7304 matches found
Mercur Messaging 2005 (Windows 2000 SP4) - IMAP 'Subscribe' Remote Overflow
!/usr/bin/python Remote exploit for the stack overflow vulnerability in Mercur Messaging 2005 SP3 IMAP service. The exploit was tested on windows 2000 server SP4 in a Vmware environment. At the time of overflow EBX points to our shellcode. However this buffer into which EBX points will give a...
Helix Server 11.0.1 Remote Heap Overflow Exploit (win2k SP4)
No description provided by source. /usr/bin/python Remote exploit for the vulnerability in Helix server v11.0.1 as described at http://gleg.net/helix.txt The exploit spawns a shell on TCP port 4444 and connects to it. At the time of overflow we control EAX which is used in a call as follows...
Mercur Messaging 2005 IMAP (SUBSCRIBE) Remote Exploit (win2k SP4)
Exploit for unknown platform in category remote exploits ================================================================= Mercur Messaging 2005 IMAP SUBSCRIBE Remote Exploit win2k SP4 ================================================================= !/usr/bin/python Remote exploit for the stack...
Helix Server 11.0.1 (Windows 2000 SP4) - Remote Heap Overflow
Helix Server 11.0.1 Windows 2000 SP4 - Remote Heap Overflow /usr/bin/python Remote exploit for the vulnerability in Helix server v11.0.1 as described at http://gleg.net/helix.txt The exploit spawns a shell on TCP port 4444 and connects to it. At the time of overflow we control EAX which is used i...
Helix Server 11.0.1 (Windows 2000 SP4) - Remote Heap Overflow
/usr/bin/python Remote exploit for the vulnerability in Helix server v11.0.1 as described at http://gleg.net/helix.txt The exploit spawns a shell on TCP port 4444 and connects to it. At the time of overflow we control EAX which is used in a call as follows 00420C64: call dword ptr eax + 4 ECX...
MOPB-array.txt
?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...
caid-msgeng.txt
!/usr/bin/python This one was listed in the SANS TOP 20 and I needed an exploit for analysis. I couldnt find a reliable exploit for my analysis and so came up with this. Remote exploit for the CA BrightStor msgeng.exe service stack overflow vulnerability as described in LS-20060330.pdf on...
clbox-rfi.txt
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= CLBOX = signup.php header Remote File Include Vulnerability Script: CLBOX Version: 1.01 Download: http://clbox.8m.com/clbox.ZIP Discover: BorN To K!LL =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= Bug in: signup.php Code: @include...
oracle 10g (PROCESS_DUP_HANDLE) Local Privilege Elevation (win32)-vulnerability warning-the black bar safety net
include windows. h include stdio. h BOOL InjectShellcodeDWORD oldEIP,CHAR oSID HMODULE hKernel; FARPROC pCreateProc; LPSTR sCommand="cmd.exe"; DWORD dwStrLen; CHAR buff1 0 0; dwStrLen=strlensCommand; hKernel=LoadLibrary"Kernel32.dll"; pCreateProc=GetProcAddresshKernel,"CreateProcessA"; strcpybuff...
PHP <= 4.4.6 / 5.2.1 array_user_key_compare() ZVAL dtor Local Exploit
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / //...
MOPB-22-2007:PHP session_regenerate_id() Double Free Vulnerability
Summary The sessionregenerateid function that is used to generate a new session identifier fails to clear an already freed pointer to the former session identifier before calling the session identifier generator. When this generator triggers an error this can result in a double free that is easil...
CA BrightStor ARCserve (msgeng.exe) Remote Stack Overflow Exploit
No description provided by source. !/usr/bin/python This one was listed in the SANS TOP 20 and I needed an exploit for analysis. I couldnt find a reliable exploit for my analysis and so came up with this. Remote exploit for the CA BrightStor msgeng.exe service stack overflow vulnerability as...
PHP <= 4.4.6 / 5.2.1 array_user_key_compare() ZVAL dtor Local Exploit
Exploit for linux platform in category local exploits ===================================================================== PHP = 4.4.6 / 5.2.1 arrayuserkeycompare ZVAL dtor Local Exploit ===================================================================== ?php...
CA BrightStor ARCserve (msgeng.exe) Remote Stack Overflow Exploit
Exploit for unknown platform in category remote exploits ================================================================= CA BrightStor ARCserve msgeng.exe Remote Stack Overflow Exploit ================================================================= !/usr/bin/python This one was listed in the...
PHP 4.4.65.2.1 - array_user_key_compare() ZVAL dtor Local Overflow
PHP 4.4.65.2.1 - arrayuserkeycompare ZVAL dtor Local Overflow ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code...
CA BrightStor ARCserve - 'msgeng.exe' Remote Stack Overflow
!/usr/bin/python This one was listed in the SANS TOP 20 and I needed an exploit for analysis. I couldnt find a reliable exploit for my analysis and so came up with this. Remote exploit for the CA BrightStor msgeng.exe service stack overflow vulnerability as described in LS-20060330.pdf on...
CA BrightStor ARCserve - msgeng.exe Remote Stack Overflow
CA BrightStor ARCserve - msgeng.exe Remote Stack Overflow !/usr/bin/python This one was listed in the SANS TOP 20 and I needed an exploit for analysis. I couldnt find a reliable exploit for my analysis and so came up with this. Remote exploit for the CA BrightStor msgeng.exe service stack overflo...
OpenBSD ICMPv6 Fragment Remote Execution Exploit PoC
No description provided by source. The PoC executes the shellcode int 3 and returns. It overwrites the extfree function pointer on the mbuf and forces a mfreem on the overflowed packet. The Impacket library is used to craft and send packets http://oss.coresecurity.com/projects/impacket.html or...
WarFTP 1.65 (USER) Remote Buffer Overflow SEH Overflow Exploit
Exploit for unknown platform in category remote exploits ============================================================== WarFTP 1.65 USER Remote Buffer Overflow SEH Overflow Exploit ==============================================================...
WarFTP 1.65 (USER) Remote Buffer Overflow Exploit (win2k SP4)
No description provided by source. !/usr/bin/python Remote exploit for WarFTP 1.65. Tested on Windows 2000 server SP4 inside VMware. A trivially exploitable stack overflow is present in WarFTP which can be triggered by sending a long username 480 bytes along with the USER...