Serviio PRO 1.8 DLNA Media Streaming Server - REST API Arbitrary Code Execution

!/usr/bin/env python Serviio PRO 1.8 DLNA Media Streaming Server REST API Arbitrary Code Execution Vendor: Petr Nejedly | Six Lines Ltd Product web page: http://www.serviio.org Affected version: 1.8.0.0 PRO, 1.7.1, 1.7.0, 1.6.1 Summary: Serviio is a free media server. It allows you to stream your...

Serviio Media Server checkStreamUrl Command Execution

This module exploits an unauthenticated remote command execution vulnerability in the console component of Serviio Media Server versions 1.4 to 1.8 on Windows operating systems. The console service on port 23423 by default exposes a REST API which which does not require authentication. The 'actio...

Microsoft Windows taskschd.msc Privilege Escalation Vulnerability

Microsoft Windows taskschd.msc local SYSTEM privilege escalation exploit. Microsoft Windows 'taskschd.msc' Local SYSTEM Privilege Escalation Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous programs is for Educational purpose ONLY...

Cisco AnyConnect SBL 4.3.04027 Local Privilege Escalation (CVE-2017-3813)

Run CMD.EXE with system privileges 1. Start Cisco anyconnect from logon screen. 2. Once the Cisco app comes up where you can select a profile and hit connect hold CTRL and hit B. 3. When the Cisco about window appears then select the URL at the bottom. This will open Internet Explorer or you can...

Cisco AnyConnect SBL 4.3.04027 Local Privilege Escalation

Exploit Title: Cisco AnyConnect Start Before Logon SBL local privilege escalation. CVE-2017-3813 Date: 02/27/2017 Exploit Author: @Pcchillin Software Link: http://www.cisco.com/c/en/us/support/security/anyconnect-secure-mobility-client/tsd-products-support-series-home.html Version: 4.3.04027 and...

Cisco AnyConnect Secure Mobility Client 4.3.04027 - Local Privilege Escalation

Cisco AnyConnect Secure Mobility Client 4.3.04027 - Local Privilege Escalation Exploit Title: Cisco AnyConnect Start Before Logon SBL local privilege escalation. CVE-2017-3813 Date: 02/27/2017 Exploit Author: @Pcchillin Software Link:...

Enigma Fileless UAC Bypass Exploit

This Metasploit module is an implementation of fileless uac bypass using cmd.exe instead of powershell.exe OJ msf module. This module will create the required registry entry in the current user's hive, set the default value to whatever you pass via the EXECCOMMAND parameter, and runs eventvwr.exe...

Windows/x86 - CreateProcessA cmd.exe Shellcode (253 bytes)

/ Title : Windows x86 CreateProcessANULL,"cmd.exe",NULL,NULL,0,NULL,NULL,NULL,&STARTUPINFO,&PROCESSINFORMATION shellcode Author : Roziul Hasan Khan Shifat Date : 15-08-2016 Tested On : Windows 7 x86 / / Disassembly of section .text: 00000000 : 0: 31 c9 xor %ecx,%ecx 2: 64 8b 41 30 mov...

Python Remote Access Tool: Ares

Ares is a Python Remote Access Tool Only use this software according to your current legislation. Misuse of this software can raise legal and ethical issues which I don’t support nor can be held responsible for. Ares is made of two main programs: A Command aNd Control server, which is a Web...

GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation

/ Exploit Title: GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit0 day Vulnerability Discovery and Exploit Author: Zhou Yu Email: Version: 8.2 Tested on: Windows 7 SP1 X32 CVE : None Vulnerability Description: SERVICECHANGECONFIG Privilege Escalation...

Windows 7 SP1 x86 Privilege Escalation

/ Exploit Title: Elevation of privilege on Windows 7 SP1 x86 Date: 28/06-2016 Exploit Author: @blomster81 Vendor Homepage: www.microsoft.com Version: Windows 7 SP1 x86 Tested on: Windows 7 SP1 x86 CVE : 2016-0400 MS16-014 EoP PoC created from...

