local

Parallels Desktop – Virtual Machine Escape

#[+] Title: Parallels Desktop - Virtual Machine Escape

TiEmu 2.08 – Local Buffer Overflow

#!/usr/bin/python

Microsoft MsMpEng – Multiple Problems Handling ntdll!NtControlChannel Commands

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1260

JAD Java Decompiler 1.5.8e – Local Buffer Overflow

#!/usr/bin/python

Dup Scout Enterprise 9.7.18 – ‘.xml’ Local Buffer Overflow

author = '''

VMware Workstation for Linux 12.5.2 build-4638234 – ALSA Configuration Host Local Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1142

KDE 4/5 – ‘KAuth’ Local Privilege Escalation

// cc -Wall smb0k.c -pedantic -std=c11

Microsoft Windows – COM Aggregate Marshaler/IRemUnknown2 Type Confusion Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1107

Dive Assistant Template Builder 8.0 – XML External Entity Injection

[+] Exploit Title: Dive Assistant - Template Builder XXE Injection

Linux Kernel 4.8.0-41-generic (Ubuntu) – Packet Socket Local Privilege Escalation

// A proof-of-concept local root exploit for CVE-2017-7308.

Xen 64bit PV Guest – pagetable use-after-type-change Breakout

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1231

Gemalto SmartDiag Diagnosis Tool < 2.5 - Local Buffer Overflow (SEH)

# Exploit Title: Gemalto SmartDiag Diagnosis Tool

MediaCoder 0.8.48.5888 – Local Buffer Overflow (SEH)

#!/usr/bin/python

Serviio PRO 1.8 DLNA Media Streaming Server – Local Privilege Escalation

Serviio PRO 1.8 DLNA Media Streaming Server Local Privilege Escalation

Ghostscript 9.21 – Type Confusion Arbitrary Command Execution (Metasploit)

##

HideMyAss Pro VPN Client for macOS 3.x – Local Privilege Escalation

Source: https://www.securify.nl/advisory/SFY20170408/local_privilege_escalation_vulnerability_in_hidemyass_pro_vpn_cl...

HideMyAss Pro VPN Client for OS X 2.2.7.0 – Local Privilege Escalation

Source: https://www.securify.nl/advisory/SFY20170402/multiple_local_privilege_escalation_vulnerabilities_in_hidemyass...

Realtek Audio Driver 6.0.1.7898 (Windows 10) – Dolby Audio X2 Service Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1075

LightDM (Ubuntu 16.04/16.10) – ‘Guest Account’ Local Privilege Escalation

Source: https://blogs.securiteam.com/index.php/archives/3134

Dell Customer Connect 1.3.28.0 – Local Privilege Escalation

# Exploit Dell Customer Connect 1.3.28.0 Privilege Escalation

Oracle VM VirtualBox 5.0.32 r112930 (x64) – Windows Process COM Injection Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1103

Oracle VM VirtualBox 5.1.14 r112924 – Unprivileged Host User to Host Kernel Privilege Escalation via ALSA config

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1141

Oracle VM VirtualBox – Guest-to-Host Privilege Escalation via Broken Length Handling in slirp Copy

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1086

Microsoft Windows 10 – Runtime Broker ClipboardBroker Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1079

Microsoft Windows 10 (Build 10586) – ‘IEETWCollector’ Arbitrary Directory/File Deletion Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1093

Linux Kernel 4.8.0 UDEV < 232 - Local Privilege Escalation

# Title: Linux Kernel 4.8.0 udev 232 - Privilege Escalation

Mozilla Firefox – Address Bar Spoofing

VirusChaser 8.0 – Local Buffer Overflow (SEH)

# Exploit Title: Virus Chaser 8.0 - Scanner component, SEH Overflow

Adobe Creative Cloud Desktop Application < 4.0.0.185 - Local Privilege Escalation

[+] Credits: John Page aka hyp3rlinx

GNS3 Mac OS-X 1.5.2 – ‘ubridge’ Local Privilege Escalation

#!/bin/sh

Solaris 7 < 11 (SPARC/x86) - 'EXTREMEPARR' dtappgather Privilege Escalation

#!/bin/ksh

Xen – Broken Check in ‘memory_exchange()’ Permits PV Guest Breakout

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1184

Proxifier for Mac 2.17/2.18 – Privesc Escalation

# Source: https://m4.rkw.io/blog/cve20177643-local-root-privesc-in-proxifier-for-mac--218.html

Proxifier for Mac 2.18 – Multiple Vulnerabilities

Source: https://www.securify.nl/advisory/SFY20170401/multiple_local_privilege_escalation_vulnerabilities_in_proxifier...

Sony Playstation 4 (PS4) 3.50 < 4.07 - WebKit Code Execution (PoC)

PS4 4.0x Code Execution

Apple macOS/iOS Kernel 10.12.3 (16D32) – Double-Free Due to Bad Locking in fsevents Device

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1129

Bluecoat ASG 6.6/CAS 1.3 – Local Privilege Escalation (Metasploit)

# Exploit Title: OS Command Injection Vulnerability in BlueCoat ASG and CAS

Linux Kernel (PonyOS 4.0) – ‘fluttershy’ LD_LIBRARY_PATH Local Privilege Escalation

#!/usr/bin/python

Microsoft Xbox One 10.0.14393.2152 – Code Execution (PoC)

For Xbox-SystemOS version: 10.0.14393.2152 (rs1_xbox_rel_1610 161208-1218) fre, 12/14/2016

Sync Breeze Enterprise 9.5.16 – ‘Import Command’ Local Buffer Overflow

#!/usr/bin/env python

DiskBoss Enterprise 7.8.16 – ‘Import Command’ Local Buffer Overflow

#!/usr/bin/env python

Disk Sorter Enterprise 9.5.12 – ‘Import Command’ Local Buffer Overflow

#!/usr/bin/env python

Intermec PM43 Industrial Printer – Local Privilege Escalation

# TITLE: Intermec Industrial Printers Local root with Busybox jailbreak

QNAP QTS < 4.2.4 - Domain Privilege Escalation

QNAP QTS Domain Privilege Escalation Vulnerability

Fortinet FortiClient 5.2.3 (Windows 10 x64 Post-Anniversary) – Local Privilege Escalation

Check these out:

Fortinet FortiClient 5.2.3 (Windows 10 x64 Pre-Anniversary) – Local Privilege Escalation

Check this out:

Linux Kernel 3.11 < 4.8 0 - 'SO_SNDBUFFORCE' / 'SO_RCVBUFFORCE' Local Privilege Escalation

// CAP_NET_ADMIN -> root LPE exploit for CVE-2016-9793

Microsoft Windows DVD Maker 6.1.7 – XML External Entity Injection

[+] Credits: John Page AKA hyp3rlinx

Microsoft Windows – COM Session Moniker Privilege Escalation (MS17-012)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1021

PCAUSA Rawether (ASUS PCE-AC56 WLAN Card Utilities Windows 10 x64) – Local Privilege Escalation

#Exploit Title: PCAUSA Rawether for Windows local privilege escalation