CVE-2023-4911

CVE-2023-4911 使用 docker build -t CVE-2023-4911 -f Dockerfile docker run -it CVE-2023-4911 /exp 参考 githubcom/leesh3288/CVE-2023-4911 githubcom/Green-Avocado/CVE-2023-4911 wwwqualyscom/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-sotxt

PoC for CVE-2023-4911 LooneyTuneables

CVE-2023-4911 This is a PoC for CVE-2023-4911 ("Looney Tunables") that exploits a bug in the glibc dynamic loader's GLIBC_TUNABLES environment variable parsing function parse_tunables() This is a rewrite of the C PoC's into a pure python approach I did this to make it easier to customize the exploit for other platforms The only requirement is pwntools, wh

PoC for CVE-2023-4911

PoC of CVE-2023-4911 "Looney Tunables" This is a PoC of CVE-2023-4911 (aka "Looney Tunables") exploiting a bug in glibc dynamic loader's GLIBC_TUNABLES environment variable parsing function parse_tunables() Code has been tested on Ubuntu 22043 with glibc version 235-0ubuntu33 No attempts have been made to generalize the PoC (read: "Works O

PoC exploits are not meant to cause harm, but to show security weaknesses within software. Identifying issues allows companies to patch vulnerabilities and protect itself against attacks

PoC of CVE-2023-4911 "Looney Tunables" This is a PoC of CVE-2023-4911 (aka "Looney Tunables") exploiting a bug in glibc dynamic loader's GLIBC_TUNABLES environment variable parsing function parse_tunables() Code has been tested on Ubuntu 22043 with glibc version 235-0ubuntu33 No attempts have been made to generalize the PoC so your mileage may

Collection of Linux Kernel exploits for CTF.

Linux kernal Exploits This repo is a collection of kernal exploits Sources githubcom/briskets/CVE-2021-3493 githubcom/UncleJ4ck/CVE-2021-41091 githubcom/xkaneiki/CVE-2023-0386 githubcom/leesh3288/CVE-2023-4911 Disclaimer I am not the author of any of this exploit

CVE-2023-4911

CVE-2023-4911 This is a PoC (Proof Of Concept) for the Looney Tunables Linux Privilege Escalation vulnerability This is based on this PoC Great thanks to leesh3288 Here you can find a very detailed writeup, and here you can see a very cool video by IppSec Usage Check if it's vulnerable env -i "GLIBC_TUNABLES=glibcmallocmxfast=glibcmallocmxfast=A" "Z=

PoC of CVE-2023-4911 Looney Tunables This is a PoC of CVE-2023-4911 (aka "Looney Tunables") exploiting a bug in glibc dynamic loader's GLIBC_TUNABLES environment variable parsing function parse_tunables() Getting Started Executing program We can check if target is vulnerable env -i "GLIBC_TUNABLES=glibcmallocmxfast=glibcmallocmxfast=A" "Z

https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

CVE-2023-4911 wwwqualyscom/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-sotxt Proof-of-Concept Developed for: Ubuntu 2204 Ubuntu GLIBC 235-0ubuntu31 su from util-linux 2372 ASLR ON Dockerfile included Debug Disable ASLR $ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space Compile with

A collection of nix modules for running a secure NixOS server

security-nix A collection of nix modules for running a secure NixOS server You might want to import: <nixpkgs/nixos/modules/profiles/hardenednix> Hostfw Hostfw is a module for managing the firewall Using this simple abstraction you can open a certain UDP or TCP port for a list of trusted IPs instead of having to call low

CVE-2023-4911 proof of concept

CVE-2023-4911 - Looney Tunables This is a (atm very rough) proof of concept for CVE-2023-4911 So far I've only verified it works on Ubuntu 2210 kinetic Current version of the exploit contains a fair amount of "magic" offsets If you have suggestions on how to improve the heap shaping, feel free to send a PR my way :) This exploit is basically an implementatio

https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

CVE-2023-4911 wwwqualyscom/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-sotxt Proof-of-Concept Developed for: Ubuntu 2204 Ubuntu GLIBC 235-0ubuntu31 su from util-linux 2372 ASLR ON Dockerfile included Debug Disable ASLR $ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space Compile with

Exploit tool for CVE-2023-4911, targeting the 'Looney Tunables' glibc vulnerability in various Linux distributions.

