Metasploit modules that can be used to exploit Linux » Linux Kernel » 2.6.14.1

Order by Disclosure Date Module Name Module Type
  • Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation
    Disclosure Date: 2018-11-01
    First seen: 2020-04-26
    exploit/linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc
    This module attempts to gain root privileges on Linux systems by abusing a NULL pointer dereference in the `rds_atomic_free_op` function in the Reliable Datagram Sockets (RDS) kernel module (rds.ko). Successful exploitation requires the RDS kernel module to be loaded. If the RDS module is not blacklisted (default); then it will be loaded automatically. This exploit supports 64-bit Ubuntu Linux systems, including distributions based on Ubuntu, such as Linux Mint and Zorin OS. Target offsets are available for: Ubuntu 16.04 kernels 4.4.0 <= 4.4.0-116-generic; and Ubuntu 16.04 kernels 4.8.0 <= 4.8.0-54-generic. This exploit does not bypass SMAP. Bypasses for SMEP and KASLR are included. Failed exploitation may crash the kernel. This module has been tested successfully on various 4.4 and 4.8 kernels. Authors: - Mohamed Ghannam - Jann Horn - wbowling - bcoles <bcoles@gmail.com> - nstarke
  • Solaris RSH Stack Clash Privilege Escalation
    Disclosure Date: 2017-06-19
    First seen: 2020-04-26
    exploit/solaris/local/rsh_stack_clash_priv_esc
    This module exploits a vulnerability in RSH on unpatched Solaris systems which allows users to gain root privileges. The stack guard page on unpatched Solaris systems is of insufficient size to prevent collisions between the stack and heap memory, aka Stack Clash. This module uploads and executes Qualys' Solaris_rsh.c exploit, which exploits a vulnerability in RSH to bypass the stack guard page to write to the stack and create a SUID root shell. This module has offsets for Solaris versions 11.1 (x86) and Solaris 11.3 (x86). Exploitation will usually complete within a few minutes using the default number of worker threads (10). Occasionally, exploitation will fail. If the target system is vulnerable, usually re-running the exploit will be successful. This module has been tested successfully on Solaris 11.1 (x86) and Solaris 11.3 (x86). Authors: - Qualys Corporation - bcoles <bcoles@gmail.com>
  • Linux Kernel 4.6.3 Netfilter Privilege Escalation
    Disclosure Date: 2016-06-03
    First seen: 2020-04-26
    exploit/linux/local/netfilter_priv_esc_ipv4
    This module attempts to exploit a netfilter bug on Linux Kernels before 4.6.3, and currently only works against Ubuntu 16.04 (not 16.04.1) with kernel 4.4.0-21-generic. Several conditions have to be met for successful exploitation: Ubuntu: 1. ip_tables.ko (ubuntu), iptable_raw (fedora) has to be loaded (root running iptables -L will do such) 2. libc6-dev-i386 (ubuntu), glibc-devel.i686 & libgcc.i686 (fedora) needs to be installed to compile Kernel 4.4.0-31-generic and newer are not vulnerable. This exploit does not bypass SMEP/SMAP. We write the ascii files and compile on target instead of locally since metasm bombs for not having cdefs.h (even if locally installed) Authors: - h00die <mike@stcyrsecurity.com> - vnik - Jesse Hertz - Tim Newsham
  • Overlayfs Privilege Escalation
    Disclosure Date: 2015-06-16
    First seen: 2020-04-26
    exploit/linux/local/overlayfs_priv_esc
    This module attempts to exploit two different CVEs related to overlayfs. CVE-2015-1328: Ubuntu specific -> 3.13.0-24 (14.04 default) < 3.13.0-55 3.16.0-25 (14.10 default) < 3.16.0-41 3.19.0-18 (15.04 default) < 3.19.0-21 CVE-2015-8660: Ubuntu: 3.19.0-18 < 3.19.0-43 4.2.0-18 < 4.2.0-23 (14.04.1, 15.10) Fedora: < 4.2.8 (vulnerable, un-tested) Red Hat: < 3.10.0-327 (rhel 6, vulnerable, un-tested) Authors: - h00die <mike@shorebreaksecurity.com> - rebel
  • Android 'Towelroot' Futex Requeue Kernel Exploit
    Disclosure Date: 2014-05-03
    First seen: 2020-04-26
    exploit/android/local/futex_requeue
    This module exploits a bug in futex_requeue in the Linux kernel, using similar techniques employed by the towelroot exploit. Any Android device with a kernel built before June 2014 is likely to be vulnerable. Authors: - Pinkie Pie - geohot - timwr
  • Android get_user/put_user Exploit
    Disclosure Date: 2013-09-06
    First seen: 2020-04-26
    exploit/android/local/put_user_vroot
    This module exploits a missing check in the get_user and put_user API functions in the linux kernel before 3.5.5. The missing checks on these functions allow an unprivileged user to read and write kernel memory. This exploit first reads the kernel memory to identify the commit_creds and ptmx_fops address, then uses the write primitive to execute shellcode as uid 0. The exploit was first discovered in the wild in the vroot rooting application. Authors: - fi01 - cubeundcube - timwr
  • Reliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation
    Disclosure Date: 2010-10-20
    First seen: 2020-04-26
    exploit/linux/local/rds_rds_page_copy_user_priv_esc
    This module exploits a vulnerability in the `rds_page_copy_user` function in `net/rds/page.c` (RDS) in Linux kernel versions 2.6.30 to 2.6.36-rc8 to execute code as root (CVE-2010-3904). This module has been tested successfully on: Fedora 13 (i686) kernel version 2.6.33.3-85.fc13.i686.PAE; and Ubuntu 10.04 (x86_64) with kernel version 2.6.32-21-generic. Authors: - Dan Rosenberg - bcoles <bcoles@gmail.com>
  • Linux Kernel Sendpage Local Privilege Escalation
    Disclosure Date: 2009-08-13
    First seen: 2020-04-26
    exploit/linux/local/sock_sendpage
    The Linux kernel failed to properly initialize some entries in the proto_ops struct for several protocols, leading to NULL being dereferenced and used as a function pointer. By using mmap(2) to map page 0, an attacker can execute arbitrary code in the context of the kernel. Several public exploits exist for this vulnerability, including spender's wunderbar_emporium and rcvalle's ppc port, sock_sendpage.c. All Linux 2.4/2.6 versions since May 2001 are believed to be affected: 2.4.4 up to and including 2.4.37.4; 2.6.0 up to and including 2.6.30.4 This module has been tested successfully on CentOS 5.0 (i386) with kernel version 2.6.18-8.1.1.tl5; and Debian 3.1r8 Sarge (i686) with kernel version 2.4.27-3-386. Authors: - Tavis Ormandy - Julien Tinnes <julien at cr0.org> - spender - rcvalle - egypt <egypt@metasploit.com>
8 metasploit modules found
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close