Kolibri+ Web Server 2 - GET Remote Overwrite (SEH)

!/usr/bin/python Could not get this to work on XP SP3. php5ts.dll is the only module with safe seh off but could not get the pop pop ret to work correctly despite the large number of usable addresses that were tested. $ ./kolibri.py 192.168.1.146 8080 Kolibri+ Webserver 2 SEH Overwrite Written by...

Kolibri+ Web Server 2 - GET Remote Overwrite (SEH)

Kolibri+ Web Server 2 - GET Remote Overwrite SEH !/usr/bin/python Could not get this to work on XP SP3. php5ts.dll is the only module with safe seh off but could not get the pop pop ret to work correctly despite the large number of usable addresses that were tested. $ ./kolibri.py 192.168.1.146...

Amaya Web Editor 11 - Remote Overwrite (SEH)

Amaya Web Editor 11 - Remote Overwrite SEH !/usr/bin/perl Title: Amaya Web Editor 11 Remote SEH Overwrite Exploit Summary: Amaya is a Web editor, i.e. a tool used to create and update documents directly on the Web. Product web page: http://www.w3.org/Amaya/ Tested on Microsoft Windows XP...

Amaya Web Editor 11 - Remote Overwrite (SEH)

!/usr/bin/perl Title: Amaya Web Editor 11 Remote SEH Overwrite Exploit Summary: Amaya is a Web editor, i.e. a tool used to create and update documents directly on the Web. Product web page: http://www.w3.org/Amaya/ Tested on Microsoft Windows XP Professional SP2 English Reference:...

CVE-2008-3910

dns2tcp before 0.4.1 does not properly handle negative values in a certain length field in the input argument to the 1 dnssimpledecode or 2 dnsdecode function, which allows remote attackers to overwrite a buffer and have unspecified other impact...

Youngzsoft CMailServer 5.4.6 - 'CMailCOM.dll' Remote Overwrite (SEH)

0 strUID = arrStringi objPOP3.MoveToFolder strUID ' ---------------- bof ... By attaching olly to the w3wp.exe sub-process you will see the usual dump with ecx and eip owned, with a buffer of approxymately 13000 chars. Exploitation is post-auth but you can have a user account by sim...

Code injection

The NNSTAT aka SYSPROC.NNSTAT procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter...

Apple QuickTime 7.27.3 - RTSP Response Remote Overwrite (SEH)

Apple QuickTime 7.27.3 - RTSP Response Remote Overwrite SEH !/usr/bin/python Apple QuickTime 7.3 RTSP Response 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on: Apple QuickTime Player 7.3 / XP SP2 Polish Details:.. RTSP Content-Type: A 995 + B 4096\r\n...

Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH)

!/usr/bin/python Apple QuickTime 7.3 RTSP Response 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on: Apple QuickTime Player 7.3 / XP SP2 Polish Details:.. RTSP Content-Type: A 995 + B 4096\r\n 0x41414141 Pointer to next SEH record 0x42424242 SE handler...

star directory traversal vulnerability

Directory traversal vulnerability in extract.c in star before 1.5a84 allows user-assisted remote attackers to overwrite arbitrary files via certain //.. slash slash dot dot sequences in directory symlinks in a TAR archive...

tar directory traversal vulnerability

Directory traversal vulnerability in the containsdotdot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. slash slash dot dot sequences in directory symlinks in a TAR archive...

SAP DB 7.4 - WebTools Remote Overwrite (SEH)

SAP DB 7.4 - WebTools Remote Overwrite SEH / Dreatica-FXP crew ---------------------------------------- Target : SAP DB 7.4 WebTools Site : http://www.sapdb.org Found by : NGSSoftware Insight Security Research ---------------------------------------- Exploit : SAP DB 7.4 WebTools Remote SEH...

SAP DB 7.4 - WebTools Remote Overwrite (SEH)

/ Dreatica-FXP crew ---------------------------------------- Target : SAP DB 7.4 WebTools Site : http://www.sapdb.org Found by : NGSSoftware Insight Security Research ---------------------------------------- Exploit : SAP DB 7.4 WebTools Remote SEH overwrite exploit Exploit date : 07.07.2007...

ViRC 2.0 - JOIN Response Remote Overwrite (SEH)

ViRC 2.0 - JOIN Response Remote Overwrite SEH !/usr/bin/python ViRC 2.0 'JOIN Response' 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Visual IRC 2.0 / 2k SP4 Polish Shellcode type: Windows Execute Command calc.exe How stuff works ? .. ViRC ----- ..JOIN...

ViRC 2.0 - JOIN Response Remote Overwrite (SEH)

!/usr/bin/python ViRC 2.0 'JOIN Response' 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Visual IRC 2.0 / 2k SP4 Polish Shellcode type: Windows Execute Command calc.exe How stuff works ? .. ViRC ----- ..JOIN.. ------------- exploittunnel...

TEC-IT TBarCode OCX ActiveX Remote Arbitrary File Overwrite Exploit

No description provided by source. pre codespan style="font: 10pt Courier New;"span class="general1-symbol"----------------------------------------------------------------------------------------------------------------- bTEC-IT TBarCode OCX ActiveX Control TBarCode7.ocx v. 7.0.2.3524 "SaveImage"...

Eudora 7.1.0.9 - IMAP FLAGS Remote Overwrite (SEH)

Eudora 7.1.0.9 - IMAP FLAGS Remote Overwrite SEH !/usr/bin/python Eudora 7.1 IMAP FLAGS 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Eudora 7.1.0.9 / 2k SP4 Polish Shellcode type: Windows Execute Command calc.exe Details:.. Eudora -- SELECT IMBOX...

Eudora 7.1.0.9 - IMAP FLAGS Remote Overwrite (SEH)

!/usr/bin/python Eudora 7.1 IMAP FLAGS 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Eudora 7.1.0.9 / 2k SP4 Polish Shellcode type: Windows Execute Command calc.exe Details:.. Eudora -- SELECT IMBOX --------- IMAP server Eudora -- FLAGS ..AAAA... ----...

FutureSoft TFTP Server 2000 - Remote Overwrite (SEH)

!/usr/bin/perl =============================================================================================== FutureSoft TFTP Server 2000 Remote SEH Overwrite Exploit By Umesh Wanve =============================================================================================== Date : 22-03-2007...

FutureSoft TFTP Server 2000 - Remote Overwrite (SEH)

FutureSoft TFTP Server 2000 - Remote Overwrite SEH !/usr/bin/perl =============================================================================================== FutureSoft TFTP Server 2000 Remote SEH Overwrite Exploit By Umesh Wanve...