PostgreSQL for Microsoft Windows Payload Execution

On default Microsoft Windows installations of PostgreSQL the postgres service account may write to the current directory which is usually "C:\Program Files\PostgreSQL\\data" where is the major.minor version of PostgreSQL. UDF DLL's may be sourced from there as well. This module uploads a Windows...

(0Day) IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes. User interaction is required to exploit this vulnerability. The specific flaw exists within the handling of malformed strings within cai:// URIs. The '--launcher.library' switch ca...

Adobe Illustrator Path Subversion Arbitrary DLL Injection Code Execution (APSB10-29)

The version of Adobe Illustrator installed on the remote host is earlier than 15.0.2. Such versions insecurely look in their current working directory when resolving DLL and file dependencies, such as for 'aires.dll'. If a malicious DLL with the same name as a required DLL is located in the...

BlackBerry Desktop Software < 6.0 B47 Path Subversion Arbitrary DLL Injection Code Execution

BlackBerry Desktop Software has a DLL loading vulnerability that occurs when the program searches for a DLL file in the current working directory. Attackers may exploit the issue by placing a specially crafted DLL file and another file associated with the application in an location controlled by...

TeamViewer Path Subversion Arbitrary DLL Injection Code Execution

The version of TeamViewer installed on the remote Windows host is earlier than 5.0.9104. Such versions insecurely look in their current working directory when resolving DLL dependencies, such as for 'dwmapi.dll'. Attackers may exploit the issue by placing a specially crafted DLL file and another...

Opera < 10.62 Path Subversion Arbitrary DLL Injection Code Execution

The version of Opera installed on the remote host is earlier than 10.62. Such versions insecurely look in their current working directory when resolving DLL dependencies, such as for 'dwmapi.dll' If another application can be made to launch Opera in such a way that it searches for DLLs in the sam...

Wireshark / Ethereal < 1.2.11 / 1.0.16 Path Subversion Arbitrary DLL Injection Code Execution

The installed version of Wireshark or Ethereal is 1.2.0 - 1.2.10 or 0.8.4 - 1.0.15. Such versions are affected by the following vulnerability : - The application uses a fixed path to look for specific files or libraries, such as for 'airpcap.dll', and this path includes directories that may not b...

VLC Media Player < 1.1.4 Patch Subversion Arbitrary DLL Injection Code Execution (deprecated)

Binary data 5651.prm...

VLC Media Player < 1.1.4 Path Subversion Arbitrary DLL Injection Code Execution

The version of VLC media player installed on the remote host is earlier than 1.1.4. Such versions insecurely look in their current working directory when resolving DLL dependencies, such as for 'wintab32.dll'. If a malicious DLL with the same name as a required DLL is located in the application's...

Inside the Black Energy 2 Botnet

By Dmitry Tarakanov Cybercriminals use a variety of bots to conduct DDoS attacks on Internet servers. One of the most popular tools is called Black Energy. To date, Kaspersky Lab has identified and implemented detection for over 4,000 modifications of this malicious program. In mid-2008 malware...

minerCPP 0.4b Buffer Overflow / Format String

!/usr/bin/env python minerCPP 0.4b Remote BOF+Format String Attack Exploit Software Link: http://sourceforge.net/projects/minercpp/ Author: l3D Sites: http://xraysecurity.blogspot.com, http://nullbyte.org.il IRC: irc://irc.nix.co.il Email: [email protected] Tested on Windows 7 In order to make...

Reflective DLL Injection, Reverse TCP Stager (DNS)

Inject a DLL via a reflective loader. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 321 include Msf::Payload::Stager include...

By injecting the Winlogon process intercepts the system password-vulnerability warning-the black bar safety net

Komaki original article, reproduced please indicate the source. Thank you. http://blog.hack.la QQ: 4 2 8 9 0 3 0 A． Winlogon. exe is a prerequisite for the user login process, and. We will now be through DLL injection, to achieve the intercepted system login user name and password and other...

Reflective DLL Injection, Reverse All-Port TCP Stager

Inject a DLL via a reflective loader. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 include...

ZDI-09-046: Novell Privileged User Manager Remote DLL Injection Vulnerability

ZDI-09-046: Novell Privileged User Manager Remote DLL Injection Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-046 July 21, 2009 -- Affected Vendors: Novell -- Affected Products: Novell Privileged User Manager -- Vulnerability Details: This vulnerability allows remote attackers ...

Novell Privileged User Manager Remote DLL Injection Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of Novell's Privileged User Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the unifid.exe service which binds on port 29010 for a...

Reflective DLL Injection, Bind TCP Stager (Windows x86)

Inject a DLL via a reflective loader. Listen for a connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

Reflective DLL Injection, Reverse TCP Stager (IPv6)

Inject a DLL via a reflective loader. Connect back to the attacker over IPv6 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 289 include Msf::Payload::Stager include...

Reflective DLL Injection, Bind IPv6 TCP Stager (Windows x86)

Inject a DLL via a reflective loader. Listen for an IPv6 connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

Reflective DLL Injection, Reverse TCP Stager (No NX or Win7)

Inject a DLL via a reflective loader. Connect back to the attacker No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 177 include Msf::Payload::Stager include...