Exploit for Incorrect Type Conversion or Cast in Redhat Enterprise Linux Desktop

CVE-2018-12386 CVE-2018-12387 CVE-2018-17462 CVE-2018-2698 CVE-2018-2860 CVE-2018-3055 CVE-2018-4233 CVE-2018-4443

githubexploit · 2019-01-16

Description

Exploit for incorrect type conversion in VirtualBox leading to remote code execution.

Affected software

Redhat Enterprise Linux Desktop= 6.0, 7.0

Redhat Enterprise Linux Server= 6.0, 7.0

Redhat Enterprise Linux Server Aus= 7.6

Redhat Enterprise Linux Server Eus= 7.5, 7.6

All known vulnerabilities by product

Alt Linux Centos Firefox Red Hat Suse Ubuntu Virtualbox Safari

CVSS Score

9.6

HIGH SEVERITY

Version 3.0

VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:REQUIRED

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

100%confidence this exploit runs

Based on 44 file(s) in the source

EPSS Score

53.8%higher than 98.9% of all CVEs

Updated 2026-06-30

Exploit Details

Modified:2025-07-20 20:52

Last Seen:2025-08-31 23:13

Reporter:niklasb

Written in:C++

Last commit:2019-07-20

Tags

virtualboxtype conversion errorremote code executionvulnerability 2018 2860

Other exploits for the same CVE

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Safari

2025-09-14 mirrors_LinusHenzeGITEE

Exploit for CVE-2016-2434

2025-07-06 mirrors_externalistGITEE

Fuzzilli - A JavaScript Engine Fuzzer

2020-11-21 KitPloitKITPLOIT

Safari Webkit Proxy Object Type Confusion Exploit

2019-06-03 metasploitZDTRuby

Safari Webkit Proxy Object Type Confusion

2019-06-02 saeloPACKETSTORMRuby

Safari Webkit Proxy Object Type Confusion

2019-06-02 saelo, niklasb, Ian Beer, siguzaMETASPLOITRuby

WebKit JSC - 'AbstractValue::set' Use-After-Free

2019-01-02 Google Security ResearchEXPLOITDB

WebKit JSC AbstractValue::set Use-After-Free Exploit

2018-12-29 Google Security ResearchZDT

Exploit Code

README28 lines

## https://sploitus.com/exploit?id=36E25596-E1DF-59B9-B506-2852EB6F6A67
VirtualBox

* [CVE-2018-2860](https://github.com/niklasb/sploits/tree/master/virtualbox/hgcm-oob)
* [CVE-2018-2698](https://github.com/niklasb/sploits/tree/master/virtualbox/vbva-oob)
* [CVE-2018-3055+3085](https://github.com/niklasb/3dpwn/tree/master/CVE-2018-3055%2B3085) (3D)

Safari

* [CVE-2018-4233](https://github.com/niklasb/sploits/blob/master/safari/createthis.txt)
* [unnamed RCE #1](https://github.com/niklasb/sploits/blob/master/safari/ftl-butterfly-oob.js)
* [unnamed RCE #2](https://github.com/niklasb/sploits/blob/master/safari/array-overflow.js)
* [UXSS 1day](https://github.com/niklasb/sploits/blob/master/safari/regexp-uxss.html)
* [CVE-2018-4443](https://github.com/niklasb/sploits/blob/master/safari/cve-2018-4443)

Firefox

* [CVE-2018-12386](https://github.com/niklasb/sploits/blob/master/firefox/rce-register-misalloc.js) (Exploit by saelo & me)
* [CVE-2018-12387](https://github.com/niklasb/sploits/blob/master/firefox/stack-off-by-8.js)

Chrome:

* [CVE-2018-17462](https://github.com/niklasb/hack2win-chrome) (bug by Ned Williamson, exploit by the two of us)


## License

Unless otherwise noted, the files in this repository are released under the terms specified in the [`LICENSE`](https://github.com/niklasb/sploits/blob/master/LICENSE) file.