EasyPHP Devserver 16.1.1 – Insecure File Permissions Privilege Escalation
Title: EasyPHP Devserver Insecure File Permissions Privilege Escalation
local
local 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Microsoft PowerShell – XML External Entity Injection
[+] Credits: John Page aka hyp3rlinx
Apache CouchDB 2.0.0 – Local Privilege Escalation
[+] Credits: John Page aka hyp3rlinx
Microsoft MSINFO32.EXE 6.1.7601 – ‘.NFO’ XML External Entity Injection
[+] Credits: John Page aka hyp3rlinx
Microsoft Event Viewer 1.0 – XML External Entity Injection
[+] Credits: John Page aka hyp3rlinx
Microsoft Windows Media Center 6.1.7600 – ‘ehshell.exe’ XML External Entity Injection
[+] Credits: John Page aka hyp3rlinx
Microsoft Excel Starter 2010 – XML External Entity Injection
[+] Credits: John Page aka hyp3rlinx
Microsoft Authorization Manager 6.1.7601 – ‘azman’ XML External Entity Injection
[+] Credits: John Page aka hyp3rlinx
Tor (Firefox 41 < 50) - Code Execution
# TOR Browser 0day : JavaScript Exploit !
WinPower 4.9.0.4 – Local Privilege Escalation
// Exploit Title: WinPower V4.9.0.4 Privilege Escalation
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)
// EDB-Note: Compile: g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil
Microsoft Windows Kernel – ‘win32k.sys NtSetWindowLongPtr’ Local Privilege Escalation (MS16-135) (1)
Complete Proof of Concept:
Ubuntu 15.10 – ‘USERNS ‘ Overlayfs Over Fuse Privilege Escalation
Source: http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/
Ubuntu 14.04/15.10 – User Namespace Overlayfs Xattr SetGID Privilege Escalation
Source: http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/
Huawei UTPS – Unquoted Service Path Privilege Escalation
# Exploit Title: Unquoted Service Path Vulnerability in Huawei UTPS Software
Palo Alto Networks PanOS – ‘root_reboot’ Local Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=913
Palo Alto Networks PanOS – ‘root_trace’ Local Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=912
Nagios 4.2.2 – Local Privilege Escalation
Affected Product: Nagios 4
Microsoft Windows – VHDMP Arbitrary Physical Disk Cloning Privilege Escalation (MS16-138)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=916
Microsoft Windows – VHDMP ZwDeleteFile Arbitrary File Deletion Privilege Escalation (MS16-138)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=915
Microsoft Windows – VHDMP Arbitrary File Creation Privilege Escalation (MS16-138)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=914
Avira Antivirus 15.0.21.86 – ‘.zip’ Directory Traversal / Command Execution
# Title : Avira Antivirus >= 15.0.21.86 Command Execution (SYSTEM)
MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x – ‘mysql’ System User Privilege Escalation / Race Condition
Source: https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html // http:/...
Apple macOS 10.12 – ‘task_t’ Local Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=837
NVIDIA Driver – NvStreamKms ‘PsSetCreateProcessNotifyRoutineEx Local Stack Buffer Overflow Callback / Local Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=918
NVIDIA Driver – UVMLiteController ioctl Handling Unchecked Input/Output Lengths Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=880
Apple OS X/iOS Kernel – IOSurface Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=831
HP TouchSmart Calendar 4.1.4245 – Insecure File Permissions Privilege Escalation
[+] Credits: John Page aka hyp3rlinx
GNU GTypist 2.9.5-2 – Local Buffer Overflow
# Exploit developed using Exploit Pack v6.5
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method)
// $ echo pikachu|sudo tee pokeball;ls -l pokeball;gcc -pthread pokemon.c -o d;./d pokeball miltank;cat pokeball
Network Scanner 4.0.0 – Local Buffer Overflow (SEH)
#!/usr/bin/python
Microsoft Windows (x86) – ‘NDISTAPI’ Local Privilege Escalation (MS11-062)
################################################################
Microsoft Windows – NtLoadKeyEx Read Only Hive Arbitrary File Write Privilege Escalation (MS16-124)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=871
Microsoft Windows Edge/Internet Explorer – Isolated Private Namespace Insecure Boundary Descriptor Privilege Escalation (MS16-118)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=878
Microsoft Windows Edge/Internet Explorer – Isolated Private Namespace Insecure DACL Privilege Escalation (MS16-118)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=879
Oracle Netbeans IDE 8.1 – Directory Traversal
[+] Credits: John Page aka hyp3rlinx
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method)
####################### dirtyc0w.c #######################
Realtek High Definition Audio Driver 6.0.1.6730 – Unquoted Service Path Privilege Escalation
# Exploit Title: Realtek High Definition Audio Driver - Unquoted Service Path Privilege Escalation
PDF Complete 4.1.12 Corporate Edition – Unquoted Service Path Privilege Escalation
# Exploit Title: PDF Complete Corporate Edition - Unquoted Service Path Privilege Escalation