Microsoft IIS - ISAPI 'w3who.dll' Query String Overflow (Metasploit)

$Id: w3whoquery.rb 9719 2010-07-07 17:38:59Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

LILDBI Shell Upload Vulnerability

Exploit for php platform in category web applications ================================= LILDBI Shell Upload Vulnerability ================================= Author: EraGoN Version: 1.0 Tested on: Windows XP sp2/sp3 & Linux Ubuntu Code : Dark Hackers Team Dork : allinurl:"/lildbi/ The shell upload...

SasCam 2.7 - ActiveX Head Buffer Overflow

SasCam 2.7 - ActiveX Head Buffer Overflow Exploit Title: SasCam 2.7 ActiveX Head Buffer Overflow Date: July 4, 2010 Author: Blake Software Link:http://download.cnet.com/SasCam-Webcam-Server/3000-23484-10491197.html Version: 2.7 Tested on: Windows XP SP3 / IE6 and 7 'for debugging/custom prolog...

EasyFTP Server LIST Command Stack Buffer Overflow

This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11. credit goes to Karn Ganeshan. NOTE: Although, this is likely to exploit the same vulnerability as the 'easyftpcwdfixret' exploit, it uses a slightly different vector. Module Options msf use...

SasCam 2.7 ActiveX Head Buffer Overflow

Exploit for windows platform in category local exploits ======================================= SasCam 2.7 ActiveX Head Buffer Overflow ======================================= Exploit Title: SasCam 2.7 ActiveX Head Buffer Overflow Author: Blake Software Link:...

SasCam 2.7 - ActiveX Head Buffer Overflow

Exploit Title: SasCam 2.7 ActiveX Head Buffer Overflow Date: July 4, 2010 Author: Blake Software Link:http://download.cnet.com/SasCam-Webcam-Server/3000-23484-10491197.html Version: 2.7 Tested on: Windows XP SP3 / IE6 and 7 'for debugging/custom prolog 'targetFile = "C:\Program...

Registry OCX 1.5 - ActiveX Buffer Overflow

Registry OCX 1.5 - ActiveX Buffer Overflow Tested on: Windows XP SP3 IE6/7 ' Registry OCX Remote Buffer Overflow ' Written by Blake buffer = String2008, "A" eip = unescape"%f3%30%9d%7c" 'eip 7C9D30F3 JMP ESP - SHELL32 nops = String20, unescape"%90" ' nop sled junk = String804, "D" ' bind shell po...

Registry OCX v1.5 ActiveX Buffer Overflow Exploit

Exploit for windows platform in category remote exploits ================================================= Registry OCX v1.5 ActiveX Buffer Overflow Exploit ================================================= Tested on: Windows XP SP3 IE6/7 ' Registry OCX Remote Buffer Overflow ' Written by Blake...

Registry OCX 1.5 - ActiveX Buffer Overflow

Tested on: Windows XP SP3 IE6/7 ' Registry OCX Remote Buffer Overflow ' Written by Blake buffer = String2008, "A" eip = unescape"%f3%30%9d%7c" 'eip 7C9D30F3 JMP ESP - SHELL32 nops = String20, unescape"%90" ' nop sled junk = String804, "D" ' bind shell port 4444 sc =...

SasCam WebCam Server 2.6.5 Active-X SEH Overwrite

'SEH Overwrite exploited by Blake 'Original EIP method by callAX 'Tested on XP SP3/IE7 in virtualbox '$ nc 192.168.1.155 4444 'Microsoft Windows XP Version 5.1.2600 'C Copyright 1985-2001 Microsoft Corp. ' 'C:\Documents and Settings\blake\Desktop buffer = String8349, "A" nseh =...

SasCam WebCam Server 2.6.5 - ActiveX Overwrite (SEH)

SasCam WebCam Server 2.6.5 - ActiveX Overwrite SEH 'SEH Overwrite exploited by Blake 'Original EIP method by callAX 'Tested on XP SP3/IE7 in virtualbox '$ nc 192.168.1.155 4444 'Microsoft Windows XP Version 5.1.2600 'C Copyright 1985-2001 Microsoft Corp. ' 'C:\Documents and Settings\blake\Desktop...

Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (MS06-057) (Metasploit) (2)

$Id: ms06057webviewsetslice.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Microsoft LSASS Service - DsRolerUpgradeDownlevelServer Overflow (MS04-011) (Metasploit)

$Id: ms04011lsass.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

NCTAudioFile2 2.x - ActiveX Control 'SetFormatLikeSample()' Remote Buffer Overflow (Metasploit)

$Id: nctaudiofile2setformatlikesample.rb 9668 2010-07-03 01:38:15Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Microsoft NetDDE Service - Remote Overflow (MS04-031) (Metasploit)

$Id: ms04031netdde.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

SasCam WebCam Server v2.6.5 ActiveX SEH Overwrite

Exploit for windows platform in category remote exploits ================================================= SasCam WebCam Server v2.6.5 ActiveX SEH Overwrite ================================================= 'SEH Overwrite exploited by Blake 'Original EIP method by callAX 'Tested on XP SP3/IE7 in...

Sun Java Web Server 7.0 u7 - Remote Overflow

Sun Java Web Server 7.0 u7 - Remote Overflow / Sun Java Web Server Exploit Tested on: Sun Java Web Server 7.0 update 7 - XP SP3 Ref: CVE-2010-0361 This vulnerability was identified by Evgeny Legerov Author: Dominic Chell Date: 23/01/2010 / include "stdafx.h" include include include include includ...

BigAnt Server 2.50 SP1 - Remote Buffer Overflow (Metasploit)

$Id: bigantserver250.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

Microsoft Internet Explorer - 'VML' Fill Method Code Execution (MS06-055) (Metasploit)

$Id: ms06055vmlmethod.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Microsoft Internet Explorer - XML Core Services HTTP Request Handling (MS06-071) (Metasploit)

$Id: ms06071xmlcore.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...