Oracle VM VirtualBox – Cooperating VMs can Escape from Shared Folder
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1037
local
local 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
USBPcap 1.1.0.0 (WireShark 2.2.5) – Local Privilege Escalation
Exploit Title - USBPcap Null Pointer Dereference Privilege Escalation
CyberGhost 6.0.4.2205 – Local Privilege Escalation
# Exploit CyberGhost 6.0.4.2205 Privilege Escalation
Cisco AnyConnect Secure Mobility Client 4.3.04027 – Local Privilege Escalation
# Exploit Title: Cisco AnyConnect Start Before Logon (SBL) local privilege escalation. CVE-2017-3813
ntfs-3g – Unsanitized modprobe Environment Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1072
ShadeYouVPN Client 2.0.1.11 – Local Privilege Escalation
# Exploit ShadeYouVPN.com Client v2.0.1.11 for Windows Privilege Escalation
Cimetrics BACnet Explorer 4.0 – XML External Entity Injection
Cimetrics BACnet Explorer 4.0 XXE Vulnerability
Cimetrics BACstac 6.2f – Local Privilege Escalation
Cimetrics BACstac Routing Service 6.2f Local Privilege Escalation
IVPN Client 2.6.1 – Local Privilege Escalation
# Exploit IVPN Client for Windows 2.6.6120.33863 Privilege Escalation
ntfs-3g (Debian 9) – Local Privilege Escalation
#!/bin/bash
Ghostscript 9.20 – ‘Filename’ Command Execution
[+]#################################################################################################
Google Android – RKP EL1 Code Loading Bypass
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=981
Viscosity 1.6.7 – Local Privilege Escalation
# Exploit Title: Viscosity for Windows 1.6.7 Privilege Escalation
Oracle VM VirtualBox < 5.0.32 / < 5.1.14 - Local Privilege Escalation
== [ Overview ] ===
Palo Alto Networks Terminal Services Agent 7.0.3-13 – Integer Overflow
Exploit Title - Palo Alto Networks Terminal Services Agent Integer Overflow
GNU Screen 4.5.0 – Local Privilege Escalation
#!/bin/bash
Systemd 228 (SUSE 12 SP2 / Ubuntu Touch 15.04) – Local Privilege Escalation
source: http://www.openwall.com/lists/oss-security/2017/01/24/4
GNU Screen 4.5.0 – Local Privilege Escalation (PoC)
Commit f86a374 ("screen.c: adding permissions check for the logfile name",
Microsoft Power Point 2016 – Java Code Execution
# Exploit Title: Microsoft Power Point Java Payload Code Execution
Google Android TSP sysfs – ‘cmd_store’ Multiple Overflows
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=967
iSelect v1.4 – Local Buffer Overflow
# Exploit developed using Exploit Pack v7.01
aSc Timetables 2017 – Local Buffer Overflow
# Exploit Title: aSc Timetables 2017 input field buffer overflow and code execution
Firejail – Local Privilege Escalation
# firejail advisory for TOCTOU in --get and --put (local root)
Cemu 1.6.4b – Information Leak / Buffer Overflow (Emulator Breakout)
For those who only care about one thing: [the PoC is here.](https://rol.im/kpwned.zip)
Microsoft Windows Kernel – ‘win32k.sys NtSetWindowLongPtr’ Local Privilege Escalation (MS16-135) (2)
Source: https://ricklarabee.blogspot.com/2017/01/virtual-memory-page-tables-and-one-bit.html
Advanced Desktop Locker 6.0.0 – Lock Screen Bypass
Exploit Title : Advanced Desktop Locker [ Locker Bypass ]
Firejail < 0.9.44.4 / < 0.9.38.8 LTS - Local Sandbox Escape
#define _POSIX_C_SOURCE 200212
Kaspersky 17.0.0 – Local CA Root Incorrectly Protected
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=989
Microsoft Windows 8.1 (x64) – ‘RGNOBJ’ Integer Overflow (MS16-098)
// Source: https://github.com/sensepost/ms16-098/tree/b85b8dfdd20a50fc7bc6c40337b8de99d6c4db80
Shutter 0.93.1 – Code Execution
# Exploit Title: Shutter user-assisted remote code execution
Wampserver 3.0.6 – Insecure File Permissions Privilege Escalation
=====================================================
OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1010
Apple macOS < 10.12.2 / iOS < 10.2 - Broken Kernel Mach Port Name uref Handling Privileged Port Name Replacement Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=959
Apple macOS < 10.12.2 / iOS < 10.2 - '_kernelrpc_mach_port_insert_right_trap' Kernel Reference Count Leak / Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=941
RedStar 3.0 Server – ‘Shellshock’ ‘BEAM’ / ‘RSSMON’ Command Injection
#!/usr/bin/env python
Apple macOS 10.12 16A323 XNU Kernel / iOS 10.1.1 – ‘set_dp_control_port’ Lack of Locking Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=965
Nagios < 4.2.4 - Local Privilege Escalation
#!/bin/bash
Apport 2.x (Ubuntu Desktop 12.10 < 16.04) - Local Code Execution
Both of these issues were reported to the Apport maintainers and a fix was released on 2016-12-14. The CrashDB code i...
Google Chrome (Fedora 25 / Ubuntu 16.04) – ‘tracker-extract’ / ‘gnome-video-thumbnailer’ + ‘totem’ Drive-By Download
Source: https://scarybeastsecurity.blogspot.com/2016/12/redux-compromising-linux-using-snes.html