Arbitrary memory corruption in NCSS 07.1.21

Luigi Auriemma Application: NCSS aka NCSS 2007 http://www.ncss.com/ncss.html Versions: = 07.1.21 Platforms: Windows Bug: array overflow with write2 Exploitation: file Date: 28 Sep 2011 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 The Code 4 Fix...

NCSS 07.1.21 - Array Overflow with Write2

NCSS 07.1.21 - Array Overflow with Write2 Luigi Auriemma Application: NCSS aka NCSS 2007 http://www.ncss.com/ncss.html Versions: = 07.1.21 Platforms: Windows Bug: array overflow with write2 Exploitation: file Date: 28 Sep 2011 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1...

PcVue 10.0 - Multiple Vulnerabilities

PcVue 10.0 - Multiple Vulnerabilities Luigi Auriemma Application: PcVue http://www.arcinfo.com/index.php?option=comcontent&id=2&Itemid=151 Versions: PcVue = 10.0 SVUIGrd.ocx = 1.5.1.0 aipgctl.ocx = 1.07.3702 Platforms: Windows Bugs: A code execution in SVUIGrd.ocx Save/LoadObject B write4 in...

Sterling Trader 7.0.2 - Integer Overflow

Luigi Auriemma Application: Sterling Trader http://www.sterlingtrader.com/TradingPlatforms/tradingplatforms2.html Versions: 83BF BC001000 10 CMP DWORD PTR DS:EDI+1000BC,10 004922EA . 0F8C 66010000 JL Elite.00492456 004922F0 . 8D46 0C LEA EAX,DWORD PTR DS:ESI+C 004922F3 . 50 PUSH EAX ; &num2...

Sterling Trader 7.0.2 - Integer Overflow

Sterling Trader 7.0.2 - Integer Overflow Luigi Auriemma Application: Sterling Trader http://www.sterlingtrader.com/TradingPlatforms/tradingplatforms2.html Versions: 83BF BC001000 10 CMP DWORD PTR DS:EDI+1000BC,10 004922EA . 0F8C 66010000 JL Elite.00492456 004922F0 . 8D46 0C LEA EAX,DWORD PTR...

sunway ForceControl 6.1 sp3 - Multiple Vulnerabilities

Luigi Auriemma Application: Sunway ForceControl http://www.sunwayland.com.cn/pro.asp Versions: B9 19000000 MOV ECX,19 004022E6 . 33C0 XOR EAX,EAX 004022E8 . 8D7C24 24 LEA EDI,DWORD PTR SS:ESP+24 004022EC . 83FE 64 CMP ESI,64 ; our value 004022EF . F3:AB REP STOS DWORD PTR ES:EDI 004022F1 . 0F8D...

Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57

This module exploits a stack based buffer overflow found in the SNMP NetDBServer service of Sunway Forcecontrol use exploit/windows/scada/sunway/forcecontrolnetdbsrv msf undefinedforcecontrolnetdbsrv show actions ...actions... msf undefinedforcecontrolnetdbsrv set ACTION msf...

Cogent Datahub 7.1.1.63 - Remote Unicode Buffer Overflow

Cogent Datahub 7.1.1.63 - Remote Unicode Buffer Overflow !/usr/bin/python Cogent Datahub @netninja || @luigiauriemma example usage: mrme@neptune cognet$ ./cognetoverflow.py 192.168.114.130 ----------------------------------------------------- ------ Cogent Datahub Unicode Overflow Exploit ------...

Cogent Datahub 7.1.1.63 - Remote Unicode Buffer Overflow

!/usr/bin/python Cogent Datahub @netninja || @luigiauriemma example usage: mrme@neptune cognet$ ./cognetoverflow.py 192.168.114.130 ----------------------------------------------------- ------ Cogent Datahub Unicode Overflow Exploit ------ ------------- Found by Luigi Auriemma ---------------...

Cogent Datahub 7.1.1.63 Buffer Overflow

!/usr/bin/python Cogent Datahub @netninja || @luigiauriemma example usage: mrme@neptune cognet$ ./cognetoverflow.py 192.168.114.130 ----------------------------------------------------- ------ Cogent Datahub Unicode Overflow Exploit ------ ------------- Found by Luigi Auriemma ---------------...

MetaServer RT 3.2.1.450 - Multiple Vulnerabilities

MetaServer RT 3.2.1.450 - Multiple Vulnerabilities Luigi Auriemma Application: MetaServer RT http://www.traderssoft.com/ts/msrt/ Versions: = 3.2.1.450 Platforms: Windows Bugs: A heap overflow B various Denials of Service Exploitation: remote Date: 19 Sep 2011 Author: Luigi Auriemma e-mail:...

MetaServer RT 3.2.1.450 Heap Overflow / Denial Of Service

Luigi Auriemma Application: MetaServer RT http://www.traderssoft.com/ts/msrt/ Versions: = 3.2.1.450 Platforms: Windows Bugs: A heap overflow B various Denials of Service Exploitation: remote Date: 19 Sep 2011 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug...

Cogent Datahub <= v7.1.1.63 Remote Unicode Buffer Overflow Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python Cogent Datahub @netninja || @luigiauriemma example usage: email protected cognet$ ./cognetoverflow.py 192.168.114.130 ----------------------------------------------------- ------ Cogent Datahub Unicode Overflow Exploit ----...

EViews 7.0.0.1 (aka 7.2) - Multiple Vulnerabilities

Luigi Auriemma Application: EViews http://www.eviews.com Versions: = 7.0.0.1 aka 7.2 Platforms: Windows Bugs: A memory corruption B heap overflow Exploitation: remote Date: 19 Sep 2011 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bugs 3 The Code 4 Fix...

DaqFactory HMI NETB Request Overflow

$Id: daqfactorybof.rb 13756 2011-09-19 11:38:49Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

DaqFactory - HMI NETB Request Overflow (Metasploit)

$Id: daqfactorybof.rb 13750 2011-09-18 02:45:55Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

DaqFactory HMI NETB Request Overflow

Exploit for windows platform in category remote exploits $Id: daqfactorybof.rb 13750 2011-09-18 02:45:55Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on...

Measuresoft ScadaPro Remote Command Execution

This module allows remote attackers to execute arbitrary commands on the affected system by abusing via Directory Traversal attack when using the 'xf' command execute function. An attacker can execute system from msvcrt.dll to upload a backdoor and gain remote code execution. This vulnerability...

Advisory for MS11-035 / ZDI-11-167

Luigi Auriemma Application: Microsoft WINS service http://www.microsoft.com Versions: = 5.2.3790.4520 Platforms: Windows Bug: arbitrary memory corruption Exploitation: remote, versus server Date: found 21 Oct 2010 patched 10 May 2011 advisory 13 Sep 2011 Author: Luigi Auriemma e-mail:...

Cogent Datahub 7.1.1.63 Directory Traversal

Luigi Auriemma Application: Cogent DataHub http://www.cogentdatahub.com/Products/CogentDataHub.html Versions: = 7.1.1.63 Platforms: Windows Bug: directory traversal Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 Th...