BSD systems CARDP protocol DoS

It's possible to bring all nodes to backup state by using replay attack...

ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)

This module exploits a stack-based buffer overflow in versions of ProFTPD server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a large number of Telnet IAC commands, an attacker can corrupt memory and execute arbitrary code. Module Options msf use...

RealServer - Describe Buffer Overflow (Metasploit)

$Id: describe.rb 9971 2010-08-07 06:59:16Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Apple Mac OS X WebDAV内核扩展本地拒绝服务漏洞

BUGTRAQ ID: 41958 CVE ID: CVE-2010-1794 Mac OS X是苹果家族机器所使用的操作系统。 Mac OS X支持使用WebDAV共享，由内核扩展实现。本地用户可以使用默认安装的mountwebdav工具来加载WebDAV共享。 WebDAV内核扩展中存在拒绝服务漏洞，漏洞代码位于webdavmount函数中： MALLOCfmp-pmsocketname, struct sockaddr , args.pasocketnamelen, MTEMP, MWAITOK;...

Joomla! Component com_seyret - Local File Inclusion

Exploit Title: Joomla Component Seyret comseyret Date: 2010-06-26 Author: mlk Software Link: null Version: null Tested on: Linux,BSD and windows CVE : null Code : on paper Joomla Component Seyret comseyret - Local File Inclusion Vulnerability + Discovered by : mlk Renan + Teams : c00kies , BugSec...

Generic Payload Handler

This module is a stub that provides all of the features of the Metasploit payload system to exploits that have been launched outside of the framework. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Samba 2.2.8 (BSD x86) - 'trans2open' Remote Overflow (Metasploit)

$Id: trans2open.rb 9552 2010-06-17 22:11:43Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Preemptive Protection against Multiple Vendors OPIE Off-by-one Stack Buffer Overflow Vulnerability

A stack buffer overflow vulnerability has been reported in OPIE. OPIE, "One time Passwords In Everything", is a login and password package installed on the server and the client, which makes untrusted networks safer against password-sniffing packet analysis software. OPIE is shipped with DragonFl...

Q&A: HD Moore on Metasploit, Disclosure and Ethics

We conducted our third live chat this week, this one with HD Moore, the founder of the Metasploit Project and the CSO of Rapid7. Moore got a lot of great questions on a wide variety of topics, so if you weren’t able to join us, here’s a full transcript of the chat. Dennis Fisher: Hi everyone, and...

Apple 10.6.3 chpass BSD Insecure Temp File Creating In /etc

!/bin/sh Apple private/etc fantastics-macbook: fantastic$ ./prdelka-vs-APPLE-chpass.sh Apple /etc/I.HAX.9GrrKm fantastics-macbook: fantastic$ cat /etc/I.HAX.9GrrKm Turtle power -- prdelka cat evil.c include include int mainint ar...

29o3 CMS Remote File Inclusion

================================================ 29o3 CMS LibDir Multiple RFI Vulnerability ================================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //...

29o3 CMS (LibDir) Multiple RFI Vulnerability

Exploit for php platform in category web applications ============================================ 29o3 CMS LibDir Multiple RFI Vulnerability ============================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, ...

XTACACSD <= 4.1.2 report Buffer Overflow

XTACACSD. CVE-2008-7232. Remote exploit for freebsd platform $Id: xtacacsdreport.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information o...

Generic x86 Tight Loop

Generate a tight loop in the target process This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 2 include Msf::Payload::Single def initializeinfo = supermergeinfoinfo, 'Name' = 'Generi...

Shellcode - Win32 MessageBox Metasploit module

Shellcode - Win32 MessageBox Metasploit module. Shellcode exploit for win32 platform $Id: messagebox.rb 4 2010-02-26 00:28:00:00Z corelanc0d3r & rick2600 $ Installation instructions : Drop file in framework3/modules/payloads/singles/windows folder Usage : ./msfpayload windows/messagebox...

phpCOIN 1.2.1 (mod.php) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ========================================================== phpCOIN 1.2.1 mod.php Local File Inclusion Vulnerability ========================================================== Exploit Title: phpCOIN 1.2.1 mod.php LFI vulnerability Author: m...

BSD-based systems &#40;FreeBSD, NetBSD, OpenBSD&#41; index array overflow

Index array overflow in libc gdtoa function used by printf...

KAME IKE Daemon (racoon) INITIAL_CONTACT Improper Handling (CVE-2004-0164)

Racoon is an Internet Key Exchange IKE daemon for automatically keying IPsec connections. There exists a vulnerability in the IKE daemon of some BSD systems Such as NetBSD's racoon where sending specifically crafted IKE packets could remove an IPsec SA or all SAs. Once an attacker successfully...

FreeBSD fifo_vnops.c资源泄漏本地拒绝服务漏洞

BUGTRAQ ID: 36949 FreeBSD就是一种运行在Intel平台上、可以自由使用的开放源码Unix类系统。 FreeBSD的usr/src/sys/fs/fifofs/fifovnops.c文件中存在资源泄漏漏洞： / Open called to set up a new instance of a fifo or to find an active instance of a fifo. / / ARGSUSED / static int fifoopenap struct vopopenargs / struct vnode avp; int amode; struc...

How to find unix broiler-vulnerability warning-the black bar safety net

Why that is I and the x-laser together with looking for broiler? Because all our operations are all in the 3 3 8 9 broiler on. First of all, we are on to the same terminal, premise:the terminal is open,rather than doing it on your own,so that only the Terminal Services Manager can be usedand then...