MS10-073 Windows Class Handling

include / Source: http://mista.nu/blog/2010/12/01/windows-class-handling-gone-wrong/ / int mainint argc, char argv WNDCLASSA Class = 0; CREATESTRUCTA Cs = 0; FARPROC MenuWindowProcA; HMODULE hModule; HWND hWindow; Class.lpfnWndProc = DefWindowProc; Class.lpszClassName = "Class"; Class.cbWndExtra ...

Microsoft Windows - Class Handling (MS10-073)

include / Source: http://mista.nu/blog/2010/12/01/windows-class-handling-gone-wrong/ / int mainint argc, char argv WNDCLASSA Class = 0; CREATESTRUCTA Cs = 0; FARPROC MenuWindowProcA; HMODULE hModule; HWND hWindow; Class.lpfnWndProc = DefWindowProc; Class.lpszClassName = "Class"; Class.cbWndExtra ...

Design/Logic Flaw

Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and possibly other versions before 7.3.46, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse User32.dll or other DLL that is located in...

Minishare 1.5.5 Buffer Overflow

Exploit Title: Minishare 1.5.5 Buffer Overflow Vulnerability users.txt Date: 11/02/2010 Author: Chris Gabriel Software Link: http://sourceforge.net/projects/minishare Version: 1.4.0 - 1.5.5 Tested on: Windows XP SP3 EN CVE: MessageBoxA TITLE=HAX TEXT=HAX WIN XP SP3 Shellcode...

Minishare 1.5.5 Buffer Overflow Vulnerability (users.txt)

Exploit for windows platform in category local exploits ========================================================= Minishare 1.5.5 Buffer Overflow Vulnerability users.txt ========================================================= Exploit Title: Minishare 1.5.5 Buffer Overflow Vulnerability users.tx...

MiniShare 1.4.0 < 1.5.5 - 'users.txt' Local Buffer Overflow

Exploit Title: Minishare 1.5.5 Buffer Overflow Vulnerability users.txt Date: 11/02/2010 Author: Chris Gabriel Software Link: http://sourceforge.net/projects/minishare Version: 1.4.0 - 1.5.5 Tested on: Windows XP SP3 EN CVE: MessageBoxA TITLE=HAX TEXT=HAX WIN XP SP3 Shellcode...

win32/xp sp3 (Tr) user32.dll Edit with notepad.exe Shellcode 87 bytes

Exploit for win32 platform in category shellcode ===================================================================== win32/xp sp3 Tr user32.dll Edit with notepad.exe Shellcode 87 bytes =====================================================================...

Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (MS07-017) (Metasploit)

$Id: ms07017aniloadimagechunksize.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

win32/xp sp3 (En) MessageBoxA Shellcode 87 bytes

Exploit for win32 platform in category shellcode ================================================ win32/xp sp3 En MessageBoxA Shellcode 87 bytes ================================================ / Title: Windows XP SP3 English MessageBoxA Shellcode 87 bytes Date: August 20, 2010 Author: Glafkos...

Easy FTP Server 1.7.0.11 XRMD Buffer Overflow

Exploit Title: Easy FTP Server v1.7.0.11 'XRMD' Command Buffer Overflow Post Auth Date: August 12, 2010 Author: Glafkos Charalambous Software Link: Version: 1.7.0.11 Tested on: Windows XP SP3 En import socket import sys if lensys.argv != 3: print "Usage: ./easyftpXRMD.py " sys.exit1 target =...

Easy FTP Server 1.7.0.11 Buffer Overflow

Note: RNFR, DELE, RMD, STOR commands are have the same offset Exploit Title: Easy FTP Server v1.7.0.11 DELE Command Remote Buffer Overflow Exploit Post Auth Date: August 08, 2010 Author: Glafkos Charalambous Version: 1.7.0.11 Tested on: Windows XP SP3 En import socket import sys if lensys.argv !=...

Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP) (MS07-017) (Metasploit)

$Id: ms07017aniloadimagechunksize.rb 9984 2010-08-12 16:56:41Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)

This module exploits a buffer overflow vulnerability in the LoadAniIcon function of USER32.dll. The flaw is triggered through Outlook Express by using the CURSOR style sheet directive to load a malicious .ANI file. This vulnerability was discovered by Alexander Sotirov of Determina and was...

EasyFTP Server 1.7.0.11 - CWD (Authenticated) Remote Buffer Overflow

EasyFTP Server 1.7.0.11 - CWD Authenticated Remote Buffer Overflow Exploit Title: Easy FTP Server v1.7.0.11 CWD Command Remote Buffer Overflow Exploit Post Auth Date: 2010-07-18 Author: @fdiskyou e-mail: rui at deniable.org Software Link: Version: 1.7.0.11 Tested on: Windows XP SP3 en import sock...

Easy FTP Server v1.7.0.11 CWD Command Remote Buffer Overflow Exploit

Exploit for windows platform in category remote exploits ================================================================================ Easy FTP Server v1.7.0.11 CWD Command Remote Buffer Overflow Exploit Post Auth ================================================================================...

EasyFTP Server 1.7.0.11 - 'CWD' (Authenticated) Remote Buffer Overflow

Exploit Title: Easy FTP Server v1.7.0.11 CWD Command Remote Buffer Overflow Exploit Post Auth Date: 2010-07-18 Author: @fdiskyou e-mail: rui at deniable.org Software Link: Version: 1.7.0.11 Tested on: Windows XP SP3 en import socket import sys buffersize = 268 windows/exec - 227 bytes...

Private Wire Gateway - Remote Buffer Overflow (Metasploit)

$Id: privatewiregateway.rb 9179 2010-04-30 08:40:19Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP)

This module exploits a buffer overflow vulnerability in the LoadAniIcon function in USER32.dll. The flaw can be triggered through Internet Explorer 6 and 7 by using the CURSOR style sheet directive to load a malicious .ANI file. The module can also exploit Mozilla Firefox by using a UNC path in a...

Windows ANI LoadAniIcon() Chunk Size Stack Overflow (HTTP)

$Id: ms07017aniloadimagechunksize.rb 9085 2010-04-15 16:08:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Shadow Stream Recorder 3.0.1.7 (.asx) Local Buffer Overflow

No description provided by source. !/usr/bin/python Title: Shadow Stream Recorder 3.0.1.7 .asx Local Buffer Overflow Date: 03-29-2010 Author: b0telh0 Link: http://www.rm-to-mp3.net/downloads/ssrecordersetup.exe Tested on: Windows XP SP3 windows/exec - 228 bytes EXITFUNC=seh, CMD=calc.exe shellcod...