Qualys Corporation Oracle Solaris 11.1/11.3 (RSH) - 'Stack Clash' Local Privilege Escalation
local solaris_x86 CVE-2017-3631;CVE-2017-3630;CVE-2017-3629

Jonathan Salwan Solaris/x86 - Sync() + reboot() + exit(0) Shellcode (48 bytes)
solaris_x86 48

Jonathan Salwan Solaris/x86 - Download File (http://shell-storm.org/exemple-solaris) Shellcode (79 bytes)
solaris_x86 79

Jonathan Salwan Solaris/x86 - Reboot() Shellcode (37 bytes)
solaris_x86 37

Jonathan Salwan Solaris/x86 - Halt Shellcode (36 bytes)
solaris_x86 36

Jonathan Salwan Solaris/x86 - execve(_/bin/sh___/bin/sh__NULL) Shellcode (27 bytes)
solaris_x86 27

shellcode.com.ar Solaris/x86 - execve(/bin/sh) Shellcode (43 bytes)
solaris_x86 43

John Babio Solaris/x86 - setuid(0) + /bin/cat /etc/shadow Shellcode (61 bytes)
solaris_x86 61

sm4x Solaris/x86 - setuid(0) + execve(/bin/cat_ /etc/shadow) + exit(0) Shellcode (59 bytes)
solaris_x86 59

sm4x Solaris/x86 - setuid(0) + execve(/bin/sh) + exit(0) + Null-Free Shellcode (39 bytes)
solaris_x86 39

anonymous Solaris/x86 - inetd Add Service + execve() Shellcode (201 bytes)
solaris_x86 201

anonymous Solaris/x86 - execve(/bin/sh) ToUpper Encoded Shellcode (84 bytes)
solaris_x86 84