HansoPlayer 3.4.0 Memory Corruption

!/usr/bin/python + Author: Rajganesh Raj Pandurangan + Exploit Title: HansoPlayer 3.4.0 Memory Corruption PoC + Date: 06-17-2015 + Category: DoS/PoC + Tested on: WinXp/Windows 7 + Vendor: http://www.hansotools.com + Download: http://www.hansotools.com/downloads/hanso-player-setup.exe + Sites:...

XtMediaPlayer 0.93 - .wav Crash (PoC)

XtMediaPlayer 0.93 - .wav Crash PoC !/usr/bin/python + Author: SATHISH ARTHAR + Exploit Title: XtMediaPlayer - 0.93 Memory Corruption PoC + Date: 16-06-2015 + Category: DoS/PoC + Tested on: WinXp/Windows 7 + Vendor:...

FinePlayer 2.20 - .mp4 Crash (PoC)

FinePlayer 2.20 - .mp4 Crash PoC !/usr/bin/python + Author: SATHISH ARTHAR + Exploit Title: FinePlayer - 2.20 Memory Corruption PoC + Date: 16-06-2015 + Category: DoS/PoC + Tested on: WinXp/Windows 7 + Vendor: http://www.gitashare.com + Download: http://www.gitashare.com/downloads/fineplayer220.z...

XtMediaPlayer 0.93 (.wav) - Crash PoC

Exploit for windows platform in category dos / poc !/usr/bin/python + Author: SATHISH ARTHAR + Exploit Title: XtMediaPlayer - 0.93 Memory Corruption PoC + Date: 16-06-2015 + Category: DoS/PoC + Tested on: WinXp/Windows 7 + Vendor:...

Microsoft Windows 8.08.1 (x64) - TrackPopupMenu Local Privilege Escalation (MS14-058)

Microsoft Windows 8.08.1 x64 - TrackPopupMenu Local Privilege Escalation MS14-058 Windows 8.0 - 8.1 x64 TrackPopupMenu Privilege Escalation MS14-058 CVE-2014-4113 Privilege Escalation http://www.offensive-security.com Thx to Moritz Jodeit for the beautiful writeup...

Microsoft Windows 8.0/8.1 (x64) - 'TrackPopupMenu' Local Privilege Escalation (MS14-058)

Windows 8.0 - 8.1 x64 TrackPopupMenu Privilege Escalation MS14-058 CVE-2014-4113 Privilege Escalation http://www.offensive-security.com Thx to Moritz Jodeit for the beautiful writeup http://www.exploit-db.com/docs/35152.pdf Target OS Windows 8.0 - 8.1 x64 Author: Matteo Memelli ryujin...

Windows-NDPROXY-SYSTEM

Original crash ... null pointer dereference Access violation - code c0000005 !!! second chance !!! 00000038 ?? ??? NDPROXY Local SYSTEM privilege escalation from ctypes import from ctypes.wintypes import import os, sys kernel32 = windll.kernel32 ntdll = windll.ntdll GENERICREAD = 0x80000000...

Symantec Endpoint Protection 11.x, 12.x - Kernel Pool Overflow

No description provided by source. Symantec Endpoint Protection 11.x, 12.x - Kernel Pool Overflow http://www.offensive-security.com Tested on Windows 7 http://www.offensive-security.com/vulndev/symantec-endpoint-protection-0day/ Authors: Matteo 'ryujin' Memelli & Alexandru 'sickness' Uifalvi at...

Symantec Endpoint Protection 11.x/12.x - Kernel Pool Overflow / Local Privilege Escalation

Symantec Endpoint Protection 11.x, 12.x - Kernel Pool Overflow http://www.offensive-security.com Tested on Windows 7 http://www.offensive-security.com/vulndev/symantec-endpoint-protection-0day/ Authors: Matteo 'ryujin' Memelli & Alexandru 'sickness' Uifalvi offensive-security.com from ctypes impo...

Audacity <= 1.2 (.gro File) Universal BOF Exploit (egg hunter)

No description provided by source. !/usr/bin/env python Audacity = 1.2 .gro universal buffer overflow exploit Author: mrme Download: http://audacity.sourceforge.net/download/ Tested on Wind0ws XP sp3 & Vist@ Greetz fly to Muts and the offensive-security team also to my wonderful partner Vanessa F...

smartermail free 9.2 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: SmarterMail Version: Free 9.2 Vendor Site: http://www.smartertools.com Software Download: http://smartertools.com/smartermail/mail-server-software.aspx Timeline: 29 May 2012: Vulnerability...

Joomla Component com_jfuploader < 2.12 Remote File Upload

No description provided by source. ========================================================================================================= Type : Joomla Component comjfuploader 2.12 Remote File Upload Author : Setr0nix Home : www.Setr0nix.com Contact : [email protected]...

winwebmail server 3.8.1.6 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: WinWebMail Server Version: 3.8.1.6 Vendor Site: http://www.winwebmail.net Software Download: http://www.winwebmail.net/email-server-download.html Timeline: 29 May 2012: Vulnerability reported...

QuickZip 4.60.019 Stack BOF - XP SP3

No description provided by source. Exploit Title : QuickZip 4.60.019 Stack BOF - XP SP3 OSVDB-ID : 62781 Date : March 2nd 2010 Author : corelanc0d3r Bug found by : corelanc0d3r Software Link : http://www.quickzip.org/downloads.html Version : 4.60.019 OS : Windows Tested on : XP SP3 En VirtualBox ...

manageengine service desk plus 8.1 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: ManageEngine Service Desk Plus Windows standard Version: 8.1 Vendor Site: http://www.manageengine.com Software Download: http://www.manageengine.com/products/service-desk/download.html...

dreamMail e-mail client 4.6.9.2 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: dreamMail e-mail client Version: 4.6.9.2 Vendor Site: http://www.dreammail.eu Software Download: http://www.dreammail.eu/intl/en/download.html Tested on: Windows XP SP3 Eng. Tested on: Window...

Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 4.1.X Bypass

Exploit for windows platform in category remote exploits function strtointstr return str.charCodeAt10x10000 + str.charCodeAt0; var free = "EEEE"; while free.length 500 free += free; var string1 = "AAAA"; while string1.length 500 string1 += string1; var string2 = "BBBB"; while string2.length 500...

Solarwinds Storage Manager 5.1.0 - Remote SYSTEM SQL Injection Exploit

No description provided by source. !/usr/bin/python Exploit Title: Solarwinds Storage Manager 5.1.0 Remote SYSTEM SQL Injection Exploit Date: May 2nd 2012 Author: muts Version: SolarWinds Storage Manager 5.1.0 Tested on: Windows 2003 Archive Url :...

Mercur Messaging 2005 <= SP4 - IMAP Remote Exploit (egghunter mod)

No description provided by source. !/usr/bin/python Mercur Messaging 2005 SP3 IMAP service - Egghunter mod [email protected] http://www.offensive-security.com Original exploit by Winny Thomas Thanks Thomas, this code really came in handy ! VMWare seems to alter the stack a bit as the...

escon supportportal pro 3.0 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: ESCON SupportPortal Pro Version: 3.0 Vendor Site: http://www.e-supportportal.com Software Download: http://www.e-supportportal.com/download.html Timeline: 29 May 2012: Vulnerability reported ...