KL-001-2014-004 : VMWare vmx86.sys Arbitrary Kernel Read

Title: VMWare vmx86.sys Arbitrary Kernel Read Advisory ID: KL-001-2014-004 Publication Date: 2014.11.04 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-004.txt 1. Vulnerability Details Affected Vendor: VMWare Affected Product: Workstation Affected Version: 10.0.0.40273...

i-FTP Schedule Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in i-Ftp v2.20, caused by a long time value set for scheduled download. By persuading the victim to place a specially-crafted Schedule.xml file in the i-FTP folder, a remote attacker could execute arbitrary code on the system or cau...

Windows TrackPopupMenu Win32k NULL Pointer Dereference Exploit

This Metasploit module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability can be triggered through the use of TrackPopupMenu. Under special conditions, the NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary code execution. This Metasploit module...

Windows TrackPopupMenu Win32k NULL Pointer Dereference

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 'Windows TrackPopupMenu Win32k NULL Pointer Dereference',...

Windows TrackPopupMenu Win32k NULL Pointer Dereference

This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability can be triggered through the use of TrackPopupMenu. Under special conditions, the NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary code execution. This module has been tested...

Kolibri WebServer HTTP POST Request Handling Remote Stack Buffer Overflow

Added: 10/10/2014 CVE: CVE-2014-5289 BID: 69263 OSVDB: 110142 Background SENKAS Kolibri Webserver is a free very simple web server for Microsoft Windows that supports serving static web content. Problem Kolibri Webserver is vulnerable to a stack buffer overflow as a result of failure to properly...

Kolibri Webserver 2.0 Buffer Overflow with EMET 5.0 and EMET 4.1 Partial Bypass

No description provided by source. !/bin/python import socket, sys, re Exploit Title: Kolibri POST Buffer overflow with EMET 5.0 and EMET 4.1 Partial Bypass Date: September 30th 2014 Author: tekwizz123 Vendor Homepage: http://www.senkas.com Software Download:...

openSUSE Security Update : xen (openSUSE-SU-2014:1279-1)

XEN was updated to fix various bugs and security issues. Security issues fixed : - bnc897657 - CVE-2014-7188: XSA-108 Improper MSR range used for x2APIC emulation - bnc895802 - CVE-2014-7156: XSA-106: Missing privilege level checks in x86 emulation of software interrupts - bnc895799 -...

Rejetto HttpFileServer Remote Command Execution

No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Rejetto HttpFileServer Remote Command Execution", 'Description' = %q Rejetto HttpFileServer HFS i...

Rejetto HttpFileServer Remote Command Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Rejetto HttpFileServer Remote Command Execution", 'Description' = %q Rejetto HttpFileServer HFS is vulnerable to remote command...

Asx to Mp3 2.7.5 - Stack Overflow Exploit

Exploit for windows platform in category local exploits Exploit Title: ASX to MP3 Converter 2.7.5 stack buffer overflow Date: 6 Oct 2014 Exploit Author: Amir Reza Tavakolian Vendor Homepage: http://binarylife.blog.ir/ Software Link:...

Kolibri Webserver 2.0 Buffer Overflow

!/bin/python import socket, sys, re Exploit Title: Kolibri POST Buffer overflow with EMET 5.0 and EMET 4.1 Partial Bypass Date: September 30th 2014 Author: tekwizz123 Vendor Homepage: http://www.senkas.com Software Download: http://www.senkas.com/kolibri/download.php Version: 2.0 Tested on: Windo...

Kolibri WebServer 2.0 - Remote Buffer Overflow (EMET 5.0 EMET 4.1 Partial Bypass)

Kolibri WebServer 2.0 - Remote Buffer Overflow EMET 5.0 EMET 4.1 Partial Bypass !/bin/python import socket, sys, re Exploit Title: Kolibri POST Buffer overflow with EMET 5.0 and EMET 4.1 Partial Bypass Date: September 30th 2014 Author: tekwizz123 Vendor Homepage: http://www.senkas.com Software...

Kolibri WebServer 2.0 - Remote Buffer Overflow (EMET 5.0 / EMET 4.1 Partial Bypass)

!/bin/python import socket, sys, re Exploit Title: Kolibri POST Buffer overflow with EMET 5.0 and EMET 4.1 Partial Bypass Date: September 30th 2014 Author: tekwizz123 Vendor Homepage: http://www.senkas.com Software Download: http://www.senkas.com/kolibri/download.php Version: 2.0 Tested on: Windo...

Fast Image Resizer 098 - Local Crash Poc

No description provided by source. !/usr/bin/perl Title : Fast Image Resizer 098 Local Crash Poc Author: Niko Tested: Windows XP SP3 En Apps : http://adionsoft.net/fastimageresize/FastImageResizer098.exe EAX 00000000 ECX 010422F8 EDX 00000000 EBX 00000000 ESP 0012F658 EBP 00000000 ESI 010421A8 ED...

Advantech WebAccess dvs.ocx GetColor Buffer Overflow Exploit

This Metasploit module exploits a buffer overflow vulnerability in Advantec WebAccess. The vulnerability exists in the dvs.ocx ActiveX control, where a dangerous call to sprintf can be reached with user controlled data through the GetColor function. This Metasploit module has been tested...

Fast Image Resizer 098 - Local Crash (PoC)

Fast Image Resizer 098 - Local Crash PoC !/usr/bin/perl Title : Fast Image Resizer 098 Local Crash Poc Author: Niko Tested: Windows XP SP3 En Apps : http://adionsoft.net/fastimageresize/FastImageResizer098.exe EAX 00000000 ECX 010422F8 EDX 00000000 EBX 00000000 ESP 0012F658 EBP 00000000 ESI...

VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/local/windowskernel' require 'rex' class Metasploit3 Msf::Exploit::Local Rank =...

VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation Exploit

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and availability via unknown vectors related to Core. A vulnerability within the VBoxGuest driver allows an...

Oracle VM VirtualBox Guest Additions 4.3.10r93012 - 'VBoxGuest.sys' Local Privilege Escalation (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/local/windowskernel' require 'rex' class Metasploit3 'VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation',...