4002 matches found
Mercur Messaging 2005 <= SP4 IMAP Remote Exploit (egghunter mod)
No description provided by source. !/usr/bin/python Mercur Messaging 2005 SP3 IMAP service - Egghunter mod [email protected] http://www.offensive-security.com Original exploit by Winny Thomas Thanks Thomas, this code really came in handy ! VMWare seems to alter the stack a bit as the...
PHP <= 4.4.6 / 5.2.1 ext/gd Already Freed Resources Usage Exploit
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | \| || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / //...
MOPB-header.txt
?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...
PHP 4.4.65.2.1 - extgd Already Freed Resources Usage
PHP 4.4.65.2.1 - extgd Already Freed Resources Usage ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the...
PHP 5.2.1 - 'hash_update_file()' Freed Resource Usage
?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...
PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit
Exploit for linux platform in category local exploits ======================================================= PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit ======================================================= ?php //////////////////////////////////////////////////////////////////////...
Snort 2.6.1.12.6.1.22.7.0 - fragementation Remote Denial of Service
Snort 2.6.1.12.6.1.22.7.0 - fragementation Remote Denial of Service / DOS Snort Inline Affected Versions: 2.6.1.1, 2.6.1.2, 2.7.0beta Requirements : Frag3 Enabled, Inline, Linux, ipconntrack disabled Antimatt3r [email protected] Offset needs to be supplied that would cause reassembly for...
Mandrake Linux Security Advisory : kernel (MDKSA-2007:040)
Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : The isdnpppccpresetallocstate function in drivers/isdn/isdnppp.c in the Linux 2.4 kernel before 2.4.34-rc4, as well as the 2.6 kernel, does not call the inittimer function for the ISDN PPP CCP reset state timer, which ha...
maildisable-v6.pl.txt
!/usr/bin/perl maildisable-v6.pl Mail Enable Professional =v2.35 win32 remote exploit by mu-b - Tue Dec 5 2006 - Tested on: Mail Enable Professional v2.35 win32 Note: timing is quite critical with this!!, so change $senddelay if it doesn't work.... use Getopt::Std; getopts't:n:', %arg; use Socket...
MailEnable IMAPD Enterprise 2.32 < 2.34 - Remote Buffer Overflow
!/usr/bin/perl maildisable-v3.pl Mail Enable Professional/Enterprise v2.32-4 win32 remote exploit by mu-b - Thu Nov 23 2006 - Tested on: Mail Enable Professional v2.32 win32 - with HOTFIX Mail Enable Professional v2.33 win32 Mail Enable Professional v2.34 win32 what does this remind you off? Note...
MailEnable Enterprise <= 2.32 - 2.34 Remote Buffer Overflow Exploit
No description provided by source. !/usr/bin/perl maildisable-v3.pl Mail Enable Professional/Enterprise v2.32-4 win32 remote exploit by mu-b - Thu Nov 23 2006 - Tested on: Mail Enable Professional v2.32 win32 - with HOTFIX Mail Enable Professional v2.33 win32 Mail Enable Professional v2.34 win32...
Windows Disable Windows ICF, Command Shell, Bind TCP Inline
Disable the Windows ICF, then listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 529 include Msf::Payload::Windows include...
Microsoft Word Document - Malformed Pointer (PoC)
===== The file I have attached is a very basic two stage bug. stage 1 the first mod forces the code down a wrong path. the second mod by itsself is harmless, however when used with the first it will be the first and part of the second overwrite. I have use 41414141 as a marker to make it easier f...
Solaris 2.4 passwd, yppasswd, and nispasswd Overflow Exploits
No description provided by source. ---------------------------- file newpass.c ------------------------------- include stdio.h include syslog.h define hiddenpasswd "/bin/hpasswd" /change here .../ define MAXLENGTH 32 void mainint argc, char argv int i; char args10; ifargc 10 args0=hiddenpasswd;...
Cisco IOS GRE报文路由选项解析溢出漏洞
Cisco互联网操作系统（IOS）是Cisco设备所使用的操作系统。 Cisco Systems IOS在解析包含有GRE源路由信息的GRE报文时存在漏洞，远程攻击者可能导致设备处理报文出错。 如果收到了特制的GRE报文的话，IOS设备没有验证偏移字段是否指向报文内，如果偏移值被设置为负值，IOS直接从包含有IP报文全长的整数中减去了偏移，导致缓冲区访问越界溢出。这可能导致将报文环缓冲区（ring buffer）的其他内存内容解释为负载IP报文并以很大的长度信息重新注入到路由队列中： GRE decapsulated IP 0.3.74.0-0.0.1.30 len=65407,...
PowerZip 7.06.38950 - 'Filename Handling' Local Buffer Overflow
/ PowerZip 7.06 Exploit by bratax http://www.bratax.be/ Just a quick one as I was able to reuse most of my zipcentral eploit code.. Greetz to everyone I like...special greetz to mobbie and DT as they were sad I didn't mention them the previous time :p Some technical info: - Original advisory +...
Cyrus IMAPD 2.3.2 - 'pop3d' Remote Buffer Overflow (3)
!/usr/bin/perl Creator: K-sPecial xzziroz.net of .aware awarenetwork.org Name: bid-18056.pl Date: 08/12/2006 Description: this is yet another exploit for the cyrus pop3d buffer overflow. I tried both public exploits and not either of them worked not that they don't but coding my own is generaly...
CVE-2006-3464
TIFF library libtiff before 3.8.2 allows context-dependent attackers to pass numeric range checks and possibly execute code, and trigger assert errors, via large offset values in a TIFF directory that lead to an integer overflow and other unspecified vectors involving "unchecked arithmetic...
gdiplus.pl.txt
!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...
Gdiplus.dll division by 0
!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...