ignore security and it'll go away
Showing 26 - 50 of 2,152 RSS Feed

TCP Files

OpenSSH Local Privilege Escalation
Posted Dec 23, 2016
Authored by Jann Horn, Google Security Research

OpenSSH can forward TCP sockets and UNIX domain sockets. If privilege separation is disabled, then on the server side, the forwarding is handled by a child of sshd that has root privileges. For TCP server sockets, sshd explicitly checks whether an attempt is made to bind to a low port (below IPPORT_RESERVED) and, if so, requires the client to authenticate as root. However, for UNIX domain sockets, no such security measures are implemented. This means that, using "ssh -L", an attacker who is permitted to log in as a normal user over SSH can effectively connect to non-abstract unix domain sockets with root privileges. On systems that run systemd, this can for example be exploited by asking systemd to add an LD_PRELOAD environment variable for all following daemon launches and then asking it to restart cron or so. The attached exploit demonstrates this - if it is executed on a system with systemd where the user is allowed to ssh to his own account and where privsep is disabled, it yields a root shell.

tags | exploit, shell, root, tcp
systems | unix
advisories | CVE-2016-10010
MD5 | b93e78906a304aa126934a6c44a6999b
Nmap Port Scanner 7.40
Posted Dec 21, 2016
Authored by Fyodor | Site insecure.org

Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols (UDP, TCP, ICMP, etc.). Nmap supports Vanilla TCP connect() scanning, TCP SYN (half open) scanning, TCP FIN, Xmas, or NULL (stealth) scanning, TCP ftp proxy (bounce attack) scanning, SYN/FIN scanning using IP fragments (bypasses some packet filters), TCP ACK and Window scanning, UDP raw ICMP port unreachable scanning, ICMP scanning (ping-sweep), TCP Ping scanning, Direct (non portmapper) RPC scanning, Remote OS Identification by TCP/IP Fingerprinting, and Reverse-ident scanning. Nmap also supports a number of performance and reliability features such as dynamic delay time calculations, packet timeout and retransmission, parallel port scanning, detection of down hosts via parallel pings.

Changes: Updated the bundled Npcap from 0.10r9 to 0.78r5. Integrated 568 IPv4 OS fingerprint submissions. Integrated 779 service/version fingerprints. Various other updates and features.
tags | tool, remote, udp, tcp, protocol, nmap
systems | unix
MD5 | 1c300c247558e9cf7612e585cf2edfa0
Bettercap 1.5.9
Posted Dec 15, 2016
Authored by evilsocket | Site bettercap.org

BetterCAP is a powerful, flexible, and portable tool created to perform various types of MITM attacks against a network, manipulate HTTP, HTTPS and TCP traffic in realtime, sniff for credentials and much more.

Changes: New --no-http-logs proxy option. New Response#redirect! helper method. Various other features and bug fixes.
tags | tool, web, sniffer, tcp
systems | unix
MD5 | 45dc1892b89449cb25a45c72f3a98d06
Pozzo And Lucky, The Phantom Shell. Stego In TCP/IP Part 2
Posted Dec 12, 2016
Authored by John Torakis

Whitepaper called Pozzo and Lucky, The phantom Shell. Stego in TCP/IP Part 2.

tags | paper, shell, tcp
MD5 | a6c9bb01e06dadec12c647c00cd97767
Windows x64 Bind Shell TCP Shellcode
Posted Dec 8, 2016
Authored by Roziul Hasan Khan Shifat

508 bytes small Windows x64 bind shell TCP shellcode.

tags | shell, tcp, shellcode
systems | windows
MD5 | 88daf8d528993fc1e0347b49202b3b2a
Teaching An Old Dog (Not That New) Tricks - Stego In TCP/IP Made Easy Part 1
Posted Dec 8, 2016
Authored by John Torakis

Whitepaper called Teaching an Old Dog (not that new) Tricks - Stego in TCP/IP made easy (part-1).

