CVE-2022-26809

CVE-2022-26809 This repo just simply research for the CVE, for more detailed ananlysis,please refer here. UPDATE:05/19 2022 This ananlyze hasn't been finished yet.... UPDATE:05/22 2022 HuanGMz Post and corelight blog show the real vulnerable point: OSFCASSOCIATION::ProcessBindAckOrNak This...

RpcProxyInvoke

RpcProxyInvoke Overview To create a general way to execute local and remote code, we designed a relatively obscure method of code execution, which we internally refer to as RpcCraft Self and RpcExec Remote Process. This technique leverages a methodology well-known among exploit developers, abusin...

CVE-2022-26809

CVE description CVE-2022-26809 - weakness in a core Windows component RPC earned a CVSS score of 9.8 not without a reason, as the attack does not require authentication and can be executed remotely over a network, and can result in remote code execution RCE with the privileges of the RPC service,...

cve-2020-1015

CVE-2020-1015 PoC for CVE-2020-1015 More detail available here To compile: 1. Create an empty C++ project in Visual Studio. 2. Add cve20201015.cpp and Source.idl to the project as source files. 3. Compile Source.idl. This will generate three files: Sourcec.c, Sourceh.h and Sources.c. 4. Add the...

MPlayer Lite r33064 Buffer Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MPlayer Lite M3U Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability in MPlayer Lite r33064,...

Exploit for CVE-2022-26809

Cve-2022-26809 CVE-2022-26809 This repo just simply resear...

Calling Local Windows RPC Servers from .NET

Posted by James Forshaw, Project Zero As much as I enjoy finding security vulnerabilities in Windows, in many ways I prefer the challenge of writing the tools to make it easier for me and others to do the hunting. This blog post gives an overview of using some recent tooling I’ve released as part...

Intel Content Protection HECI Service - Type Confusion Privilege Escalation Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1358 Intel Content Protection HECI Service Type Confusion EoP Platform: Tested on Windows 10, service version 9.0.2.117 Class: Elevation of Privilege Summary: The Intel Content...

MP3-Nator-Buffer-Overflow

Exploit Title: Exploit Buffer Overflow MP3-Nator SEH - DEP BYPASS Date: 18-11-2010 Author: Muhamad Fadzil Ramli Credit/Bug Found By: C4SS!0 G0M3S Software Link: http://files.brothersoft.com/mp3audio/players/mp3nator.zip filename = 'crash.plf' ./msfpayload windows/exec CMD=calc EXITFUNC=seh R |...

MS14-047: Vulnerability in LRPC Could Allow Security Feature Bypass (2978668)

The remote Windows host is affected by a security feature bypass vulnerability in Microsoft Remote Procedure Call LRPC. The vulnerability is due to RPC improperly freeing malformed messages, allowing an attacker to fill up the address space of a process. Successful exploitation of the issue allow...

HCView WriteAV Crash Proof Of Concept

!/usr/bin/perl Hardcoreview WriteAV Arbitrary Code Execution Author: Jean Pascal Pereira Vendor URI: http://sourceforge.net/projects/hardcoreview/ Vendor Description: Image browser. Designed and created for profesional and amature watching image files. All kind of image files ; . Support .jpg,...

FreeFloat FTP Server Buffer Overflow

!/usr/bin/python import socket, sys from struct import pack print "\n===============================" print "Freefloat FTP Server DEP Bypass" print " Written by Blake " print "===============================\n" if lensys.argv != 3: print " Usage: %s \n" % sys.argv0 sys.exit0 target = sys.argv1 po...

MP3-Nator Buffer Overflow SEH-DEP Bypass

Exploit Title: Exploit Buffer Overflow MP3-Nator SEH - DEP BYPASS Date: 18-11-2010 Author: Muhamad Fadzil Ramli - mind1355atgmaildotcom Credit/Bug Found By: C4SS!0 G0M3S Software Link: http://www.brothersoft.com/d.php?softid=16524&url=http://files.brothersoft.com/mp3audio/players/mp3nator.zip...

MP3-Nator - Local Buffer Overflow (SEH) (DEP Bypass)

Exploit Title: Exploit Buffer Overflow MP3-Nator SEH - DEP BYPASS Date: 18-11-2010 Author: Muhamad Fadzil Ramli - mind1355atgmaildotcom Credit/Bug Found By: C4SS!0 G0M3S Software Link: http://www.brothersoft.com/d.php?softid=16524&url=http://files.brothersoft.com/mp3audio/players/mp3nator.zip...

MS10-084: Vulnerability in Windows Local Procedure Call Could Cause Elevation of Privilege (2360937)

The LRPC implementation on the remote host has a vulnerability in the way the local LRPC server handles specially crafted LPC messages. A locally, authenticated user could exploit this flaw to elevate his privileges to the NetworkService account. C Tenable Network Security, Inc...

MS Windows Server Service Code Execution Exploit (MS08-067)

Exploit for unknown platform in category remote exploits =========================================================== MS Windows Server Service Code Execution Exploit MS08-067 =========================================================== / MS08-067 Remote Stack Overflow Vulnerability Exploit Author:...

MS Windows Server Service Code Execution Exploit (MS08-067)

No description provided by source. / MS08-067 Remote Stack Overflow Vulnerability Exploit Author: Polymorphours Email: [email protected] Homepage:http://www.whitecell.org Date: 2008-10-28 / include "stdafx.h" include winsock2.h include Rpc.h include stdio.h include stdlib.h pragma...

MS08-067 Remote Stack Overflow Vulnerability Exploit

No description provided by source. include "stdafx.h" include winsock2.h include Rpc.h include stdio.h include stdlib.h pragma commentlib, "mpr" pragma commentlib, "Rpcrt4" pragma commentlib, "ws232" struct RPCBIND BYTE VerMaj; BYTE VerMin; BYTE PacketType; BYTE PacketFlags; DWORD DataRep; WORD...

Design/Logic Flaw

rpcrt4.dll aka the RPC runtime library in Microsoft Windows XP SP2, XP Professional x64 Edition, Server 2003 SP1 and SP2, Server 2003 x64 Edition and x64 Edition SP2, and Vista and Vista x64 Edition allows remote attackers to cause a denial of service RPCSS service stop and system restart via an...

CVE-2007-2228

rpcrt4.dll aka the RPC runtime library in Microsoft Windows XP SP2, XP Professional x64 Edition, Server 2003 SP1 and SP2, Server 2003 x64 Edition and x64 Edition SP2, and Vista and Vista x64 Edition allows remote attackers to cause a denial of service RPCSS service stop and system restart via an...