QuickZip 0day detailed write-up

In case some of you missed it - I published 2 articles on the Offensive Security Blog last one was published a few hours ago, explaining the process of building a not so typical SEH based exploit for a QuickZip 0day vulnerability. Part 1 :...

QuickZip 4.60.019 Stack Buffer Overflow

Exploit Title : QuickZip 4.60.019 Stack BOF - XP SP3 OSVDB-ID : 62781 Date : March 2nd 2010 Author : corelanc0d3r Bug found by : corelanc0d3r Software Link : http://www.quickzip.org/downloads.html Version : 4.60.019 OS : Windows Tested on : XP SP3 En VirtualBox - offset is 297. You may have to...

QuickZip 4.60.019 (Windows XP SP3) - Local Stack Buffer Overflow

QuickZip 4.60.019 Windows XP SP3 - Local Stack Buffer Overflow Exploit Title : QuickZip 4.60.019 Stack BOF - XP SP3 OSVDB-ID : 62781 Date : March 2nd 2010 Author : corelanc0d3r Bug found by : corelanc0d3r Software Link : http://www.quickzip.org/downloads.html Version : 4.60.019 OS : Windows Teste...

CastRipper 2.9.6.0 (.wvx) file local BOF 0day exploit

Exploit for unknown platform in category local exploits ====================================================== CastRipper 2.9.6.0 .wvx file local BOF 0day exploit ====================================================== !/usr/bin/python CastRipper 2.9.6.0 .wvx file local BOF 0day by FB1H2S Greetz t...

CastRipper 2.9.6.0 .wvx File Local Buffer Overflow

!/usr/bin/python CastRipper 2.9.6.0 .wvx file local BOF 0day by FB1H2S Greetz to all Darkc0de, Andhra Hackers and ICW Memebers Thanks : Mr bond,beenu,Wipu,GOdwinAustin,Theempty,hgH@x0r,r45c4l,itsecurity,eberly,Tia Shoutz : SMARTHAX0R,j4ckh4x0r,41w@r10r,Hackuin Catch us at www.andhrahackers.com or...

The All-Decade Interview Team

It occurred to me recently that I’ve been covering the security industry for just about 10 years. That’s a long time to be doing anything, and especially to be writing about one topic. But it’s hard to think of something that would have been much more interesting to cover this decade, given the...

HP NNM 7.53 ovalarm.exe CGI Pre Authentication Remote Buffer Overflow

No description provided by source. !/usr/bin/python HP NNM 7.53 ovalarm.exe CGI Pre Authentication Remote Buffer Overflow Tested on XP SP3 + NNM Release B.07.50 Authors: muts & sinn3r Reference: http://dvlabs.tippingpoint.com/advisory/TPTI-09-12...

Savant Web Server 3.1 Remote Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ==================================================== Savant Web Server 3.1 Remote Buffer Overflow Exploit ==================================================== Title: Savant Web Server 3.1 Remote Buffer Overflow Exploit CVE-ID: OSVDB-ID:...

HP OpenView Network Node Manager (OV NNM) 7.53 - ovalarm.exe CGI Remote Buffer Overflow

HP OpenView Network Node Manager OV NNM 7.53 - ovalarm.exe CGI Remote Buffer Overflow !/usr/bin/python HP NNP ovalarm.exe CGI Remote Buffer Overflow - Pre Authentication Tested on XP SP3 + IIS + NNM Release B.07.50 Authors: muts & sinn3r x90.sinner a.t gmail.c0m Reference:...

HP OpenView Network Node Manager (OV NNM) 7.53 - 'ovalarm.exe' CGI Remote Buffer Overflow

!/usr/bin/python HP NNP ovalarm.exe CGI Remote Buffer Overflow - Pre Authentication Tested on XP SP3 + IIS + NNM Release B.07.50 Authors: muts & sinn3r x90.sinner a.t gmail.c0m Reference: http://dvlabs.tippingpoint.com/advisory/TPTI-09-12...

