SIPDroid Extension Grabber

This module exploits a leak of extension/SIP Gateway on SIPDroid 1.6.1 beta, 2.0.1 beta, 2.2 beta tested in Android 2.1 and 2.2 - official Motorola release other versions may be affected. This module requires Metasploit: https://metasploit.com/download Current source:...

Sybase Advantage Server buffer overflow

Off-by-one overflow on TCP/6262, UDP/6262 traffic parsing. Format string vulnerability on TCP/5001 traffic processing...

DNS Invalid Compression Denial Of Service

!/usr/bin/perl DNS Invalid Compression attack coded by sipher www.elitter.net History: elitter.net provides Free UNIX shells and receives its more than fair amount of DDoS's and DoS attacks. 1 lovely day someone targeted our DNS services and managed to bring the system to 100% CPU usage. Goal:...

broadcast-db2-discover NSE Script

Attempts to discover DB2 servers on the network by sending a broadcast request to port 523/udp. Script Arguments max-newtargets, newtargets See the documentation for the target library. Example Usage nmap --script db2-discover Script Output Pre-scan script results: | broadcast-db2-discover: |...

Beckhoff TwinCAT Read Access Violation

Overview This Advisory is a follow-up to the Alert, ICS-ALERT-11-256-06—BECKHOFF TWINCAT READ ACCESS VIOLATION, that was published September 13, 2011, on the Industrial Control Systems Cyber Emergency Response Team ICS-CERT web page. ICS-CERT is aware of a public report of a read access violation...

OS X Gather Mac OS X System Information Enumeration

This module gathers basic system information from Mac OS X Tiger 10.4, through Mojave 10.14. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OS X Gather Mac OS X System Information Enumeration'...

Off-by-one in Sybase Advantage Server 10.0.0.3

Luigi Auriemma Application: Sybase Advantage Server http://www.sybase.com/products/databasemanagement/advantagedatabaseserver Versions: = 10.0.0.3 Platforms: Windows, NetWare, Linux Bug: off-by-one Exploitation: remote, versus server Date: 27 Jun 2011 found 29 Oct 2010 Author: Luigi Auriemma...

Kaillera 0.86 Server Denial of Service

The Kaillera 0.86 server can be shut down by sending any malformed packet after the initial "hello" packet. Module Options msf use auxiliary/dos/windows/games/kaillera msf undefinedkaillera show actions ...actions... msf undefinedkaillera set ACTION msf undefinedkaillera show options ...show and...

Kaillera Multiple Clients Buffer Overflow Vulnerabilities

Exploit for windows platform in category remote exploits !/usr/bin/perl Exploit Title: Remote Buffer Overflows in Kaillera clients Date: 6/30/11 Author: sil3ntdre4m Software Link: Multiple: 1. Kaillera original client: An emulator to download with this client bundled with it is Project64K 0.13:...

Kaillera - Multiple Clients Buffer Overflow Vulnerabilities

Kaillera - Multiple Clients Buffer Overflow Vulnerabilities !/usr/bin/perl Exploit Title: Remote Buffer Overflows in Kaillera clients Date: 6/30/11 Author: sil3ntdre4m Software Link: Multiple: 1. Kaillera original client: An emulator to download with this client bundled with it is Project64K 0.13...

Kaillera - Multiple Clients Buffer Overflow Vulnerabilities

!/usr/bin/perl Exploit Title: Remote Buffer Overflows in Kaillera clients Date: 6/30/11 Author: sil3ntdre4m Software Link: Multiple: 1. Kaillera original client: An emulator to download with this client bundled with it is Project64K 0.13: http://www.zophar.net/downloadfile/1907 2. Supraclient...

RealityServer Web Services RTMP Server 3.1.1 build 144525.5 - Null Pointer Dereference Denial of Service

source: https://www.securityfocus.com/bid/48476/info RealityServer Web Services is prone to a remote denial-of-service vulnerability caused by a NULL pointer dereference. Attackers can exploit this issue to cause the server to dereference an invalid memory location, resulting in a denial-of-servi...

Citrix Provisioning Services 5.6 streamprocess.exe Buffer Overflow

Exploit for windows platform in category remote exploits $Id: citrixstreamprocess.rb 13042 2011-06-27 18:00:12Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more informatio...

AzeoTech DAQFactory Stack Overflow

Overview This advisory is a follow-up to the alert titled “ICS-ALERT-11-256-02—AzeoTech DAQFactory Stack Overflow” that was published September 13, 2011, on the ICS-CERT web page. ICS-CERT is aware of a public report of one stack overflow vulnerability with proof-of-concept POC exploit code...

Measuresoft ScadaPro Vulnerabilities

Overview This Advisory is a follow-up to the Alert titled “ICS-ALERT-11-256-04 Measuresoft ScadaPro” that was published September 13, 2011, on the ICS-CERT website. ICS-CERT is aware of a public report of three vulnerabilities with proof-of-concept PoC exploit code affecting Measuresoft ScadaPro...

Ubuntu 8.04 LTS : linux vulnerabilities (USN-1133-1)

Nelson Elhage discovered that Econet did not correctly handle AUN packets over UDP. A local attacker could send specially crafted traffic to crash the system, leading to a denial of service. CVE-2010-4342 Dan Rosenberg discovered that the OSS subsystem did not handle name termination correctly. A...

Ubuntu: Security Advisory (USN-1133-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Nmap NSE net: db2-das-info

Connects to the IBM DB2 Administration Server DAS on TCP or UDP port 523 and exports the server profile. No authentication is required for this request. The script will also set the port product and version if a version scan is requested. OpenVAS Vulnerability Test $Id: gbnmapdb2dasinfonet.nasl...

Nmap NSE net: path-mtu

Performs simple Path MTU Discovery to target hosts. TCP or UDP packets are sent to the host with the DF don't fragment bit set and with varying amounts of data. If an ICMP Fragmentation Needed is received, or no reply is received after retransmissions, the amount of data is lowered and another...

Nmap NSE net: dhcp-discover

Sends a DHCPDISCOVER request to a host on UDP port 67. The response comes back to UDP port 68, and is read using pcap due to the inability for a script to choose its source port at the moment. DHCPDISCOVER is a DHCP request that returns useful information from a DHCP server. The request sends a...