1264 matches found
Microsoft Internet Explorer释放后重用远程代码执行漏洞
BUGTRAQ ID: 65551 CVECAN ID: CVE-2014-0322 Internet Explorer是微软公司推出的一款网页浏览器。 Microsoft Internet Explorer 10在实现上存在释放后重利用漏洞，攻击者可利用此漏洞修改任意地址处的内存字节，结合Flash ActionScript获取内存读写权限，读出actionscript中对象的虚表指针，从而绕过ASLR；然后使用ROOP技术绕过DEP。 0 Microsoft Internet Explorer 10 临时解决方法： 安装EMET或升级到IE 11以防恶意利用此漏洞。...
Microsoft Mitigation Bypass Bug Bounty Winner Yang Yu
Microsoft has paid out another $100,000 bounty as part of its Security Response Center’s bounty program. A researcher from Asia named Yang Yu was awarded the prize today for three mitigation bypass variants, Microsoft announced. “This payout reflects the fact that we learned something new that wi...
Internet Explorer CMarkup use-after-free vulnerability
Overview Microsoft Internet Explorer contains a use-after-free vulnerability in the MSHTML CMarkup component, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Internet Explorer contains a use-after-free vulnerability in the...
MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free
This module exploits an use after free condition on Internet Explorer as used in the wild as part of "Operation SnowMan" in February 2014. The module uses Flash Player 12 in order to bypass ASLR and DEP. Module Options msf use exploit/windows/browser/ms14/012cmarkupuaf msf undefined012cmarkupuaf...
Easy CD-DA Recorder PLS Buffer Overflow Exploit
Exploit for windows platform in category local exploits require 'msf/core' class Metasploit3 'Easy CD-DA Recorder PLS Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability in Easy CD-DA Recorder 2007, caused by a long string in a playlist entry. By...
Adrenalin Player 2.2.5.3 - .m3u Local Buffer Overflow (SEH) (ASLR + DEP Bypass)
Adrenalin Player 2.2.5.3 - .m3u Local Buffer Overflow SEH ASLR + DEP Bypass !/usr/bin env ruby Exploit Title: Adrenalin Player 2.2.5.3 .m3u SEH-Buffer Overflow ASLR+DEP Bypass Date: 3/2/2014 Exploit Author: Muhamad Fadzil Ramli Vendor HomePage:...
Adrenalin Player 2.2.5.3 - '.m3u' Local Buffer Overflow (SEH) (ASLR + DEP Bypass)
!/usr/bin env ruby Exploit Title: Adrenalin Player 2.2.5.3 .m3u SEH-Buffer Overflow ASLR+DEP Bypass Date: 3/2/2014 Exploit Author: Muhamad Fadzil Ramli Vendor HomePage: http://software.naver.com/software/summary.nhn?softwareId=MFS100099 Software Link:...
MS12-027 - Office 2010 DEP/ASLR Bypass Exploit
This module target Office 2010. The DEP/ASLR bypass on Office 2010 is done with article written by Anonymous. The ROP chain uses "msgr3en.dll", which will load after about 400 pages got load. This file is part of the Metasploit Framework and may be subject to redistribution and commercial...
RealNetworks RealPlayer 16.0.3.51/16.0.2.32 - '.rmp' Version Attribute Buffer Overflow
!/usr/bin/perl ----------------------------------------------------------------------------- Exploit Title: RealNetworks RealPlayer Version Attribute Buffer Overflow Date: Dec 20 2013 Exploit Author: Gabor Seljan Vendor Homepage: http://www.real.com Software Link:...
VUPlayer 2.49 - (.M3U) Universal Buffer Overflow (DEP Bypass)
Exploit for windows platform in category local exploits import struct p = open"ExploitVirtualProtect.m3u", "w" crash = "\x41" 1012 sc = "\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49" "\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"...
CVE-2 0 1 3-3 8 9 7 sample analysis study notes-vulnerability warning-the black bar safety net
Before, see FireEye on the CVE-2 0 1 3-3 8 9 3 analysis, see Use way relatively similar, the thought is the same, the analysis of learning, discovery led to the question of object is inconsistent, it does not use the ms-help load the office of hxdl structure of the ROP, and later in the BinVul on...
