[+] Solaris vulnerabilities:

Solaris 7: sadmind_exec SADMIND - weakness in default security settings - allows root - rootdown.pl **ttyprompt TELNET - buffer overflow in solaris login - manual through telnet client sendmail_exec LPD - line printer daemon buffer overflow - allows root heap_noir DTSPCD - CDE common desktop environment heap overflow TCP port 6112, runs with root ypupdated_exec YPUPDATED - weakness in handling of the command shell - allows root kcms_readfile kcms / ttdbserverd remote file read (only in msf2)

Solaris 8:
sadmind_exec SADMIND - weakness in default security settings - allows root - rootdown.pl **ttyprompt TELNET - buffer overflow in solaris login - manual through telnet client sendmail_exec LPD - line printer daemon buffer overflow - allows root heap_noir DTSPCD - CDE common desktop environment heap overflow TCP port 6112, runs with root ypupdated_exec YPUPDATED - weakness in handling of the command shell - allows root. no exploit - sadmind_adm_build_path SADMIND - stack buffer overflow in adm_build_path() function. kcms_readfile kcms / ttdbserverd remote file read (only in msf2)

solaris 9: sadmind_exec SADMIND - weakness in default security settings - allows root - rootdown.pl ypupdated_exec YPUPDATED - weakness in handling of the command shell - allows root. sadmind_adm_build_path SADMIND - stack buffer overflow in adm_build_path() function. kcms_readfile kcms / ttdbserverd remote file read (only in msf2)

Solaris 10: fuser TELNET - authentication bypass through -f command - can be manually exploited ypupdated_exec YPUPDATED - weakness in handling of the command shell - allows root.

Solaris 11: fuser TELNET - authentication bypass through -f command - can be manually exploited

[+] Adding solaris user:

useradd -u 0 -o pentestuser passwd -d pentestuser

[+] In addition, familiarise yourself with rpcinfo, nfsshell, showmount, 'mount -t nfs'.