ImageMagick 6.8.8-4 - Local Buffer Overflow (SEH)

I saw the notice for this CVE today but there was no known published expoits so I figured I'd put together this quick POC. Note, all app modules for the tested version were compiled with safeSEH so my use of an OS module may require adjustment of the offsets. There also appears to be several bad...

ImageMagick 6.8.8-4 - Local Buffer Overflow (SEH)

ImageMagick 6.8.8-4 - Local Buffer Overflow SEH !/usr/bin/perl Exploit Title: ImageMagick 6.8.8-5 - Local Buffer Overflow SEH Date: 2-13-2014 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software: ImageMagick all versions prior to 6.8.8-5 Software Link:...

ImageMagick 6.8.8-4 - Local Buffer Overflow (SEH)

!/usr/bin/perl Exploit Title: ImageMagick 6.8.8-5 - Local Buffer Overflow SEH Date: 2-13-2014 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software: ImageMagick all versions prior to 6.8.8-5 Software Link: http://ftp.sunet.se/pub/multimedia/graphics/ImageMagick/binaries/ Versio...

Publish-It 3.6d - '.pui' Local Buffer Overflow (SEH)

!/usr/bin ruby env Exploit Title: Publish-It 3.6d - SEH Buffer Overflow Date: 8/2/2014 Exploit Author: Muhamad Fadzil Ramli Vendor HomePage: https://www.postersw.com Software Link: https://www.postersw.com/publish3.exe Version App: v3.6d Tested on: Windows 7 x86 - Version 6.1.7600 CVE:None Notes:...

Adrenalin Player 2.2.5.3 - '.m3u' Local Buffer Overflow (SEH) (ASLR + DEP Bypass)

!/usr/bin env ruby Exploit Title: Adrenalin Player 2.2.5.3 .m3u SEH-Buffer Overflow ASLR+DEP Bypass Date: 3/2/2014 Exploit Author: Muhamad Fadzil Ramli Vendor HomePage: http://software.naver.com/software/summary.nhn?softwareId=MFS100099 Software Link:...

haneWIN DNS Server 1.5.3 - Buffer Overflow Exploit (SEH)

Exploit for windows platform in category remote exploits !/usr/bin/python Exploit Title: haneWIN DNS Server SEH Author: Dario Estrada dash https://intrusionlabs.org Date: 2014-01-29 Version: haneWIN DNS Server 1.5.3 Vendor Homepage: http://www.hanewin.net/ Vulnerable app...

haneWIN DNS Server 1.5.3 Buffer Overflow

!/usr/bin/python Exploit Title: haneWIN DNS Server SEH Author: Dario Estrada dash https://intrusionlabs.org Date: 2014-01-29 Version: haneWIN DNS Server 1.5.3 Vendor Homepage: http://www.hanewin.net/ Vulnerable app link:http://www.hanewin.net/dns-e.htm Tested on: Windows XP SP3 Thanks to God, to ...

haneWIN DNS Server 1.5.3 - Remote Buffer Overflow (SEH)

haneWIN DNS Server 1.5.3 - Remote Buffer Overflow SEH !/usr/bin/python Exploit Title: haneWIN DNS Server SEH Author: Dario Estrada dash https://intrusionlabs.org Date: 2014-01-29 Version: haneWIN DNS Server 1.5.3 Vendor Homepage: http://www.hanewin.net/ Vulnerable app...

haneWIN DNS Server 1.5.3 - Remote Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: haneWIN DNS Server SEH Author: Dario Estrada dash https://intrusionlabs.org Date: 2014-01-29 Version: haneWIN DNS Server 1.5.3 Vendor Homepage: http://www.hanewin.net/ Vulnerable app link:http://www.hanewin.net/dns-e.htm Tested on: Windows XP SP3 Thanks to God, to ...

Daum Game 1.1.0.5 - ActiveX 'IconCreate Method' Remote Stack Buffer Overflow

var overwrite =...

DaumGame ActiveX 1.1.0.x Buffer Overflow

Trustwave SpiderLabs Security Advisory TWSL2014-002: Buffer Overflow Vulnerability in DaumGame ActiveX Published: 01/07/2014 Version: 1.1 Vendor: Daum daum.net Product: Daum Game ActiveX Version affected: 1.1.0.5, 1.1.0.4 Product description: DaumGame ActiveX of Daum Communications is a plugin th...

