Microsoft Windows Media Player 10 - Plugin Overflow (MS06-006)

Microsoft Windows Media Player 10 - Plugin Overflow MS06-006 WMP Plugin EMBED Exploit // Windows Media Player Plug-In EMBED Overflow Universal Exploit MS06-006 // By Matthew Murphy [email protected] // // DISCLAIMER: // // This exploit code is intended only as a demonstration tool for //...

eStara SoftPhone 3.0.1.46 - SIP Remote Buffer Overflow (2)

eStara SoftPhone 3.0.1.46 - SIP Remote Buffer Overflow 2 !/usr/bin/perl -s damn-hippie.pl by kokanin google estara, it shows sip stuff and a hippie Remote "estara softphone" exploit, executable version info = 3.0.1.2 kokanin did the research, metasploit.com did the encoded bindshell on tcp/5060...

PostgreSQL security releases 8.0.6 and 8.1.2

PostgreSQL versions 8.0.6 and 8.1.2 have been released fixing a remote denial of service vulnerability on the win32 platform. Details ------- Vulnerability type: Denial of service Remotely exploitable: Yes Affected versions: PostgreSQL 8.0.0-8.0.5, 8.1.0-8.1.1 Fixed versions: PostgreSQL 8.0.6,...

ironwallTraverse.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 IronWall webserver 7.41 directory traversal - Software App: IronWall Webserver Version: 7.41 estable others not tested Platform: win32 Background Ironwall webserver is a small web server for win32 systems. It can be downloaded totally free at...

win32 Download & Exec Shellcode 226 bytes+

Exploit for win32 platform in category shellcode ========================================== win32 Download & Exec Shellcode 226 bytes+ ========================================== / \ WINSHELLCODE / :: win32 download & exec shellcode :: \ :: by Darkeagle of Unl0ck Research Team http://exploiterz.or...

SHOUTcast DNAS/win32 1.9.4 File Request Format String Overflow

This module exploits a format string vulnerability in the Nullsoft SHOUTcast server for Windows. The vulnerability is triggered by requesting a file path that contains format string specifiers. This vulnerability was discovered by Tomasz Trojanowski and Damian Put. This module requires Metasploit...

Icecast Header Overwrite

This module exploits a buffer overflow in the header parsing of icecast versions 2.0.1 and earlier, discovered by Luigi Auriemma. Sending 32 HTTP headers will cause a write one past the end of a pointer array. On win32 this happens to overwrite the saved instruction pointer, and on linux dependin...

win32 Download & Exec Shellcode 226 bytes+

win32 Download & Exec Shellcode 226 bytes+. Shellcode exploit for win32 platform / \ WINSHELLCODE / :: win32 download & exec shellcode :: \ :: by Darkeagle of Unl0ck Research Team http://exploiterz.org :: / :: to avoid 0x00 use ^^xor^^ : :: \ :: greets goes to: Sowhat, 0x557 guys, 55k7 guys,...

MailEnable Enterprise Edition 1.1 - 'EXAMINE' Remote Buffer Overflow

!/usr/bin/python Remote Mailenable Enterprise 1.1 EXAMINE buffer Overflow Discovered and exploited by [email protected] This vulnerability affects Mailenable Enterprise 1.1 without the ME-10009.EXE patch. Details: SEH gets overwritten at 965 968 in VMWare bytes in the EXAMINE command. Filteri...

Oracle 9.2.0.1 Universal XDB HTTP Pass Overflow Exploit

Exploit for unknown platform in category remote exploits ======================================================= Oracle 9.2.0.1 Universal XDB HTTP Pass Overflow Exploit ======================================================= This file is part of the Metasploit Framework and may be redistributed...

CA CAM log_security() Stack Buffer Overflow (Win32)

This module exploits a vulnerability in the CA CAM service by passing a long parameter to the logsecurity function. The CAM service is part of TNG Unicenter. This module has been tested on Unicenter v3.1. This module requires Metasploit: https://metasploit.com/download Current source:...

Oracle 9i XDB FTP PASS Overflow (win32)

By passing an overly long string to the PASS command, a stack based buffer overflow occurs. David Litchfield, has illustrated multiple vulnerabilities in the Oracle 9i XML Database XDB, during a seminar on "Variations in exploit methods between Linux and Windows" presented at the Blackhat...

Platinum FTP Server

Platinum FTP server for Win32 has several vulnerabilities in the way it checks the format of command strings passed to it. This leads to the following vulnerabilities in the server: The 'dir' command can be used to examine the filesystem of the machine and gather further information about the hos...

Apache HTTP Server Remote Command Execution via .bat files

The Apache HTTP Server 2.0.x Win32 installation is shipped with a default script, /cgi-bin/test-cgi.bat, that allows an attacker to execute commands on the Apache server although it is reported that any .bat file could open this vulnerability. SPDX-FileCopyrightText: 2002 Matt Moore Some text...

Check for Apache Multiple / vulnerability

Certain versions of Apache for Win32 have a bug wherein remote users can list directory entries. Specifically, by appending multiple /'s to the HTTP GET command, the remote Apache server will list all files and subdirectories within the web root as defined in httpd.conf. OpenVAS Vulnerability Tes...

PHP.EXE / Apache Win32 Arbitrary File Reading Vulnerability

A configuration vulnerability exists for PHP.EXE cgi running on Apache for Win32 platforms. It is reported that the installation text recommends configuration options in httpd.conf that create a security vulnerability, allowing arbitrary files to be read from the host running PHP. Remote users ca...

PHP.EXE / Apache HTTP Server Win32 Arbitrary File Reading Vulnerability - Active Check

A configuration vulnerability exists for PHP.EXE cgi running on Apache HTTP Server for Win32 platforms. SPDX-FileCopyrightText: 2002 Matt Moore Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Apache HTTP Server Multiple '/' Vulnerability - Active Check

Certain versions of Apache HTTP Server for Win32 have a bug wherein remote users can list directory entries. SPDX-FileCopyrightText: 2000 John Lampe Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Apache Remote Command Execution via .bat files

The Apache 2.0.x Win32 installation is shipped with a default script, /cgi-bin/test-cgi.bat, that allows an attacker to execute commands on the Apache server although it is reported that any .bat file could open this vulnerability. An attacker can send a pipe character with commands appended as...

snort_bo_overflow_win32.pm.txt

for educational purpose only by Kira package Msf::Exploit::snortbooverflowwin32; use base 'Msf::Exploit'; use strict; use Pex::Text; my $holdrand; my $advanced = ; my $info = 'Name' = 'Snort Back Orifice Preprocessor Overflow', 'Version' = '$Revision: 1.0 $', 'Authors' = 'Trirat Puttaraksa Kira '...