write(0,"Hello core!\n",12); shellcode for Linux x86. writehello-core.s is appended.
41fd3af95203826a26802304166e8c49b0a8f32ba4bc6763401241d7c8b03ebf
read and chmod shellcode for Linux x86. readnchmod-core.s is appended.
5cd6262dd473ef3cfd822593dd79d775204a412f232377a407335a80515dd956
if(read(fd,buf,512)<=2) _exit(1) else buf(); shellcode for Linux x86. h3ll-core.s is appended.
d3520474d0b54fff6d65387a6361d6638be7d0e9f057c1a62cb7801571603558
_exit(1); shellcode for Linux x86.
ba689a9bd5eb2cf68686500b209ee31348604a6d736dc138f474e6e70bf88b53
dup2(0,0); dup2(0,1); dup2(0,2); shellcode for Linux x86. dup2_loop-core.s is appended.
b4cc8feaf73d1c1548958a27f11126de31bfc8a7af149ae4c738f23de3915083
56 bytes execve /bin/sh shellcode for Linux MIPS running in little-endian mode. linux-mipsel-execve-core.s is appended.
892a894f4ab144a5b2015aaa606544ed7f3ec962cc1146fdbf4a0f17aee9cc28
read(0,stack,1028); stack(); shellcode for Linux PPC. readnexecppc-core.s appended.
d0b4499072948b6491f643ea4ced7fa7145948d309b2bbfe20f29161e8bd9115
execve /bin/sh shellcode for Linux PPC. execve-core.s is appended.
e4820ba2d6164b87e8b80dd60e8b6f7fb00ec0069aeb21349b4dc1a0069f00cd
Linux/ppc shellcode which connects /bin/sh to a host. connect-core5.s is appended.
ff836d3fdda9ddcc1157a20752d7f94cb9c0518549ed0ff11dc9dc5f996f11bf
Solaris 10 DtPrintinfo/Session exploit for x86.
fcc0583f608dfa2ff466ab8443bc545a183459bdd2c5ce5d9e65723a7cbcc153
Operator Shell (osh) 1.7-12 local root exploit. New version of an old exploit. This version has the shellcode trimmed down to 9 bytes thanks to Andrewg.
93c7051b9b8e5fc758a98373d2984054e773f1047fd7a891921e608d15228270
Operator Shell (osh) 1.7-12 local root exploit. New version of an old exploit.
4ddcb37c6addfe9669637e9768105bf89fb404c3737bcff22f8e1019069720c9
Operator Shell (osh) 1.7-12 local root exploit.
fe3a929faff57858b299fc1c0d1660e3387d19c65452c581dd20e06aa4b548d6
Debian uucp v1.06.1 local uid=utmp or root exploit. Trojans uucp and uux, attempting to get a root shell. Based on an exploit by zen-parse. Tested on Debian PowerPC Unstable.
c9cbbdcce388932c2f4626a8b3f784ee30cadbd876fa9fedf737a7fee68ad530
Local root exploit for sudo + postfix. Exploits sudo prior to sudo-1.6.4.1. Tested on debian powerpc unstable.
56c4a7509e2a9ce7833c6d4cb82396da0284a904354b620cfe74d1de0f8ee533
/usr/bin/pileup local root exploit. Tested against Debian 2.2.
91ffd9b5c600d6641fc76b93d1585a6c5bdb92d4d9d1ce2ffd0e8c74e173e9b9
lmail local root exploit. Simply run it with the file you want to create/overwrite and the data you wish to place in the file.
ff21e217a7ee6a988dfe12d26ee5f7bdafde7ca74bec3f4eee9cbaa42d1ea328
Glibc prior to v2.1.9x allows local users to read any file. This shell script exploits this bug using the Openssh-2.3.0p1 binary. Tested against Debian 2.3 and Redhat 7.0.
2d457aea08bb212a673eba42f38cd71b80a69cfa337478e974be158a3d4ea4f9