Privilege escalation

afd.sys in the Ancillary Function Driver in Microsoft Windows Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."...

CVE-2012-0149: Improper Input Validation

afd.sys in the Ancillary Function Driver in Microsoft Windows Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."...

PT-2012-2351

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2003 SP2 Description The issue arises from improper validation of user-mode input passed to kernel mode by the Ancillary Function Driver afd.sys in Microsoft Windows. This could allow a local attacker to execute...

Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode Buffer Overflow

Exploit for windows platform in category remote exploits $Id: $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Sysax Multi Server 5.52 Buffer Overflow

!/usr/bin/python Title: Sysax Multi Server " sys.exit1 target = sys.argv1 port = intsys.argv2 user = sys.argv3 password = sys.argv4 opersys = sys.argv5 base64 encode the provided creds creds = base64.encodestringuser+"\x0a"+password msfpayload windows/shellbindtcp LPORT=4444 R|msfencode -e...

Sysax Multi Server <= 5.52 File Rename BoF RCE (Egghunter)

Exploit for windows platform in category remote exploits !/usr/bin/python Title: Sysax Multi Server " sys.exit1 target = sys.argv1 port = intsys.argv2 user = sys.argv3 password = sys.argv4 opersys = sys.argv5 base64 encode the provided creds creds = base64.encodestringuser+"\x0a"+password...

Sysax Multi Server 5.52 - File Rename Buffer Overflow Remote Code Execution (Egghunter)

Sysax Multi Server 5.52 - File Rename Buffer Overflow Remote Code Execution Egghunter !/usr/bin/python Title: Sysax Multi Server " sys.exit1 target = sys.argv1 port = intsys.argv2 user = sys.argv3 password = sys.argv4 opersys = sys.argv5 base64 encode the provided creds creds =...

Sysax Multi Server 5.52 - File Rename Buffer Overflow Remote Code Execution (Egghunter)

!/usr/bin/python Title: Sysax Multi Server " sys.exit1 target = sys.argv1 port = intsys.argv2 user = sys.argv3 password = sys.argv4 opersys = sys.argv5 base64 encode the provided creds creds = base64.encodestringuser+"\x0a"+password msfpayload windows/shellbindtcp LPORT=4444 R|msfencode -e...

Sphinix Mobile Web Server U3 3.1.2.47 Cross Site Scripting

Title : Sphinix Mobile Web Server Multiple Persistent XSS Vulnerabilities Author : Prabhu S Angadi SecPod Technologies www.secpod.com Vendor : http://www.sphinx-soft.com/MWS/index.html Advisory : http://secpod.org/blog/?p=453...

win32/xp sp2 ARABIC (ar) mechanism shellcode + proxy 500 bytes

Title :windows xp sp2 arabic mechanism shellcode 128 bytes+proxy=500bytes Author :TrOoN E-mail : email protected | www.facebook.com/fysl.fyslm Home : city 617 logts : Draria . algeria Web Site : www.1337day.com | 1337Day is ThE best pentes Security platform : WinDows XP sp 2 AraBic | platform i...

win32/xp sp2 ARABIC (ar) Message Box Shellcode (87 bytes)

Title : Windows XP SP2 ARABIC ar Message Box Shellcode 87 bytes Author :TrOoN E-mail : email protected | Facebook : www.facebook.com/fysl.fyslm Home : city 617 logts : Draria . algeria Web Site : www.1337day.com platform : WinDows sp2 arabiC Type : shell COde | etc... WARNING : Windows XP SP2...

Sysax Multi Server 5.50 - Create Folder Remote Code Execution Buffer Overflow (Metasploit)

Sysax Multi Server 5.50 - Create Folder Remote Code Execution Buffer Overflow Metasploit Title: Sysax Multi Server 5.50 Create Folder Remote Code Exec BoF MSF Module Author: Craig Freyman @cd1zz Tested on: XP SP3 32bit and Server 2003 SP2 32bitNo DEP Notes: My original exploit =...

MiniShare 1.4.1 0day exploit

Exploit for windows platform in category remote exploits !/usr/bin/python tested on WIN XP SP2 English tested on Jan 24 2012 01 : 19 AM Jakarta - Indonesia tested by red-dragon Inj3ct0r Exploit DataBase 1337day.com import socket targetip="10.10.10.129" evil = "GET " evil+= "\x90" 1787 1787 =...

Sysax Multi Server 5.50 Create Folder BOF

Exploit for windows platform in category remote exploits !/usr/bin/python Title: Sysax Multi Server 5.50 Create Folder BOF Author: Craig Freyman @cd1zz Tested on: XP SP3 32bit and Server 2003 SP2 32bitNo DEP Date Discovered: January 13, 2012 Vendor Contacted: January 15, 2012 Vendor Response:...

Sysax Multi Server 5.50 - Create Folder Buffer Overflow

!/usr/bin/python Title: Sysax Multi Server 5.50 Create Folder BOF Author: Craig Freyman @cd1zz Tested on: XP SP3 32bit and Server 2003 SP2 32bitNo DEP Date Discovered: January 13, 2012 Vendor Contacted: January 15, 2012 Vendor Response: January 16, 2012 Vendor Fix: Version 5.52 released on Januar...

CVE-2010-5082: Undefined Security Weakness

Untrusted search path vulnerability in colorcpl.exe 6.0.6000.16386 in the Color Control Panel in Microsoft Windows Server 2008 SP2, R2, and R2 SP1 allows local users to gain privileges via a Trojan horse sti.dll file in the current working directory, as demonstrated by a directory that contains a...

PT-2012-1325

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 SP2, R2, and R2 SP1 Description The issue allows local users to gain privileges via a Trojan horse sti.dll file in the current working directory. This can be demonstrated by a directory that contains a .camp, .cdm...

CVE-2012-0001: Undefined Security Weakness

The kernel in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly load structured exception handling tables, which allows context-dependent attackers to bypass the SafeSEH security feature by...

Microsoft Office 2003 Home/Pro 0day

No description provided by source. !/usr/bin/python ----------------------------------------------------------------------------------- Exploit: Microsoft Office 2003 Home/Pro 0day - Tested on XP SP1,2.3 Authors: b33f Ruben Boonen && g11tch Chris Hodges One shellcode to rule them all, One shellco...

Microsoft Office 2003 Home/Pro 0day

Exploit for windows platform in category local exploits !/usr/bin/python ----------------------------------------------------------------------------------- Exploit: Microsoft Office 2003 Home/Pro 0day - Tested on XP SP1,2.3 Authors: b33f Ruben Boonen && g11tch Chris Hodges One shellcode to rule...