MUSE 4.9.0.006 - '.pls' Universal Local Buffer Overflow (SEH)

Exploit Title: MUSE v4.9.0.006 .pls Local Universal Buffer Overflow SEH Date: August 17, 2010 Author: Glafkos Charalambous glafkos@astalavistadotcom Software Link: http://download.cnet.com/MUSE/3000-21404-42511.html Version: 4.9.0.006 Tested on: Windows XP SP3 En payload = "\x41" 1376 payload +=...

Rosoft Media Player 4.4.4 - Local Buffer Overflow (SEH) (2)

!/usr/bin/python Title: Rosoft media player 4.4.4 SEH buffer overflow Date: August 15, 2010 Author: dijital1 Original Advisory: http://www.exploit-db.com/exploits/14601 - abhishek lyall Platform: Windows XP SP3 EN Professional - VMware Greetz to: Corelan Security Team, Exploit-db, OffSec...

Rosoft media player 4.4.4 SEH Buffer Overflow

Exploit for windows platform in category local exploits ============================================= Rosoft media player 4.4.4 SEH Buffer Overflow ============================================= !/usr/bin/python Title: Rosoft media player 4.4.4 SEH buffer overflow Date: August 15, 2010 Author:...

Xion Player 1.0.125 - Local Stack Buffer Overflow

Xion Player 1.0.125 - Local Stack Buffer Overflow !/usr/bin/python Title: Xion 1.0.125 Stack Buffer Overflow Date: August 13, 2010 Author: corelanc0d3r and dijital1 Grtz to dijital1 : I had a lot of fun working with you on this one ! : Grtz to dookie2000ca : Original Advisory:...

Xion Player 1.0.125 - Local Stack Buffer Overflow

!/usr/bin/python Title: Xion 1.0.125 Stack Buffer Overflow Date: August 13, 2010 Author: corelanc0d3r and dijital1 Grtz to dijital1 : I had a lot of fun working with you on this one ! : Grtz to dookie2000ca : Original Advisory: http://www.exploit-db.com/exploits/14517 hadji samir Platform: Window...

Windows win32k.sys驱动用户池溢出本地权限提升漏洞（MS10-048）

BUGTRAQ ID: 42245 CVE ID: CVE-2010-1895 Microsoft Windows是微软发布的非常流行的操作系统。 Windows中的win32k.sys内核驱动在从用户态进行拷贝时没有正确地分配内存，导致权限提升。成功利用这个漏洞的攻击者可以执行任意内核态代码。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。 Microsoft Windows XP SP3 Microsoft Windows XP Pro x64版SP2 Microsoft Windows Server 2003 SP2 厂商补丁： Microsoft...

Windows win32k.sys驱动边界检查本地拒绝服务漏洞（MS10-048）

BUGTRAQ ID: 42250 CVE ID: CVE-2010-1887 Microsoft Windows是微软发布的非常流行的操作系统。 Windows中的win32k.sys内核驱动没有正确地验证传送给系统调用的参数，本地用户可以通过运行特制的应用程序来利用这个漏洞导致系统变得没有响应并自动重启。 Microsoft Windows XP SP3 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows Server 2008 SP2 Microsoft Windows Server...

Easy FTP Server v1.7.0.11 Multiple Commands Buffer Overflow Exploit

Exploit for windows platform in category remote exploits =================================================================== Easy FTP Server v1.7.0.11 Multiple Commands Buffer Overflow Exploit =================================================================== Note: RNFR, DELE, RMD, STOR commands...

Easy FTP 1.7.0.11 Buffer Overflow

Exploit Title: Easy FTP Server v1.7.0.11 NLST , NLST -al, APPE, RETR , SIZE and XCWD Commands Remote Buffer Overflow Exploit Date: 10/8/2010 Author: Rabih Mohsen Software Link:http://code.google.com/p/easyftpsvr/downloads/detail?name=easyftp-server-1.7.0.11-cn.zip Version: 1.7.0.11 Tested on:...

