部分万户EIP v3.0 未授权访问导致任意上传和路径泄露

简要描述： 万户EIP v3.0 任意上传和路径泄露 详细说明： 今天在对时代传媒集团渗透的过程中发现的这个问题，并通过google发现是通用型的 时代传媒http://www.chinatmg.com 首先是用工具跑出了源码http://www.chinatmg.com/chinatmg.rar 艹，居然近400mb，面对渣渣的网速我想还是算了，把资源留给迅雷云播同志，管理员显然安全意识不足，不如找找有没有其他的收获 然后首先发现几个目录的遍历： http://www.chinatmg.com/whirsystem/module/...

万户EIP邮件发送邮箱密码泄漏

简要描述： 万户EIP是国内使用很多的商业CMS系统，万户EIP用于注册用户邮箱验证和密码找回功能的邮箱密码泄漏，导致众多网站注册用户存在风险。 详细说明： 漏洞证明：...

CoolPlayer+ Portable 2.19.4 - Local Buffer Overflow

CoolPlayer+ Portable 2.19.4 - Local Buffer Overflow !/usr/bin/perl Exploit Title: CoolPlayer+ Portable v2.19.4 - Local Buffer Overflow Date: 11-15-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software: CoolPlayer+ Portable v2.19.4 Software Link:...

Plogue Sforzando 1.665 - Buffer Overflow (SEH) (PoC)

Plogue Sforzando 1.665 - Buffer Overflow SEH PoC !/usr/bin/perl Exploit Title: Plogue Sforzando v1.665 Buffer Overflow POC Date Discovered: 10-29-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software: Sforzando v1.665 Software Link:...

Microsoft DirectShow - Arbitrary Memory Overwrite (MS13-056)

Introduction: The Microsoft DirectShow application programming interface API is a media-streaming architecture for Microsoft Windows. Using DirectShow, your applications can perform high-quality video and audio playback or capture. Overview: DirectShow in Microsoft Windows XP SP2 and SP3, Windows...

Bifrost 1.2d Remote Buffer Overflow

!/usr/bin/python2.7 By : Mohamed Clay import socket from time import sleep from itertools import izip, cycle import base64 import threading import sys def rc4cryptdata, key: x = 0 box = range256 for i in range256: x = x + boxi + ordkeyi % lenkey % 256 boxi, boxx = boxx, boxi x = 0 y = 0 out = for...

Ophcrack v3.5.0 - Local Code Execution BOF

Stack based buffer overflow - direct EIP overwrite in this case SEH based exploitation is possible as well In order to exploit go to: Load - Remote SAM - put the content of buffer.txt file generated by this exploit into the "Host name:" field - "Don't send" once you see the crash. pwdump6setup.ex...

Ophcrack 3.50 Buffer Overflow / Code Execution

Exploit Title: ophcrack v3.5.0 - Local Code Execution BOF Date: 21.05.2013 Exploit Author: xisone@STM Solutions Vendor Homepage: http://ophcrack.sourceforge.net/ Software Link: http://downloads.sourceforge.net/ophcrack/ophcrack-win32-installer-3.5.0.exe Version: 3.5.0 Tested on: Windows XP SP3 En...

Ophcrack 3.5.0 - Code Execution Local Buffer Overflow

Exploit Title: ophcrack v3.5.0 - Local Code Execution BOF Date: 21.05.2013 Exploit Author: xisone@STM Solutions Vendor Homepage: http://ophcrack.sourceforge.net/ Software Link: http://downloads.sourceforge.net/ophcrack/ophcrack-win32-installer-3.5.0.exe Version: 3.5.0 Tested on: Windows XP SP3 En...

Ophcrack 3.5.0 - Code Execution Local Buffer Overflow

Ophcrack 3.5.0 - Code Execution Local Buffer Overflow Exploit Title: ophcrack v3.5.0 - Local Code Execution BOF Date: 21.05.2013 Exploit Author: xisone@STM Solutions Vendor Homepage: http://ophcrack.sourceforge.net/ Software Link:...

