Mozilla Firefox "nsTreeRange" Dangling Pointer Vulnerability

This module exploits a code execution vulnerability in Mozilla Firefox 3.6.x use exploit/windows/browser/mozilla/nstreerange msf undefinednstreerange show actions ...actions... msf undefinednstreerange set ACTION msf undefinednstreerange show options ...show and set options... msf...

U.S. investigators demand details about WikiLeaks' Twitter account from court !

U.S. investigators have gone to court to demand details about WikiLeaks' Twitter account, according to documents obtained Saturday -- the first revelation about the criminal case Washington is trying to build against those who leaked classified U.S. documents. The U.S. District Court for the...

NetSupport Manager Agent Remote Buffer Overflow

This module exploits a buffer overflow in NetSupport Manager Agent. It uses a similar ROP to the proftpdiac exploit in order to avoid non executable stack. Module Options msf use exploit/linux/misc/netsupport/manageragent msf undefinedmanageragent show actions ...actions... msf...

Internet Explorer CSS SetUserClip Memory Corruption

$Id: ms10090iecssclip.rb 11331 2010-12-14 18:41:20Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Internet Explorer CSS Tags Memory Corruption

$Id: ms10xxxiecssclip.rb 10912 2010-11-05 00:08:55Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption

This module exploits a memory corruption vulnerability within Microsoft's HTML engine mshtml. When parsing an HTML page containing a specially crafted CSS tag, memory corruption occurs that can lead arbitrary code execution. It seems like Microsoft code inadvertently increments a vtable pointer t...

ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)

This module exploits a stack-based buffer overflow in versions of ProFTPD server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a large number of Telnet IAC commands, an attacker can corrupt memory and execute arbitrary code. The Debian Squeeze version of the exploit uses a litt...

AoA Audio Extractor v2.x ActiveX ROP exploit

Exploit for windows platform in category remote exploits ============================================ AoA Audio Extractor v2.x ActiveX ROP exploit ============================================ AoA Audio Extractor v2.x ActiveX ROP exploit Hadji Samir - s-dzhotmail.fr & mrme - mrmenet-ninja.net ' RO...

AoA Audio Extractor 2.x - ActiveX ROP

AoA Audio Extractor 2.x - ActiveX ROP AoA Audio Extractor v2.x ActiveX ROP exploit Hadji Samir - s-dzhotmail.fr & mrme - mrmenet-ninja.net ' ROP magic begins here: Stack pivot seh = unescape"%72%2a%02%10"' 0x10022a72 == ADD ESP,604; RETN 4 ' VirtualProtect placeholders ; vp = "AAAA" vp = vp +...

AoA Audio Extractor 2.x Active-X Exploit

AoA Audio Extractor v2.x ActiveX ROP exploit Hadji Samir - s-dzhotmail.fr & mrme - mrmenet-ninja.net ' ROP magic begins here: Stack pivot seh = unescape"%72%2a%02%10"' 0x10022a72 == ADD ESP,604; RETN 4 ' VirtualProtect placeholders ; vp = "AAAA" vp = vp + "BBBB" vp = vp + "CCCC" vp = vp + "DDDD" ...

AoA Audio Extractor 2.x - ActiveX ROP

AoA Audio Extractor v2.x ActiveX ROP exploit Hadji Samir - s-dzhotmail.fr & mrme - mrmenet-ninja.net ' ROP magic begins here: Stack pivot seh = unescape"%72%2a%02%10"' 0x10022a72 == ADD ESP,604; RETN 4 ' VirtualProtect placeholders ; vp = "AAAA" vp = vp + "BBBB" vp = vp + "CCCC" vp = vp + "DDDD" ...

SnackAmp 3.1.3B Malicious SMP Buffer Overflow (SEH - DEP BYPASS)

Exploit for windows platform in category local exploits ================================================================ SnackAmp 3.1.3B Malicious SMP Buffer Overflow SEH - DEP BYPASS ================================================================ Exploit Title: SnackAmp 3.1.3B Malicious SMP...

