125 matches found
Amaya Web Editor 11.0 - Remote Buffer Overflow (PoC)
!/usr/bin/perl -w Amaya Web Editor "."\n". ''."\n". "Heap"."\n". ""; my $file="St.html"; $exploit = $code.$bof.$bof2.$bof3.$coding; openmy $FILE, "$file" or die "Cannot open $file: $!"; print $FILE $exploit ; close$FILE; print "$file has been created \n"; milw0rm.com 2009-01-29...
Linux/x86 - Remote File Download Shellcode (42 bytes)
Linux/x86 - Remote File Download Shellcode 42 bytes. Shellcode exploit for Linuxx86 platform / Title: Linux x86 - Remote file Download - 42 bytes Author: Jonathan Salwan Web: http://www.shell-storm.org Twitter: http://twitter.com/jonathansalwan !Database of Shellcodes...
IntelliTamper 2.072.08 - .map Local Overwrite (SEH)
IntelliTamper 2.072.08 - .map Local Overwrite SEH !/usr/bin/python IntelliTamper 2.07/2.08 MAP File 0-day Local SEH Overwrite Exploit Bug discovered by cN4phux Tested on: IntelliTamper 2.07/2.08 / win32 SP3 FR Shellcode: Windows Execute Command calc Here's the debugger output like what u see, the...
VeryPDF PDFView - OCX ActiveX OpenPDF Heap Overflow (PoC)
Sub Boom buff = String1006, "A" target.OpenPDF buff, 1, 1 End Sub milw0rm.com 2008-11-15...
win32 PEB Kernel32.dll ImageBase Finder (Ascii Printable) 49 bytes
No description provided by source. / PEB Kernel32.dll ImageBase Finder Ascii Printable Author: Koshi Description: Uses PEB method to locate the ImageBase of Kernel32.dll ONLY supports NT/2K/XP.. sorry no 9X. ImageBase will be returned in EAX. No null bytes, obviously, so no need to encode really...
win32 PEB Kernel32.dll ImageBase Finder Ascii Printable 49 bytes
win32 PEB Kernel32.dll ImageBase Finder Ascii Printable 49 bytes. Shellcode exploit for win32 platform / PEB Kernel32.dll ImageBase Finder Ascii Printable Author: Koshi Description: Uses PEB method to locate the ImageBase of Kernel32.dll ONLY supports NT/2K/XP.. sorry no 9X. ImageBase will be...
OllyDBG v1.10 and ImpREC v1.7f (export name) BOF PoC
No description provided by source. ;-------------------------------------------------------------------------; ; OllyDBG v1.10 and ImpREC v1.7f export name buffer overflow vulnerability ; PoC probably older versions affected too, not tested though. ; ; Included shellcode shows a messagebox WinXP...
OllyDBG v1.10 and ImpREC v1.7f (export name) BOF PoC
Exploit for unknown platform in category local exploits ==================================================== OllyDBG v1.10 and ImpREC v1.7f export name BOF PoC ==================================================== ;-------------------------------------------------------------------------; ; OllyDB...
MS Windows Messenger Service Remote Exploit FR (MS03-043)
No description provided by source. // / Crpt MS03-043 - Messenger exploit by MrNice Crpt / / --------------------------------------------------------------- / / / /  ...
SubEdit Player build 4066 - subtitle Buffer Overflow (PoC)
SubEdit Player build 4066 - subtitle Buffer Overflow PoC /===Subedit Player build 4066 subtitle BoF vulnerability=========| | | SubEdit Player is a very popular player and subtitles | editor in Poland. It does not perform any boundery checks | on supplied subtitles. This causes buffer overrun and...
CA BrightStor ARCserve Backup r11.5 ActiveX Remote BOF Exploit 0day
No description provided by source. HTML !-- CA BrightStor ARCserve Backup r11.5 AddColumn 0day ActiveX Remote Buffer Overflow Exploit Bug discovered by Krystian Kloskowski h07 [email protected] Tested on: - CA BrightStor ARCserve Backup r11.5 ftp://ftp.ca.com/priv/trial/BABr11/BABLDr115/BABLDr115.zi...
PHP 5.2.3 php_ntuser ntuser_getuserlist() Local Buffer Overflow PoC
No description provided by source. ?php //PHP 5.2.3 phpntuser ntusergetuserlist Local Buffer Overflow //author: shinnai //mail: shinnaiatautisticidotorg //site: http://shinnai.altervista.org //greetz to BrainBugger Crew //http://www.brainbugger.altervista.org/ //Bug discovered with "Footzo" thank...
phpget-overflow.txt
...
Savant 3.1 Get Request Remote Overflow Exploit (Universal)
Exploit for unknown platform in category remote exploits ========================================================== Savant 3.1 Get Request Remote Overflow Exploit Universal ========================================================== !/usr/bin/perl -w exploit for Savant webserver 3.1 remote bof...
Lotus Domino IMAP4 Server 6.5.4 Remote Buffer Overflow Exploit
No description provided by source. Lotus Domino IMAP4 Server Release 6.5.4 / Windows 2000 Advanced Server x86 Remote Exploit Vulnerable: IBM Lotus Domino = 7.0.2 && 6.5.5 FP2 tested 6.5.4 Authors: Dominic Chell [email protected] & prdelka Exploitation steps:...
lotus-overflow.txt
Lotus Domino IMAP4 Server Release 6.5.4 / Windows 2000 Advanced Server x86 Remote Exploit Vulnerable: IBM Lotus Domino & prdelka Exploitation steps: 1 The instruction "call dword ecx" is performed with user supplied ECX 2 EAX reference our buffer from retaddr onward 3 we put pointer in ECX to a...
notepad++[v4.1]: (win32) ruby file processing buffer overflow exploit.
...i took a look at the new notepad++, and noticed this, i'm not sure how long it has been there or if it was recently added to the code... either way here is a POC for it. original reference: http://fakehalo.us/xnotepad++.c / notepad++v4.1: win32 ruby file processing buffer overflow exploit. by:...
Winamp 5.34 - .mp4 Code Execution
Winamp 5.34 - .mp4 Code Execution /\ Winamp = 5.34 .MP4 File Code Execution Winamp MP4's plugin fails to handle exceptional conditions, which can lead to code execution. However exploitation is hard, firstly because of the return address. This code exploits a call eax, and it might be complicated...
helix-1101.txt
/usr/bin/python Remote exploit for the vulnerability in Helix server v11.0.1 as described at http://gleg.net/helix.txt The exploit spawns a shell on TCP port 4444 and connects to it. At the time of overflow we control EAX which is used in a call as follows 00420C64: call dword ptr eax + 4 ECX...
Imail 8.10-8.12 (RCPT TO) Remote Buffer Overflow Exploit (meta)
No description provided by source. This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same...