2559 matches found
Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050)
Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference --------------------------------------------------------------------- Exploited by Piotr Bania // www.piotrbania.com Exploit for Vista SP2/SP1 only, should be reliable! Tested on: Vista sp2 6.0.6002.18005 Vista sp1 ultimate...
Windows win32k.sys驱动用户输入验证本地权限提升漏洞（MS10-048）
BUGTRAQ ID: 42210 CVE ID: CVE-2010-1896 Microsoft Windows是微软发布的非常流行的操作系统。 Windows中的win32k.sys内核驱动没有正确地验证用户态输入，本地用户可以通过执行恶意应用程序导致执行任意内核态代码。 Microsoft Windows XP SP3 Microsoft Windows XP Pro x64版SP2 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows Server 2008 SP2 Microsoft...
Input validation
The kernel in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate ACLs on kernel objects, which allows local users to cause a denial of service reboot via a crafted application, aka "Windows Kernel Improper Validation Vulnerability....
CVE-2010-1896
The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, and Windows Server 2008 Gold and SP2 do not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted...
MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP)
This module exploits a stack buffer overflow in the RPC interface of the Microsoft DNS service. The vulnerability is triggered when a long zone name parameter is supplied that contains escaped octal strings. This module is capable of bypassing NX/DEP protection on Windows 2003 SP1/SP2. This modul...
CA BrightStor Universal Agent - Remote Overflow (Metasploit)
$Id: universalagent.rb 9583 2010-06-22 19:11:05Z todb $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...
Microsoft Office COM对象验证远程代码执行漏洞（MS10-036）
BUGTRAQ ID: 40574 CVE ID: CVE-2010-1263 Microsoft Office是非常流行的办公软件套件。 Office中的组件在实例化对象时没有充分地验证COM对象，用户受骗打开了恶意的Excel、PowerPoint、Publisher、Visio 或Word文档就会导致执行任意代码。 Microsoft Office XP SP3 Microsoft Office 2007 SP2 Microsoft Office 2007 SP1 Microsoft Office 2003 Service Pack 3 临时解决方法：...
CVE-2010-1261
CVE-2010-1261 : A memory-corruption vulnerability in the Internet Explorer 8 Developer Toolbar (IE8) affects IE8 SP1/SP2/SP3. The connected MS knowledge base MS10-035 documents a remote code execution risk when processing a specially crafted page, due to uninitialized/deleted objects. Microsoft’s...
Microsoft Windows Outlook Express and Windows Mail Integer Overflow
Exploit for windows platform in category dos / poc =================================================================== Microsoft Windows Outlook Express and Windows Mail Integer Overflow =================================================================== Application: Microsoft Outlook Express...
Microsoft Outlook Express - NNTP Response Parsing Buffer Overflow (MS05-030) (Metasploit)
$Id: ms05030nntp.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...
HP Mercury Quality Center - ActiveX Control ProgColor Buffer Overflow (Metasploit)
$Id: hpmqcprogcolor.rb 9179 2010-04-30 08:40:19Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...
Microsoft SRV2.SYS SMB2 Logoff Remote Kernel NULL Pointer Dereference
This module triggers a NULL pointer dereference in the SRV2.SYS kernel driver when processing an SMB2 logoff request before a session has been correctly negotiated, resulting in a BSOD. Effecting Vista SP1/SP2 And possibly Server 2008 SP1/SP2, the flaw was resolved with MS09-050. This module...
CVE-2010-0810
CVE-2010-0810 corresponds to the Windows kernel exception handler vulnerability. Affected products per connected data: Windows Vista (Gold), SP1 and SP2, and Windows Server 2008 (Gold and SP2). Root cause: improper handling of certain exceptions in the Windows kernel, leading to a denial-of-servi...
Microsoft Windows MP3音频解码器栈溢出漏洞（MS10-026）
BUGTRAQ ID: 39303 CVE ID: CVE-2010-0480 Microsoft Windows是微软发布的非常流行的操作系统。 Windows中所使用的MP3编码解码器处理AVI媒体文件的方式中存在栈溢出漏洞。如果用户打开包含MP3音频流的特制的AVI文件，此漏洞可能允许远程执行代码。如果用户使用管理用户权限登录，成功利用此漏洞的攻击者便可完全控制受影响的系统。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Vista SP2 Microsoft Windows Vista SP...
PHP 6.0 Dev str_transliterate() Buffer Overflow
whoami whoami nt authority\system / errorreporting0; $bases = $GET'poss'; $basee = $GET'pose'; $offs = $GET'offs'; $offe = $GET'offe'; ifinigetbool'unicode.semantics' $buff = strrepeat"\u4141", 32; $tbp = "\u2650\u6EE5"; // 6EE52650 ADDRESS TO BE PATCHED BY WPM $ptw = "\u2FE0\u6EE5"; // 6EE52FE0...
PHP 6.0 Dev str_transliterate() Buffer overflow - NX + ASLR Bypass
No description provided by source. ?php / 04-06-2010 PHP 6.0 Dev strtransliterate 0Day Buffer Overflow Exploit Tested on Windows 2008 SP1 DEP alwayson Matteo Memelli aka ryujin AT offsec.com original sploit: http://www.exploit-db.com/exploits/12051 Author: Pr0T3cT10n Thx to muts and Elwood for...
Mocha LPD 1.9 - Remote Buffer Overflow (Denial of Service) (PoC)
!/usr/bin/python Mocha LPD v1.9 Remote Heap Overflow Exploit ol skool 'write 4' whoops, I said it was a DoS. My bad. btw yes, I know its 2010 :0 CVE: 2010-1687 tested on XP sp1 use anti debugging to see it work - !hidedebug zwqueryinformationprocess call trace: ntdll.RtlAllocateHeap Called...
PHP 6.0 Dev - str_transliterate() Local Buffer Overflow (NX + ASLR Bypass)
PHP 6.0 Dev - strtransliterate Local Buffer Overflow NX + ASLR Bypass whoami whoami nt authority\system / errorreporting0; $bases = $GET'poss'; $basee = $GET'pose'; $offs = $GET'offs'; $offe = $GET'offe'; ifinigetbool'unicode.semantics' $buff = strrepeat"\u4141", 32; $tbp = "\u2650\u6EE5"; //...
PHP 6.0 Dev str_transliterate() Buffer overflow - NX + ASLR Bypass
Exploit for windows platform in category local exploits ================================================================== PHP 6.0 Dev strtransliterate Buffer overflow - NX + ASLR Bypass ================================================================== whoami whoami nt authority\system /...
