The DefaultActionMapper class in Apache Struts 2 supports a method for short-circuit navigation state changes by prefixing parameters like "redirect:" or "redirect-action:". The information contained in these prefixes is not properly sanitized before being evaluated as OGNL expressions on the server side, which allows remote attackers to execute arbitrary Java code on the server. This module exploits the vulnerability in any web application built on top of vulnerable versions of the Apache Struts 2 framework.

The vmx86 kext ioctl handler, part of the VMware Fusion application, allow unprivileged process to initialize function pointers. This module exploits the vulnerability via the 0x802E564A ioctl, obtaining root privileges.

Exploits a missing verification of the path in the command "sudoedit", provided by the sudo package. This can be exploited to e.g. execute any command as root including a shell, allowing an unprivileged process to elevate privileges to root.

The setuid-set ViscosityHelper binary insecurely executes certain scripts and can be exploited to gain escalated privileges via symlink attacks.

This module exploits a buffer overflow vulnerability in smcFanControl in Apple Mac OS X 10.4 that allows local users to get code execution with elevated privileges.

This module exploits a vulnerability in the The PPP daemon (pppd) in Apple Mac OS X which allows an attacker to load arbitrary plugins and gain root privileges by bypassing this check.

This module exploits a vulnerability on "i386_set_ldt" function of "mach_kernel" creating a "call gate" entry in the LDT. Then it jumps to the new call gate selector, setting from the ring 0 the UID and the EUID of the current process to ROOT ( ID 0 ).

This module exploits a format string vulnerability in CUPS lppasswd in Apple Mac OS X 10.5.6 that allows local users to get code execution with elevated privileges. Exploitation requires valid local user, with access to the lppasswd command. After successful exploitation an agent will be deployed. This agent will inherit the user identity and capabilities of the previous agent. However, the euid (as opposite to the uid) of the agent may be not that of the super user (usually is "nobody"), and by using the setuid module (see setuid module documentation), it can be changed to zero (root).

This module exploits a vulnerability in ARDAgent in Apple Mac OS X 10.4 and 10.5 that allows local users to gain privileges via an osascript tell command.

When a process executes a setuid executable, all existing rights to the task port are invalidated, to make sure unauthorized processes do not retain control of the process. Exception handlers however remain installed, and when some kind of hardware exception occurs, the exception handler can receive a new right to the task port as one of its arguments, and thus regain full control over the process. Interestingly, the code to reset the exception handlers (and hence thwart this attack) upon exec() of a setuid executable has been present in the kernel since OSX 10.3, but is disabled (#if 0) for unspecified reasons.