Microsoft Windows 7 SP1 (x86) - Privilege Escalation (MS16-014)

Exploit for windows platform in category local exploits / Exploit Title: Elevation of privilege on Windows 7 SP1 x86 Date: 28/06-2016 Exploit Author: @blomster81 Vendor Homepage: www.microsoft.com Version: Windows 7 SP1 x86 Tested on: Windows 7 SP1 x86 CVE : 2016-0400 MS16-014 EoP PoC created fro...

Windows x86 ShellExecuteANULL,NULL,"cmd.exe",NULL,NULL,1 Shellcode

Windows x86 ShellExecuteANULL,NULL,"cmd.exe",NULL,NULL,1 Shellcode. Shellcode exploit for win32 platform / Title : Windows x86 ShellExecuteANULL,NULL,"cmd.exe",NULL,NULL,1 shellcode Date : 22-06-2016 Author : Roziul Hasan Khan Shifat Tested on : Windows 7,10 x86 / / section .text global start...

Windows/x86 - ShellExecuteA(NULL,NULL,"cmd.exe",NULL,NULL,1) Shellcode (250 bytes)

/ Title : Windows x86 ShellExecuteANULL,NULL,"cmd.exe",NULL,NULL,1 shellcode Date : 22-06-2016 Author : Roziul Hasan Khan Shifat Tested on : Windows 7,10 x86 / / section .text global start start: xor ecx,ecx mov eax,fs:ecx+0x30 ;EAX=PEB mov eax,eax+0xc ;EAX=PEB-Ldr mov esi,eax+0x14...

Windows/x86 - WinExec("cmd.exe",0) Shellcode (184 bytes)

/ Title : Windows x86 WinExec"cmd.exe",0 shellcode Date : 07/06/2016 Author : Roziul Hasan Khan Shifat Tested On : Windows 7 Professional x86 / / To Compile: -------------- $nasm -f win32 winexec.asm -o exec.obj Linking: ---------- $ "C:\Program Files\CodeBlocks\MinGW\bin\ld.exe" -o winexec.exe...

Windows x86 WinExec"cmd.exe",0 Shellcode

Windows x86 WinExec"cmd.exe",0 Shellcode. Shellcode exploit for win32 platform / Title : Windows x86 WinExec"cmd.exe",0 shellcode Date : 07/06/2016 Author : Roziul Hasan Khan Shifat Tested On : Windows 7 Professional x86 / / To Compile: -------------- $nasm -f win32 winexec.asm -o exec.obj Linkin...

Rejetto HTTP File Server 2.3.x Remote Code Execution

!/usr/bin/python Exploit Title: HttpFileServer 2.3.x Remote Command Execution Google Dork: intext:"httpfileserver 2.3" Date: 04-01-2016 Remote: Yes Exploit Author: Avinash Kumar Thapa aka "-Acid" Vendor Homepage: http://rejetto.com/ Software Link: http://sourceforge.net/projects/hfs/ Version: 2.3...

Ares - Python Botnet and Backdoor

Ares is made of two main programs: A Command aNd Control server, which is a Web interface to administer the agents An agent program, which is run on the compromised host, and ensures communication with the CNC The Web interface can be run on any server running Python. You need to install the...

Windows batch parsing vulnerability-vulnerability warning-the black bar safety net

In this article before you begin, Please note that this is a very jumbled information security notices. Related to Windows control command identifier, I may have found a simple batch file to attack the BUG. This BUG is present in Windows 2 0 0 0 version more 6 4-bit and 3 2-bit machine, it is a...

DVD X Player 5.5 Pro (SEH DEP + ASLR Bypass) Exploit

No description provided by source. ?php / Title: DVD X Player 5.5 Pro DEP + ASLR Bypass Exploit Date: Sep 08, 2011 Author: Rew [email protected] Discovered by: Blake http://www.exploit-db.com/exploits/17788/ Link: http://www.dvd-x-player.com/download/DVDXPlayerSetup.exe Tested on: WinXP Pro SP3 +...