1548 matches found
madwifi <= 0.9.2.1 WPA/RSN IE Remote Kernel Buffer Overflow Exploit
No description provided by source. / ---- madwifi WPA/RSN IE remote kernel buffer overflow ------ expoit code by: sgrakkyu antifork.org -- 10/1/2007 CVE: 2006-6332 Laurent BUTTI, Jerome RAZNIEWSKI, Julien TINNES for wpa .... memcpybuf, se-sewpaie, se-sewpaie1 + 2 .... .... the function re-uses ar...
madwifi <= 0.9.2.1 WPA/RSN IE Remote Kernel Buffer Overflow Exploit
No description provided by source. / ---- madwifi WPA/RSN IE remote kernel buffer overflow ------ expoit code by: sgrakkyu at antifork.org -- 10/1/2007 CVE: 2006-6332 Laurent BUTTI, Jerome RAZNIEWSKI, Julien TINNES for wpa .... memcpybuf, se-sewpaie, se-sewpaie1 + 2 .... .... the function re-uses...
Madwifi 0.9.2.1 - WPA/RSN IE Remote Kernel Buffer Overflow
/ ---- madwifi WPA/RSN IE remote kernel buffer overflow ------ expoit code by: sgrakkyu antifork.org -- 10/1/2007 CVE: 2006-6332 Laurent BUTTI, Jerome RAZNIEWSKI, Julien TINNES for wpa .... memcpybuf, se-sewpaie, se-sewpaie1 + 2 .... .... the function re-uses args in the stack before returning so...
revenge_proftpd_ctrls_24.pl.txt
!/usr/bin/perl -w $Id: revengeproftpdctrls24.pl, v1.0 2007/02/18 19:24:22 revenge Exp $ ProFTPD v1.3.0/1.3.0a Controls Buffer Overflow Exploit Old style school sploit against gcc 3.x and linux kernel 2.4 Original Advisory : http://www.coresecurity.com/?action=item&id=1594 Exploitation condition -...
ProFTPd 1.3.01.3.0a - mod_ctrls support Local Buffer Overflow (2)
ProFTPd 1.3.01.3.0a - modctrls support Local Buffer Overflow 2 !/usr/bin/perl -w $Id: revengeproftpdctrls26.pl, v1.1 2007/02/18 19:30:25 revenge Exp $ ProFTPD v1.3.0/1.3.0a Controls Buffer Overflow Exploit Original Advisory : http://www.coresecurity.com/?action=item&id=1594 Exploitation condition...
Exploits Microsoft Windows NtRaiseHardError Csrss.exe-winsrv.dll Double Free
No description provided by source. ///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe-winsrv.dll Double Free ///////////////////////////////////////// ///// Ruben Santamarta ///// ruben at reversemode dot co...
Microsoft Windows - 'Csrss.exe/winsrv.dll' NtRaiseHardError Double-Free
///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe-winsrv.dll Double Free ///////////////////////////////////////// ///// Ruben Santamarta ///// ruben at reversemode dot com ///// www.reversemode.com...
Microsoft Windows - NtRaiseHardError Csrss.exe Memory Disclosure
Microsoft Windows - NtRaiseHardError Csrss.exe Memory Disclosure ///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe memory disclosure ///////////////////////////////////////// ///// Ruben Santamarta /////...
D-LINK DWL-2000AP+远程拒绝服务漏洞
D-LINK DWL-2000AP+是一款流行的无线接入路由器。 DWL-2000AP+在处理大量ARP请求时存在漏洞，远程攻击者可能利用此漏洞导致设备无法正常工作。 D-LINK DWL-2000AP+没有正确的处理arp...
ProFTPD <= 1.3.0a (mod_ctrls support) Local Buffer Overflow PoC
Exploit for linux platform in category dos / poc =============================================================== ProFTPD = 1.3.0a modctrls support Local Buffer Overflow PoC =============================================================== Core Security Technologies - Corelabs Advisory ProFTPD...
solaris/sparc download and execute 278 bytes
Exploit for solaris/sparc platform in category shellcode ============================================ solaris/sparc download and execute 278 bytes ============================================ / black-dl-exec-SOLARIS.c MIPS 278:bytes Dowloads a binary from host given named 'evil-dl' to '/tmp/ff'...
Kerio WebSTAR 5.4.2 (OSX) - 'libucache.dylib' Local Privilege Escalation
!/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom you must have access to the webstar user or be in the admin group This is currently not patched... chmod -s your kerio binaries foreach $key keys %ENV delete $ENV$key; $tgts"0" = "kerio-webstar-5.4.2-mac.bi...
Digipass Go3 Token Dumper (at least for 2006)
The initial reverse engineering of Vasco’s Digipass Go3 algorithm follows in C++. I think this implementation is a "rough" approximation, if we take some limitations about 2006 and the calculations made into account. Or I'm just joking… : This generator was able to predict an "otp" collision,...
Xcode OpenBase <= 10.0.0 (unsafe system call) Local Root Exploit (OSX)
No description provided by source. !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom = ftp://www.openbase.com/pub/OpenBase10.0 vulnerable ? This is some fairly blatant and retarded use of system cd cp chmod chown rm mkdir and killall appear as strings in t...
Xcode OpenBase 10.0.0 (OSX) - Unsafe System Call Privilege Escalation
Xcode OpenBase 10.0.0 OSX - Unsafe System Call Privilege Escalation !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom \n\nTargets:\n\n"; foreach $key sortkeys %tgts $a,$b = split/:/,$tgts"$key"; print "\t$key . $a - $b\n"; print "\n"; exit 1; $ret =...
SCO OpenServer 5.0.5 Env Local Stack Overflow Exploit
No description provided by source. / Copyright c 2000 ADM / / All Rights Reserved / / THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF ADM / / The copyright notice above does not evidence any / / actual or intended publication of such source code. / / / / Title: SCO OpenServer mscreen / / Tested...
Infecting Elf Binaries to Gain Local Root Exploit
No description provided by source. gcc infR3.s -o infR3 strip infR3 find a writable binary example: ls ./infR3 /bin/ls when root calls the writable ls, chmod will be setuided Coded by [email protected] == [email protected] .text .global main infeccion de start para conseguir local root use ...
Solaris 10 libnspr constructor Local Root Exploit
No description provided by source. !/bin/sh $Id: raptorlibnspr3,v 1.1 2006/10/24 15:54:57 raptor Exp $ raptorlibnspr3 - Solaris 10 libnspr constructor exploit Copyright c 2006 Marco Ivaldi [email protected] Local exploitation of a design error vulnerability in version 4.6.1 of NSPR, as...
Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation (2)
source: https://www.securityfocus.com/bid/20471/info The Netscape Portable Runtime API running on Sun Solaris 10 operating system is prone to a local privilege-escalation vulnerability. A successful exploit of this issue allows an attacker to gain superuser privileges, completely compromising the...
Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation (2)
Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation 2 source: https://www.securityfocus.com/bid/20471/info The Netscape Portable Runtime API running on Sun Solaris 10 operating system is prone to a local privilege-escalation vulnerability. A successful exploit of this iss...