SpiceWorks 3.6 - Accept Overflow Crash

SpiceWorks 3.6 - Accept Overflow Crash !/usr/bin/python Spiceworks 3.6 Accept Parameter Overflow Remote Crash P.O.C. Written by: SecureState R&D Author: David Kennedy ReL1K Tested on Windows 2003 SP2 R2 Vendor Notified on: 05/11/2009 Vendor Fix: Fixed in version 4.0 esi 000334E0 ASCII...

Spiceworks 3.6 Accept Parameter Overflow Crash Exploit

Exploit for unknown platform in category dos / poc ====================================================== Spiceworks 3.6 Accept Parameter Overflow Crash Exploit ====================================================== !/usr/bin/python Spiceworks 3.6 Accept Parameter Overflow Remote Crash P.O.C...

Novell eDirectory多个拒绝服务漏洞

BUGTRAQ ID: 35666 CVECAN ID: CVE-2009-0192 Novell eDirectory是一个的跨平台的目录服务器。 eDirectory的iMonitor组件在处理HTTP请求时存在栈溢出漏洞。如果攻击者发送了带有畸形Accept-Language头的HTTP请求，就可以触发这个溢出，导致服务器崩溃。 此外RDN中的多个通配符和LDAP报文也可能导致拒绝服务的情况。 Novell eDirectory 8.8 SP3 FTF3 Novell eDirectory 8.8 SP3 厂商补丁： Novell ------...

CVE-2009-0192

Off-by-one error in the iMonitor component in Novell eDirectory 8.8 SP3, 8.8 SP3 FTF3, and possibly other versions allows remote attackers to execute arbitrary code via an HTTP request with a crafted Accept-Language header, which triggers a stack-based buffer overflow...

CVE-2009-0192: Undefined Security Weakness

Off-by-one error in the iMonitor component in Novell eDirectory 8.8 SP3, 8.8 SP3 FTF3, and possibly other versions allows remote attackers to execute arbitrary code via an HTTP request with a crafted Accept-Language header, which triggers a stack-based buffer overflow...

Linux/x86 Port Binding Shellcode (xor-encoded) 152 bytes

No description provided by source. / Author: Rick Email: [email protected] OS: Linux/x86 Description: Port Bind 4444 xor-encoded -------------------------------------------------------------------- section .text global start start: ;socket PFINET, SOCKSTREAM, 0 push byte 0x66 pop eax push byte...

linux/x86 bindport 8000 & execve iptables -F 176 bytes

No description provided by source. ; ; Title : Bindport TCP/8000 & execve iptables -F ; os : Linux x86 ; size : 176 bytes ; IP : localhost ; Port : 8000 ; Use : nc localhost 8000 ; ; Author : Jonathan Salwan ; Mail : submit AT shell-storm.org ; Web : http://www.shell-storm.org ; ; ; More shellcod...

linux/x86 bindport 8000 & add user with root access 225+ bytes

No description provided by source. ; ; Title : Bindport TCP/8000 & execve add user with access root ; os : Linux x86 ; size : 225+ bytes ; IP : localhost ; Port : 8000 ; Use : nc localhost 8000 ; ; Author : Jonathan Salwan ; Mail : submit AT shell-storm.org ; Web : http://www.shell-storm.org ; ; ...

SAP GUI ActiveX buffer overflow

Buffer overflow in SAPIrRfc component Accept method...

linux/x86 Bind ASM Code Linux 179 bytes

linux/x86 Bind ASM Code Linux 179 bytes.. Shellcode exploit for linx86 platform ; ; Title : Bind asm code Linux x86 - 179 bytes ; IP : 0.0.0.0 ; Port : 8000 ; ; ; Use : nc localhost 8000 ; id ; uid=0root gid=0root groupes=0root ; ; ; Author : Jonathan Salwan ; Mail : submit AT shell-storm.org ; W...

linux/x86 Bind ASM Code Linux 179 bytes

Exploit for linux/x86 platform in category shellcode ======================================= linux/x86 Bind ASM Code Linux 179 bytes ======================================= ; ; Title : Bind asm code Linux x86 - 179 bytes ; IP : 0.0.0.0 ; Port : 8000 ; ; ; Use : nc localhost 8000 ; id ; uid=0root...

Webmedia Explorer 5.0.95.10 - Multiple Cross-Site Scripting Vulnerabilities

Webmedia Explorer 5.0.95.10 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/35368/info Webmedia Explorer is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these...

AGTC MyShop 3.2 - Insecure Cookie Handling

AGTC MyShop 3.2 - Insecure Cookie Handling ======================================================= +++++++++++++++++++ information +++++++++++++++++++++++ ======================================================= + Script : AGTC MyShop v3.2b + Site :www.websiteforsaleuk.co.uk + Found by : Mr.tro0oq...

Heap overflow

Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via 1 a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or 2 a long Accept-Language HTTP header,...

CVE-2009-0921: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via 1 a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or 2 a long Accept-Language HTTP header,...

Novell eDirectory iMonitor - Accept-Language Request Buffer Overflow (PoC)

Novell eDirectory iMonitor - Accept-Language Request Buffer Overflow PoC !usr/bin/perl -w Novell eDirectory iMonitor 'Accept-Language' Request Buffer Overflow Vulnerability Refer: https://www.securityfocus.com/bid/33928/discuss To run this exploit on MS Windows replace "!usr/bin/perl -w" with...

Novell eDirectory iMonitor Accept-Language头远程溢出漏洞

BUGTRAQ ID: 33928 Novell eDirectory是一个的跨平台的目录服务器。 如果向Novell eDirectory的iMonitor服务发送了包含有超长Accept-Language头的畸形报文的话，就可以触发缓冲区溢出，导致执行任意代码。 Novell eDirectory 8.8 SP3 厂商补丁： Novell ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme5042340.html...

Linux/mips - port bind 4919 - 276 bytes

No description provided by source. / - MIPS little-endian - linux port listener 276 bytes shellcode - execve"/bin/sh","/bin/sh",; - port 0x1337 4919 - tested on Linksys WRT54G/GL DD-WRT Linux - based on scut paper Writing MIPS/Irix shellcode vaicebine at gmail dot com / include "stdio.h" char...

FreeBSD/x86-64 - Bind TCP Shell (/bin/sh) + Password (R2CBw0cr) Shellcode (127 bytes)

FreeBSD/x86-64 - Bind TCP Shell /bin/sh + Password R2CBw0cr Shellcode 127 bytes. Shellcode exploit for FreeBSDx86-64 platform / Gitsnik, @dracyrys FreeBSD x8664 bindtcp with passcode, 127 bytes Passcode: R2CBw0cr / C Source: char code = \ "\x6a\x61\x58\x6a\x02\x5f\x6a\x01\x5e\x99"...

Solaris/SPARC - Bind TCP (2001/TCP) Shell (/bin/sh) Shellcode

Solaris/SPARC - Bind TCP 2001/TCP Shell /bin/sh Shellcode. Shellcode exploit for SolarisSPARC platform !!! $Id: sparc-bind.s,v 1.1 2003/03/01 01:10:51 ghandi Exp $ !!! Bind /bin/sh to TCP port 2001. Calls setuid0 so /bin/sh won't !!! drop privileges. After assembly, change the third byte in the !...