58 bytes small Linux/x86 bind (99999/TCP) netcat traditional (/bin/nc) shell (/bin/bash) shellcode.
f4b8522201682477a5e1e7f645023f2244 bytes small Linux/x86 execve(/bin/cat /etc/ssh/sshd_config) shellcode.
08e75ccaebbd0e64a304144280cd18e9This Metasploit module exploits an elevation of privilege vulnerability that exists in Windows 7 and 2008 R2 when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This Metasploit module is tested against windows 7 x86, windows 7 x64 and windows server 2008 R2 standard x64.
967e04838b302049cc237c549437ccecLinux suffers from a semi-arbitrary task stack read on ARM64 (and x86) via /proc/$pid/stack.
7100e417a396e293988088f73c3b7c3aThis Metasploit module exploits a vulnerability in RSH on unpatched Solaris systems which allows users to gain root privileges. The stack guard page on unpatched Solaris systems is of insufficient size to prevent collisions between the stack and heap memory, aka Stack Clash. This Metasploit module uploads and executes Qualys' Solaris_rsh.c exploit, which exploits a vulnerability in RSH to bypass the stack guard page to write to the stack and create a SUID root shell. This Metasploit module has offsets for Solaris versions 11.1 (x86) and Solaris 11.3 (x86). Exploitation will usually complete within a few minutes using the default number of worker threads (10). Occasionally, exploitation will fail. If the target system is vulnerable, usually re-running the exploit will be successful. This Metasploit module has been tested successfully on Solaris 11.1 (x86) and Solaris 11.3 (x86).
91b277586c77a3c37e33c0ac990f0483This Metasploit module attempts to gain root privileges on QNX 6.4.x and 6.5.x systems by exploiting the ifwatchd suid executable. ifwatchd allows users to specify scripts to execute using the '-A' command line argument; however, it does not drop privileges when executing user-supplied scripts, resulting in execution of arbitrary commands as root. This Metasploit module has been tested successfully on QNX Neutrino 6.5.0 (x86) and 6.5.0 SP1 (x86).
7a562f56fafb417de6cf725f6b38c71d104 bytes small Linux/x86 execve(/bin/sh) + MMX/ROT13/XOR shellcode (encoder/decoder).
91a1c7261b81497074a6cfeffc31630e50 bytes small Linux/x86 execve(/bin/sh) + NOT +SHIFT-N+ XOR-N encoded shellcode.
64b57a9f7a3293afd5379cf96dc5385dThis Metasploit module exploits a directory traversal vulnerability in the dtappgather executable included with Common Desktop Environment (CDE) on unpatched Solaris systems prior to Solaris 10u11 which allows users to gain root privileges. dtappgather allows users to create a user-owned directory at any location on the filesystem using the DTUSERSESSION environment variable. This Metasploit module creates a directory in /usr/lib/locale, writes a shared object to the directory, and runs the specified SUID binary with the shared object loaded using the LC_TIME environment variable. This Metasploit module has been tested successfully on: Solaris 9u7 (09/04) (x86); Solaris 10u1 (01/06) (x86); Solaris 10u2 (06/06) (x86); Solaris 10u4 (08/07) (x86); Solaris 10u8 (10/09) (x86); Solaris 10u9 (09/10) (x86).
f10a9baa72d2639e9298d5dc6fb5e7c227 bytes small Linux/x86 egghunter (0x50905090) + sigaction() shellcode.
98c3b4f85def0478d23b5494b10248c2This Metasploit module exploits an arbitrary file write vulnerability in the Netscape Portable Runtime library (libnspr) on unpatched Solaris systems prior to Solaris 10u3 which allows users to gain root privileges. libnspr versions prior to 4.6.3 allow users to specify a log file with the `NSPR_LOG_FILE` environment variable. The log file is created with the privileges of the running process, resulting in privilege escalation when used in combination with a SUID executable. This Metasploit module writes a shared object to the trusted library directory `/usr/lib/secure` and runs the specified SUID binary with the shared object loaded using the `LD_LIBRARY_PATH` environment variable. This Metasploit module has been tested successfully with libnspr version 4.5.1 on Solaris 10u1 (01/06) (x86) and Solaris 10u2 (06/06) (x86).
0f80a93992c7fdfbc617a2b680a3059e54 bytes small Linux/x86 random bytewise XOR + insertion encoder shellcode.
06349f5063d609d0069f113064a877b799 bytes small Linux/x86 file modification (/etc/hosts) polymorphic shellcode.
b6b68473df8cea8e32cab90f6a2fb2df61 bytes small Linux/x86 read file (/etc/passwd) MSF optimized shellcode.
774bb96e53da0cf6170ece1a360e3be1103 bytes small Linux/x86 add user (r00t/blank) polymorphic shellcode.
688f6c9dd5bbf7d04ce90d82048badff94 bytes small Linux/x86 IPv6 reverse TCP shellcode generator.
56a1d4c121dd1129c1e1128c8a0c5b07Linux/x86 dual network stack (IPv4 and IPv6) bind TCP shellcode.
0dd1f19482e4deabce127fe130413c4aFreeBSD Security Advisory - On certain Intel 64-bit x86 systems there is a period of time during terminal fault handling where the CPU may use speculative execution to try to load data. The CPU may speculatively access the level 1 data cache (L1D). Data which would otherwise be protected may then be determined by using side channel methods. This issue affects bhyve on FreeBSD/amd64 systems. An attacker executing user code, or kernel code inside of a virtual machine, may be able to read secret data from the kernel or from another virtual machine.
d2d8d94bd9c95b68c83e957598d1c85c86 bytes small Linux/x86 reverse TCP (::FFFF:192.168.1.5:4444/TCP) shell (/bin/sh) + null-free + IPv6 shellcode.
841854d50e743d5f6ad22336b8cda687100 bytes small Linux/x86 /bin/sh bindshell IPv6 TCP/4444 shellcode.
0dc31090de755d284bd719ffb52f6db920 bytes small Linux/x86 kill process shellcode.
85b2934d4f610ce119d7650948da097e37 bytes small Linux/x86 execve /bin/cat /etc/passwd shellcode.
4d27f629e415202443486cfadf82494b105 bytes small Linux/x86 bindshell shellcode that spawns on TCP/4444.
843af161ff8f5f667b5b1c61ca684aff38 bytes small Linux/x86 egghunter + access() shellcode.
387772621eb89201ab1a444b0f1cfc2f98 bytes small Linux/x86 TCP/5555 bindshell shellcode.
460b0890fcf26db29390427ea3c1ed44
© 2018 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed