Green Dam - URL Processing Buffer Overflow (Metasploit)

$Id: greendamurl.rb 8762 2010-03-10 05:58:01Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Orbital Viewer ORB File Parsing Buffer Overflow

This module exploits a stack-based buffer overflow in David Manthey's Orbital Viewer. When processing .ORB files, data is read from file into a fixed-size stack buffer using the fscanf function. Since no bounds checking is done, a buffer overflow can occur. Attackers can execute arbitrary code by...

Easy~FTP Server v1.7.0.2 CWD Command Buffer Overflow

New Ticket: EasyFTP BoF meta Exploit Title: EasyFTP Date: March 9, 2010 Author: Blake Version: 1.7.0.2 Tested on: Windows XP SP3 CVE : require 'msf/core' class Metasploit3 'EasyFTP Server v1.7.0.2 CWD Command Buffer Overflow', 'Description' = %q This module exploits a stack overflow in the CWD ve...

QuickZip 4.x Local Universal Buffer Overflow

!/usr/bin/python Exploit Title : QuickZip 4.x .zip 0day Local Universal Buffer Overflow PoC Exploit Date : 9/3/2010 Author : corelanc0d3r & mrme Bug found by : corelanc0d3r http://corelan.be:8800/ Software Link : http://www.quickzip.org/downloads.html Version : 4.60 OS : Windows Tested on : XP SP...

Easy FTP Server v1.7.0.2 CWD Remote BoF - MSF Module

Exploit for unknown platform in category remote exploits ==================================================== Easy FTP Server v1.7.0.2 CWD Remote BoF - MSF Module ==================================================== Exploit Title: EasyFTP Date: March 9, 2010 Author: Blake Version: 1.7.0.2 Tested...

PHP File Sharing System v1.5.1 Multiple Vulnerabilities

No description provided by source. Title: PHP File Sharing System 1.5.1 Multiple Vulnerabilities Author: blake Tested on: Windows XP SP3 with xampplite 1 XSS http://192.168.1.149/fss/index.php?cam= 2 Directory transversal http://192.168.1.149/fss/index.php?cam=/../../../../../../../.. 3 Shell...

PHP File Sharing System 1.5.1 Directory Traversal / XSS / Shell Upload

Title: PHP File Sharing System 1.5.1 Multiple Vulnerabilities Date: March 8, 2010 Author: blake Download: http://sourceforge.net/projects/phpfilesadmin/ Version: 1.5.1 Tested on: Windows XP SP3 with xampplite 1 XSS http://192.168.1.149/fss/index.php?cam= 2 Directory transversal...

EasyFTP Server 1.7.0.2 - CWD Remote Buffer Overflow (Metasploit)

EasyFTP Server 1.7.0.2 - CWD Remote Buffer Overflow Metasploit Exploit Title: EasyFTP Date: March 9, 2010 Author: Blake Version: 1.7.0.2 Tested on: Windows XP SP3 CVE : require 'msf/core' class Metasploit3 'EasyFTP Server v1.7.0.2 CWD Command Buffer Overflow', 'Description' = %q This module...

PHP File Sharing System 1.5.1 - Multiple Vulnerabilities

Title: PHP File Sharing System 1.5.1 Multiple Vulnerabilities Author: blake Tested on: Windows XP SP3 with xampplite 1 XSS http://192.168.1.149/fss/index.php?cam= 2 Directory transversal http://192.168.1.149/fss/index.php?cam=/../../../../../../../.. 3 Shell through file upload can upload php...

EasyFTP Server 1.7.0.2 - CWD Remote Buffer Overflow (Metasploit)

Exploit Title: EasyFTP Date: March 9, 2010 Author: Blake Version: 1.7.0.2 Tested on: Windows XP SP3 CVE : require 'msf/core' class Metasploit3 'EasyFTP Server v1.7.0.2 CWD Command Buffer Overflow', 'Description' = %q This module exploits a stack overflow in the CWD verb in EasyFTP Server. You mus...