tags | paper, tcp
MD5 | 960ed71aa5f4b8c8ae9fbfcff0bbc475
Kernel Live Patch Security Notice LSN-0014-1
Posted Dec 8, 2016
Authored by Luis Henriques

Philip Pettersson discovered a race condition in the af_packet implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial of service (system crash) or run arbitrary code with administrative privileges. Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller driver in the Linux kernel when handling ioctl()s. A local attacker could use this to cause a denial of service (system crash). Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

tags | advisory, denial of service, arbitrary, kernel, local, tcp
systems | linux
advisories | CVE-2016-6480, CVE-2016-6828, CVE-2016-8655
MD5 | c654f261f98e8fb00d15ffa5185aa4a4
Red Hat JBoss EAP 5.2.x Untrusted Data Deserialization
Posted Nov 24, 2016
Authored by Maurizio Agazzini, Federico Dotta

JBoss EAP's JMX Invoker Servlet is exposed by default on port 8080/TCP. The communication employs serialized Java objects, encapsulated in HTTP requests and responses. The server deserializes these objects without checking the object type. This behavior can be exploited to cause a denial of service and potentially execute arbitrary code.

tags | exploit, java, web, denial of service, arbitrary, tcp
advisories | CVE-2016-7065
MD5 | eaea199662dd8fa71b42b12d170d351d
Dlink DIR Routers Unauthenticated HNAP Login Stack Buffer Overflow
Posted Nov 21, 2016
Authored by Pedro Ribeiro | Site metasploit.com

Several Dlink routers contain a pre-authentication stack buffer overflow vulnerability, which is exposed on the LAN interface on port 80. This vulnerability affects the HNAP SOAP protocol, which accepts arbitrarily long strings into certain XML parameters and then copies them into the stack. This exploit has been tested on the real devices DIR-818LW and 868L (rev. B), and it was tested using emulation on the DIR-822, 823, 880, 885, 890 and 895. Others might be affected, and this vulnerability is present in both MIPS and ARM devices. The MIPS devices are powered by Lextra RLX processors, which are crippled MIPS cores lacking a few load and store instructions. Because of this the payloads have to be sent unencoded, which can cause them to fail, although the bind shell seems to work well. For the ARM devices, the inline reverse tcp seems to work best. Check the reference links to see the vulnerable firmware versions.

tags | exploit, overflow, shell, tcp, protocol
advisories | CVE-2016-6563
MD5 | dd3ba90a3c8d9aee1a73c5d68572d159
Linux Kernel TCP Related Read Use-After-Free
Posted Nov 9, 2016
Authored by Marco Grassi

The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option.

tags | exploit, kernel, tcp
systems | linux
advisories | CVE-2016-6828
MD5 | 01fc228e1ee6c5dde13e4bc2c41a84af
Red Hat Security Advisory 2016-2590-02
Posted Nov 4, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-2590-02 - The Dynamic Host Configuration Protocol is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix: A resource-consumption flaw was discovered in the DHCP server. dhcpd did not restrict the number of open connections to OMAPI and failover ports. A remote attacker able to establish TCP connections to one of these ports could use this flaw to cause dhcpd to exit unexpectedly, stop responding requests, or exhaust system sockets.

tags | advisory, remote, tcp, protocol
systems | linux, redhat
advisories | CVE-2016-2774
MD5 | fdc54986e8a172eb32b9e90f1ea0be12
Samhain File Integrity Checker 4.2.0
Posted Nov 1, 2016
Authored by Rainer Wichmann | Site samhain.sourceforge.net

Samhain is a file system integrity checker that can be used as a client/server application for centralized monitoring of networked hosts. Databases and configuration files can be stored on the server. Databases, logs, and config files can be signed for tamper resistance. In addition to forwarding reports to the log server via authenticated TCP/IP connections, several other logging facilities (e-mail, console, and syslog) are available. Tested on Linux, AIX, HP-UX, Unixware, Sun and Solaris.

