NetBSD – ‘mail.local(8)’ Local Privilege Escalation
// Source: http://akat1.pl/?id=2
local
local 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Wowza Streaming Engine 4.5.0 – Local Privilege Escalation
Wowza Streaming Engine 4.5.0 Local Privilege Escalation
InstantHMI 6.1 – Local Privilege Escalation
Title: InstantHMI - EoP: User to ADMIN
Hide.Me VPN Client 1.2.4 – Local Privilege Escalation
Title: Hide.Me VPN Client - EoP: User to SYSTEM
GE Proficy HMI/SCADA CIMPLICITY 8.2 – Local Privilege Escalation
# Exploit Title: GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit(0 day)
Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation
EDB Note: Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44300.zip
Exim 4 (Debian 8 / Ubuntu 16.04) – Spool Privilege Escalation
-----BEGIN PGP SIGNED MESSAGE-----
Linux Kernel 4.4.0-21 (Ubuntu 16.04 x64) – Netfilter ‘target_offset’ Out-of-Bounds Privilege Escalation
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40053.zip
Lenovo ThinkPad – System Management Mode Arbitrary Code Execution
Source: https://github.com/Cr4sh/ThinkPwn
Microsoft Windows 7 SP1 (x86) – Local Privilege Escalation (MS16-014)
# Exploit Title: Elevation of privilege on Windows 7 SP1 x86
HNB 1.9.18-10 – Local Buffer Overflow
# Exploit developed using Exploit Pack v5.4
PInfo 0.6.9-5.1 – Local Buffer Overflow
# Exploit developed using Exploit Pack v5.4
Panda Security (Multiple Products) – Local Privilege Escalation
# Exploit Title: Panda Security Privilege Escalation
VUPlayer 2.49 (Windows 7) – ‘.m3u’ Local Buffer Overflow (DEP Bypass)
#!/usr/bin/env python
Mediacoder 0.8.43.5830 – ‘.m3u’ Local Buffer Overflow (SEH)
#!/usr/bin/python
Microsoft Internet Explorer 11 (Windows 10) – VBScript Memory Corruption (MS16-051)
Source: https://github.com/theori-io/cve-2016-0189
Linux Kernel – ‘ecryptfs’ ‘/proc/$pid/environ’ Local Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=836
ACROS Security 0patch 2016.05.19.539 – ‘0PatchServicex64.exe’ Unquoted Service Path Privilege Escalation
ACROS Security 0patch (0PatchServicex64.exe) Unquoted Service Path Privilege Escalation
SolarWinds Virtualization Manager – Local Privilege Escalation
Product: Solarwinds Virtualization Manager
AdobeUpdateService 3.6.0.248 – Unquoted Service Path Privilege Escalation
----------------------------------------------------------------------------------------------------------
iSQL 1.0 – Command Injection
#!/bin/ruby
Easy RM to MP3 Converter 2.7.3.700 – ‘.m3u’ File (Universal ASLR + DEP Bypass)
# Exploit Title: Easy RM to MP3 Converter 2.7.3.700 (.m3u) File BoF Exploit with Universal DEP+ASLR bypass
Riot Games League of Legends – Insecure File Permissions Privilege Escalation
------------------------------------------------------------------------------------
Matrix42 Remote Control Host 3.20.0031 – Unquoted Path Privilege Escalation
# Exploit Title: Matrix42 Remote Control Host - Unquoted Path Privilege Escalation
League of Legends Screensaver – Insecure File Permissions Privilege Escalation
# Exploit Title: League of Legends Screensaver Insecure File Permissions
League of Legends Screensaver – Unquoted Service Path Privilege Escalation
# Exploit Title: League of Legends Screensaver Unquoted Service Paths
Valve Steam 3.42.16.13 – Local Privilege Escalation
# Exploit Title: Valve Steam 3.42.16.13 Local Privilege Escalation
Operation Technology ETAP 14.1.0 – Local Privilege Escalation
Operation Technology ETAP 14.1.0 Local Privilege Escalation
VirIT Explorer Lite & Pro 8.1.68 – Local Privilege Escalation
Full title: VirIT Explorer Lite & Pro v.8.1.68 Local Privilege Escalation (System)/Arbitrary Code Execution
Hex : Shard of Fate 1.0.1.026 – Unquoted Path Privilege Escalation
-----------------------------------------------------------------------------------------------------------------
Multiples Nexon Games – Unquoted Path Privilege Escalation
-----------------------------------------------------------------------------------------------------------------
runAV mod_security – Arbitrary Command Execution
# Title : runAV mod_security Remote Command Execution
NRSS Reader 0.3.9 – Local Stack Overflow
# Exploit developed using Exploit Pack v5.4
Intuit QuickBooks Desktop 2007 < 2016 - Arbitrary Code Execution
+ Credits: Maxim Tomashevich from Thegrideon Software
FileZilla FTP Client 3.17.0.0 – Unquoted Path Privilege Escalation
-----------------------------------
Microsoft Windows 7 – ‘WebDAV’ Local Privilege Escalation (MS16-016) (2)
# Exploit Title: WebDAV Elevation of Privilege Vulnerability (MS16)-2
Certec EDV atvise SCADA Server 2.5.9 – Local Privilege Escalation
Certec EDV atvise SCADA server 2.5.9 Privilege Escalation Vulnerability
Linux Kernel 4.4.x (Ubuntu 16.04) – ‘double-fdput()’ bpf(BPF_PROG_LOAD) Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=808
Linux Kernel (Ubuntu 14.04.3) – ‘perf_event_open()’ Can Race with execve() (Access /etc/shadow)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=807
Zabbix Agent 3.0.1 – ‘mysql.size’ Shell Command Injection
CVE-2016-4338: Zabbix Agent 3.0.1 mysql.size shell command injection
TRN Threaded USENET News Reader 3.6-23 – Local Stack Overflow
# Exploit developed using Exploit Pack v5.4
Sony Playstation 4 (PS4) 1.76 – ‘dlclose’ Linux Kernel Loader
Code written based on info available here http://cturt.github.io/dlclose-overflow.html