Ubuntu 18.04 – ‘lxd’ Privilege Escalation
#!/usr/bin/env bash
local
local 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Microsoft Windows – AppX Deployment Service Local Privilege Escalation (3)
CVE-2019-0841 BYPASS #2
VMware WorkStation 12.5.3 – Virtual Machine Escape
# VMware Escape Exploit
Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution
Vim/Neovim Arbitrary Code Execution via Modelines
DVD X Player 5.5 Pro – Local Buffer Overflow (SEH)
# Exploit Title: DVDXPlayer 5.5 Pro Local Buffer Overflow with SEH
Nvidia GeForce Experience Web Helper – Command Injection
Press CTRL+V+Enter
EquityPandit 1.0 – Password Disclosure
#Exploit title: EquityPandit v1.0 - Insecure Logging
Axessh 4.2 – ‘Log file name’ Local Stack-based Buffer Overflow
# Title: Axessh 4.2 - 'Log file name' Local Stack-based Buffer Overflow
Microsoft Windows – AppX Deployment Service Local Privilege Escalation (2)
There is still a vuln in the code triggered by CVE-2019-0841
Microsoft Windows 10 (17763.379) – Install DLL
edit: Figure out how this works for yourself. I can't be bothered. It's a really hard race, doubt anyone will be able...
Microsoft Windows 10 1809 – ‘CmKeyBodyRemapToVirtualForEnum’ Arbitrary Key Enumeration Privilege Escalation
Windows: CmKeyBodyRemapToVirtualForEnum Arbitrary Key Enumeration EoP
Microsoft Internet Explorer 11 – Sandbox Escape
Inject into IE11.
Microsoft Windows (x86) – Task Scheduler’ .job’ Import Arbitrary Discretionary Access Control List Write / Local Privilege Escalation
Task Scheduler .job import arbitrary DACL write
Microsoft Windows (x86/x64) – ‘Error Reporting’ Discretionary Access Control List / Local Privilege Escalation
EDIT: Apparently this was patched earlier this month.. so whatever.
Huawei eSpace 1.1.11.103 – DLL Hijacking
Huawei eSpace Desktop DLL Hijacking Vulnerability
Iperius Backup 6.1.0 – Privilege Escalation
Exploit Author: bzyo
JetAudio jetCast Server 2.0 – ‘Log Directory’ Local SEH Alphanumeric Encoded Buffer Overflow
# Title: JetAudio jetCast Server 2.0 'Log Directory' Local SEH Alphanumeric Encoded Buffer Overflow
VMware Workstation 15.1.0 – DLL Hijacking
#---------------------------------------------------------
Microsoft Windows – ‘Win32k’ Local Privilege Escalation
# CVE-2019-0803
MiniFtp – ‘parseconf_load_setting’ Buffer Overflow
# Exploit Title: MiniFtp parseconf_load_setting local-bufferoverflow (318 bytes)
Admin Express 1.2.5.485 – ‘Folder Path’ Local SEH Alphanumeric Encoded Buffer Overflow
# Title: Admin Express v1.2.5.485 'Folder Path' Local SEH Alphanumeric Encoded Buffer Overflow
NSClient++ 0.5.2.35 – Privilege Escalation
Exploit Author: bzyo
DeviceViewer 3.12.0.1 – ‘user’ SEH Overflow
# Exploit Title: DeviceViewer v3.12.0.1 username field SEH overflow (PoC)
Lavavo CD Ripper 4.20 – ‘License Activation Name’ Buffer Overflow (SEH)
# Exploit Title: Lavavo CD Ripper 4.20 Local Seh Exploit
VirtualBox 6.0.4 r128413 – COM RPC Interface Code Injection Host Privilege Escalation
VirtualBox: COM RPC Interface Code Injection Host EoP
Ross Video DashBoard 8.5.1 – Insecure Permissions
Ross Video DashBoard 8.5.1 Insecure Permissions
LabF nfsAxe 3.7 Ping Client – ‘Host IP’ Buffer Overflow (Direct Ret)
#!/usr/bin/python
Evernote 7.9 – Code Execution via Path Traversal
Exploit Title: Code execution via path traversal
Microsoft Windows 10 1809 – LUAFV PostLuafvPostReadWrite SECTION_OBJECT_POINTERS Race Condition Privilege Escalation
Windows: LUAFV PostLuafvPostReadWrite SECTION_OBJECT_POINTERS Race Condition EoP
Microsoft Windows 10 1809 – LUAFV Delayed Virtualization Cache Manager Poisoning Privilege Escalation
Windows: LUAFV Delayed Virtualization Cache Manager Poisoning EoP
Microsoft Windows 10 1809 – LUAFV NtSetCachedSigningLevel Device Guard Bypass
Windows: LUAFV NtSetCachedSigningLevel Device Guard Bypass
Microsoft Windows 10 1809 – LUAFV LuafvCopyShortName Arbitrary Short Name Privilege Escalation
Windows: LUAFV LuafvCopyShortName Arbitrary Short Name EoP
Microsoft Windows 10 1809 – LUAFV Delayed Virtualization Cross Process Handle Duplication Privilege Escalation
Windows: LUAFV Delayed Virtualization Cross Process Handle Duplication EoP
Microsoft Windows 10 1809 – LUAFV Delayed Virtualization MAXIMUM_ACCESS DesiredAccess Privilege Escalation
Windows: LUAFV Delayed Virtualization MAXIMUM_ACCESS DesiredAccess EoP
Microsoft Windows 10 1809 / 1709 – CSRSS SxSSrv Cached Manifest Privilege Escalation
Windows: CSRSS SxSSrv Cached Manifest EoP
Zoho ManageEngine ADManager Plus 6.6 (Build < 6659) - Privilege Escalation
# Exploit Title: Zoho ManageEngine ADManager Plus 6.6 (Build < 6659) Privilege Escalation
Microsoft Internet Explorer 11 – XML External Entity Injection
[+] Credits: John Page (aka hyp3rlinx)
CyberArk EPM 10.2.1.603 – Security Restrictions Bypass
# Exploit Title: CyberArk Endpoint bypass
FTPShell Server 6.83 – ‘Virtual Path Mapping’ Local Buffer
#!/usr/bin/python
FTPShell Server 6.83 – ‘Account name to ban’ Local Buffer
#!/usr/bin/python
Microsoft Windows – AppX Deployment Service Privilege Escalation
This vulnerability allows low privileged users to hijack file that are owned by NT AUTHORITY\SYSTEM by overwriting pe...