Libdbus 1.5.x and earlier, when used in setuid processes not clearing the environment variables, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. This module exploits the vulnerability as present on the Xorg setuid binary and installs an agent with root privileges.

There is an exploitable buffer overflow in the SSINC.DLL file used by Microsoft IIS 5.0. The problem is triggered while including long enough filenames in any ASP file. After successful exploitation an agent will be installed. The process being exploited is usually run as an IUSR or IWAM user, specially created for IIS to answer anonymous requests. If this condition is present, the newly deployed agent will run with an unprivileged user. In most cases, the RevertToSelf Win32 API call can be used, available with the RevertToSelf module (see "RevertToSelf") to replace the current process access token with the saved one, usually SYSTEM, thus, effectively gaining full control of the target host.

IBM Director is prone to a privilege-escalation vulnerability that affects the CIM server. Attackers can leverage this issue to execute arbitrary code with elevated privileges in the context of the CIM server process.

The GNU C dynamic linker (ld.so) is prone to a local privilege-escalation vulnerability. This module exploits the vulnerability to create a world writable file in the /etc/cron.d directory. Then it uses the file to install an agent with root privileges. Finally the world writable file is deleted.

The GNU C library (GNU glibc) is prone to a local privilege-escalation vulnerability. This module exploits the vulnerability to install an agent with root privileges.

The bdfReadCharacters() function in the libXfont component of X.Org is prone to a stack-based buffer overflow vulnerability when parsing a specially crafted BDF font file. This vulnerability can be exploited by a local unprivileged attacker to gain root privileges.

Local attackers can exploit this issue to execute arbitrary code with superuser privileges. Successfully exploiting this issue will facilitate the complete compromise of affected computers.

On Intel CPUs, sysret to non-canonical addresses causes a fault on the sysret instruction itself after the stack pointer is set to guest value but before the current privilege level (CPL) is changed. FreeBSD is vulnerable to this issue due to insufficient sanity checks when returning from a system call. This module exploits the vulnerability and installs an agent with root privileges.

Due to spurious call to pfs_unlock() in pfs_getattr() (as defined in sys/fs/pseudofs/pseudofs_vnops.c), null pointer is dereferenced after calling extattr_get_attribute() on pseudofs vnode. By allocating page at address 0x0, attacker can overwrite arbitrarily chosen portion of kernel memory, leading to crash or local root escalation. This module exploits the vulnerability via the procfs file system, obtaining root privileges.

Improper input validation in the FreeBSD kernel's NFS client-side implementation allows local unprivileged users to escalate their privileges and execute arbitrary code with root permissions. The function nfs_mount() in file src/sys/nfsclient/nfs_vfsops.c, which is reachable from the mount and nmount system calls, employs an insufficient input validation method for copying data passed in a structure of type nfs_args from userspace to kernel. Specifically, the file handle buffer to be mounted (args.fh) and its size (args.fhsize) are completely user-controllable. This vulnerability can cause a kernel stack overflow which leads to privilege escalation.