213 matches found
Windows ATMFD.DLL Out-of-Bounds Read Due to Malformed Name INDEX in the CFF Table Exploit
Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=386&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: ---...
Microsoft Windows - 'ATMFD.DLL' Out-of-Bounds Read Due to Malformed Name INDEX in the CFF Table
Source: https://code.google.com/p/google-security-research/issues/detail?id=386&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: --- DRIVERPAGEFAULTINFREEDSPECIALPOOL d5 Memory was referenced after it...
PonyOS 3.0 tty ioctl() Privilege Escalation
Exploit Title: PonyOS include include int main struct winsize ws; printf"+ PonyOS = 3.0 ioctl local root exploit\n"; memcpy&ws,"\x90\x90\x90\x90\x8b\x45\x08\x89",8; ioctl0, TIOCSWINSZ, &ws; ioctl0, TIOCGWINSZ, void 0x0010f101; printf"- patched syssetuid\n"; asm"movl $0x18,%eax"; asm"xorl...
OpenBSD 5.6 - Multiple Local Kernel Panics Exploit
Proof of concept exploit for OpenBSD versions 5.6 and below that causes a kernel panic in sys/uvm/uvmmap.c. / Exploit Title: OpenBSD include include include include include include ifndef OpenBSD error "Not OpenBSD !!!1111"; else include endif ifndef i386 error "Not i386 !!!1111"; endif char...
OpenBSD 5.6 - Multiple Local Kernel Panics (Denial of Service)
OpenBSD 5.6 - Multiple Local Kernel Panics Denial of Service / Exploit Title: OpenBSD include include include include include include ifndef OpenBSD error "Not OpenBSD !!!1111"; else include endif ifndef i386 error "Not i386 !!!1111"; endif char bigb00bz = "...
OpenBSD <= 5.5 - Local Kernel Panic
No description provided by source. / tenochtitlan.c OpenBSD = 5.5 Local Kernel Panic by Alejandro Hernandez @nitr0usmx Advisory and technical details: http://www.ioactive.com/pdfs/IOActiveAdvisoryOpenBSD55LocalKernelPanic.pdf Fix: http://www.openbsd.org/errata55.html013kernexec This PoC works onl...
OpenBSD 5.5 - Local Kernel Panic (Denial of Service)
OpenBSD 5.5 - Local Kernel Panic Denial of Service / tenochtitlan.c OpenBSD include include include include include include include include ifndef OpenBSD error "Not an OpenBSD system !!!1111"; else include endif ifndef i386 error "Not an i386 system !!!1111"; endif // In Aztec mythology,...
OpenBSD 5.5 - Local Kernel Panic (Denial of Service)
/ tenochtitlan.c OpenBSD include include include include include include include include ifndef OpenBSD error "Not an OpenBSD system !!!1111"; else include endif ifndef i386 error "Not an i386 system !!!1111"; endif // In Aztec mythology, Huitzilopochtli, was a god of war, a sun god, // the patro...
Kingsoft AntiVirus 2012 KisKrnl.sys <= 2011.7.8.913 Local Kernel Mode Privilege Escalation Exploit
No description provided by source. Kingsoft AntiVirus 2012 KisKrnl.sys = 2011.7.8.913 Local Kernel Mode Privilege Escalation Exploit Date: 2011-7-23 Author : MJ0011 Version: Kingsoft AntiVirus 2012 Tested on: Windows XP SP3 DETAILS: In KisKrnl.sys 's hook function of NtQueryValueKey , it directly...
DESlock+ <= 3.2.7 (probe read) Local Kernel Denial of Service PoC
No description provided by source. / deslock-probe-read.c Copyright c 2008 by [email protected] DESlock+ = 3.2.7 local kernel DoS POC by mu-b - Sat 19 Jul 2008 - Tested on: DLMFENC.sys 1.0.0.28 call to ProbeForRead with a user-definable address that is eventually overwritten should have been...
