Socat 1.4.0.2 - Not SETUID Local Format String

/ socatexp.c Socat Format String Vulnerability socat No System Group - http://www.nosystem.com.ar coki@servidor:$ make socatexp coki@servidor:$ ./socatexp socat shellcode address = 0xbfffffb9 .dtors address = 0x080740c4 2004/10/19 09:49:46 socat26197 E unknown syslog facility...

bsd/x86 - portbind port random 143 bytes

bsd/x86 portbind port random 143 bytes. Shellcode exploit for bsdx86 platform / Here is a BSD remote shellcode. Tested on NetBSD . SHould work on FreeBSD and OpenBSD . by MayheM ExileCrew www.exile2k.org / / 143 bytes / char shellcode = "\x31\xC0" "\x50" "\x50" "\xB0\x17" "\xCD\x80" // setuid...

MusicDaemon <= 0.0.3 /etc/shadow Stealer / DoS Exploit

Discovered and Exploit Coded by: Tal0n [email protected] URL: http://musicdaemon.sourceforge.net Note: This was 0day for several months.. I decided to turn it in because there may be 10 whole boxes in the world running this.. and its not very handy sitting around on my box =p. / MusicDaemon ...

bitlanceOpera.txt

A vulnerability is found in the Opera browser version 7.51 , which can be exploited by spammers to spoof information displayed in the address bar.Tested on Windows OS. Demonstration HTML source code: ======== begin ======== !DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" html...

Critical WFTPD buffer overflow vulnerability

Name of Advisory: Critical WFTPD buffer overflow vulnerability Severity: Critical Discoverer: axl [email protected] Released: Today Vendor Notified: Today WFTPD who? what? when? Vendor quote: "WFTPD Server has been a leading FTP server for Windows since it was released in 1993. Its stability and...

WFTPD Server 3.21 - Remote Buffer Overflow

/ WFTPD buffer overflow exploit, c axl 2004, [email protected] Discovered by the very same guy :p Tested WFTPD versions: - WFTPD Pro Server 3.21 Release 1 trial latest version - WFTPD Pro Server 3.20 Release 2 trial - WFTPD Server 3.21 Release 1 trial latest version - WFTPD Server 3.10 Release 1...

Microsoft Security Bulletin MS04-007

Microsoft Security Bulletin MS04-007 ASN.1 Vulnerability Could Allow Code Execution 828028 Issued: February 10, 2004 Version Number: 1.0 Summary Who should read this document: Customers who are using Microsoft® Windows® Impact of vulnerability: Remote Code Execution Maximum Severity Rating:...

Microsoft Security Bulletin MS04-004

Microsoft Security Bulletin MS04-004 Cumulative Security Update for Internet Explorer 832894 Issued: February 2, 2004 Version: 1.0 Summary Who should read this document: Customers who are using Microsoft® Internet Explorer Impact of vulnerability: Remote Code Execution Maximum Severity Rating:...

CesarFTP v0.99g CPU OverLoad [Proof of concept]

Description : FTP server CesarFTP v0.99g has a security hole in the command CWD. This command allow somebody to rise up the CPU usage with the following command : USER user PASS pass CWD ..................per 10000.... The CPU utilisation will be equal to 100, the connection will not responding...

Eznet 3.5.0 - Remote Stack Overflow Universal

Eznet 3.5.0 - Remote Stack Overflow Universal !/usr/bin/perl -w COROMPUTER Crpt universal eZ v3.3 3 print "syntax: ".$0." \r\n"; exit; print "+ Connecting to ".$ARGV0."\t..."; my $sock = IO::Socket::INET-newProto='tcp', PeerAddr=$ARGV0, PeerPort="80"; if!$sock print "Error\r\n"; exit; print...

Linux pam_lib_smb < 1.1.6 - '/bin/login' Remote Overflow

/ Linux pamlibsmb include include include include include include include include include / first negotiate / / packet capture by ethereal / char packet1 = 0xff, 0xfd, 0x03, 0xff, 0xfb, 0x18, 0xff, 0xfb, 0x1f, 0xff, 0xfb, 0x20, 0xff, 0xfb, 0x21, 0xff, 0xfb, 0x22, 0xff, 0xfb, 0x27, 0xff, 0xfd, 0x0...

Nokia IPSO Vulnerability

There is a remote security vulnerability in the Nokia IPSO operating system. Anyone with access to the webgui Voyager on the Nokia IP-box can read any file on the system. For example, login as the user 'monitor' disabled by default and use the readfile.tcl to read any file:...

ftls.org Guestbook 1.1 Script Injection

ftls.org Guestbook 1.1 Script Injection Vulnerabilities Discovered By BrainRawt [email protected] About MyGuestbook: ------------------ Your basic guestbook that can be downloaded at http://www.ftls.org/en/examples/cgi/Guestbook.shtmls1. Vulnerable tested Versions: --------------------...

Melange Chat Server 1.10 - Remote Buffer Overflow

/ Proof of Concept for Melange Chat Server 1.10 a lame remote bof exploit by innerphobia 12/24/02 Credits go to: - iDefense Labs for the advisory - blink for discovering the bug - Irian for the shellcode With careful calculation it is possible to control even the EIP, not just one byte of EIP...

HP-UX 11.011.11 - swxxx Privilege Escalation

HP-UX 11.011.11 - swxxx Privilege Escalation / Program : xhpux11isw.c Use : HP-UX 11.11/11.0 exploit swxxx to get local root shell. Complie : cc xhpux11isw.c -o xsw;./xsw not use gcc for some system Usage : ./xsw off Tested : HP-UX B11.11 & HP-UX B11.0 Author : watercloud @ xfocus.org Date :...

MSIEv6 &#37; encoding - Konqueror 3.0.3 also vulnerable

Hello, Test page for Konqueror is at: http://pp.siedziba.pl/2f/ I have also tested it with Mozilla 1.0 Gecko/20020829 and Galeon 1.2.5 Gecko/20020606 and found not vulnerable - the script throws "Permission denied to get property HTMLDocument.body" exception. -- Piotr Pawow mailto:[email protected]...

SNMP vulnerability in AVAYA Cajun firmware

Problem Description There exists an undocumented SNMP r/w community string in firmware for Avaya Cajun P33x series hardware. This allows anyone having SNMP access to the device to administer it. 2. Tested systems The following versions were tested and found vulnerable: Avaya Cajun P330T software...

malicious PHP source injection in phpBB

JCC Security Advisory June 16, 2002 malicious PHP source injection in phpBB Description phpBB is one of popular PHP bulletin board systems. When allowurlfopen = On and registerglobals = On in php.ini, phpBB has vulnerability because install.php contains dangerous codes. So an attacker can include...

[ ** Snes9x buffer overflow vulnerability ** ]

Snes9x buffer overflow vulnerability Affected version: v1.37 prior versions might also be affected. Tested platforms: FreeBSD, NetBSD, OpenBSD and Linux. A buffer overflow vulnerability exists in the snes9x emulator. The problem is that rom names given as an argument upon execution of the program...

Advisory for Jana server

Advisory for Jana Webserver Site: http://www.janaserver.de by nemesystm of the DHC http://dhcorp.cjb.net - [email protected] ADV-0112 /-|=explanation=|- Jana Webserver is well, a webserver. It has a hex-encoded dot dot bug and a denial of service. /-|=who is vulnerable=|- Tested to be...