Awesome Windows Exploitation Resources

A curated list of awesome Windows Exploitation resources. Windows stack overflows Stack Base Overflow Articles. Win32 Buffer Overflows Location, Exploitation and Prevention – by Dark spyrit 1999 Writing Stack Based Overflows on Windows – by Nish Bhalla’s 2005 Windows heap overflows Heap Base...

McAfee VirusScan Enterprise DEP Bypass ASLR

The vulnerability of the McAfee VirusScan Enterprise antivirus software is related to the allocation of memory with read, write, and execute permissions at certain addresses on a 32-bit platform, during the protection of external applications. Exploiting this vulnerability could allow an attacker...

AVG InternetSecurity DEP Bypass ASLR

The vulnerability of the AVG InternetSecurity antivirus software relates to the possibility of memory access with read, write, and execute permissions. Exploiting this vulnerability can allow a malicious actor to bypass the User Process DEP and ASLR protection mechanisms...

AVG Internet Security Security Bypass Vulnerability

AVG Internet Security is a suite of Internet security software from the Czech company AVG. The AVG Internet Security 2015 program protects user-mode processes by allocating memory with Read, Write, Execute RWX privileges in predictable addresses, allowing an attacker to bypass the DEP and ASLR...

McAfee VirusScan Enterprise Buffer Overflow Protection Security Bypass Vulnerability

McAfee VirusScan Enterprise is a suite of antivirus software that provides a full range of security, scans memory for malicious code and optimizes updates for remote systems. A security vulnerability in the McAfee VirusScan Enterprise Buffer Overflow Protection BOP feature allocates memory with...

Kaspersky Total Security Security Bypass Vulnerability

Kaspersky Total Security is a comprehensive multi-device version of the Russian antivirus program. The Kaspersky Total Security program protects user-mode processes by allocating memory with Read, Write, Execute RWX privileges in predictable addresses, allowing an attacker to exploit this...

Buffer overflow

Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data...

on windows systems use the VS compiler to buffer overflow preventive measures-vulnerability warning-the black bar safety net

0x01 /GS --buffer security check If you use the/GS compile the program to insert code to detect possible overwrite the function return address of buffer overflows. If the occurrence of a buffer overflow, the system will display to the user a warning dialog, and then terminate the program. Thus, t...

Return-into-libc attack and Defense-bug warning-the black bar safety net

This article first analyzes the return-into-libc attack principle, were introduced in different platforms for the traditional return-into-libc attack of the experimental process and results. Then, this paper further introduces and explains the return-oriented programming attacks, this attack can...

PHP DateTime Use-After-Free

Use After Free Vulnerability in unserialize with DateTime CVE-2015-0273 Taoguang Chen - Write Date: 2015.1.29 - Release Date: 2015.2.20 A use-after-free vulnerability was discovered in unserialize with DateTime/DateTimeZone/DateInterval/DatePeriod objects's wakeup magic method that can be abused...

CoreGraphics Memory Corruption - CVE-2014-4377

Apple CoreGraphics library fails to validate the input when parsing the colorspace specification of a PDF XObject resulting in a heap overflow condition. A small heap memory allocation can be overflowed with controlled data from the input in any application linked with the affected framework. Usi...

Small HTTP Server <= 3.05.28 Arbitrary Data Execution Exploit

No description provided by source. !/usr/bin/perl sHTTP FTPServer Abritary Data Execution Exploit -------------------------------------------------- Infam0us Gr0up - Securiti Research E:\PERLperl shttp.pl localhost C:\shttps ? Version: libwww-perl-5.76 + Connect to localhost... + Connected + Send...

Virtual PC Hypervisor Memory Protection Vulnerability

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Virtual PC Hypervisor Memory Protection Vulnerability 1. Advisory Information Title: Virtual PC Hypervisor Memory Protection...

VLC Media Player 2.0.4 (.swf) - Crash PoC

No description provided by source. Title : VLC media player 2.0.4 buffer overflow POC Version : 2.0.4 Twoflower Date : 2012-12-06 Vendor : www.videolan.org/vlc/ Impact : Med/High Contact : coolkaveh at rocketmail.com Twitter : @coolkaveh tested : windows XP SP3 Author : coolkaveh VLC media player...

Microsoft Internet Explorer 8 - Fixed Col Span ID (Full ASLR + DEP + EMET 4.1.x Bypass) (MS12-037)

function strtointstr return str.charCodeAt10x10000 + str.charCodeAt0; var free = "EEEE"; while free.length 500 free += free; var string1 = "AAAA"; while string1.length 500 string1 += string1; var string2 = "BBBB"; while string2.length 500 string2 += string2; var fr = new Array; var al = new Array...

VUPEN Discloses Details of Patched Firefox Pwn2Own Zero-Days

Contestants at this year’s Pwn2Own contest made no bones about it: they were going after browsers and as it turned out, Firefox had the biggest target on its back. Mozilla’s popular browser was popped four times during the Canadian hacker festival accounting for a quarter of the $800,000-plus in...

OpenSSL 1.0.0 < 1.0.0m Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.0m. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.0m advisory. - The dtls1clearqueues function in ssl/d1lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data...

Complete Microsoft EMET Bypass Developed

SAN FRANCISCO — Researchers at Bromium Labs are expected to announce today they have developed an exploit that bypasses all of the mitigations in Microsoft’s Enhanced Mitigation Experience Toolkit EMET. Principal security researcher Jared DeMott is scheduled to deliver a presentation this morning...

New IE Zero Day Found Targeting Military Intelligence

Attackers were able to compromise the U.S. Veterans of Foreign Wars’ website this week and serve up a previously unknown zero day exploit in Internet Explorer 10, and while motivation behind the campaign is still unclear, experts are speculating its aim was to procure military intelligence...

Mitigating the LdrHotPatchRoutine DEP/ASLR bypass with MS13-063

Today we released MS13-063 which includes a defense in depth change to address an exploitation technique that could be used to bypass two important platform mitigations: Address Space Layout Randomization ASLR and Data Execution Prevention DEP. As we’ve described in the past, these mitigations pl...