Netcat v1.10 NT Stack Buffer Overflow

This module exploits a stack buffer overflow in Netcat v1.10 NT. By sending an overly long string we are able to overwrite SEH. The vulnerability exists when netcat is used to bind -e an executable to a port in doexec.c. This module tested successfully using "c:\nc -L -p 31337 -e ftp". Module...

IPSwitch WhatsUp Gold 8.03 Remote Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ========================================================= IPSwitch WhatsUp Gold 8.03 Remote Buffer Overflow Exploit ========================================================= !/usr/bin/perl LoWNOISE NotmuchG.pl v.1.5...

Zinf Audio Player 2.2.1 (PLS File) Stack Buffer Overflow

This module exploits a stack-based buffer overflow in the Zinf Audio Player 2.2.1. An attacker must send the file to victim and the victim must open the file. Alternatively it may be possible to execute code remotely via an embedded PLS file within a browser, when the PLS extension is registered ...

AOL Instant Messenger goaway Overflow

This module exploits a flaw in the handling of AOL Instant Messenger's 'goaway' URI handler. An attacker can execute arbitrary code by supplying an overly sized buffer as the 'message' parameter. This issue is known to affect AOL Instant Messenger 5.5. Module Options msf use...

Sasser Worm ftpd - Remote Buffer Overflow (port 5554)

Sasser Worm ftpd - Remote Buffer Overflow port 5554 / / // / / / / \ / / / / / / / // // / // / // //// - ROMANIAN SECURITY RESEARCH 2004 - sasser va-e exploit of its ftpd server exploit version 1.4, public author: mandragore date: Mon May 10 16:13:31 2004 vuln type: SEH ptr overwriting greets:...

RhinoSoft Serv-U FTPd Server 4.x - site chmod Remote Buffer Overflow

RhinoSoft Serv-U FTPd Server 4.x - site chmod Remote Buffer Overflow include include include include define exploitlength 511 define NOP 'A' define SEHhandleroffset 400 char SEHhandler = "\x41\x41\xEB\x04"; // 3 jmp over next four bytes char retaddress4004 = "\xab\x1c\x5f\x01"; // 1...

shatterSEH3.txt

============================================================================ = Shattering SEH III = = [email protected] = http://www.security-assessment.com = = Originally posted: September 29, 2003 ============================================================================ ==...

Shattering SEH II

========================================================================= = Shattering SEH II = = [email protected] = http://www.security-assessment.com = = Originally posted: July 28, 2003 ========================================================================= == Background =...

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error (1)

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error 1 // source: https://www.securityfocus.com/bid/5408/info A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely...

0815 ++ */ SEH_Web

Phenoelit Advisory wir-haben-auch-mal-was-gefunden 0815 +--+ Authors FX [email protected] kim0 [email protected] Phenoelit Group http://www.phenoelit.de Advisory http://www.phenoelit.de/stuff/SEHWeb.txt Affected Products SEH GmbH IC9 Pocket Print Server Tested on SEH IC9 Firmware 7.1.30 and 7.1.36f...

GAMSoft TelSrv 1.5 Username Buffer Overflow

This module exploits a username sprintf stack buffer overflow in GAMSoft TelSrv 1.5. Other versions may also be affected. The service terminates after exploitation, so you only get one chance! Module Options msf use exploit/windows/telnet/gamsoft/telsrvusername msf undefinedtelsrvusername show...