7304 matches found
TerminatorX <= 3.81 stack overflow local root exploit
No description provided by source. / TerminatorX V. = 3.81 local root exploit by Li0n7 Typical local stack-based overflow Bugs discovered by c0wboy from 0x333 Contact Li0n7 voila fr Usage: ./terminatorX-exp -r RET-b -s STARTINGRET -r RET: no bruteforcing, try to execute shellcode with RET as retu...
AOL Instant Messenger AIM "Away" Message Local Exploit
No description provided by source. / subject: local PoC exploit for AIM 5.5.3595 vendor: http://www.aim.com cve: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0636 credits: Matt Murphy date: 10 August 2004 notes: exploits localy if an argument is supplied, otherwise prints the url...
Solaris 7/8/9 CDE LibDTHelp Local Buffer Overflow Exploit
No description provided by source. / $Id: raptorlibdthelp.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorlibdthelp.c - libDtHelp.so local, Solaris/SPARC 7/8/9 Copyright c 2003-2004 Marco Ivaldi [email protected] Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary...
WinRAR 1.0 Local Buffer Overflow Exploit
No description provided by source. / WinRar local buffer overflow exploit V1.0 Coded By ATmaCA Copyright ? 2004 ProGroup Software, Inc. E-Mail:[email protected] Web:www.prohack.net Usage:\r\nexploit Target OutputPath Targets: 1 - WinXP SP1 user32.dll 0x77D718FC 2 - WinXP SP2 user32.dll...
dap-overflow.txt
!/usr/bin/python Download Accelerator Plus - DAP 8.x m3u 0day Local Buffer Overflow Exploit Bug discovered by Krystian Kloskowski h07 Tested on: Download Accelerator Plus 8.6 / XP SP2 Polish Shellcode: Windows Execute Command calc Just for fun ; from struct import pack shellcode =...
ollydbg-overflow.txt
;-------------------------------------------------------------------------; ; OllyDBG v1.10 and ImpREC v1.7f export name buffer overflow vulnerability ; PoC probably older versions affected too, not tested though. ; ; Included shellcode shows a messagebox WinXP SP2 and is configured for ; OllyDBG...
FreeSSHD 1.2.1 (Post Auth) Remote Seh Overflow
No description provided by source. !/usr/bin/perl FreeSSHD 1.2.1 Post Auth Remote Seh Overflow http://freeddsshd.com/ Exploit based on securfrog Poc http://www.milw0rm.com/exploits/5709 Coded by Matteo Memelli aka ryujin Spaghetti & PwnSauce http://www.be4mind.com http://www.gray-world.net Tested...
Download Accelerator Plus - DAP 8.x (m3u) Local BOF Exploit 0day
No description provided by source. !/usr/bin/python Download Accelerator Plus - DAP 8.x m3u 0day Local Buffer Overflow Exploit Bug discovered by Krystian Kloskowski h07 [email protected] Tested on: Download Accelerator Plus 8.6 / XP SP2 Polish Shellcode: Windows Execute Command calc Just for fun ;...
OllyDBG v1.10 and ImpREC v1.7f (export name) BOF PoC
No description provided by source. ;-------------------------------------------------------------------------; ; OllyDBG v1.10 and ImpREC v1.7f export name buffer overflow vulnerability ; PoC probably older versions affected too, not tested though. ; ; Included shellcode shows a messagebox WinXP...
Download Accelerator Plus - DAP 8.x (m3u) Local BOF Exploit 0day
Exploit for unknown platform in category local exploits ================================================================ Download Accelerator Plus - DAP 8.x m3u Local BOF Exploit 0day ================================================================ !/usr/bin/python Download Accelerator Plus - DAP...
OllyDBG v1.10 and ImpREC v1.7f (export name) BOF PoC
Exploit for unknown platform in category local exploits ==================================================== OllyDBG v1.10 and ImpREC v1.7f export name BOF PoC ==================================================== ;-------------------------------------------------------------------------; ; OllyDB...
OllyDBG 1.10 and ImpREC 1.7f - Export Name Buffer Overflow
;-------------------------------------------------------------------------; ; OllyDBG v1.10 and ImpREC v1.7f export name buffer overflow vulnerability ; PoC probably older versions affected too, not tested though. ; ; Included shellcode shows a messagebox WinXP SP2 and is configured for ; OllyDBG...
Download Accelerator Plus DAP 8.x - .m3u Local Buffer Overflow
Download Accelerator Plus DAP 8.x - .m3u Local Buffer Overflow !/usr/bin/python Download Accelerator Plus - DAP 8.x m3u 0day Local Buffer Overflow Exploit Bug discovered by Krystian Kloskowski h07 Tested on: Download Accelerator Plus 8.6 / XP SP2 Polish Shellcode: Windows Execute Command calc Jus...
OllyDBG 1.10 and ImpREC 1.7f - Export Name Buffer Overflow
OllyDBG 1.10 and ImpREC 1.7f - Export Name Buffer Overflow ;-------------------------------------------------------------------------; ; OllyDBG v1.10 and ImpREC v1.7f export name buffer overflow vulnerability ; PoC probably older versions affected too, not tested though. ; ; Included shellcode...
linux/x86 snoop /dev/dsp shellcode 172 bytes
No description provided by source. / Placed the listener here http://www.milw0rm.com/down.php?id=1293 /str0ke / / hey folks, this is snoopshell, short and simply it snoops on /dev/dsp and after attempting to lower the audio quality will stream any data read on this device over a udp stream to a...
Apple iTunes Playlist Local Parsing Buffer Overflow Exploit
No description provided by source. / PoC for iTunes on OS X 10.3.7 - [email protected] - Generates a .pls file, when loaded in iTunes it binds a shell to port 4444. Shellcode contains no \x00 or \x0a's. sample output: -nemo@gir:$ ./fm-eyetewnz foo.pls - fm-eyetewnz - - [email protected] -...
MS Windows JPEG Processing Buffer Overrun Exploit (MS04-028)
No description provided by source. !/bin/sh The JPEG vuln is triggered by the 0 or 1 length field with an integer flaw The crafted JPEG header makes Windows crash a couple of different ways 1 First, it crashes when the image is opened. 2 Second, it crashes when hovering the mouse over the image...
linux/mips execve /bin/sh 56 bytes
No description provided by source. / 56 bytes execve /bin/sh shellcode - linux-mipsel - by core [email protected] Note: For MIPS running in little-endian mode. Tested on a Cobalt Qube2 server running Linux 2.4.18 Greetz to bighawk... i couldn't get his execve to work for some reason :/ / char code ...
linux/amd64 connect-back semi-stealth shellcode 88+ bytes
No description provided by source. include sys/socket.h include netinet/in.h include arpa/inet.h include stdlib.h include stdio.h include string.h include limits.h / usual rant here.. this is just a doodle.. i was curious about the amd64 and since i dont think a simple exec /bin/sh is worth...