This exploit is a kernel stack overflow exploit which uses the SETFKEY and GETFKEY ioctl calls to overflow the stack with a payload. The payload is then executed in kernel mode, allowing the attacker to gain root privileges.
This exploit is based on a dlclose() vulnerability in the PS4 kernel. It allows for arbitrary code execution in the kernel, which can be used to gain root access. The exploit is written in C and uses assembly code to enable UART output, disable write protection, and escalate the process to root. It also resolves kernel functions and allocates RWX memory to execute the shellcode.
This PoC uses only syscalls not any libraries, like pthread. Threads are implemented using raw Linux syscalls.
This repository demonstrates the WebKit heap based buffer overflow vulnerability (CVE-2014-1303) on Linux. Original exploit is written for Mac OS X and PS4 (PlayStation4). It contains an exploit.html file which triggers the vulnerability and jump to ROP chain, scripts/roputil.js which contains utilities for ROP building, scripts/syscall.js which contains syscall ROP chains, scripts/code.js which contains hard coded remote loader, loader/ which contains a simple remote loader written in C and loader/bin2js which converts binary to js variables (for loader).
An independent security researcher, TigerPuma (at) Fosec.vn, has reported a buffer overflow vulnerability in Dasan Networks GPON ONT WiFi Router H640X versions 12.02-01121 / 2.77p1-1124 / 3.03p2-1146. The vulnerability is caused due to the use of strcpy without checking the length of the input from the client request. This can be exploited to trigger a buffer overflow and control the PC.
This repository contains a poc for the CVE 2014-1303 originally disclosed by Liang Chen. It has been tested to work on system firmware 2.03, but should work for systems on a firmware < 2.50, the ROP test will however only work on 2.03. You need to edit the dns.conf to point to the ip address of your machine, and modify your consoles dns settings to point to it as well. Then run python fakedns.py -c dns.conf then python server.py. Debug output will come from this process. Navigate to the User's Guide page on the PS4 and various information should be printed to the console. The ROP test will print what is stored in the rsp register. Continuing execution after rsp is pivoted still needs to be done.
This repo is an edit of the 4.0x webkit exploit released by qwertyoruiopz. The edit re-organizes, comments, and adds portability across 3.50 - 4.07 (3.50, 3.55, 3.70, 4.00, and of course 4.06/4.07). The exploit is much more stable than FireKaku and sets up the foundation for running basic ROP chains and returns to normal execution. Credit for the exploit goes completely to qwertyoruiopz.
HPE Intelligent Management Center (iMC) is vulnerable to a stack buffer overflow that lead to remote code execution. The imcsyslogdm service handles syslog messages received on UDP port 514. The imcsyslogdm service handles the forwarded messages by using FORWARD_HEAD ( ‘Forwarded From:‘) and FORWARD_HEAD_END (‘Quidview‘) markers at the beginning of the packet to indicate the originator of the syslog message. In case there’s a FORWARD_HEAD marker but no FORWARD_HEAD_END, the application ends up copying the contents of the packet into a fixed-size stack buffer that is vulnerable to a buffer overflow. The first stage of the proof of concept is used to trigger the overflow and start a ROP chain by sending data on UDP port 514.
User controlled input is not sufficiently sanitized, and then passed to a function responsible for accessing the filesystem. Successful exploitation of this vulnerability enables a remote unauthenticated user to read the content of any file existing on the host, this includes files located outside of the web root folder. By sending a GET request, an attacker can get direct access to the configuration file, which allows them to log in to the login panel.
An attacker can get the /etc/passwd file from the remote device, by sending a GET request to the TCP/4321 port of the Cisco DPC3928AD DOCSIS 3.0 2-PORT Voice Gateway.
Services By CQR