1086 matches found
Hylafax 4.1.x - HFaxD Format String
Hylafax 4.1.x - HFaxD Format String // source: https://www.securityfocus.com/bid/9005/info Hylafax hfaxd daemon has been reported prone to an unspecified format string vulnerability that may be exploited under non-standard configurations to execute arbitrary instructions remotely as the root user...
Pine <= 4.56 Remote Buffer Overflow Exploit
Exploit for linux platform in category remote exploits =========================================== Pine eip/ebp this can actually be "bruteforced" I didn't show this since this is a PoC and uses "exact offsets" All u do is supply multiple charsets and overwrite larger areas of memory This makes...
Stunnel <= 3.24 4.00 Daemon Hijacking Proof of Concept Exploit
No description provided by source. / By Steve Grubb : The technique is simple. 1 Fork so that stunnel can't find you when it dies. 2 Send stunnel a SIGUSR2. Unhandled signals generally kill programs. Since you are a child of stunnel, the OS will deliver the signal. 3 Select on the leaked descript...
Batalla Naval 1.0 4 - Remote Buffer Overflow (1)
Batalla Naval 1.0 4 - Remote Buffer Overflow 1 source: https://www.securityfocus.com/bid/7699/info Batalla Naval is prone to a remotely exploitable buffer overflow when handling requests of excessive length. This could allow for execution of malicious instructions in the context of the game serve...
MS Windows WebDAV (ntdll.dll) Remote Exploit
Exploit for unknown platform in category remote exploits ============================================ MS Windows WebDAV ntdll.dll Remote Exploit ============================================ // / Crpt ntdll.dll exploit trough WebDAV by kralor Crpt / /...
Yet another plaintext attack to ZIP encryption scheme.
Introduction ------------ The ZIP format is one of the most widely used compresion/archival programs on computers systems, its use is even more extended on Windows plataform, with WinZIP program. Known Attacks ------------- The PKZIP encryption scheme have been proved to be weak in a lot of paper...
H-Sphere WebShell 2.4 - Local Privilege Escalation
H-Sphere WebShell 2.4 - Local Privilege Escalation // source: https://www.securityfocus.com/bid/6527/info A vulnerability has been discovered in H-Sphere Webshell. During the pre-authentication phase Webshell fails to perform sufficient bounds checking on user-supplied HTTP parameters. As a resul...
MSIE:"SaveRef" turns Zone off
TITLEMSIE:"SaveRef" turns Zone off/TITLE digest MSIE: you can execute jscript in any zone by saving the reference of "NewWindow.location.assign". content after the "exp" section is not directly related to the flaw, so skip it if you are in a hurry; testedMSIEv6CN version IEXPLORE.EXE file version...
TCP SYN - 'bang.c' Denial of Service
/ BANG.C Coded by Sorcerer of DALnet FUCKZ to: etech, blazin, udp, hybrid and kdl PROPZ : skrilla, thanks for all your help with JUNO-Z and especially this code : -------------------------------- REDIRECTION DOS FINALLY DISTRIBUTED !!!!!! This is POC and demonstrates a new method of DoS. The idea...
rsync 2.5.1 - Remote (1)
rsync 2.5.1 - Remote 1 / 7350fuqnut - rsync include include include include include include include include include define MAXPATHLEN 4096 define VERSION "@RSYNCD: 26\n" define PORT 873 define NULLOFFSET -48 define STARTNULLBRUTE -44 define ENDNULLBRUTE -56 define BRUTEBASE 0xbfff7777 define...
UseLogin.txt
-- OpenSSH UseLogin bug proof of concept exploit -- by WaR / http://www.genhex.org -- Intro -- I was very curious in finding out how to exploit this problem. Although I don't think anyone uses this feature, I looked into the matter anyway. Here it goes. It was tested on the following platforms: -...
IP ID could allow to scan a masquerade network.
Hello, I was working on a new implementation of the IPID scann also known has idle scan in the nmap man page or pixie-scan as i call it During my test I think I discover a new way to use this type of scan : Synopsis ------------- Using the gateway of a masquerade network as a witness relay host f...
ISS Security Advisory: Wired-side SNMP WEP key exposure in 802.11 b Access Points
Internet Security Systems Security Advisory June 20, 2001 Wired-side SNMP WEP key exposure in 802.11b Access Points Synopsis: Internet Security Systems ISS X-Force has discovered a vulnerability in several 802.11b Access Point devices. This problem may reveal the Wired Equivalent Privacy WEP key...
ultimate-bb.txt
I set up a script on some server somewhere that will mail me the contents of "whatever" in a url query as such - http://somehost.com/somescript.php/cgi/pl/asp?contents="whatever" when I have that script in place I post a message on the board that I wish to steal peoples passes from withfor Intern...
Linux Kernel 2.2.x - sysctl() Memory Reading
Linux Kernel 2.2.x - sysctl Memory Reading / source: https://www.securityfocus.com/bid/2364/info The Linux Kernel is the core of the Linux Operating System. It was originally written by Linus Torvalds, and is publicly maintained. A problem in the Linux kernel may allow root compromise. The sysctl...
Tru64 5 - su Env Local Stack Overflow
Tru64 5 - su Env Local Stack Overflow / Copyright c 2000 ADM / / All Rights Reserved / / THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF ADM / / The copyright notice above does not evidence any / / actual or intended publication of such source code. / / / / Title: Tru64 5 su / / Tested under: Tru6...
Solaris 2.5 / 2.5.1 getgrnam() Local Overflow Exploit
Exploit for solaris platform in category local exploits ===================================================== Solaris 2.5 / 2.5.1 getgrnam Local Overflow Exploit ===================================================== include include / getgrnam function overflow. works against Solaris 2.5/2.5.1 SPA...
HP-UX 11.0 /bin/cu Privilege Escalation Exploit
Exploit for hp-ux platform in category local exploits =============================================== HP-UX 11.0 /bin/cu Privilege Escalation Exploit =============================================== / Copyright c 2001 Zorgon All Rights Reserved The copyright notice above does not evidence any actu...
BFTPd 1.0.12 Remote Exploit
Exploit for linux platform in category remote exploits =========================== BFTPd 1.0.12 Remote Exploit =========================== / Creates a filname to exploit the bug in bftpd 1.0.12 Create the file, cwd in the shell directory and nlist the file directory. Coded by korty / include...
Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (1)
source: https://www.securityfocus.com/bid/1578/info Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server. It is...