Lorex LH300 Series - ActiveX Buffer Overflow (PoC)

Lorex LH300 Series - ActiveX Buffer Overflow PoC Disclosure: 09/01/2014 / Last updated: 18/01/2015 Hi, I have discovered a buffer overflow vulnerability that allows remote code execution in an ActiveX control bundled by a manufacturer of video surveillance systems. The company is Lorex...

GetGo Download Manager HTTP Response Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'GetGo Download Manager HTTP Response Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow...

QQPlayer-asx-File-Processing-Buffer-Overflow

Title: QQPlayer asx File Processing Buffer Overflow Exploit Author: Li Qingshan of Information Security Engineering Center,School of Software and Microelectronics,Peking University Vendor: www.qq.com head =''' ''' payload=head+junk+nseh+seh+adjust+shellcode+junk+foot fobj = open"poc.asx","w"...

Minishare-1.5.5-Buffer-Overflow

Exploit Title: Minishare 1.5.5 Buffer Overflow Vulnerability users.txt Date: 11/02/2010 Author: Chris Gabriel Software Link: http://sourceforge.net/projects/minishare Version: 1.4.0 - 1.5.5 shellcode = "TYVTX10X41PZ41H4A4H1TA91TAFVTZ32PZNBFZDQE02D" "QF0D13DJE1F4847029R9VNN0D668M194A0I5G5L2G3W3"...

BulletProof FTP Client BPS Buffer Overflow Exploit

Exploit for windows platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'BulletProof FTP Client BPS Buffer Overflow', 'Description' = %q This module...

CoolPlayer-2.18-DEP-Bypass

Tested on: Windows XP SP3 running in Virtualbox Uses SetProcessDEPPolicy to disable DEP for the process Thanks to mrme for the encouragement Exploit-DB Notes: May not work on all Win XP SP3 machines windows/exec calc.exe 227 bytes - 240 bytes of shellcode space available shellcode =...

Novell-Client-2-SP3---Privilege-Escalation

The first public information I have seen about this bug was from Nikita Tarakanov @NTarakanov I am not sure weather there was anything else public Exploit for DEMO purposes : Does not bypass SMEP on Windows 8 from ctypes import import sys,struct,os from optparse import OptionParser kernel32 =...

Windows-XP-SP3---BthPan.sys

Title: Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation Advisory ID: KL-001-2014-002 Publication Date: 2014-07-18 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt from ctypes import from struct import pack from os import getpid,system from sys...

Adobe-Flash-Player-SequenceParameterSetNALUnit

Abysssec Public Exploit CVE-2011-2140 This exploit tested on Adobe Flash Player 10.3.181.34 XP sp3 contact : info at abysssec.com...

i-FTP Schedule Buffer Overflow Exploit

This Metasploit module exploits a stack-based buffer overflow vulnerability in i-Ftp version 2.20, caused by a long time value set for scheduled download. By persuading the victim to place a specially-crafted Schedule.xml file in the i-FTP folder, a remote attacker could execute arbitrary code on...

i-FTP 2.20 Schedule Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'i-FTP Schedule Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow...

Advantech AdamView 4.30.003 - .gni Local Buffer Overflow (SEH)

Advantech AdamView 4.30.003 - .gni Local Buffer Overflow SEH !/usr/bin/env ruby Exploit Title: Advantech AdamView .gni SEH Buffer Overflow Date: Dec 09 2014 Vulnerability Discovery: Daniel Kazimirow and Fernando Paez - Core Security Exploit Author: Muhamad Fadzil Ramli Software Link:...

Mozilla Firefox 3.6 mChannel Use-After-Free Vulnerability

Mozilla Firefox 3.6 is prone to a use-after-free vulnerability in OBJECT mChannel that allows an attacker to execute arbitrary code. Title: Firefox 3.6 Universal function exploit var foo=document.getElementById"exploit";...

Mozilla Firefox 3.6 mChannel Use-After-Free

Title: Firefox 3.6 Universal function exploit var foo=document.getElementById"exploit"; e.QueryInterfaceComponents.interfaces.nsIChannelEventSink.onChannelRedirectnull,new Object,0; var vftable = unescape"\x00% u0c10"; var shellcode =...

Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/local/windowskernel' require 'rex' class Metasploit3 Msf::Exploit::Local Rank =...

Microsoft Office Compatibility Pack Remote Code Execution Vulnerabilities (3009710)

This host is missing an important security update according to Microsoft Bulletin MS14-069. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Remote code execution

Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted Office document, aka "Microsoft Office Bad Index Remote Code Execution Vulnerability."...

CVE-2014-6333

CVE-2014-6333 affects Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3. The issue arises when parsing specially crafted Office documents, enabling a remote attacker to execute arbitrary code in the context of the logged-in user. The connected advisories consolidate three re...

CVE-2014-6335

CVE-2014-6335 affects Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3. The root cause is improper handling of objects in memory while parsing specially crafted Office files, leading to remote code execution or memory corruption (and possible DoS). Technical details across ...

PT-2014-2028 · Microsoft · Windows Server 2008 +5

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Server versions 2003 SP2 through 2008 SP2 and R2 SP1 Microsoft Windows Vista version SP2 Microsoft Windows 7 version SP1 Microsoft Office version 2007 SP3 Description: The issue is related to the Input Method Editor IME...