HP Power Manager Administration Universal Buffer Overflow

!/usr/bin/python HP Power Manager Administration Universal Buffer Overflow Exploit CVE 2009-2685 Tested on Win2k3 Ent SP2 English, Win XP Sp2 English Matteo Memelli ryujin A-T offensive-security.com www.offensive-security.com Spaghetti & Pwnsauce - 07/11/2009 ryujin@bt:$ ./hppowermanager.py...

Novell eDirectory 8.8 SP5 iConsole Buffer Overflow

!/usr/bin/python Novell eDirectory 8.8 SP5 iConsole BOF Vulnerability found by Hellcode Labs, Original POC http://downloads.securityfocus.com/vulnerabilities/exploits/36815.pl Exploit coded by Matteo Memelli | ryujin A-T offensive-security.com www.offensive-security.com Spaghetti & Pwnsauce -...

Novell eDirectory 8.8 SP5 iConsole Buffer Overflow

No description provided by source. !/usr/bin/python Novell eDirectory 8.8 SP5 iConsole BOF Vulnerability found by Hellcode Labs, Original POC http://downloads.securityfocus.com/vulnerabilities/exploits/36815.pl Exploit coded by Matteo Memelli | ryujin A-T offensive-security.com...

Hewlett-Packard (HP) Power Manager Administration Power Manager Administration - Universal Buffer Overflow

Hewlett-Packard HP Power Manager Administration Power Manager Administration - Universal Buffer Overflow !/usr/bin/python HP Power Manager Administration Universal Buffer Overflow Exploit CVE 2009-2685 Tested on Win2k3 Ent SP2 English, Win XP Sp2 English Matteo Memelli ryujin A-T...

HP Power Manager Administration Universal Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ================================================================= HP Power Manager Administration Universal Buffer Overflow Exploit ================================================================= Title: HP Power Manager Administration...

Novell eDirectory 8.8 SP5 - iConsole Buffer Overflow

Novell eDirectory 8.8 SP5 - iConsole Buffer Overflow !/usr/bin/python Novell eDirectory 8.8 SP5 iConsole BOF Vulnerability found by Hellcode Labs, Original POC http://downloads.securityfocus.com/vulnerabilities/exploits/36815.pl Exploit coded by Matteo Memelli | ryujin A-T offensive-security.com...

Novell eDirectory 883ftf3 - nldap module Denial of Service

!/usr/bin/python 22/03/2009 Novell eDirectory 883ftf3 nldap module DOS Matteo Memelli - offensive-security.com ryujin @ offensive-security.com A malformed bind LDAP packet can make dhost.exe service crashing. 24/03/2009 Vendor notification; patched in 885 release import sys from socket import...

Microsoft IIS 5.0 FTP Server Remote Stack Overflow Exploit (win2k sp4)

No description provided by source. !/usr/bin/perl IIS 5.0 FTP Server / Remote SYSTEM exploit Win2k SP4 targets bug found & exploited by Kingcope, kcope2atgooglemail.com Affects IIS6 with stack cookie protection Modded by muts, additional egghunter added for secondary larger payload Might take a...

Linux Kernel 2.6.19 (x86x64) - udp_sendmsg Local Privilege Escalation (2)

Linux Kernel 2.6.19 x86x64 - udpsendmsg Local Privilege Escalation 2 / second verse, same as the first CVE-2009-2698 udpsendmsg, x86/x64 Cheers to Julien/Tavis for the bug, p0c73n1 for just throwing code at NULL and finding it executed This exploit is a bit more nuanced and thoughtful ; use...

Microsoft IIS 5.0 FTP Server Remote Stack Overflow Exploit (win2k sp4)

Exploit for windows platform in category remote exploits ====================================================================== Microsoft IIS 5.0 FTP Server Remote Stack Overflow Exploit win2k sp4 ====================================================================== !/usr/bin/perl IIS 5.0 FTP...