VUPlayer 2.49 - .m3u File Universal Buffer Overflow (DEP Bypass) (2)
VUPlayer 2.49 - .m3u File Universal Buffer Overflow DEP Bypass 2 VUPlayer 2.49 .M3U ExploitUniversal buffer overflow/DEP bypass Download: http://vuplayer.com/ Tested on Wind0ws XP SP3 DEP:OptOut Author: Lucfer ------ [email protected] free to tell me your ideas!! : All the Gadgets are from APP's...
VUPlayer 2.49 - '.m3u' File Universal Buffer Overflow (DEP Bypass) (2)
VUPlayer 2.49 .M3U ExploitUniversal buffer overflow/DEP bypass Download: http://vuplayer.com/ Tested on Wind0ws XP SP3 DEP:OptOut Author: Lucfer ------ [email protected] free to tell me your ideas!! : All the Gadgets are from APP's DLLsI could only use the addresses that doesnt start with null...
Castripper 2.50.70 - (.pls) DEP Exploit
Exploit for windows platform in category local exploits Castripper 2.50.70 .pls exploit Stack buffer overflow/DEP bypass Download: http://www.mini-stream.net/castripper/ Tested on Wind0ws XP SP3 DEP:OptOut Author: Lucfer ------ email protected All ROP gadgets are from the APP's DLLs except for th...
Castripper 2.50.70 - .pls DEP Bypass
Castripper 2.50.70 - .pls DEP Bypass Castripper 2.50.70 .pls exploit Stack buffer overflow/DEP bypass Download: http://www.mini-stream.net/castripper/ Tested on Wind0ws XP SP3 DEP:OptOut Author: Lucfer ------ [email protected] All ROP gadgets are from the APP's DLLs except for the hardcoded...
Castripper 2.50.70 - '.pls' DEP Bypass
Castripper 2.50.70 .pls exploit Stack buffer overflow/DEP bypass Download: http://www.mini-stream.net/castripper/ Tested on Wind0ws XP SP3 DEP:OptOut Author: Lucfer ------ [email protected] All ROP gadgets are from the APP's DLLs except for the hardcoded SetProcessDEPPolicy address import struct f =...
Steinberg MyMp3PRO 5.0 DEP Bypass With ROP
!/usr/bin/ruby Vendor: http://cjcity.ru/soft/35-8.html Software link: http://cjcity.ru/2/downloader.php?id=00000000559 print ''' Steinberg MyMp3PRO v5.0 DEP Bypass with ROP Version: 5.0 Build 5.1.0.21 Date found: 04.12.2013 Exploit Author: metacom Tested on:XP-Sp3-EN ''' sleep3 junk="\x41" 1044 R...
Steinberg MyMp3PRO v5.0 DEP Bypass with ROP
Exploit for windows platform in category local exploits !/usr/bin/ruby Vendor: http://cjcity.ru/soft/35-8.html Software link: http://cjcity.ru/2/downloader.php?id=00000000559 print ''' Steinberg MyMp3PRO v5.0 DEP Bypass with ROP Version: 5.0 Build 5.1.0.21 Date found: 04.12.2013 Exploit Author:...
Steinberg MyMp3PRO 5.0 - Local Buffer Overflow (SEH) (DEP Bypass + ROP)
Steinberg MyMp3PRO 5.0 - Local Buffer Overflow SEH DEP Bypass + ROP !/usr/bin/ruby print ''' Steinberg MyMp3PRO v5.0 Buffer Overflow Version: 5.0 Build 5.1.0.21 Date found: 04.12.2013 Exploit Author: metacom Tested on:XP-Sp3-EN ''' sleep3 junk="\x41" 1044 eip=0x7C86467B.pack'V'7C86467B FFE4 JMP E...
Steinberg MyMp3PRO 5.0 - Local Buffer Overflow (SEH) (DEP Bypass + ROP)
!/usr/bin/ruby print ''' Steinberg MyMp3PRO v5.0 Buffer Overflow Version: 5.0 Build 5.1.0.21 Date found: 04.12.2013 Exploit Author: metacom Tested on:XP-Sp3-EN ''' sleep3 junk="\x41" 1044 eip=0x7C86467B.pack'V'7C86467B FFE4 JMP ESP kernel32.dll nops="\x90" 100 landing zone...