Knox Arkeia Backup Client Type 77 (Windows x86) - Remote Overflow (Metasploit)

$Id: type77.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ requir...

ProSSHD 1.2 20090726 scp_get()函数远程溢出漏洞

BUGTRAQ ID: 38487 ProSSHD是由Labtam Inc.开发的Windows平台SSH服务器和客户端。 ProSSHD服务器没有正确地过滤用户提交给scpget函数的输入参数，远程攻击者可以通过发送恶意请求触发缓冲区溢出，导致执行任意代码。成功利用这个漏洞要求用户通过认证。 LabTam ProSSHD 1.2 20090726 厂商补丁： LabTam ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.prosshd.com/ http://sebug.net/exploit/1921...

CA BrightStor Agent for Microsoft SQL - Remote Overflow (Metasploit)

$Id: sqlagent.rb 9179 2010-04-30 08:40:19Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Xftp client 3.0 - 'PWD' Remote Overflow

Exploit Title: Xftp client 3.0 PWD Remote Exploit Date: 2010-04-21 Author: zombiefx Software Link: http://www.netsarang.com/download/downxft3.html Version: Xftp 3.0 build 0238 Tested on: Windows XP SP3 Usage: ./xftpexploit The BOF occurs when sending an overly long PWD response. EDB Testing Notes...

WinMount 3.3.0401 ZIP文件解析远程溢出漏洞

BUGTRAQ ID: 39557 WinMount是一款免费的Windows小工具，具有压缩、解压、浏览压缩和挂载DVD、CD、虚拟机硬盘镜像等功能。 用户受骗使用WinMount加载了带有超长文件名的zip文件就可以触发缓冲区溢出，导致执行任意代码。 WinMount 3.3.0401 厂商补丁： WinMount -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.winmount.com/ Poc: import os sploitfile="test.zip" ldfheader...

HP Operations Manager 8.16 - srcvw4.dll LoadFile()SaveFile() Remote Unicode Stack Overflow (PoC)

HP Operations Manager 8.16 - srcvw4.dll LoadFileSaveFile Remote Unicode Stack Overflow PoC !-- |------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// //...

Liquid XML Studio 2010 8.061970 - LtXmlComHelp8.dll OpenFile() Remote Overflow

Liquid XML Studio 2010 8.061970 - LtXmlComHelp8.dll OpenFile Remote Overflow !-- |------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | |...

Liquid XML Studio 2010 < 8.061970 - 'LtXmlComHelp8.dll OpenFile()' Remote Overflow

!-- |------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | | http://www.corelan.be:8800 | | [email protected] | | |...

(Gabriel's FTP Server) Open & Compact FTPd 1.2 - Remote Overflow

Title: Open & Compact FTPd Pre-Authentication Remote Exploit Written by: Lincoln Originally discovered by: loneferret Reference: http://www.exploit-db.com/exploits/11391/ Tested on: XPSP2 root@box: ./ftpd.py 192.168.139.130 Try connecting to host on port 4444 root@box: nc -vn 192.168.139.130 4444...

(Gabriels FTP Server) Open Compact FTPd 1.2 - Remote Overflow

Gabriels FTP Server Open Compact FTPd 1.2 - Remote Overflow Title: Open & Compact FTPd Pre-Authentication Remote Exploit Written by: Lincoln Originally discovered by: loneferret Reference: http://www.exploit-db.com/exploits/11391/ Tested on: XPSP2 root@box: ./ftpd.py 192.168.139.130 Try connectin...

PostgreSQL bitsubstr函数远程溢出漏洞

BUGTRAQ ID: 37973 CVECAN ID: CVE-2010-0442 PostgreSQL是一款高级对象－关系型数据库管理系统，支持扩展的SQL标准子集。 远程攻击者可以利用PostgreSQL的bitsubstr函数处理超长字符串时的缓冲区溢出导致拒绝服务或执行任意代码。 PostgreSQL 8.0.23 厂商补丁： PostgreSQL ---------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.postgresql.org testdb= select...

NetTransport Download Manager 2.90.510 - Remote Overflow (SEH)

NetTransport Download Manager 2.90.510 - Remote Overflow SEH !/usr/bin/python NetTransport Download Manager version:2.90.510 0day Discovered by Lincoln Tested on Windows XP SP3 eMule file sharing protocol SEH overwrite, leaves only 60 or so bytes after p/p/r egghunter is used to find sc calc.exe...

NetTransport Download Manager 2.90.510 - Remote Overflow (SEH)

!/usr/bin/python NetTransport Download Manager version:2.90.510 0day Discovered by Lincoln Tested on Windows XP SP3 eMule file sharing protocol SEH overwrite, leaves only 60 or so bytes after p/p/r egghunter is used to find sc calc.exe root@BT4VM: ./netxfer.py 192.168.1.8 31491 import socket,sys...

BigAnt Server 2.52 - Remote Overflow (SEH)

BigAnt Server 2.52 - Remote Overflow SEH !/usr/bin/python import socket, sys BigAnt version 2.52 0day Tested on XPSP2 & Win2k3 SP2 Discovered by Lincoln Thanks to muts & remote-exploit 650 or so bytes available after seh, easier to jump back root@BT4VM: ./bigant.py 192.168.87.130 Exploit sent!...

BigAnt Server 2.52 - Remote Overflow (SEH)

!/usr/bin/python import socket, sys BigAnt version 2.52 0day Tested on XPSP2 & Win2k3 SP2 Discovered by Lincoln Thanks to muts & remote-exploit 650 or so bytes available after seh, easier to jump back root@BT4VM: ./bigant.py 192.168.87.130 Exploit sent! Connect to remote host on port 4444...

Savant Web Server 3.1 - Remote Buffer Overflow (3)

!/usr/bin/python Title: Savant web server 3.1 buffer overflow exploit Author: DouBleZer0 Version: 3.1 Tested on: win xp sp2,3 en Vulnerability discovered by Mutsoffensive security \x83\xc4\x50\x54\xc3 -add esp,50 push esp retsee the double dance of this in exploit ret=00401D09pop ebp, ret import...

Symantec多个产品AeXNSConsoleUtilities.dll ActiveX控件远程溢出漏洞

BUGTRAQ ID: 37092 CVECAN ID: CVE-2009-3033 Altiris Notification Server、Management Platform和Altiris Deployment Solution都是Symantec的网管和部署解决方案。 在初次连接到Altiris Deployment Solution等产品管理服务器的Web控制台时会安装一个Altiris eXpress NS Console Utilities...

eMule IRC Module / Web Server DecodeBase16 Function Remote Overflow

According to its version, the eMule Web Server listening on this port contains a buffer overflow vulnerability in the 'DecodeBase16' function due to a lack of length checks on its inputs. An anonymous remote attacker may be able to leverage this issue to execute arbitrary code on the affected hos...

How to find unix broiler-vulnerability warning-the black bar safety net

Why that is I and the x-laser together with looking for broiler? Because all our operations are all in the 3 3 8 9 broiler on. First of all, we are on to the same terminal, premise:the terminal is open,rather than doing it on your own,so that only the Terminal Services Manager can be usedand then...

EMC Captiva QuickScan Pro 4.6 SP1 and EMC Documentum ApllicationXtender Desktop 5.4 (keyhelp.ocx 1.2.312) - Remote Overflow

//executing calc scode = unescape"%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49" & unescape"%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36" & unescape"%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34" & unescape"%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41" &...