Changes: Various updates.
tags | tool, tcp, intrusion detection
systems | linux, unix, solaris, aix, hpux, unixware
MD5 | 39f476e7ac4f97fc9e5b0b1da79e121c
Nmap Port Scanner 7.30
Posted Oct 21, 2016
Authored by Fyodor | Site insecure.org

Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols (UDP, TCP, ICMP, etc.). Nmap supports Vanilla TCP connect() scanning, TCP SYN (half open) scanning, TCP FIN, Xmas, or NULL (stealth) scanning, TCP ftp proxy (bounce attack) scanning, SYN/FIN scanning using IP fragments (bypasses some packet filters), TCP ACK and Window scanning, UDP raw ICMP port unreachable scanning, ICMP scanning (ping-sweep), TCP Ping scanning, Direct (non portmapper) RPC scanning, Remote OS Identification by TCP/IP Fingerprinting, and Reverse-ident scanning. Nmap also supports a number of performance and reliability features such as dynamic delay time calculations, packet timeout and retransmission, parallel port scanning, detection of down hosts via parallel pings.

Changes: New service probe and match line for iperf3. Added Drupal to the set of web apps brute forced by http-form-brute. Various other updates and fixes.
tags | tool, remote, udp, tcp, protocol, nmap
systems | unix
MD5 | cba828e3c2cc59d9437f3d786a44a4af
Ubuntu Security Notice USN-3097-2
Posted Oct 14, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3097-2 - Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code in the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Pengfei Wang discovered a race condition in the audit subsystem in the Linux kernel. A local attacker could use this to corrupt audit logs or disrupt system-call auditing. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary, kernel, local, tcp
systems | linux, ubuntu
advisories | CVE-2016-6136, CVE-2016-6480, CVE-2016-6828
MD5 | 5bfc16d8b3a737ef00ff4133ad234e42
Bettercap 1.5.8
Posted Oct 13, 2016
Authored by evilsocket | Site bettercap.org

BetterCAP is a powerful, flexible, and portable tool created to perform various types of MITM attacks against a network, manipulate HTTP, HTTPS and TCP traffic in realtime, sniff for credentials and much more.

Changes: New --log-http-response, --html-file, and --full-duplex options. Various fixes.
tags | tool, web, sniffer, tcp
systems | unix
MD5 | 36da34d5adcfb224dff49bee99847691
Ubuntu Security Notice USN-3099-3
Posted Oct 12, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3099-3 - It was discovered that an unbounded recursion in the VLAN and TEB Generic Receive Offload processing implementations in the Linux kernel, A remote attacker could use this to cause a stack corruption, leading to a denial of service. Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code in the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary, kernel, local, tcp
systems | linux, ubuntu
advisories | CVE-2016-6480, CVE-2016-6828, CVE-2016-7039
MD5 | 0dba9e104afbb1a7d310cf8642437ede
Ubuntu Security Notice USN-3099-4
Posted Oct 12, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3099-4 - It was discovered that an unbounded recursion in the VLAN and TEB Generic Receive Offload processing implementations in the Linux kernel, A remote attacker could use this to cause a stack corruption, leading to a denial of service. Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code in the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary, kernel, local, tcp
systems | linux, ubuntu
advisories | CVE-2016-6480, CVE-2016-6828, CVE-2016-7039
MD5 | 059295b45e6db97ee1690400709c173d
Ubuntu Security Notice USN-3097-1
Posted Oct 12, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3097-1 - Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code in the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Pengfei Wang discovered a race condition in the audit subsystem in the Linux kernel. A local attacker could use this to corrupt audit logs or disrupt system-call auditing. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary, kernel, local, tcp
systems | linux, ubuntu
advisories | CVE-2016-6136, CVE-2016-6480, CVE-2016-6828
MD5 | 705aae2a7f026da93b84be90ba5fc103
Ubuntu Security Notice USN-3098-1
Posted Oct 12, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3098-1 - It was discovered that an unbounded recursion in the VLAN and TEB Generic Receive Offload processing implementations in the Linux kernel, A remote attacker could use this to cause a stack corruption, leading to a denial of service. Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code in the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary, kernel, local, tcp
systems | linux, ubuntu
advisories | CVE-2016-6136, CVE-2016-6480, CVE-2016-6828, CVE-2016-7039
MD5 | f6a6065596ed373a81c7246483b609d2
Ubuntu Security Notice USN-3099-1
Posted Oct 12, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3099-1 - It was discovered that an unbounded recursion in the VLAN and TEB Generic Receive Offload processing implementations in the Linux kernel, A remote attacker could use this to cause a stack corruption, leading to a denial of service. Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code in the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary, kernel, local, tcp
systems | linux, ubuntu
advisories | CVE-2016-6130, CVE-2016-6480, CVE-2016-6828, CVE-2016-7039
MD5 | 8c1bb6d933865d7036eccc1367667395
Nmap Port Scanner 7.30
Posted Oct 2, 2016
Authored by Fyodor | Site insecure.org

Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols (UDP, TCP, ICMP, etc.). Nmap supports Vanilla TCP connect() scanning, TCP SYN (half open) scanning, TCP FIN, Xmas, or NULL (stealth) scanning, TCP ftp proxy (bounce attack) scanning, SYN/FIN scanning using IP fragments (bypasses some packet filters), TCP ACK and Window scanning, UDP raw ICMP port unreachable scanning, ICMP scanning (ping-sweep), TCP Ping scanning, Direct (non portmapper) RPC scanning, Remote OS Identification by TCP/IP Fingerprinting, and Reverse-ident scanning. Nmap also supports a number of performance and reliability features such as dynamic delay time calculations, packet timeout and retransmission, parallel port scanning, detection of down hosts via parallel pings.

Changes: Integrated 12 IPv6 OS fingerprint submissions from June to September. Added 7 NSE scripts, from 3 authors, bringing the total up to 541. New service probes and match lines for DTLS, IPMI-RMCP, MQTT, PCWorx, ProConOS, and Tridium Fox. Various updates and fixes.
tags | tool, remote, udp, tcp, protocol, nmap
systems | unix
MD5 | a46631700c796be1ce24c261c36f46a7
Cisco Security Advisory 20160928-smi
Posted Sep 29, 2016
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - The Smart Install client feature in Cisco IOS and IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a memory leak and eventual denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect handling of image list parameters. An attacker could exploit this vulnerability by sending crafted Smart Install packets to TCP port 4786. A successful exploit could cause a Cisco Catalyst switch to leak memory and eventually reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability other than disabling Smart Install functionality on the affected device.

tags | advisory, remote, denial of service, tcp, memory leak
systems | cisco, osx
MD5 | f4a1186c6866c8953658abc16723759c
Red Hat Security Advisory 2016-1939-01
Posted Sep 27, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1939-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: It was found that the RFC 5961 challenge ACK rate limiting as implemented in the Linux kernel's networking subsystem allowed an off-path attacker to leak certain information about a given connection by creating congestion on the global challenge ACK rate limit counter and then measuring the changes by probing packets. An off-path attacker could use this flaw to either terminate TCP connection and/or inject payload into non-secured TCP connection between two endpoints on the network.

tags | advisory, kernel, tcp
systems | linux, redhat
advisories | CVE-2016-5696
MD5 | a9636eb286bec01bbe5d14ee00037807
Windows x86 Password Protected TCP Bind Shell
Posted Sep 13, 2016
Authored by Roziul Hasan Khan Shifat

637 bytes small Microsoft Windows x86 password protect TCP bind shell shellcode.

tags | shell, x86, tcp, shellcode
systems | windows
MD5 | 44673d888c74d09fc997b10a17a7957e
Windows x86 TCP Bind Shell Shellcode
Posted Sep 8, 2016
Authored by Roziul Hasan Khan Shifat

Microsoft Windows x86 TCP bind shell shellcode.

tags | shell, x86, tcp, shellcode
systems | windows
MD5 | 81ca9b2fe7691f52ad5a45f10902c82e
Page 2 of 87
Back12345Next

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    6 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close