Windows Movie Maker and Microsoft Producer IsValidWMToolsStream() Heap Overflow

Advisory ID Internal CORE-2009-0813 1. Advisory Information Title: Windows Movie Maker and Microsoft Producer IsValidWMToolsStream Heap Overflow Advisory Id: CORE-2009-0813 Advisory URL:http://www.coresecurity.com/content/movie-maker-heap-overflow Date published: 2010-03-09 Date of last update:...

Flare <= 0.6 Local Heap Overflow DoS

Exploit for multiple platform in category dos / poc ==================================== Flare Site: xraysecurity.blogspot.com ---- Coming soon! Registers: EAX 003E0000 ECX 003E1088 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..." EDX 41414141 EBX 00004141 ESP 0022FB0C EBP 0022FBDC ESI...

Microsoft Windows XP/2000 - Help File Relative Path Remote Command Execution

source: https://www.securityfocus.com/bid/38661/info Microsoft Windows is prone to a remote command-execution vulnerability because it opens help files from unsafe locations. An attacker could exploit this issue by enticing a victim to load help files when working in a directory containing crafte...

Microsoft Windows XP2000 - Help File Relative Path Remote Command Execution

Microsoft Windows XP2000 - Help File Relative Path Remote Command Execution source: https://www.securityfocus.com/bid/38661/info Microsoft Windows is prone to a remote command-execution vulnerability because it opens help files from unsafe locations. An attacker could exploit this issue by entici...

Namoroka 3.6 Alpha 1 Remote Memory Corrupt (Local Crash Exploit)

Exploit for unknown platform in category dos / poc ================================================================ Namoroka 3.6 Alpha 1 Remote Memory Corrupt Local Crash Exploit ================================================================ function DoS var buffer = '\x41'; for i...

Ipswitch IMail Server - IMAP4 Server (IMail 11.01) Password Decryptor

No description provided by source. !/usr/bin/python Ipswitch IMail Server - IMAP4 Server IMail 11.01 Password Decryptor Tested on: Windows XP SP3 Windows version does not matter Description: So I reverse engineered the IMail password decryption function in IMailsec.dll, located at 0x00563130. In...

Flare 0.6 - Local Heap Overflow Denial of Service

Flare 0.6 - Local Heap Overflow Denial of Service Exploit Title: Flare Site: xraysecurity.blogspot.com ---- Coming soon! Registers: EAX 003E0000 ECX 003E1088 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..." EDX 41414141 EBX 00004141 ESP 0022FB0C EBP 0022FBDC ESI 003E1080 EDI 41414141 EIP...

Apple iTunes .pls文件解析缓冲区溢出漏洞

BUGTRAQ ID: 36478 CVECAN ID: CVE-2009-2817 iTunes是用于Mac和PC的一款免费应用程序，可播放音乐和视频内容，以及将内容同步到iPod和Apple TV。 用户受骗使用iTunes加载了畸形的.pls播放列表文件就可以触发缓冲区溢出，导致执行任意代码。 Apple iTunes 9.0.1 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.apple.com Exploit Title: iTunes .pls file handling buffer overfl...

J. River Media Jukebox 12 MP3 File Handling Remote Heap Overflow PoC

Summary Media Jukebox 12 is a media player application for playing various media files on a Windows machine. Description Media Jukebox 12 suffers from a heap overflow vulnerability when processing .mp3 files and its metadata ID3 tags. When a malicious .mp3 file is played the application pops out ...

Internet Explorer winhlp32.exe 'MsgBox()'远程代码执行漏洞

BUGTRAQ ID: 38463 CVECAN ID: CVE-2010-0483 Internet Explorer是Windows操作系统中默认捆绑的web浏览器。 用户可以使用VBScript从IE调用winhlp32.exe服务，如果向该服务传送了恶意的.HLP文件就会导致执行任意命令。 必需一些用户交互才可以触发这个漏洞，在显示MsgBox弹出框时用户需要按下F1。以下是MsgBox函数的句法： MsgBoxprompt,buttons,title,helpfile,context...