DaumGame ActiveX 1.1.0.x缓冲区溢出漏洞

No description provided by source. Vendor: Daum daum.net Product: Daum Game ActiveX Version affected: 1.1.0.5, 1.1.0.4 Product description: DaumGame ActiveX of Daum Communications is a plugin that is required for playing in Daum Game website. Finding 1: ActiveX IconCreate SEH Overwrite Remote Cod...

Beetel Connection Manager 'NetConfig.ini'文件处理远程缓冲区溢出漏洞

BUGTRAQ ID: 63414 Beetel Connection Manager是一套3G无线上网卡的连接管理器。 Beetel Connection Manager验证 NetConfig.ini 文件不正确时可触发缓冲区溢出，这可使上下文独立的攻击者造成应用崩溃，停止响应，也可能执行任意代码。 0 beetel Beetel Connection Manager PCWBTLINDV1.0.0B04 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

GOM Player 2.2.53.5169 - .reg Local Buffer Overflow (SEH)

GOM Player 2.2.53.5169 - .reg Local Buffer Overflow SEH !/usr/bin/perl Exploit Title: GOM Player 2.2.53.5169 - SEH Buffer Overflow .reg Date: 11-26-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software/Version: GOM Player 2.2.53.5169 Vendor Site:...

GOM Player 2.2.53.5169 - '.reg' Local Buffer Overflow (SEH)

!/usr/bin/perl Exploit Title: GOM Player 2.2.53.5169 - SEH Buffer Overflow .reg Date: 11-26-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software/Version: GOM Player 2.2.53.5169 Vendor Site: http://player.gomlab.com/eng/ Vulnerable Software Link:...

Steinberg MyMp3PRO 5.0 SEH Buffer Overflow

!/usr/bin/ruby Vendor: http://cjcity.ru/soft/35-8.html Software link: http://cjcity.ru/2/downloader.php?id=00000000559 print ''' Steinberg MyMp3PRO v5.0 SEH Buffer Overflow Version: 5.0 Build 5.1.0.21 Date found: 04.12.2013 Exploit Author: metacom Tested on:XP-Sp3-EN ''' sleep3 junk="\x41" 1056...

Steinberg MyMp3PRO 5.0 - Local Buffer Overflow (SEH) (DEP Bypass + ROP)

Steinberg MyMp3PRO 5.0 - Local Buffer Overflow SEH DEP Bypass + ROP !/usr/bin/ruby print ''' Steinberg MyMp3PRO v5.0 Buffer Overflow Version: 5.0 Build 5.1.0.21 Date found: 04.12.2013 Exploit Author: metacom Tested on:XP-Sp3-EN ''' sleep3 junk="\x41" 1044 eip=0x7C86467B.pack'V'7C86467B FFE4 JMP E...

Steinberg MyMp3PRO v5.0 SEH Buffer Overflow

Exploit for windows platform in category local exploits !/usr/bin/ruby Vendor: http://cjcity.ru/soft/35-8.html Software link: http://cjcity.ru/2/downloader.php?id=00000000559 print ''' Steinberg MyMp3PRO v5.0 SEH Buffer Overflow Version: 5.0 Build 5.1.0.21 Date found: 04.12.2013 Exploit Author:...

Total Video Player 1.3.1 (Settings.ini) - SEH Buffer Overflow Vulnerability

Usage Info To Exploit: - Replace Settings.ini file in program folder e.g., "C:\Program Files\Total Video Player" - Start Application !/usr/bin/perl my $buffsize = 5000; sets buffer size for consistent sized payload my $header = "Support Groups\r\nVideo="; start of ini file my $footer =...

Kingsoft Office Writer 2012 8.1.0.3385 - '.wps' Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: Kingsoft Office Writer v2012 8.1.0.3385 .wps Buffer Overflow Exploit SEH Version: 2012 8.1.0.3385 Date: 2013-11-27 Author: Julien Ahrens @MrTuxracer Homepage: http://www.rcesecurity.com Software Link: http://www.kingsoftstore.com Tested on: WinXP-GER, Win7-GER,...