PT-2017-4109 · Qemu +1 · Qemu +1

Name of the Vulnerable Software and Affected Versions: QEMU versions prior to 2.9.0 Description: The issue is related to the disas insn function in target/i386/translate.c of the QEMU emulator, which does not limit the instruction size when TCG mode without hardware acceleration is used. This...

Linux/x86-64 - mkdir Shellcode (25 bytes)

/ --------------------------------------------------------------------------------------------------- Linux/x86x64 - mkdir"ajit", 755 - 25 bytes Ajith Kp http://fb.com/ajithkp560 http://www.terminalcoders.blogspot.com Vishnu Nath Kp http://www.terminalcoders.blogspot.com Sayooj S Nambiar...

Microsoft Internet Explorer 10 MSHTML CElement::GetPlainTextInScope Out-Of-Bounds Read

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the third entry in that series. The below information is also available on my blog at http://blog.skylined.nl/20161103001.html. There you can find a repro that trigger...

Binary Analysis Platform: angr

Binary Analysis Platform angr is a platform-agnostic binary analysis framework developed by the Computer Security Lab at UC Santa Barbara and their associated CTF team, Shellphish. angr is a suite of python libraries that let you load a binary and do a lot of cool things to it: Disassembly and...

RealPlayer 18.1.5.705 - .QCP Crash (PoC)

RealPlayer 18.1.5.705 - .QCP Crash PoC Tested on: Win7 / Win10 x64 Date: October 20th 2016 Vendor homepage: http://www.real.com Software link: http://realplayer-download.real.com/free/windows/installer/stubinst/stub/rt1/T10EUDRP/RealTimes-RealPlayer.exe File version both realplay.exe and...

Microsoft Office PowerPoint 2010 - Invalid Pointer Reference

Microsoft Office PowerPoint 2010 - Invalid Pointer Reference Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=866 The following crash was observed in Microsoft PowerPoint 2010 running under Windows 7 x86 with application verifier enabled. File versions are: mso.dll: 14.0.7166.500...

Microsoft Office PowerPoint 2010 - Invalid Pointer Reference

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=866 The following crash was observed in Microsoft PowerPoint 2010 running under Windows 7 x86 with application verifier enabled. File versions are: mso.dll: 14.0.7166.5000 ppcore.dll: 14.0.7168.5000 Attached crashing file:...

Windows x86 - Password Protected TCP Bind Shell (637 bytes)

Windows x86 - Password Protected TCP Bind Shell 637 bytes. Shellcode exploit for Winx86 platform / Title : Windows x86 password protected bind shell tcp shellcode Date : 12-09-2016 Author : Roziul Hasan Khan Shifat size : 637 bytes Tested On : Windows 7 ultimate x86 x64 Email : [email protected]...

Embedded Hardware Hacking 101 – The Belkin WeMo Link

Why Embedded Hacking? Devices that are connected to the Internet or run a full operating system are becoming more and more prevalent in today’s society. From devices for locomotives to wireless light switches, the Internet of Things IoT trend is on the rise and here to stay. This has the potentia...

Windows x86 ShellExecuteANULL,NULL,"cmd.exe",NULL,NULL,1 Shellcode

Windows x86 ShellExecuteANULL,NULL,"cmd.exe",NULL,NULL,1 Shellcode. Shellcode exploit for win32 platform / Title : Windows x86 ShellExecuteANULL,NULL,"cmd.exe",NULL,NULL,1 shellcode Date : 22-06-2016 Author : Roziul Hasan Khan Shifat Tested on : Windows 7,10 x86 / / section .text global start...

Linux x86_64 Information Stealer Shellcode

Linux x8664 Information Stealer Shellcode. Shellcode exploit for linx86-64 platform / Title : Linux x8664 information stealer Date : 23-05-2016 Author : Roziul Hasan Khan Shifat Tested On : Ubuntu 14.04 LTS x8664 Contact : [email protected] / / How does this shellcode works...

EhTrace - Tool for Tracing Execution of Binaries on Windows

Eh'Trace pronounced ATrace is a binary tracing tool for Windows. Implemented in C but has some interesting properties that may make it suitable for tracing binaries when other methods are not sufficient, in particular EhTrace does not require changes to a binary to enable traces, despite being ab...

Deobfuscating Python Bytecode

Introduction During an investigation, the FLARE team came across an interesting Python malware sample MD5: 61a9f80612d3f7566db5bdf37bbf22cf that is packaged using py2exe. Py2exe is a popular way to compile and package Python scripts into executables. When we encounter this type of malware we...

Linux x64 - Bind Shell Shellcode Generator

Linux x64 - Bind Shell Shellcode Generator. Shellcode exploit for linx86-64 platform !/bin/python import socket import sys """ Linux x64 - Bind Shell shellcode Generator --------------------------------------------------------------------------------- Disassemby of bindshell - port 5600 Disassemb...

Linux/x86-64 - Bind Shell Shellcode (Generator)

!/bin/python import socket import sys """ Linux x64 - Bind Shell shellcode Generator --------------------------------------------------------------------------------- Disassemby of bindshell - port 5600 Disassembly of section .text:0000000000400080 : 400080: 48 31 c0 xor %rax,%rax 400083: 48 31 f...

Extensible Debugger UI For Hackers: Voltron

Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs, you ca...

Linux/x86-64 - Read /etc/passwd Shellcode (65 bytes)

/ --------------------------------------------------------------------------------------------------- Linux/x8664 - Read /etc/passwd - 65 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa Sad-Gamaya | Tamaso Maa Jyotir-Gamaya | Mrtyor-Maa Amrtam Gamaya | Om Shaantih...

Linux/x86_x64 - execve/bin/sh - 25 bytes

Linux/x86x64 - execve/bin/sh - 25 bytes. Shellcode exploit for linx86-64 platform / --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/sh - 25 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa...

Linux/x86-64 - execve(/bin/sh) Shellcode (26 bytes)

/ --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/sh - 26 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa Sad-Gamaya | Tamaso Maa Jyotir-Gamaya | Mrtyor-Maa Amrtam Gamaya | Om Shaantih...

Linux/x86_x64 - execve/bin/sh - 26 bytes

Linux/x86x64 - execve/bin/sh - 26 bytes. Shellcode exploit for linx86-64 platform / --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/sh - 26 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa...