Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samba lsaiotransnames Heap Overflow', 'Description' = %q This...

Hidden DCERPC Service Discovery

This module will query the endpoint mapper and make a list of all ncacntcp RPC services. It will then connect to each of these services and use the management API to list all other RPC services accessible on this port. Any RPC service found attached to a TCP port, but not listed in the endpoint...

Endpoint Mapper Service Discovery

This module can be used to obtain information from the Endpoint Mapper service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Endpoint Mapper Service Discovery', 'Description' = %q This modul...

Remote Management Interface Discovery

This module can be used to obtain information from the Remote Management Interface DCERPC service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Remote Management Interface Discovery',...

Snort 2.6.1 (Linux) - DCERPC Preprocessor Remote Buffer Overflow

Snort 2.6.1 Linux - DCERPC Preprocessor Remote Buffer Overflow !/usr/bin/python Remote exploit for Snort DCE/RPC preprocessor vulnerability as described in CVE-2006-5276. The exploit binds a shell to TCP port 4444 and connects to it. This code was tested against snort-2.6.1 running on Red Hat Lin...

caid-msgeng.txt

!/usr/bin/python This one was listed in the SANS TOP 20 and I needed an exploit for analysis. I couldnt find a reliable exploit for my analysis and so came up with this. Remote exploit for the CA BrightStor msgeng.exe service stack overflow vulnerability as described in LS-20060330.pdf on...

Microsoft Windows - DCE-RPC svcctl ChangeServiceConfig2A() Memory Corruption

!/usr/bin/python MS Windows DCE-RPC svcctl ChangeServiceConfig2A 0day Memory Corruption PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Windows 2000 SP4 Polish all patches Requires.. - Impacket : http://oss.coresecurity.com/projects/impacket.html - PyCrypto :...

Snort 2.6.1 - DCERPC Preprocessor Remote Buffer Overflow

Snort 2.6.1 - DCERPC Preprocessor Remote Buffer Overflow !/usr/bin/python Snort DCE/RPC Preprocessor Buffer Overflow Command Execution Version Author: Trirat Puttaraksa http://sf-freedom.blogspot.com For educational purpose only This exploit call calc.exe on Windows XP SP2 + Snort 2.6.1 Note: thi...

Snort 2.6.1 - DCERPC Preprocessor Remote Buffer Overflow (Denial of Service) (PoC)

Snort 2.6.1 - DCERPC Preprocessor Remote Buffer Overflow Denial of Service PoC !/usr/bin/python Snort DCE/RPC Preprocessor Buffer Overflow DoS Author: Trirat Puttaraksa http://sf-freedom.blogspot.com For educational purpose only This exploit just crash Snort 2.6.1 on Fedora Core 4. However, Code...

MS05-039 Microsoft Plug and Play Service Overflow

This module exploits a stack buffer overflow in the Windows Plug and Play service. This vulnerability can be exploited on Windows 2000 without a valid user account. NOTE: Since the PnP service runs inside the service.exe process, a failed exploit attempt will cause the system to automatically...

Novell NetWare 6.5 SP2-SP7 - LSASS CIFS.NLM Overflow (Metasploit)

Novell NetWare 6.5 SP2-SP7 - LSASS CIFS.NLM Overflow Metasploit This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Novell NetWare 6.5 SP2-SP7 LSASS CIFS.NLM Overflow

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

Novell NetWare 6.5 SP2-SP7 - LSASS CIFS.NLM Overflow (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Novell NetWare...

Microsoft Windows - spoolss GetPrinterData() Remote Denial of Service

Microsoft Windows - spoolss GetPrinterData Remote Denial of Service !/usr/bin/python MS Windows spoolss GetPrinterData 0day Memory Allocation Remote DoS Exploit Bug discovered by h07 Tested on Windows 2000 SP4 Polish + All Microsoft Security Bulletins Example: C:\python spoolssdos.py 192.168.0.2...

MS06-066 Microsoft Services nwwks.dll Module Exploit

This module exploits a stack buffer overflow in the svchost service, when the netware client service is running. This specific vulnerability is in the nwapi32.dll module. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewor...

MS06-066 Microsoft Services nwapi32.dll Module Exploit

This module exploits a stack buffer overflow in the svchost service when the netware client service is running. This specific vulnerability is in the nwapi32.dll module. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

MS04-011 Microsoft LSASS Service DsRolerUpgradeDownlevelServer Overflow

This module exploits a stack buffer overflow in the LSASS service, this vulnerability was originally found by eEye. When re-exploiting a Windows XP system, you will need need to run this module twice. DCERPC request fragmentation can be performed by setting 'FragSize' parameter. This module...

Microsoft Windows RRAS - Remote Stack Overflow (MS06-025) (Metasploit)

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

MS05-017 Microsoft Message Queueing Service Path Overflow

This module exploits a stack buffer overflow in the RPC interface to the Microsoft Message Queueing service. The offset to the return address changes based on the length of the system hostname, so this must be provided via the 'HNAME' option. Much thanks to snort.org and Jean-Baptiste Marchand's...

security flaw

Multiple unspecified vulnerabilities in Ethereal 0.9.x up to 0.10.14 allow remote attackers to cause a denial of service crash from null dereference via 1 an invalid display filter, or the 2 GSM SMS, 3 ASN.1-based, 4 DCERPC NT, 5 PER, 6 RPC, 7 DCERPC, and 8 ASN.1 dissectors...