Sockso <= 1.5 Directory Traversal

Exploit for windows platform in category web applications Luigi Auriemma Application: Sockso http://sockso.pu-gh.com Versions: = 1.5 Platforms: Windows, Mac, Linux Bug: directory traversal Exploitation: remote Date: 14 Mar 2012 Author: Luigi Auriemma e-mail: email protected web: aluigi.org 1...

Microsoft Terminal Services - Use-After-Free (MS12-020)

Luigi Auriemma Application: Microsoft Terminal Services / Remote Desktop Services http://www.microsoft.com http://msdn.microsoft.com/en-us/library/aa383015v=vs.85.aspx Versions: any Windows version before 13 Mar 2012 Platforms: Windows Bug: use after free Exploitation: remote, versus server Date:...

sockso 1.5 - Directory Traversal

sockso 1.5 - Directory Traversal Luigi Auriemma Application: Sockso http://sockso.pu-gh.com Versions: = 1.5 Platforms: Windows, Mac, Linux Bug: directory traversal Exploitation: remote Date: 14 Mar 2012 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 The...

Sockso 1.5 Directory Traversal

Luigi Auriemma Application: Sockso http://sockso.pu-gh.com Versions: = 1.5 Platforms: Windows, Mac, Linux Bug: directory traversal Exploitation: remote Date: 14 Mar 2012 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 The Code 4 Fix =============== 1...

EMC NetWorker 7.6 sp3 - Denial of Service

EMC NetWorker 7.6 sp3 - Denial of Service Luigi Auriemma Application: EMC NetWorker Legato http://www.emc.com/backup-and-recovery/networker/networker.htm Versions: = 7.6 sp3 7.6.3.2 Build 860 Platforms: AIX, HP-UX, Linux, Solaris, Windows Bug: invalid read access Exploitation: remote Date: 14 Mar...

Epson EventManager 2.50 - Denial of Service

Luigi Auriemma Application: Epson EventManager http://www.epson.com Versions: 53 PUSH EBX 01639680 |. 8B5C24 24 MOV EBX,DWORD PTR SS:ESP+24 01639684 |. 53 PUSH EBX 01639685 |. 50 PUSH EAX 01639686 |. E8 25F8FFFF CALL epnsm.01638EB0 ; parse "x-protocol-version" string 0163968B |. 83C4 08 ADD ESP,8...

TVersity 1.9.7 - Arbitrary File Download

TVersity 1.9.7 - Arbitrary File Download Luigi Auriemma Application: TVersity http://tversity.com Versions: = 1.9.7 Platforms: Windows Bug: arbitrary files downloading Exploitation: remote Date: 14 Mar 2012 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3...

Sockso Music Host Server 1.5 Directory Traversal

This module exploits a directory traversal bug in Sockso on port 4444. This is done by using "../" in the path to retrieve a file on a vulnerable machine. Module Options msf use auxiliary/scanner/http/sockso/traversal msf undefinedtraversal show actions ...actions... msf undefinedtraversal set...

TVersity <= 1.9.7 Arbitrary File Download

Exploit for php platform in category web applications Luigi Auriemma Application: TVersity http://tversity.com Versions: = 1.9.7 Platforms: Windows Bug: arbitrary files downloading Exploitation: remote Date: 14 Mar 2012 Author: Luigi Auriemma e-mail: email protected web: aluigi.org 1 Introduction...

Epson EventManager 2.50 - Denial of Service

Epson EventManager 2.50 - Denial of Service Luigi Auriemma Application: Epson EventManager http://www.epson.com Versions: 53 PUSH EBX 01639680 |. 8B5C24 24 MOV EBX,DWORD PTR SS:ESP+24 01639684 |. 53 PUSH EBX 01639685 |. 50 PUSH EAX 01639686 |. E8 25F8FFFF CALL epnsm.01638EB0 ; parse...

presto! pagemanager 9.01 - Multiple Vulnerabilities

Luigi Auriemma Application: Presto! PageManager http://www.newsoftinc.com/products/productpage.php?PId=5 Versions: = 9.01 Platforms: Windows, MacOSX Bugs: A Heap-overflow B Arbitray files downloading C Denial of Service Exploitation: remote Date: 14 Mar 2012 Author: Luigi Auriemma e-mail:...

Unity 3D Web Player 3.2.0.61061 - Denial of Service

Unity 3D Web Player 3.2.0.61061 - Denial of Service Luigi Auriemma Application: Unity 3D web player http://unity3d.com/webplayer/ Versions: = 3.2.0.61061 Platforms: Windows Bug: heap corruption Exploitation: remote Date: 21 Feb 2012 Author: Luigi Auriemma e-mail: [email protected] web:...

Unity 3D Web Player 3.2.0.61061 - Denial of Service

Luigi Auriemma Application: Unity 3D web player http://unity3d.com/webplayer/ Versions: = 3.2.0.61061 Platforms: Windows Bug: heap corruption Exploitation: remote Date: 21 Feb 2012 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 The Code 4 Fix...

Novell Groupwise Messenger 2.1.0 - Arbitrary Memory Corruption

Novell Groupwise Messenger 2.1.0 - Arbitrary Memory Corruption Luigi Auriemma Application: Novell GroupWise Messenger http://www.novell.com/products/groupwise/ Versions: 8B5D 0C /MOV EBX,DWORD PTR SS:EBP+C 00496E2D | 8B4D F8 MOV ECX,DWORD PTR SS:EBP-8 00496E30 |. 8A47 06 |MOV AL,BYTE PTR DS:EDI+6...

Novell Groupwise Messenger 2.1.0 - Memory Corruption

Novell Groupwise Messenger 2.1.0 - Memory Corruption Luigi Auriemma Application: Novell GroupWise Messenger http://www.novell.com/products/groupwise/ Versions: NMAPARM1 allows to corrupt the heap memory: 0042BCD9 |. 8B0B MOV ECX,DWORD PTR DS:EBX ; 3 0042BCDB |. 8B55 FC MOV EDX,DWORD PTR SS:EBP-4 ...

Novell Groupwise Messenger 2.1.0 - Memory Corruption

Luigi Auriemma Application: Novell GroupWise Messenger http://www.novell.com/products/groupwise/ Versions: NMAPARM1 allows to corrupt the heap memory: 0042BCD9 |. 8B0B MOV ECX,DWORD PTR DS:EBX ; 3 0042BCDB |. 8B55 FC MOV EDX,DWORD PTR SS:EBP-4 ; 3 0042BCDE |. C1EE 02 SHR ESI,2 0042BCE1 |. 81C6...

Novell Groupwise Messenger 2.1.0 - Arbitrary Memory Corruption

Luigi Auriemma Application: Novell GroupWise Messenger http://www.novell.com/products/groupwise/ Versions: 8B5D 0C /MOV EBX,DWORD PTR SS:EBP+C 00496E2D | 8B4D F8 MOV ECX,DWORD PTR SS:EBP-8 00496E30 |. 8A47 06 |MOV AL,BYTE PTR DS:EDI+6 00496E33 |. 81E1 FFFF0000 |AND ECX,0FFFF 00496E39 |. 3C 02 |CM...

RabidHamster R4 Log Entry sprintf() Buffer Overflow

This module exploits a vulnerability found in RabidHamster R4's web server. By supplying a malformed HTTP request, it is possible to trigger a stack-based buffer overflow when generating a log, which may result in arbitrary code execution under the context of the user. Module Options msf use...

Sunway ForceControl - SNMP 'NetDBServer.exe' Opcode 0x57 (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Sunway Forcecontr...

Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...