Flash Uninitialized Stack Variable MPD Parsing Memory Corruption

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=316&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for: https://code.google.com/p/chromium/issues/detail?id=472201 Credit is to bilou,...

FTP Commander 8.02 Buffer Overflow

Exploit Title: FTP Commander 'Costum Command' SEH Over-WriteBuffer Overflow. Date: 8/17/2015 Exploit Author: UnN0n Software Vendor : http://www.internet-soft.com/ Software Link: http://www.internet-soft.com/ftpcomm.htm Version: 8.02 Tested on: Windows 7 x3232 BIT Steps to Produce the Crash: 1- op...

Adobe Flash - URL Resource Use-After-Free

Adobe Flash - URL Resource Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=410&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id The following crash was observed in Flash Player 17.0.0.188 on Windows: 81c.854: Access violation - code...

Adobe Flash AS2 - textfield.filters Use-After-Free (1)

Source: https://code.google.com/p/google-security-research/issues/detail?id=330&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for: https://code.google.com/p/chromium/issues/detail?id=476926 Credit is to bilou, working with the Chromium Vulnerability Rewards...

Adobe Flash - Out-of-Bounds Read in UTF Conversion

Source: https://code.google.com/p/google-security-research/issues/detail?id=378&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id We've hit the same bug from two different avenues: 1 A report to the Chromium bug tracker:...

FTP Commander 8.02 - Overwrite (SEH)

FTP Commander 8.02 - Overwrite SEH Exploit Title: FTP Commander 'Costum Command' SEH Over-WriteBuffer Overflow. Date: 8/17/2015 Exploit Author: UnN0n Software Vendor : http://www.internet-soft.com/ Software Link: http://www.internet-soft.com/ftpcomm.htm Version: 8.02 Tested on: Windows 7 x3232 BI...

FTP Commander 8.02 - Overwrite (SEH)

Exploit Title: FTP Commander 'Costum Command' SEH Over-WriteBuffer Overflow. Date: 8/17/2015 Exploit Author: UnN0n Software Vendor : http://www.internet-soft.com/ Software Link: http://www.internet-soft.com/ftpcomm.htm Version: 8.02 Tested on: Windows 7 x3232 BIT Steps to Produce the Crash: 1- op...

XMPlay 3.8.1.12 - .pls Local Crash (PoC)

XMPlay 3.8.1.12 - .pls Local Crash PoC !/usr/bin/env python Exploit Title: XMPlay .pls Local Crash poc Date: 2015-08-16 Exploit Author: St0rn Twitter: st0rnpentest Vendor Homepage: http://www.un4seen.com/ Software Link: http://www.un4seen.com/download.php?xmplay38 Version: 3.8.1.12 Tested on:...

Microsoft Windows HTA Remote Code Execution

!/usr/bin/php poc'."\n\n"; $reza = socketcreateAFINET, SOCKSTREAM, 0 or die'Failed to create socket!'; socketbind$reza, 0,$port; socketlisten$reza; $msgd = "\x3c\x68\x74\x6d\x6c\x3e\x0d\x0a\x3c\x6d\x65\x74\x61\x20\x68\x74\x74\x70\x2d\x65\x71\x75\x69\x76"...

Microsoft Windows HTA (HTML Application) - Remote Code Execution (MS14-064)

!/usr/bin/php poc'."\n\n"; $reza = socketcreateAFINET, SOCKSTREAM, 0 or die'Failed to create socket!'; socketbind$reza, 0,$port; socketlisten$reza; $msgd = "\x3c\x68\x74\x6d\x6c\x3e\x0d\x0a\x3c\x6d\x65\x74\x61\x20\x68\x74\x74\x70\x2d\x65\x71\x75\x69\x76"...

MASM321 11 Quick Editor .qeditor 4.0g - .qse File Buffer Overflow (SEH) (ASLR + SafeSEH Bypass)

MASM321 11 Quick Editor .qeditor 4.0g - .qse File Buffer Overflow SEH ASLR + SafeSEH Bypass !/usr/bin/env python Exploit Title: MASM32 quick editor .QSE SEH Based Buffer Overflow ASLR & SAFESEH bypass Date: 2015-08-15 Exploit Author: St0rn Twitter: st0rnpentest Vendor Homepage:...

XMPlay 3.8.1.12 - .pls Local Crash PoC

XMPlay version 3.8.1.12 .pls local crash proof of concept exploit. !/usr/bin/env python Exploit Title: XMPlay .pls Local Crash poc Date: 2015-08-16 Exploit Author: St0rn Twitter: st0rnpentest Vendor Homepage: http://www.un4seen.com/ Software Link: http://www.un4seen.com/download.php?xmplay38...

MASM321 11 Quick Editor '.qeditor' 4.0g - '.qse' File Buffer Overflow (SEH) (ASLR + SafeSEH Bypass)

!/usr/bin/env python Exploit Title: MASM32 quick editor .QSE SEH Based Buffer Overflow ASLR & SAFESEH bypass Date: 2015-08-15 Exploit Author: St0rn Twitter: st0rnpentest Vendor Homepage: http://www.masm32.com/ Software Link: http://www.masm32.com/masmdl.htm Version: MASM32 11 qeditor 4.0g Tested...

XMPlay 3.8.1.12 Proof Of Concept

!/usr/bin/env python Exploit Title: XMPlay .pls Local Crash poc Date: 2015-08-16 Exploit Author: St0rn Twitter: st0rnpentest Vendor Homepage: http://www.un4seen.com/ Software Link: http://www.un4seen.com/download.php?xmplay38 Version: 3.8.1.12 Tested on: Windows 7 Stack Overflowing xmplay, but we...

Design/Logic Flaw

ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted...

Design/Logic Flaw

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight...

Privilege escalation

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified filesystem actions via a crafted...

Code injection

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2,...

Design/Logic Flaw

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1,...

Design/Logic Flaw

ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4....