metasploit module exploits a shellshock vulnerability on Qmail, a public domain MTA written in C that runs on Unix systems. Due to the lack of validation on the MAIL FROM field, it is possible to execute shell code on a system with a vulnerable BASH (Shellshock). This flaw works on the latest Qmail versions (qmail-1.03 and netqmail-1.06). However, in order to execute code, /bin/sh has to be linked to bash (usually default configuration) and a valid recipient must be set on the RCPT TO field (usually admin@exampledomain.com). The exploit does not work on the "qmailrocks" community version as it ensures the MAILFROM field is well-formed.

tags | exploit, shell, bash
systems | unix
advisories | CVE-2014-6271
MD5 | e886215786e8070f396bf10bc995a777
PhpCollab 2.5.1 Shell Upload
Posted Sep 29, 2017
Authored by Nicolas Serra

PhpCollab versions 2.5.1 and below suffer from a remote shell upload vulnerability.

tags | exploit, remote, shell
advisories | CVE-2017-6090
MD5 | 27220dc23bb2abac37e991a03abd8894
UCOPIA Wireless Appliance Restricted Shell Escape
Posted Sep 29, 2017
Authored by Nicolas Chatelain

UCOPIA Wireless Appliance version prior to 5.1.8 suffer from a restricted shell escape vulnerability.

tags | exploit, shell
advisories | CVE-2017-11321
MD5 | d7ec758fffa0347a2564b5cb077d8709
Debian Security Advisory 3984-1
Posted Sep 28, 2017
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3984-1 - joernchen discovered that the git-cvsserver subcommand of Git, a distributed version control system, suffers from a shell command injection vulnerability due to unsafe use of the Perl backtick operator. The git-cvsserver subcommand is reachable from the git-shell subcommand even if CVS support has not been configured (however, the git-cvs package needs to be installed).

tags | advisory, shell, perl
systems | linux, debian
MD5 | 98463fb673a8ecb102e3ba8022adf3af
FLIR Systems FLIR Thermal Camera FC-S/PT Authenticated OS Command Injection
Posted Sep 25, 2017
Authored by LiquidWorm | Site zeroscience.mk

FLIR FC-S/PT series suffer from an authenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user.

tags | exploit, arbitrary, shell, root
MD5 | 636a089048b47449c889902485301766
Supervisor XML-RPC Authenticated Remote Code Execution
Posted Sep 25, 2017
Authored by Calum Hutton | Site metasploit.com

This Metasploit module exploits a vulnerability in the Supervisor process control software, where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root. This vulnerability can only be exploited by an authenticated client, or if supervisord has been configured to run an HTTP server without authentication. This vulnerability affects versions 3.0a1 to 3.3.2.

tags | exploit, web, arbitrary, shell, root
advisories | CVE-2017-11610
MD5 | 72e2b4eea477f27f5a652ee4327d9755
DlxSpot Shell Upload
Posted Sep 19, 2017
Authored by Simon Brannstrom

DlxSpot Player4 LED video wall suffers from a remote shell upload vulnerability. Versions greater than 1.5.10 are affected.

tags | exploit, remote, shell
advisories | CVE-2017-12928, CVE-2017-12929, CVE-2017-12930
MD5 | 9af7a881088ecdf7ad4e03ae9466faeb
Aerohive Networks HiveManager Remote Shell Upload
Posted Sep 8, 2017
Authored by Sandro Zaccarini

Aerohive Networks HiveManager Classic Online NMS suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell
advisories | CVE-2017-14105
MD5 | c7a05d84a6ceaa5379e1b1bb8508ce38
SOA - School Management System 3.0 Shell Upload
Posted Sep 2, 2017
Authored by Ali BawazeEer

SOA - School Management System version 3.0 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell
MD5 | 2fe2cdfd6210b32a06189f8002f9cb10
Asterisk Project Security Advisory - AST-2017-006
Posted Aug 31, 2017
Authored by Richard Mudgett, Corey Farrell | Site asterisk.org

Asterisk Project Security Advisory - The app_minivm module has an externnotify program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.

tags | advisory, arbitrary, shell
MD5 | 748567bf154dce3a594d7969b1e1b697
Linux/x86-64 Reverse TCP Shell Shellcode
Posted Aug 21, 2017
Authored by Touhid M.Shaikh

153 bytes small Linux/x86-64 reverse TCP shell shellcode that binds to 192.168.1.2:4444.

tags | shell, x86, tcp, shellcode
systems | linux
MD5 | 61d0bff1874dee43bdda29cd1ada3ad1
Red Hat Security Advisory 2017-2491-01
Posted Aug 18, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-2491-01 - Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection. Security Fix: A shell command injection flaw related to the handling of "ssh" URLs has been discovered in Git. An attacker could use this flaw to execute shell commands with the privileges of the user running the Git client, for example, when performing a "clone" action on a malicious repository or a legitimate repository containing a malicious commit.

tags | advisory, shell
systems | linux, redhat
advisories | CVE-2017-1000117, CVE-2017-8386
MD5 | 2f87d3f7e18f8ea1608c332b3ef8877c
Page 1 of 103
Back12345Next

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    19 Files
  • 18
    Nov 18th
    4 Files
  • 19
    Nov 19th
    2 Files
  • 20
    Nov 20th
    9 Files
  • 21
    Nov 21st
    15 Files
  • 22
    Nov 22nd
    23 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close