Exploits Microsoft Windows NtRaiseHardError Csrss.exe-winsrv.dll Double Free

No description provided by source. ///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe-winsrv.dll Double Free ///////////////////////////////////////// ///// Ruben Santamarta ///// ruben at reversemode dot co...

csrss.exe double-free vulnerability - arbitrary DWORD overwrite exploit

Hi, For those researchers who are interested in the Csrss Double-Free vulnerability, I have coded an arbitrary DWORD overwrite exploit. This flaw is hard to exploit at least for me due to the the "fail-and-die" situation. Corrupting the heap in a process like Csrss is dangerous. However, by...

Microsoft Windows - 'Csrss.exe/winsrv.dll' NtRaiseHardError Double-Free

///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe-winsrv.dll Double Free ///////////////////////////////////////// ///// Ruben Santamarta ///// ruben at reversemode dot com ///// www.reversemode.com...

Durian Web Application Server 3.02 Remote Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ================================================================= Durian Web Application Server 3.02 Remote Buffer Overflow Exploit ================================================================= http://sourceforge.net/projects/durian/ /...

Macromedia Shockwave 10 SwDir.dll Internet Explorer 7 - Denial of Service

Macromedia Shockwave 10 SwDir.dll Internet Explorer 7 - Denial of Service argCount = 1 arg1=String1000000, "A" ShockW.swURL = arg1 milw0rm.com 2006-12-29...

Macromedia Flash 8 (Flash8b.ocx) Internet Explorer 7 - Denial of Service

Macromedia Flash 8 Flash8b.ocx Internet Explorer 7 - Denial of Service argCount = 1 arg1=String1000000, "A" Flash8b.AllowScriptAccess=arg1 milw0rm.com 2006-12-29...

Durian Web Application Server 3.02 - Remote Buffer Overflow

http://sourceforge.net/projects/durian/ / errorreportingEALL; $address = "192.168.1.3"; $serviceport = "4002"; $shellcode = "\xeb\x1b". "\x5b". "\x31\xc0". "\x50". "\x31\xc0". "\x88\x43\x59". "\x53". "\xbb\x6d\x13\x86\x7c". //WinExec, 0x7c86136d "\xff\xd3". "\x31\xc0". "\x50"...

Macromedia Flash 8 (Flash8b.ocx) Internet Explorer 7 - Denial of Service

argCount = 1 arg1=String1000000, "A" Flash8b.AllowScriptAccess=arg1 milw0rm.com 2006-12-29...

RealPlayer 10.5 ierpplug.dll Internet Explorer Denial of Service Exploit

Exploit for unknown platform in category dos / poc ======================================================================== RealPlayer 10.5 ierpplug.dll Internet Explorer Denial of Service Exploit ========================================================================...

Mercur Messaging 2005 IMAP Login Buffer Overflow

This module exploits a stack buffer overflow in Atrium Mercur IMAP 5.0 SP3. Since the room for shellcode is small, using the reverse ordinal payloads yields the best results. This module requires Metasploit: https://metasploit.com/download Current source:...

BolinTech DreamFTP Server 1.0.2 - 'PORT' Remote Denial of Service

/ ============================================================= DREAM FTP Server 1.0.2 PORT Denial of Service Exploit ============================================================= Discovered by: InTeL Tested on DREAM FTP v1.02 on Windows XP SP2 Dream FTP v1.02 also has anonymous logins enabled by...

CVE-2006-6659

CVE-2006-6659 affects the Microsoft Office Outlook Recipient ActiveX control (ole32.dll) in Windows XP SP2. The vulnerability allows remote attackers to cause a denial of service by presenting crafted HTML, resulting in an Internet Explorer 7 hang. The connected Red Hat and NVD records reiterate ...

RealPlayer 10.5 (ActiveX Control) Denial of Service Exploit

Exploit for unknown platform in category dos / poc =========================================================== RealPlayer 10.5 ActiveX Control Denial of Service Exploit =========================================================== RealPlayer.Initialize"AA","defaultV" 0day.today 2018-01-05...

RealPlayer 10.5 - ActiveX Control Denial of Service

RealPlayer 10.5 - ActiveX Control Denial of Service RealPlayer.Initialize"AA","defaultV" milw0rm.com 2006-12-20...

MS06-057 Microsoft Internet Explorer WebViewFolderIcon setSlice() Overflow

This module exploits a flaw in the WebViewFolderIcon ActiveX control included with Windows 2000, Windows XP, and Windows 2003. This flaw was published during the Month of Browser Bugs project MoBB 18. This module requires Metasploit: https://metasploit.com/download Current source:...

CVE-2006-6601

Windows Media Player 10.00.00.4036 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a .MID MIDI file with a malformed header chunk without any track chunks, possibly involving 1 number of tracks of 2 time division fields that are set to 0...

CVE-2006-6602

explorer.exe in Windows Explorer 6.00.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a crafted WMV file...

CVE-2006-6602

CVE-2006-6602 affects explorer.exe in Microsoft Windows XP SP2 (Windows Explorer 6.00.2900.2180). A user-assisted remote attacker can cause a denial of service by presenting a crafted WMV file. Affected component: Windows Explorer. The connected documents provide the vulnerability description and...

CVE-2006-6601

Windows Media Player 10.00.00.4036 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a .MID MIDI file with a malformed header chunk without any track chunks, possibly involving 1 number of tracks of 2 time division fields that are set to 0...

CVE-2006-6602

explorer.exe in Windows Explorer 6.00.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a crafted WMV file...