. NET Remoting remote code execution vulnerability explore-exploit warning-the black bar safety net

This is an article on . NET Remoting the security of the Coptic text, in the article will use a simple RCE exploit and provide the right case will be described. This paper mainly has the following content: 1. The . NET Remoting technology made a brief introduction 2. Use VS 编写 一 个 简单 的 .NET...

Oracle Application Testing Suite (ATS) 12.4.0.2.0 - Authentication Bypass Arbitrary File Upload

Oracle Application Testing Suite ATS 12.4.0.2.0 - Authentication Bypass Arbitrary File Upload Exploit Title: Oracle Application Testing Suite Authentication Bypass and Arbitrary File Upload Remote Exploit Exploit Author: Zhou Yu Vendor Homepage: http://www.oracle.com/ Software Link:...

Oracle Application Testing Suite 12.4.0.2.0 - Authentication Bypass / Arbitrary File Upload

Exploit for jsp platform in category web applications Exploit Title: Oracle Application Testing Suite Authentication Bypass and Arbitrary File Upload Remote Exploit Exploit Author: Zhou Yu Vendor Homepage: http://www.oracle.com/ Software Link:...

Oracle Application Testing Suite (ATS) 12.4.0.2.0 - Authentication Bypass / Arbitrary File Upload

Exploit Title: Oracle Application Testing Suite Authentication Bypass and Arbitrary File Upload Remote Exploit Exploit Author: Zhou Yu Vendor Homepage: http://www.oracle.com/ Software Link: http://www.oracle.com/technetwork/oem/downloads/apptesting-downloads-1983826.html?ssSourceSiteId=otncn...

Immunity Canvas: MS16_032

Name| ms16032 ---|--- CVE| CVE-2016-0099 Exploit Pack| CANVAS Description| MS16-032 Seclogon Thread Handle Leak Notes| CVE Name: CVE-2016-0099 VENDOR: Microsoft Notes: Our exploit module is really two modules: 1 An exploit, based off of Google Project Zero's post by James Foreshaw. It is extremel...

KiTTY Portable 0.65.0.2p (Windows 7) - Local kitty.ini Overflow (Wow64 Egghunter)

Exploit Title: KiTTY Portable Code Execution Instructions:...

Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow

Exploit for windows platform in category remote exploits !/usr/bin/env python Easy File Sharing Web Server v7.2 Remote SEH Based Overflow The buffer overwrites ebx with 750+ offset, when sending 4059 it overwrites the EBX vulnerable file /changeuser.ghp Cookies UserID=buf Means there are two ways...

Easy File Sharing Web Server 7.2 - Remote Overflow (SEH)

Easy File Sharing Web Server 7.2 - Remote Overflow SEH !/usr/bin/env python Easy File Sharing Web Server v7.2 Remote SEH Based Overflow The buffer overwrites ebx with 750+ offset, when sending 4059 it overwrites the EBX vulnerable file /changeuser.ghp Cookies UserID=buf Means there are two ways t...

Easy File Sharing Web Server 7.2 - Remote Overflow (SEH)

!/usr/bin/env python Easy File Sharing Web Server v7.2 Remote SEH Based Overflow The buffer overwrites ebx with 750+ offset, when sending 4059 it overwrites the EBX vulnerable file /changeuser.ghp Cookies UserID=buf Means there are two ways to exploit changeuser.ghp Tested on Win7 x64 and x86, it...

Microsoft Windows Kernel - Pool Buffer Overflow Drawing Caption Bar (MS15-061)

Microsoft Windows Kernel - Pool Buffer Overflow Drawing Caption Bar MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=321 The PoC triggers a crashes due to a pool buffer overflow while drawing the caption bar of window. The trigger depends on the current window...

Microsoft Windows Kernel - WindowStation Use-After-Free (MS15-061)

Microsoft Windows Kernel - WindowStation Use-After-Free MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=295 Platform: Win7 32-bit. trigger.cpp should fire the issue, with caveats: - PoC MUST be compiled in release mode. - PoC may need to be run a few times to...

Microsoft Windows Kernel - Null Pointer Dereference with Window Station and Clipboard (MS15-061)

Microsoft Windows Kernel - Null Pointer Dereference with Window Station and Clipboard MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=294 Platform: Win7 32-bit. trigger.cpp should fire the issue, with a caveat - PoC might NOT work if compiled as a debug build...

Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (1)

Source: https://code.google.com/p/google-security-research/issues/detail?id=293 Platform: Win7 32-bit. trigger.cpp should fire the issue, with two caveats: - PoC will NOT work if compiled as a debug build. - PoC will trigger the condition every time but the subsequent corruption might not cause a...

Microsoft Windows Kernel - Null Pointer Dereference with Window Station and Clipboard (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=294 Platform: Win7 32-bit. trigger.cpp should fire the issue, with a caveat - PoC might NOT work if compiled as a debug build. windbg.txt is a sample crash log. Analysis from Nils: --- please find attached a C trigger,...

Microsoft Windows Kernel - WindowStation Use-After-Free (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=295 Platform: Win7 32-bit. trigger.cpp should fire the issue, with caveats: - PoC MUST be compiled in release mode. - PoC may need to be run a few times to trigger the crash. Analysis is attached as a text file. Proof of...

Sysax Multi Server 6.40 - SSH Component Denial of Service

''' Exploit title: Sysax Multi Server 6.40 ssh component denial of service vulnerability Date: 29-8-2015 Vendor homepage: http://www.sysax.com Software Link: http://www.sysax.com/download/sysaxservsetup.msi Version: 6.40 Author: 3unnym00n Details: ---------------------------------------------- by...

Flash Player - Integer Overflow in Function.apply

Flash Player - Integer Overflow in Function.apply Source: https://code.google.com/p/google-security-research/issues/detail?id=302&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for: https://code.google.com/p/chromium/issues/detail?id=470837 VULNERABILITY DETAILS A...

Adobe Flash AS2 - Color.setRGB Use-After-Free

Adobe Flash AS2 - Color.setRGB Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=367&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Deadline tracking for Chromium VRP bug https://code.google.com/p/chromium/issues/detail?id=484610...

Adobe Flash AS2 - Color.setRGB Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=367&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Deadline tracking for Chromium VRP bug https://code.google.com/p/chromium/issues/detail?id=484610 Credit is to bilou, working with the Chromium...

Flash Player - Integer Overflow in Function.apply

Source: https://code.google.com/p/google-security-research/issues/detail?id=302&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for: https://code.google.com/p/chromium/issues/detail?id=470837 VULNERABILITY DETAILS An integer overflow while calling Function.apply ca...