Microsoft Windows Subsystem for Linux – ‘execve()’ Local Privilege Escalation
#define _GNU_SOURCE
local
local 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Hotspot Shield – Information Disclosure
## Vulnerability Summary
System Shield 5.0.0.136 – Privilege Escalation
Exploit Title - System Shield AntiVirus & AntiSpyware Arbitrary Write Privilege Escalation
systemd (systemd-tmpfiles) < 236 - 'fs.protected_hardlinks=0' Local Privilege Escalation
Product: systemd (systemd-tmpfiles)
Arq 5.10 – Local Privilege Escalation (2)
#!/bin/bash
Arq 5.10 – Local Privilege Escalation (1)
#!/usr/bin/env ruby
Sony Playstation 3 (PS3) 4.82 – ‘Jailbreak’ (ROP)
EDB Note ~ http://ps3xploit.com/help/dumper.html
Oracle VirtualBox < 5.1.30 / < 5.2-rc1 - Guest to Host Escape
# SSD Advisory – Oracle VirtualBox Multiple Guest to Host Escape Vulnerabilities
Blizzard Update Agent – JSON RPC DNS Rebinding
All blizzard games are installed alongside a shared tool called "Blizzard Update Agent", investor.activision.com clai...
HP Connected Backup 8.6/8.8.6 – Local Privilege Escalation
#Tested on HP Connected Backup version 8.8.2.0 on Windows 7 x64
glibc < 2.26 - 'getcwd()' Local Privilege Escalation
#define _GNU_SOURCE
Jungo Windriver 12.5.1 – Local Privilege Escalation
// ConsoleApplication1.cpp : Defines the entry point for the console application.
Microsoft Windows – Local XPS Print Spooler Sandbox Escape
Windows: Local XPS Print Spooler Sandbox Escape
Sony Playstation 4 (PS4) 4.05 – ‘Jailbreak’ WebKit / ‘NamedObj ‘ Kernel Loader
# PS4 4.05 Kernel Exploit
Ubiquiti UniFi Video 3.7.3 – Local Privilege Escalation
RCE Security Advisory
GNU C Library Dynamic Loader glibc ld.so – Memory Leak / Buffer Overflow
Qualys Security Advisory
Apple macOS 10.13.1 (High Sierra) – Insecure Cron System Local Privilege Escalation
Recently I was working on an security issue in some other software that has yet to be disclosed which created a rathe...
Proxifier for Mac 2.19 – Local Privilege Escalation
# With CVE-2017-7643 I disclosed a command injection vulnerablity in the KLoader
Hashicorp vagrant-vmware-fusion 4.0.23 – Local Privilege Escalation
# A couple of weeks ago I disclosed a local root privesc in Hashicorp's
Hashicorp vagrant-vmware-fusion 4.0.24 – Local Privilege Escalation
# I have previously disclosed a couple of bugs in Hashicorp's vagrant-vmware-fusion plugin for vagrant.
Hashicorp vagrant-vmware-fusion 5.0.0 – Local Privilege Escalation
# After three CVEs and multiple exploits disclosed to Hashicorp they have finally upped their game with this plugin. ...
Sera 1.2 – Local Privilege Escalation / Password Disclosure
# Sera is a free app for mac and iOS that lets you unlock your mac automatically
Hashicorp vagrant-vmware-fusion 5.0.1 – Local Privilege Escalation
# I recently blogged about how the installation process of version 5.0.0 of this
Hashicorp vagrant-vmware-fusion 5.0.3 – Local Privilege Escalation
# Another day, another root privesc bug in this plugin. Not quite so serious this
Arq 5.9.6 – Local Privilege Escalation
# Arq Backup from Haystack Software is a great application for backing up macs and
Murus 1.4.11 – Local Privilege Escalation
# I recently blogged about the prevalence of escalation hijack vulnerabilities amongst macOS applications. One exampl...
TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change
# TeamViewer Permissions Hook V1
Ruby < 2.2.8 / < 2.3.5 / < 2.4.2 / < 2.5.0-preview1 - 'NET::Ftp' Command Injection
While using NET::Ftp I realised you could get command execution through "malicious" file names.
Apple macOS 10.13.1 (High Sierra) – ‘Blank Root’ Local Privilege Escalation
## Source: https://twitter.com/lemiorhan/status/935578694541770752 & https://forums.developer.apple.com/thread/79235
Diving Log 6.0 – XML External Entity Injection
[+] Exploit Title: Diving Log 6.0 XXE Injection
ALLPlayer 7.5 – Local Buffer Overflow (SEH Unicode)
#!/usr/bin/python
Linux Kernel (Ubuntu 17.04) – ‘XFRM’ Local Privilege Escalation
## Vulnerability Summary
Microsoft Windows 10 – CiSetFileCache TOCTOU Security Feature Bypass
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1332
VX Search 10.2.14 – ‘Proxy’ Local Buffer Overflow (SEH)
#!/usr/bin/env python
IKARUS anti.virus 2.16.7 – ‘ntguard_x64’ Local Privilege Escalation
Exploit Title - IKARUS anti.virus Arbitrary Write Privilege Escalation
Symantec Endpoint Protection 12.1 – Tamper-Protection Bypass
[+] Credits: John Page a.k.a hyp3rlinx
Linux Kernel 4.13 (Ubuntu 17.10) – ‘waitid()’ SMEP/SMAP/Chrome Sandbox Privilege Escalation
// Proof of concept exploit for waitid bug introduced in Linux Kernel 4.13
Vir.IT eXplorer Anti-Virus 8.5.39 – ‘VIAGLT64.SYS’ Local Privilege Escalation
Exploit Title - Vir.IT eXplorer Anti-Virus Arbitrary Write Privilege Escalation