Apple Mac OSX < 10.7.5/10.8.2/10.9.5/10.10.2 - 'Rootpipe' Local Privilege Escalation
########################################################
local
local 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Fedora 21 setroubleshootd 3.2.22 – Local Privilege Escalation
setroubleshoot tries to find out which rpm a particular
IDM 6.20 – Local Buffer Overflow
#!/usr/bin/env python
RM Downloader 2.7.5.400 – Local Buffer Overflow
#!/usr/bin/env python
Mini-stream Ripper 2.7.7.100 – Local Buffer Overflow
#!/usr/bin/env python
Free MP3 CD Ripper 2.6 – ‘.wav’ Local Buffer Overflow
#!/usr/bin/python
Microsoft Windows 8.1 – Local WebDAV NTLM Reflection Privilege Escalation
Source: https://code.google.com/p/google-security-research/issues/detail?id=222
Spybot Search & Destroy 1.6.2 Security Center Service – Local Privilege Escalation
Spybot Search & Destroy 1.6.2 Security Center Service Privilege Escalation
Foxit Reader 7.0.6.1126 – Unquoted Service Path Privilege Escalation
Foxit Reader 7.0.6.1126 Unquoted Service Path Elevation Of Privilege
Ubuntu 15.04 (Development) – ‘Upstart’ Logrotation Privilege Escalation
Source: http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/
Rowhammer – NaCl Sandbox Escape
Sources:
Microsoft Word 2007 – RTF Object Confusion (ASLR + DEP Bypass)
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass
Ubisoft Uplay 5.0 – Insecure File Permissions Privilege Escalation
Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege Escalation
Electronic Arts Origin Client 9.5.5 – Multiple Privilege Escalation Vulnerabilities
Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities
VFU 4.10-1.1 – Move Entry Buffer Overflow
# Exploit Title: VFU Move Entry Buffer Overflow
Publish-It 3.6d – Local Buffer Overflow (SEH)
#!/usr/bin/python
Realtek 11n Wireless LAN utility – Local Privilege Escalation
Realtek 11n Wireless LAN utility privilege escalation.
MooPlayer 1.3.0 – ‘m3u’ Local Buffer Overflow (SEH) (1)
#!/usr/bin/env python
SoftSphere DefenseWall FW/IPS 3.24 – Local Privilege Escalation
Exploit Title - SoftSphere DefenseWall FW/IPS Arbitrary Write Privilege Escalation
BullGuard (Multiple Products) – Arbitrary Write Privilege Escalation
Exploit Title - BullGuard Multiple Products Arbitrary Write Privilege Escalation
AVG Internet Security 2015.0.5315 – Arbitrary Write Privilege Escalation
Exploit Title - AVG Internet Security 2015 Arbitrary Write Privilege Escalation
K7 Computing (Multiple Products) – Arbitrary Write Privilege Escalation
Exploit Title - K7 Computing Multiple Products Arbitrary Write Privilege Escalation
Symantec Altiris Agent 6.9 (Build 648) – Local Privilege Escalation
Exploit Title - Symantec Altiris Agent Arbitrary Write Privilege Escalation
Trend Micro 8.0.1133 (Multiple Products) – Local Privilege Escalation
Exploit Title - Trend Micro Multiple Products Arbitrary Write Privilege Escalation
McAfee Data Loss Prevention Endpoint – Arbitrary Write Privilege Escalation
Exploit Title - McAfee Data Loss Prevention Endpoint Arbitrary Write Privilege Escalation
Apple Mac OSX < 10.10.x - GateKeeper Bypass
# Exploit Title: OS X Gatekeeper bypass Vulnerability
Comodo Backup 4.4.0.0 – Null Pointer Dereference Privilege Escalation
Exploit Title - Comodo Backup Null Pointer Dereference Privilege Escalation
VideoLAN VLC Media Player 2.1.5 – Write Access Violation
Title : VLC Player 2.1.5 Write Access Violation Vulnerability
VideoLAN VLC Media Player 2.1.5 – DEP Access Violation
Title : VLC Player 2.1.5 DEP Access Violation Vulnerability
Apple Mac OSX 10.9.5 – IOKit IntelAccelerator Null Pointer Dereference
// clang -o ig_2_3_exploit ig_2_3_exploit.c -framework IOKit -framework CoreFoundation -m32 -D_FORTIFY_SOURCE=0
Apple Mac OSX networkd – ‘effective_audit_token’ XPC Type Confusion Sandbox Escape
// Requires Lorgnette: https://github.com/rodionovd/liblorgnette
Congstar Internet Manager – Local Buffer Overflow (SEH)
#!/usr/bin/python
T-Mobile Internet Manager – Local Buffer Overflow (SEH)
#!/usr/bin/python
Microsoft Windows < 8.1 (x86/x64) - User Profile Service Privilege Escalation (MS15-003)
## Source: https://code.google.com/p/google-security-research/issues/detail?id=123
RedStar 3.0 Desktop – ‘Software Manager swmng.app’ Local Privilege Escalation
The root user is disabled on Red Star, and it doesn't look like there is a way to enable it.
RedStar 2.0 Desktop – ‘World-writeable rc.sysinit’ Local Privilege Escalation
Red Star 2.0 desktop ships with a world-writeable "/etc/rc.d/rc.sysinit"
RedStar 3.0 Desktop – Enable sudo Privilege Escalation
#!/bin/bash -e
Apple Mac OSX 10.9.x – sysmond XPC Privilege Escalation
Source: https://code.google.com/p/google-security-research/issues/detail?id=121
Palringo 2.8.1 – Local Stack Buffer Overflow
#!/use/bin/perl
Ntpdc 4.2.6p3 – Local Buffer Overflow
# Source: https://hatriot.github.io/blog/2015/01/06/ntpdc-exploit/
Nexus 5 Android 5.0 – Local Privilege Escalation
create an Android.mk as follow:
Microsoft Windows 8.1 (x86/x64) – ‘ahcache.sys’ NtApphelpCacheControl Privilege Escalation
# Source: https://code.google.com/p/google-security-research/issues/detail?id=118#c1
GParted 0.14.1 – OS Command Execution
SEC Consult Vulnerability Lab Security Advisory < 20141218-1 >