HP OpenView OmniBack II A.03.50 - Command Execution (Metasploit)

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'HP OpenView...

aolserver 3.2 Win32 - Directory Traversal

source: https://www.securityfocus.com/bid/2343/info It is possible for a remote user to gain read access to directories outside the root directory of an AOLserver. Requesting a specially crafted URL composed of '.../' sequences will disclose an arbitrary directory. http://target/.../file outside...

Дырка в LocalWEB (directory traversal)

Обратный путь позволяет получить любой файл...

Buffer overflow in MySQL < 3.23.31

Hi, all versions of MySQL 3.23.31 have a buffer-overflow which crashs the server and which seems to be exploitable ie. 4141414 in eip Problem : An attacker could gain mysqld privileges gaining access to all the databases Requirements : You need a valid login/password to exploit this Solution :...

APC UPS 3.7.2 - 'apcupsd' Local Denial of Service

/ Local Denial of Service for any linux box running APCUPSD v3.7.2 APCUPSD has his pid file world writeable, therefore it is possible to let it kill another pid and create a denial of service against any running daemon. when the apcupsd is stopped, for example Bug discovered by: Mattias Dartsch...

Solaris 7/8-beta - ARP Local Overflow

/ arp overflow proof of concept by [email protected] shellcode originally written by Cheez Whiz. tested on x86 solaris 7,8beta default should work. if not, arg1 = offset. +- by 100's Copyright Security-Focus.com, 11/2000 / long getesp asm"movl %esp,%eax"; int mainint ac, char av char shell ...

ProFTPd 1.2.0 pre10 - Remote Denial of Service

ProFTPd 1.2.0 pre10 - Remote Denial of Service / ProFTPd DoS version 1.1 Remote DoS in proFTPd Code by: JeT-Li -The Wushu Master- [email protected] Recently I posted a remote DoS for ProFTPd based in the multiple use of the SIZE command in order to crash the system. Now and thanks to the...

Linux/x86 - Audio (knock knock knock) via /dev/dsp + setreuid(0,0) + execve() Shellcode (566 bytes)

Linux/x86 - Audio knock knock knock via /dev/dsp + setreuid0,0 + execve Shellcode 566 bytes. Shellcode exploit for Linuxx86 platform / Audio knock knock knock via /dev/dsp + setreuid0,0 + execve shellcode. Linux x86 Author: Cody Tubbs loophole of hhp. www.hhp-programming.net / [email protected]...

Solaris 2.5.12.67.08 - patchadd Race Condition

Solaris 2.5.12.67.08 - patchadd Race Condition source: https://www.securityfocus.com/bid/2127/info patchadd is the patch management tool included with the Solaris Operating Environment, distributed by Sun Microsystems. A problem exists which could allow a user to corrupt or append system files. T...

Linux Kernel 2.2.x - Non-Readable File Ptrace Local Information Leak

source: https://www.securityfocus.com/bid/2044/info Ptrace is a unix system call that is used to analyze running processes, usually for breakpoint debugging. The linux implementation of ptrace in 2.2.x kernels and possibly earlier versions contains a vulnerability that may allow an attacker to ga...

dump 0.4b15 (RedHat 6.2) - Local Privilege Escalation

/ dump-0.4b15x.c dump-0.4b15 exploit: Redhat 6.2 dump command executes external program with suid priviledge. affected: /sbin/dump /sbin/dump.static /sbin/restore /sbin/restore.static Bug found by [email protected] This example was coded by [email protected] It was written for EDUCATION...

Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8)

!/usr/bin/perl See http://www.securityfocus.com/vdb/bottom.html?section=exploit&vid=1806 Very simple PERL script to execute commands on IIS Unicode vulnerable servers Use port number with SSLproxy for testing SSL sites Usage: unicodexecute2 IP:port command Only makes use of "Socket" library New i...

ListMail 112 - Command Execution

ListMail 112 - Command Execution !/usr/bin/perl -w Listmail v112 by P.M.Systems / PoC Exploit Listmail is a powerful, hands-free mailing list manager which is exploitable due to an insecure open call. This exploit will attempt to bind a shell at port 60179/fido by using inetd. Code to spawn an...

xsplumber - strcpy() buffer overflow

Exploit for linux platform in category local exploits ==================================== xsplumber - strcpy buffer overflow ==================================== / linuxsplumberversion2 buffer overflow, by v9email protected. this is a misc. exploit for the linux-SVGAlib space plumber game. which...

buffer overflow in `phf'

PROBLEM: ... mainint argc, char argv entry entries64; ... forx=0;cl0 != '0';x++ m=x; getwordentriesx.val,cl,'&'; plustospaceentriesx.val; unescapeurlentriesx.val; getwordentriesx.name,entriesx.val,'='; ... The for' loop does not verify that x is less than 64. The entries' struct being a flat data...

Microsoft IIS 4.05.0 - Executable File Parsing

Microsoft IIS 4.05.0 - Executable File Parsing source: https://www.securityfocus.com/bid/1912/info When Microsoft IIS receives a valid request for an executable file, the filename is then passed onto the underlying operating system which executes the file. In the event that IIS receives a special...

iPlanet Web Server shtml File Handling Remote Overflow

It is possible to make the remote iPlanet web server execute arbitrary code when requesting a too long .shtml file with a name longer than 800 chars and containing computer code. An attacker may use this flaw to gain a shell on this host C Tenable Network Security, Inc. include"compat.inc"; if...

XFree86 3.3.53.3.6 - Xlib Display Buffer Overflow

XFree86 3.3.53.3.6 - Xlib Display Buffer Overflow source: https://www.securityfocus.com/bid/1805/info A vulnerability exists in xlib, the C language interface to the X Window System protocol. When applications linked to the xlib library are run, user-supplied values for the DISPLAY environment...

Oatmeal Studios Mail File 1.10 - Arbitrary File Disclosure

source: https://www.securityfocus.com/bid/1807/info OatMeal studios' Mail-File is a cgi application that allows for sending of certain files to user-specified email addresses via a web interface. A vulnerability exists in this script that can be used to send the contents of any readable...

obsd_fun.c

"hello hello obsd team. my obsd box panics every few seconds. what the hell is wrong?" "oh ? really ? hmm...out of space in kmemmap ?" "YES. you know about this bug ?" "yes. some kiddo is running a DoS against your box. we fixed it in 2.7. the kernel runs out of memory if you flood it with...