DESlock+ <= 3.2.6 DLMFDISK.sys local kernel ring0 SYSTEM Exploit
No description provided by source. / deslock-pown-v2.c Copyright c 2008 by [email protected] DESlock+ = 3.2.6 local kernel ring0 SYSTEM exploit by mu-b - Wed 26 Dec 2007 - Tested on: DLMFDISK.sys 1.2.0.27 - Microsoft Windows 2003 SP2 - Microsoft Windows XP SP2 Note: create a mountable filesyste...
DESlock+ <= 3.2.7 - Local Kernel Race Condition Denial of Service PoC
No description provided by source. / deslock-probe-race.c Copyright c 2008 by [email protected] DESlock+ = 3.2.7 local kernel race condition DoS POC by mu-b - Fri 22 Feb 2008 - Tested on: DLMFENC.sys 1.0.0.28 race conditions between calls to ProbeForRead/ProbeForWrite and pointer use. Note that...
DESlock+ <= 3.2.6 DLMFENC.sys Local Kernel ring0 link list zero PoC
No description provided by source. / deslock-list-zero.c Copyright c 2008 by [email protected] DESlock+ = 3.2.6 local kernel ring0 link list zero POC by mu-b - Fri 21 Dec 2007 - Tested on: DLMFENC.sys 1.0.0.26 - Private Source Code -DO NOT DISTRIBUTE - http://www.digit-labs.org/ -- Digit-Labs...
G Data TotalCare 2011 0day Local Kernel Exploit
No description provided by source. / Exploit Title: G Data TotalCare 2011 0day Local Kernel Exploit Date: 2010-11-08 Author: Nikita Tarakanov CISS Research Team Software Link: http://www.gdata.de/ Version: up to date, version 21.1.0.5, MiniIcpt.sys version 1.0.8.9 Tested on: Win XP SP3 CVE :...
CORE FORCE Firewall 0.95.167 and Registry Modules Multiple Local Kernel Buffer Overflow Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/27341/info CORE FORCE Firewall and Registry modules are prone to multiple local kernel buffer-overflow vulnerabilities because the software fails to adequately verify user-supplied input. Local attackers can exploit these...
Linux Kernel 2.6.x pipe.c Local Privilege Escalation Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/36901/info Linux kernel is prone to a local privilege-escalation vulnerability that is caused by a NULL-pointer dereference. Local attackers can exploit this issue to execute arbitrary code with kernel-level privileges...
DESlock+ <= 4.1.10 vdlptokn.sys Local Kernel ring0 SYSTEM Exploit
No description provided by source. / deslock-vdlptokn.c Copyright c 2009 by [email protected] DESlock+ = 4.1.10 local kernel ring0 SYSTEM exploit by mu-b - Wed 17 Jun 2009 - Tested on: vdlptokn.sys 1.0.3.54 Compile: MinGW + -lntdll - this exploit is provided for educational purposes only. You a...
ESTsoft ALYac Anti-Virus 1.5 <= 5.0.1.2 - Privilege Escalation Vulnerability
No description provided by source. ESTsoft ALYac Anti-Virus 1.5 with AYDrvNT.sys = 5.0.1.2 Local Kernel Mode Privilege Escalation Vulnerability AUTHOR MJ0011 EMAIL thdecoder$126.com VULNERABLE PRODUCTS ALYac Anti-Virus 1.5 DETAILS: AYDrvNT.sys create a device called AYDrvNTALYAC , and handles the...
Microsoft Windows xp Win32k.sys Local Kernel DoS Vulnerability
No description provided by source. //////////////////////////////////////////////////////////////////////////// // // Title: Microsoft Windows xp Win32k.sys Local Kernel DoS Vulnerability // Author: Lufeng Li of Neusoft Corporation // Vendor: www.microsoft.com // Vulnerable: Windows xp sp3full...
Windows 2000/XP/2003 win32k.sys SfnLOGONNOTIFY local kernel Denial of Service Vulnerability
No description provided by source. / Windows 2000/XP/2003 win32k.sys SfnLOGONNOTIFY local kernel Denial of Service Vulnerability Effect : Microsoft Windows 2000/XP/2003 full patch Author:MJ0011 Published: 2010-04-22 Vulnerability Details: Win32k.sys in DispatchMessage when the last call to...