LooneyPwner Exploit tool for CVE-2023-4911, targeting the 'Looney Tunables' glibc vulnerability in various Linux distributions LooneyPwner is a proof-of-concept (PoC) exploit tool targeting the critical buffer overflow vulnerability, nicknamed "Looney Tunables," found in the GNU C Library (glibc) This flaw, officially tracked as CVE-2023-4911, is present i

CVE-2023-4911

looney-tuneables CVE-2023-4911 Install pwntools: githubcom/Gallopsled/pwntools apt-get update apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential python3 -m pip install --upgrade pip python3 -m pip install --upgrade pwntools

PoC for CVE-2023-4911

CVE-2023-4911 PoC for CVE-2023-4911

My Awesome List

Awesome Stars A curated list of my GitHub stars! Generated by starred Contents Assembly Batchfile C C# C++ CSS Clojure Dart Dockerfile Elixir Go HTML Java JavaScript Jinja Jupyter Notebook Kotlin LLVM Lua Markdown Nim OCaml Others PHP Perl PowerShell Python Ren'Py Rich Text Format Ruby Rust Scala Shell Solidity Starlark Stylus Svelte TeX TypeScript Typst V VBScript Vi

Repository containing a Proof of Concept (PoC) demonstrating the impact of CVE-2023-4911, a vulnerability in glibc's ld.so dynamic loader, exposing risks related to Looney Tunables.

GNU C Library's Dynamic Loader Vulnerability (CVE-2023-4911) Overview The GNU C Library (glibc) serves as the C library in the GNU system and is integral to Linux-based systems At its core, glibc defines essential functionalities for programs, including system calls and common functions like open, malloc, printf, and exit The dynamic loader, a vital component of glibc, p

Looney Tunables CVE-2023-4911

Step 1 Check the glibc version ldd --version Check if a machine is vulnerable to Looney Tunables CVE-2023-4911 env -i "GLIBC_TUNABLES=glibcmallocmxfast=glibcmallocmxfast=A" "Z=`printf '%08192x' 1`" /usr/bin/su --help If we get a Segmentation fault (core dumped), the

Looney Tunables Local privilege escalation (CVE-2023-4911) workshop

CVE-2023-4911-Looney-Tunables Looney Tunables Local privilege escalation (CVE-2023-4911) workshop (for educational purposes only) Links: IPPSEC video Qualsys Blog Post Qualsys Tech Details Exploit POC python script GLIBC sources GLIBC tunables documentation Description What is ldso? In computing, a dynamic linker is the part of an operating system that loads and links the sh

ScanD About ScanD runs a Container Image Security Vulnerability scan against all images running in a cluster and exposes the results as a prometheus guage metric /metrics example: scand_result{id="CVE-2023-4911-libc6",image="registryk8sio/kube-proxy@sha256:4bcb707da9898d2625f5d4edc6d0c96519a24f16db914fc673aa8f97e41dbabf",security_severity="78"}

Proof of concept for CVE-2023-4911 (Looney Tunables) discovered by Qualys Threat Research Unit

Proof of concept for CVE-2023-4911 (Looney Tunables) This vulnerability has been discovered by Qualys Threat Research Here you can read the advisory they published, it explains in depth the vulnerability The exploit has been tested on Ubuntu 22042 LTS with GLIBC 235-0ubuntu31 Testing the exploit The makefile allows testing the exploit in the following scenarios: With AS

CVE-2023-4911 - Looney Tunables This is a (atm very rough) proof of concept for CVE-2023-4911 So far I've only verified it works on Ubuntu 2210 kinetic Current version of the exploit contains a fair amount of "magic" offsets If you have suggestions on how to improve the heap shaping, feel free to send a PR my way :) This exploit is basically an implementatio

Looney-Tunables-CVE-2023-4911 Os arquivos utilizados estão anexados neste repositório #TASK 5 Primeiro, você deve executar o script Python para gerar o malware libcso6 Você precisará então compilar o exploit usando gcc: E por último podemos explorar e encontrar a flag roottxt What's the value of the flag in /root/root

CVEs Exploits I'm adding exploits for some CVEs that I wrote 2023 CVE-2023-4911 Buffer Overflow in glibc's ldso CVE-2021-3156 Heap-Based Buffer Overflow in Sudo 2021 CVE-2015-6967 Nibbleblog 403 CVE-2020-28038 WordPress before 552

run programs and scripts suid

Warning! See "Security" section at the end SUID Somewhat an inverse to sudo but with security first Usage git clone githubcom/hilbix/suidgit cd suid make sudo make install Afterwards you can run something as suid command args suid is inverse to sudo in the sense, that sudo

Study Project : Linux 資訊安全檢測與漏洞分析 Linux Information Security Scanning And Vulnerability Assessment

Linux 資訊安全檢測與漏洞分析 【Linux Information Security Auditing And Exploitation Analysis】 :::info Study: Linux資訊安全檢測與漏洞分析 Author: [name=張呈顥(武田奈々)]$_{link}$ Advisor: [name=盧東華]$_{link}$ GitHub ::: ⭐ Keypoint 資安弱點掃描與檢測 自動化腳本撰寫 Linux kernel and applications 漏洞利用與原理(CVE-2