No-IP Dynamic Update Client (DUC) 2.1.9 - Local IP Address Stack Overflow

To be easily portable, the client is written in C, with minimal dependencies. So far so good, but the problem is, it is plagued of buffer overflows. import os binary = "./noip-2.1.9-1/binaries/noip2-i686" shellcode = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"...

No-IP Dynamic Update Client 2.1.9 Stack Overflow

!/usr/bin/env python Title: No-IP Dynamic Update Client DUC 2.1.9 local IPaddress stack overflow Author: Alberto Ortega @a0rtega [email protected] Date: May 11 2013 vulnerability discovered Background: No-IP is probably the most used Dynamic DNS provider worldwide, their Dynamic Update Client D...

MinaliC Webserver 2.0.0 - Buffer Overflow

Remote command execution by triggering a buffer overflow in the GET request. import socket import struct 74 bytes calc.exe from http://code.google.com/p/win-exec-calc-shellcode/ shellcode = "\x31\xd2\x52\x68\x63\x61\x6c\x63\x89\xe6\x52\x56\x64\x8b\x72" +...

KNet Web Server 1.04b - Stack Corruption Buffer Overflow

!/usr/bin/perl KNet Web Server Stack corruption BoF PoC Written by Wireghoul - http://www.justanotherhacker.com Date: 2013/04/11 Version: 1.04b Tested on: WinXP SP3 use IO::Socket::INET; $host = shift; $port = shift; print "KNet Web Server stack corruption BoF PoC - Wireghoul -...

Sami FTP Server 2.0.1 LIST Command Buffer Overflow

A buffer overflow is triggered when a long LIST command is sent to the server and the user views the Log tab. from socket import import struct, sys IP = sys.argv1 Windows bind shellcode from https://code.google.com/p/w32-bind-ngs-shellcode/ Remove bad chars using msfencode: msfencode -b...

Sami FTP Server 2.0.1 - LIST Buffer Overflow

Sami FTP Server 2.0.1 - LIST Buffer Overflow !/usr/bin/env python Exploit Title: Sami FTP LIST buffer overflow Date: 27 Feb 2013 Exploit Author: superkojiman - http://www.techorganic.com Vendor Homepage: http://www.karjasoft.com/old.php Version: Sami FTP Server 2.0.1 Tested on: Windows XP Pro SP1...

FreeFloat FTP 1.0 Raw Commands Buffer Overflow

FreeFloat FTP 1.0 allows an attacker to trigger a buffer overflow and execute arbitrary code when a long and invalid raw command is sent to it. import socket, struct, sys if lensys.argv 3: print "usage: %s IP port" % sys.argv0 sys.exit0 ip = sys.argv1 port = intsys.argv2 Bind shellcode generated...

IrfanView 4.33 - IMXCF.dll Plugin Code Execution

IrfanView 4.33 - IMXCF.dll Plugin Code Execution From the simple.xcf file, 0x004ABABC will overwrite eip. Tested on Windows XP SP3 and Windows 7 x64. Fixed in the current release IrfanView 4.35: 1 Shellcode from 2 Old version installer at 3 4. 1 http://www.irfanview.com/mainhistory.htm 2...

AOL Products downloadUpdater2 Plugin SRC Parameter Remote Code Execution

AOL Products downloadUpdater2 Plugin SRC Parameter Remote Code Execution tested against: Microsoft Windows Vista sp2 Microsoft Windows Server 2003 r2 sp2 Mozilla Firefox 14.0.1 download url: http://client.web.aol.com/toolbarfiles/Prod/downloads/downloadupdater/dnupdatersetup.exe this was the upda...

PHP 6.0 openssl_verify() Local Buffer Overflow PoC

No description provided by source. ?php // ================================================================================== // // PHP 6.0 opensslverify Local Buffer Overflow PoC // // Tested on WIN XP, Apache, PHP 6.0dev. Local Buffer Overflow. // // Local Buffer Overflow // Author: Pr0T3cT10n...