1032 matches found
UNIX 7th Edition binmkdir - Local Buffer Overflow
UNIX 7th Edition binmkdir - Local Buffer Overflow / Exploit for /bin/mkdir Unix V7 PDP-11. mkdir has a buffer overflow when checking if the directory in /arg/with/slashes/fname exists. This will run /bin/sh with euid 0, but not uid 0. Since the shell doesn't do anything special about this, we don...
NETGEAR RP114 3.26 - Content Filter Bypass
NETGEAR RP114 3.26 - Content Filter Bypass source: https://www.securityfocus.com/bid/10404/info It is reported that users may bypass Netgear RP114 content filter functionality. This can be accomplished by making a URI request string that is over 220 bytes in length. This vulnerability may result ...
Ethereal 0.10.0 0.10.2 - IGAP Overflow
Ethereal 0.10.0 0.10.2 - IGAP Overflow / THE EYE ON SECURITY RESEARCH GROUP - INDIA Ethereal IGAP Dissector Message Overflow Remote Root exploit Copyright 2004 - EOS-India Group Authors note: Shellcode splitting technique: Due to difficulty involved while following normal exploitation techniques...
Cross Site Scripting in WebzEdit
Title:Cross Site Scripting in WebzEdit Release Date: Feb 22,2004 Application: WebzEdit Version Affected: 1.9 or lower Platform: JSP Severity: Low Discover: Cheng Peng Suapplesoupatmsn.com Vendor URL: http://www.freewebs.com/ Intro: WebzEdit is a tool to edit web page online. Proof Of Concept: Thi...
Cyrus IMSP Daemon 1.x - Remote Buffer Overflow
Cyrus IMSP Daemon 1.x - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/9227/info A problem has been identified in the Cyrus IMSP Daemon implementation when handling certain types of requests. Because of this, it may be possible for a remote attacker to gain unauthorized acces...
Cyrus IMSP Daemon 1.x - Remote Buffer Overflow
// source: https://www.securityfocus.com/bid/9227/info A problem has been identified in the Cyrus IMSP Daemon implementation when handling certain types of requests. Because of this, it may be possible for a remote attacker to gain unauthorized access to a system using the vulnerable software. /...
Hylafax 4.1.x - HFaxD Format String
Hylafax 4.1.x - HFaxD Format String // source: https://www.securityfocus.com/bid/9005/info Hylafax hfaxd daemon has been reported prone to an unspecified format string vulnerability that may be exploited under non-standard configurations to execute arbitrary instructions remotely as the root user...
Pine <= 4.56 Remote Buffer Overflow Exploit
Exploit for linux platform in category remote exploits =========================================== Pine eip/ebp this can actually be "bruteforced" I didn't show this since this is a PoC and uses "exact offsets" All u do is supply multiple charsets and overwrite larger areas of memory This makes...
Stunnel <= 3.24 4.00 Daemon Hijacking Proof of Concept Exploit
No description provided by source. / By Steve Grubb : The technique is simple. 1 Fork so that stunnel can't find you when it dies. 2 Send stunnel a SIGUSR2. Unhandled signals generally kill programs. Since you are a child of stunnel, the OS will deliver the signal. 3 Select on the leaked descript...
Batalla Naval 1.0 4 - Remote Buffer Overflow (1)
Batalla Naval 1.0 4 - Remote Buffer Overflow 1 source: https://www.securityfocus.com/bid/7699/info Batalla Naval is prone to a remotely exploitable buffer overflow when handling requests of excessive length. This could allow for execution of malicious instructions in the context of the game serve...
MS Windows WebDAV (ntdll.dll) Remote Exploit
Exploit for unknown platform in category remote exploits ============================================ MS Windows WebDAV ntdll.dll Remote Exploit ============================================ // / Crpt ntdll.dll exploit trough WebDAV by kralor Crpt / /...
Yet another plaintext attack to ZIP encryption scheme.
Introduction ------------ The ZIP format is one of the most widely used compresion/archival programs on computers systems, its use is even more extended on Windows plataform, with WinZIP program. Known Attacks ------------- The PKZIP encryption scheme have been proved to be weak in a lot of paper...
H-Sphere WebShell 2.4 - Local Privilege Escalation
H-Sphere WebShell 2.4 - Local Privilege Escalation // source: https://www.securityfocus.com/bid/6527/info A vulnerability has been discovered in H-Sphere Webshell. During the pre-authentication phase Webshell fails to perform sufficient bounds checking on user-supplied HTTP parameters. As a resul...
MSIE:"SaveRef" turns Zone off
TITLEMSIE:"SaveRef" turns Zone off/TITLE digest MSIE: you can execute jscript in any zone by saving the reference of "NewWindow.location.assign". content after the "exp" section is not directly related to the flaw, so skip it if you are in a hurry; testedMSIEv6CN version IEXPLORE.EXE file version...
TCP SYN - 'bang.c' Denial of Service
/ BANG.C Coded by Sorcerer of DALnet FUCKZ to: etech, blazin, udp, hybrid and kdl PROPZ : skrilla, thanks for all your help with JUNO-Z and especially this code : -------------------------------- REDIRECTION DOS FINALLY DISTRIBUTED !!!!!! This is POC and demonstrates a new method of DoS. The idea...
rsync 2.5.1 - Remote (1)
rsync 2.5.1 - Remote 1 / 7350fuqnut - rsync include include include include include include include include include define MAXPATHLEN 4096 define VERSION "@RSYNCD: 26\n" define PORT 873 define NULLOFFSET -48 define STARTNULLBRUTE -44 define ENDNULLBRUTE -56 define BRUTEBASE 0xbfff7777 define...
UseLogin.txt
-- OpenSSH UseLogin bug proof of concept exploit -- by WaR / http://www.genhex.org -- Intro -- I was very curious in finding out how to exploit this problem. Although I don't think anyone uses this feature, I looked into the matter anyway. Here it goes. It was tested on the following platforms: -...
IP ID could allow to scan a masquerade network.
Hello, I was working on a new implementation of the IPID scann also known has idle scan in the nmap man page or pixie-scan as i call it During my test I think I discover a new way to use this type of scan : Synopsis ------------- Using the gateway of a masquerade network as a witness relay host f...
ISS Security Advisory: Wired-side SNMP WEP key exposure in 802.11 b Access Points
Internet Security Systems Security Advisory June 20, 2001 Wired-side SNMP WEP key exposure in 802.11b Access Points Synopsis: Internet Security Systems ISS X-Force has discovered a vulnerability in several 802.11b Access Point devices. This problem may reveal the Wired Equivalent Privacy WEP key...
ultimate-bb.txt
I set up a script on some server somewhere that will mail me the contents of "whatever" in a url query as such - http://somehost.com/somescript.php/cgi/pl/asp?contents="whatever" when I have that script in place I post a message on the board that I wish to steal peoples passes from withfor Intern...