MOPB-header.txt

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP 4.4.65.2.1 - extgd Already Freed Resources Usage

PHP 4.4.65.2.1 - extgd Already Freed Resources Usage ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the...

PHP 5.2.1 - 'hash_update_file()' Freed Resource Usage

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit

Exploit for linux platform in category local exploits ======================================================= PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit ======================================================= ?php //////////////////////////////////////////////////////////////////////...

Snort 2.6.1.12.6.1.22.7.0 - fragementation Remote Denial of Service

Snort 2.6.1.12.6.1.22.7.0 - fragementation Remote Denial of Service / DOS Snort Inline Affected Versions: 2.6.1.1, 2.6.1.2, 2.7.0beta Requirements : Frag3 Enabled, Inline, Linux, ipconntrack disabled Antimatt3r [email protected] Offset needs to be supplied that would cause reassembly for...

Mandrake Linux Security Advisory : kernel (MDKSA-2007:040)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : The isdnpppccpresetallocstate function in drivers/isdn/isdnppp.c in the Linux 2.4 kernel before 2.4.34-rc4, as well as the 2.6 kernel, does not call the inittimer function for the ISDN PPP CCP reset state timer, which ha...

maildisable-v6.pl.txt

!/usr/bin/perl maildisable-v6.pl Mail Enable Professional =v2.35 win32 remote exploit by mu-b - Tue Dec 5 2006 - Tested on: Mail Enable Professional v2.35 win32 Note: timing is quite critical with this!!, so change $senddelay if it doesn't work.... use Getopt::Std; getopts't:n:', %arg; use Socket...

MailEnable Enterprise <= 2.32 - 2.34 Remote Buffer Overflow Exploit

No description provided by source. !/usr/bin/perl maildisable-v3.pl Mail Enable Professional/Enterprise v2.32-4 win32 remote exploit by mu-b - Thu Nov 23 2006 - Tested on: Mail Enable Professional v2.32 win32 - with HOTFIX Mail Enable Professional v2.33 win32 Mail Enable Professional v2.34 win32...

MailEnable IMAPD Enterprise 2.32 < 2.34 - Remote Buffer Overflow

!/usr/bin/perl maildisable-v3.pl Mail Enable Professional/Enterprise v2.32-4 win32 remote exploit by mu-b - Thu Nov 23 2006 - Tested on: Mail Enable Professional v2.32 win32 - with HOTFIX Mail Enable Professional v2.33 win32 Mail Enable Professional v2.34 win32 what does this remind you off? Note...

Windows Disable Windows ICF, Command Shell, Bind TCP Inline

Disable the Windows ICF, then listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 529 include Msf::Payload::Windows include...

Seattle Lab Mail 5.5 POP3 Buffer Overflow

There exists an unauthenticated buffer overflow vulnerability in the POP3 server of Seattle Lab Mail 5.5 when sending a password with excessive length. Successful exploitation should not crash either the service or the server; however, after initial use the port cannot be reused for successive...

Microsoft Word Document - Malformed Pointer (PoC)

===== The file I have attached is a very basic two stage bug. stage 1 the first mod forces the code down a wrong path. the second mod by itsself is harmless, however when used with the first it will be the first and part of the second overwrite. I have use 41414141 as a marker to make it easier f...

Solaris 2.4 passwd, yppasswd, and nispasswd Overflow Exploits

No description provided by source. ---------------------------- file newpass.c ------------------------------- include stdio.h include syslog.h define hiddenpasswd "/bin/hpasswd" /change here .../ define MAXLENGTH 32 void mainint argc, char argv int i; char args10; ifargc 10 args0=hiddenpasswd;...

Cisco IOS GRE报文路由选项解析溢出漏洞

Cisco互联网操作系统（IOS）是Cisco设备所使用的操作系统。 Cisco Systems IOS在解析包含有GRE源路由信息的GRE报文时存在漏洞，远程攻击者可能导致设备处理报文出错。 如果收到了特制的GRE报文的话，IOS设备没有验证偏移字段是否指向报文内，如果偏移值被设置为负值，IOS直接从包含有IP报文全长的整数中减去了偏移，导致缓冲区访问越界溢出。这可能导致将报文环缓冲区（ring buffer）的其他内存内容解释为负载IP报文并以很大的长度信息重新注入到路由队列中： GRE decapsulated IP 0.3.74.0-0.0.1.30 len=65407,...

eIQNetworks ESA License Manager LICMGR_ADDLICENSE Overflow

This module exploits a stack buffer overflow in eIQnetworks Enterprise Security Analyzer. During the processing of long arguments to the LICMGRADDLICENSE command, a stack-based buffer overflow occurs. This module has only been tested against ESA v2.1.13. This module requires Metasploit:...

PowerZip 7.06.38950 - 'Filename Handling' Local Buffer Overflow

/ PowerZip 7.06 Exploit by bratax http://www.bratax.be/ Just a quick one as I was able to reuse most of my zipcentral eploit code.. Greetz to everyone I like...special greetz to mobbie and DT as they were sad I didn't mention them the previous time :p Some technical info: - Original advisory +...

Cyrus IMAPD 2.3.2 - 'pop3d' Remote Buffer Overflow (3)

!/usr/bin/perl Creator: K-sPecial xzziroz.net of .aware awarenetwork.org Name: bid-18056.pl Date: 08/12/2006 Description: this is yet another exploit for the cyrus pop3d buffer overflow. I tried both public exploits and not either of them worked not that they don't but coding my own is generaly...

CVE-2006-3464

TIFF library libtiff before 3.8.2 allows context-dependent attackers to pass numeric range checks and possibly execute code, and trigger assert errors, via large offset values in a TIFF directory that lead to an integer overflow and other unspecified vectors involving "unchecked arithmetic...

gdiplus.pl.txt

!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...

Gdiplus.dll division by 0

!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...