SnackAmp 3.1.3B SMP Buffer Overflow

Exploit Title: SnackAmp 3.1.3B Malicious SMP Buffer Overflow Vulnerability SEH - DEP BYPASS Date: 09/24/10 Author: Muhamad Fadzil Ramli - mind1355 AT gmail DOT com Credit/Bug Found By: james AT learnsecurityonline DOT com Software Link: http://sourceforge.net/projects/snackamp/ Version: 3.1.3 Bet...

Integard Pro 2.2.0.9026 (Win7 ROP-Code Metasploit Module)

No description provided by source. Exploit Title: Integard Pro 2.2.0.9026 Win7 ROP-Code Metasploit Module Date: 2010-09-15 Author: Node Software Link: http://www.exploit-db.com/application/14941 Version: Race River Integard Pro 2.2.0.9026, integard32.dllv.2.0.0.306 Tested on: Windows 7 x64 Eng CV...

Audiotran 1.4.2.4 - Local Overflow (SEH) (DEP Bypass)

Exploit Title: Audiotran 1.4.2.4 SEH Overflow Exploit DEP Bypass Date: 09/20/10 Credit/Bug found by : Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Author: Muhamad Fadzil Ramli - mind1355 at gmail dot com Software Link: http://www.e-soft.co.uk/Audiotran.htm Version:...

Integard Pro 2.2.0.9026 - Windows 7 ROP-Code (Metasploit)

Integard Pro 2.2.0.9026 - Windows 7 ROP-Code Metasploit Exploit Title: Integard Pro 2.2.0.9026 Win7 ROP-Code Metasploit Module Date: 2010-09-15 Author: Node Version: Race River Integard Pro 2.2.0.9026, integard32.dllv.2.0.0.306 Tested on: Windows 7 x64 Eng CVE : - class Metasploit3 'Race River...

ASX To MP3 Converter 3.1.2.1 SEH Exploit

Exploit Title: ASX to MP3 Converter v3.1.2.1 SEH Exploit Multiple OS, DEP and ASLR Bypass Date: July 13, 2010 Author: Node Software Link: http://www.mini-stream.net/downloads/ASXtoMP3Converter.exe Version: Mini-Stream Software ASX to MP3 Converter v3.1.2.1.2010.03.30 Evaluation Tested on: Windows...

ASX to MP3 Converter 3.1.2.1 - Multiple OS ASLR + DEP Bypass (SEH) (Metasploit)

ASX to MP3 Converter 3.1.2.1 - Multiple OS ASLR + DEP Bypass SEH Metasploit Exploit Title: ASX to MP3 Converter v3.1.2.1 SEH Exploit Multiple OS, DEP and ASLR Bypass Date: July 13, 2010 Author: Node Software Link: http://www.mini-stream.net/downloads/ASXtoMP3Converter.exe Version: Mini-Stream...

ASX to MP3 Converter 3.1.2.1 - Multiple OS ASLR + DEP Bypass (SEH) (Metasploit)

Exploit Title: ASX to MP3 Converter v3.1.2.1 SEH Exploit Multiple OS, DEP and ASLR Bypass Date: July 13, 2010 Author: Node Software Link: http://www.mini-stream.net/downloads/ASXtoMP3Converter.exe Version: Mini-Stream Software ASX to MP3 Converter v3.1.2.1.2010.03.30 Evaluation Tested on: Windows...

Sun Java Web Server 7.0 u7 Exploit with DEP bypass

No description provided by source. Exploit Title: SJWSexv2 Date: 09/07/2010 Author: dmc Software Link: download link if available Version: 7.0 u7 Tested on: Windows XP SP3 - with and without DEP CVE : CVE-2010-0361 / Sun Java Web Server Exploit v2 Tested on: Sun Java Web Server 7.0 update 7 - XP...