Windows win32k.sys驱动用户输入验证本地权限提升漏洞（MS10-048）

BUGTRAQ ID: 42210 CVE ID: CVE-2010-1896 Microsoft Windows是微软发布的非常流行的操作系统。 Windows中的win32k.sys内核驱动没有正确地验证用户态输入，本地用户可以通过执行恶意应用程序导致执行任意内核态代码。 Microsoft Windows XP SP3 Microsoft Windows XP Pro x64版SP2 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows Server 2008 SP2 Microsoft...

CVE-2010-1888

Race condition in the kernel in Microsoft Windows XP SP3 allows local users to gain privileges via vectors involving thread creation, aka "Windows Kernel Data Initialization Vulnerability."...

Race condition

Race condition in the kernel in Microsoft Windows XP SP3 allows local users to gain privileges via vectors involving thread creation, aka "Windows Kernel Data Initialization Vulnerability."...

CVE-2010-1888

Race condition in the kernel in Microsoft Windows XP SP3 allows local users to gain privileges via vectors involving thread creation, aka "Windows Kernel Data Initialization Vulnerability."...

CVE-2010-1896

The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, and Windows Server 2008 Gold and SP2 do not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted...

CVE-2010-1894

Win32k Exception Handling Vulnerability (CVE-2010-1894) affects Windows XP SP2/SP3 and Windows Server 2003 SP2 via win32k.sys. Description: the kernel-mode driver does not properly handle certain exceptions, enabling local privilege escalation by a crafted application. Impact: attacker could exec...

EasyFTP Server 1.7.0.11 - (Authenticated) Multiple Commands Remote Buffer Overflows

Exploit Title: Easy FTP Server v1.7.0.11 Multiple Command Buffer Overflow Date: August 12, 2010 Author: Glafkos Charalambous Software Link: http://easyftpsvr.googlecode.com/files/easyftp-server-1.7.0.11-en.zip Version: 1.7.0.11 Tested on: Windows XP SP3 En Vulnerable Commands: DELE, STOR, RNFR,...

Easy FTP 1.7.0.11 - NLST NLST -al APPE RETR SIZE XCWD Remote Buffer Overflow

Easy FTP 1.7.0.11 - NLST NLST -al APPE RETR SIZE XCWD Remote Buffer Overflow Exploit Title: Easy FTP Server v1.7.0.11 NLST , NLST -al, APPE, RETR , SIZE and XCWD Commands Remote Buffer Overflow Exploit Date: 10/8/2010 Author: Rabih Mohsen Software...

Easy FTP 1.7.0.11 - 'NLST' / 'NLST -al' / 'APPE' / 'RETR' / 'SIZE' / 'XCWD' Remote Buffer Overflow

Exploit Title: Easy FTP Server v1.7.0.11 NLST , NLST -al, APPE, RETR , SIZE and XCWD Commands Remote Buffer Overflow Exploit Date: 10/8/2010 Author: Rabih Mohsen Software Link:http://code.google.com/p/easyftpsvr/downloads/detail?name=easyftp-server-1.7.0.11-cn.zip Version: 1.7.0.11 Tested on:...

SopCast 3.2.9 - Remote Command Execution

Sopcast POC by Sud0 Tested on XP SP3 EN on VBox with IE 7 Spraying a lot to get a nice unicode usable address 0x20260078 I sprayed with a set of P/P/R instructions to come back to the stack Need internet connection on the box to trigger the vuln Wait for the Spray to finish IE will seem freezed f...

RSP MP3 Player - OCX ActiveX Buffer Overflow HeapSpray

. . . \ / |/| . | | | ||/ \ .| RSP MP3 Player OCX ActiveX Buffer Overflow heap spray By : MadjiX , Dz8aHotmail.com Discovered by Blake: http://www.exploit-db.com/exploits/14309/ Greetings: His0k4 , Bibi-info , The g0bl!n y , sec4ever.com Tested on Windows Xp Sp3 Fr,with IE6 sh =...