ASX to MP3 converter < 3.1.3.7 - Stack Overflow (DEP Bypass) Exploit

Exploit for windows platform in category local exploits import struct,sys head =''' REF HREF="mms://site.com/ach/music/smpl/LACA-05928-002-tes''' offset 17375 junk = "A" 17375 0x1003df8e 0x774e1035 EIP="\x36\x10\x4e\x77" adjust="A" 4 def createropchain: ropgadgets = 0x73dd5dce, POP EAX RETN...

Counter Strike: Condition Zero - .BSP Map File Code Execution

Counter Strike: Condition Zero - .BSP Map File Code Execution !/usr/bin/env python Counter Strike: Condition Zero BSP map exploit By @DigitalCold Jun 11, 2017 E-DB Note: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42325.zip bsp-exploit-source.zip from binasc...

Counter Strike: Condition Zero - '.BSP' Map File Code Execution

!/usr/bin/env python Counter Strike: Condition Zero BSP map exploit By @DigitalCold Jun 11, 2017 E-DB Note: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42325.zip bsp-exploit-source.zip from binascii import hexlify, unhexlify from struct import pack, unpack...

Easy File Sharing HTTP Server 7.2 - POST Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Easy File Sharing HTTP Server 7.2 POST Buffer Overflow', 'Description' = %q This module exploits a POST buffer overflow in the Easy File Sharing F...

HPE Intelligent Management Center (iMC) 7.2 (E0403P10) - Code Execution

HPE Intelligent Management Center iMC 7.2 E0403P10 - Code Execution Vulnerability Summary The following advisory describes a Stack Buffer Overflow vulnerability found in HPE Intelligent Management Center version v7.2 E0403P10 Enterprise, this vulnerability leads to an exploitable remote code...

HPE Intelligent Management Center (iMC) 7.2 (E0403P10) - Code Execution

Vulnerability Summary The following advisory describes a Stack Buffer Overflow vulnerability found in HPE Intelligent Management Center version v7.2 E0403P10 Enterprise, this vulnerability leads to an exploitable remote code execution. HPE Intelligent Management Center iMC delivers comprehensive...

CVE-2017-7269 a few tips and BUG fixes-vulnerability warning-the black bar safety net

Seen the analysis, to talk about the use of a few tips. 1. Vulnerability scope The original poc above wrote only applies to the 03 r2, in fact, the most common of 03 sp2 can also be directly reproduced, so it seems that the attack range is very large, after all, the domestic selling most of the 0...

Firebird - Relational Database CNCT Group Number Buffer Overflow Exploit

Exploit for windows platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Firebird Relational Database CNCT Group Number Buffer Overflow',...

Firefox 50.0.2 after the release reuse vulnerability analysis CVE-2016-9899-a vulnerability warning-the black bar safety net

Author: k0shl reprint please indicate the source author blog:http://whereisk0shl. top Preface Small year has passed, New Year rhythm, give you worship a early years, a Happy New Year! Haven't come across such after the release reuse vulnerability, which vulnerability causes is a very classic...

Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE

This module exploits a stack Buffer Overflow in the GCore server GCoreServer.exe. The vulnerable webserver is running on Port 13003 and Port 13004, does not require authentication and affects all versions from 2003 till July 2016 Version 1.4.YYYYY. Module Options msf use...

Google Android TSP sysfs - cmd_store Multiple Overflows

Google Android TSP sysfs - cmdstore Multiple Overflows Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=967 The TSP touchscreen controller driver exposes several sysfs entries through which the driver may be configured. One such entry, "cmd", allows the user to write commands to ...

Google Android TSP sysfs - 'cmd_store' Multiple Overflows

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=967 The TSP touchscreen controller driver exposes several sysfs entries through which the driver may be configured. One such entry, "cmd", allows the user to write commands to be executed by the driver. Specifically, the "cmd" entr...

Easy Internet Sharing Proxy Server 2.2 - Remote Overflow (SEH) (Metasploit)

Easy Internet Sharing Proxy Server 2.2 - Remote Overflow SEH Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Easy Internet Sharing Proxy Server 2.2 SEH buffer...

Google Android 5.0 < 5.1.1 - 'Stagefright' .MP4 tx3g Integer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Android Stagefright MP4 tx3g Integer Overflow", 'Description' = %q This module exploits a integer overflow vulnerability in the...

PCMAN FTP 2.0.7 - ls Command Buffer Overflow (Metasploit)

Exploit for windows platform in category remote exploits =begin Exploit Title: WordPress Shopping Cart 3.0.4 Unrestricted File Upload Date: 22-06-2016 Software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z Exploit Author: quanyechavshuo Contact: email protected...

PCMan FTP Server 2.0.7 - 'ls' Remote Buffer Overflow (Metasploit)

=begin Exploit Title: WordPress Shopping Cart 3.0.4 Unrestricted File Upload Date: 22-06-2016 Software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z Exploit Author: quanyechavshuo Contact: [email protected] Website: http://xinghuacai.github.io Category: ft...

Through the ELF dynamic loading of the structure ROP chain Return-to-dl-resolve-the vulnerability warning-the black bar safety net

Play CTF game stick have know that PWN type of vulnerability topic will generally provide an executable program, and provide program run dynamically link the libc library. By the libc. so you can get the library function of the offset address, combined with the leak GOT the table in the libc...

PHP 5.5.33 / 7.0.4 - SNMP Format String

Exploit for multiple platform in category remote exploits // Should bypass ASLR/NX just fine // This exploit utilizes PHP's internal "%Z" zval // format specifier in order to achieve code-execution. // We fake an object-type zval in memory and then bounce // through it carefully. First though, we...

Apache 2.4.7 + PHP 7.0.2 - openssl_seal() Uninitialized Memory Code Execution

Apache 2.4.7 + PHP 7.0.2 - opensslseal Uninitialized Memory Code Execution ?php // Source: http://akat1.pl/?id=1 function getmaps $fh = fopen"/proc/self/maps", "r"; $maps = fread$fh, 331337; fclose$fh; return explode"\n", $maps; function findmap$sym $addr = 0; foreachgetmaps as $record if...

Apache 2.4.7 + PHP 7.0.2 - 'openssl_seal()' Uninitialized Memory Code Execution

?php // Source: http://akat1.pl/?id=1 function getmaps $fh = fopen"/proc/self/maps", "r"; $maps = fread$fh, 331337; fclose$fh; return explode"\n", $maps; function findmap$sym $addr = 0; foreachgetmaps as $record if strstr$record, $sym && strstr$record, "r-xp" $addr = hexdecexplode'-', $record0;...