VUPlayer 2.49 - '.m3u' Universal Buffer Overflow

!/usr/bin/env python VUPlayer RESPECT! : What do we see at crash time? ; EAX 00000000 ECX 41414141 EDX 00000001 EBX 00000111 ESP 0012EEA8 ASCII "AAAAAAAAAAAAAAAAAA EBP 41414141 ESI 00000001 EDI 0012F214 ASCII "AAAAAAAAAAAAAAAAAA EIP 41414141 1010539f \x9f\x53\x10\x10 jmp esp in BASSWMA.dll...

VUPlayer 2.49 Buffer Overflow

!/usr/bin/env python VUPlayer RESPECT! : What do we see at crash time? ; EAX 00000000 ECX 41414141 EDX 00000001 EBX 00000111 ESP 0012EEA8 ASCII "AAAAAAAAAAAAAAAAAA EBP 41414141 ESI 00000001 EDI 0012F214 ASCII "AAAAAAAAAAAAAAAAAA EIP 41414141 1010539f \x9f\x53\x10\x10 jmp esp in BASSWMA.dll...

Playlistmaker 1.51 (.m3u File) Local Buffer Overflow Exploit (SEH)

No description provided by source. Playlistmaker version 1.51 Tested on Windows XP SP2 English Exploit originally discovered by ThE g0bL!N/exploited by germayax I could not get germayax's exploit to work with XP3. The only useable p/p/r I could find was in oledlg.dll which seems to be compiled wi...

Playlistmaker 1.51 (.m3u File) Local Buffer Overflow Exploit (SEH)

Exploit for unknown platform in category local exploits ================================================================== Playlistmaker 1.51 .m3u File Local Buffer Overflow Exploit SEH ================================================================== Playlistmaker version 1.51 Tested on Windows...

Playlistmaker 1.51 - '.m3u' Local Buffer Overflow (SEH)

Playlistmaker version 1.51 Tested on Windows XP SP2 English Exploit originally discovered by ThE g0bL!N/exploited by germayax I could not get germayax's exploit to work with XP3. The only useable p/p/r I could find was in oledlg.dll which seems to be compiled with SafeSEH on in XP SP3. However,...

Playlistmaker 1.51 Buffer Overflow

Playlistmaker version 1.51 Tested on Windows XP SP2 English Exploit originally discovered by ThE g0bL!N/exploited by germayax I could not get germayax's exploit to work with XP3. The only useable p/p/r I could find was in oledlg.dll which seems to be compiled with SafeSEH on in XP SP3. However,...

Playlistmaker 1.51 - .m3u Local Buffer Overflow (SEH)

Playlistmaker 1.51 - .m3u Local Buffer Overflow SEH Playlistmaker version 1.51 Tested on Windows XP SP2 English Exploit originally discovered by ThE g0bL!N/exploited by germayax I could not get germayax's exploit to work with XP3. The only useable p/p/r I could find was in oledlg.dll which seems ...

FTPShell Client 4.1 RC2 Stack Overflow

/ FTPShell Client, Name Session Stack Overflow Exploit Tested on Version 4.1 RC2 on Windows XP SP3 Vulnerable program download page : http://www.ftpshell.com/downloadclient.htm Coded by zec Feel yourself freely to get into touch : [email protected] / package ftpbof; import java.io.DataOutputStream;...

VLC Media Player URI Buffer Overflow

!/usr/bin/env python VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow PoC Found By: DrIDE Tested: Windows XP SP2 , XP SP3 and Windows 7 RC1 Thanks: Pankaj Kohli for finding this in 0.8.6f Original: http://www.milw0rm.com/exploits/9303 Crash Breakdown of vlc v1.0.1 on XP...

FTPShell Client 4.1 RC2 Name Session Stack Overflow Exploit

No description provided by source. / FTPShell Client, Name Session Stack Overflow Exploit Tested on Version 4.1 RC2 on Windows XP SP3 Vulnerable program download page : http://www.ftpshell.com/downloadclient.htm Coded by zec Feel yourself freely to get into touch : [email protected] / package ftpbo...

Microsoft Office Web Components OWC.Spreadsheet.9 HTMLURL property overflow

Added: 08/14/2009 CVE: CVE-2009-1534 BID: 35992 OSVDB: 56916 Background Microsoft Office Web Components OWC are a group of OLE classes implemented as ActiveX controls. Problem A buffer overflow vulnerability in the OWC.Spreadsheet.9 ActiveX control allows command execution when a user loads a web...

Microsoft Office Web Components OWC.Spreadsheet.9 HTMLURL property overflow

Added: 08/14/2009 CVE: CVE-2009-1534 BID: 35992 OSVDB: 56916 Background Microsoft Office Web Components OWC are a group of OLE classes implemented as ActiveX controls. Problem A buffer overflow vulnerability in the OWC.Spreadsheet.9 ActiveX control allows command execution when a user loads a web...

FTPShell Client 4.1 RC2 Name Session Stack Overflow Exploit

Exploit for unknown platform in category local exploits =========================================================== FTPShell Client 4.1 RC2 Name Session Stack Overflow Exploit =========================================================== / FTPShell Client, Name Session Stack Overflow Exploit Tested...

VideoLAN VLC Media Player 1.0.01.0.1 - smb: URI Handling Buffer Overflow (PoC)

VideoLAN VLC Media Player 1.0.01.0.1 - smb: URI Handling Buffer Overflow PoC !/usr/bin/env python VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow PoC Found By: DrIDE Tested: Windows XP SP2 , XP SP3 and Windows 7 RC1 Thanks: Pankaj Kohli for finding this in 0.8.6f Original:...

VideoLAN VLC Media Player 1.0.0/1.0.1 - 'smb://' URI Handling Buffer Overflow (PoC)

!/usr/bin/env python VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow PoC Found By: DrIDE Tested: Windows XP SP2 , XP SP3 and Windows 7 RC1 Thanks: Pankaj Kohli for finding this in 0.8.6f Original: http://www.milw0rm.com/exploits/9303 Crash Breakdown of vlc v1.0.1 on XP...

FTPShell Client 4.1 RC2 - Name Session Stack Overflow

FTPShell Client 4.1 RC2 - Name Session Stack Overflow / FTPShell Client, Name Session Stack Overflow Exploit Tested on Version 4.1 RC2 on Windows XP SP3 Vulnerable program download page : http://www.ftpshell.com/downloadclient.htm Coded by zec Feel yourself freely to get into touch :...

FTPShell Client 4.1 RC2 - Name Session Stack Overflow

/ FTPShell Client, Name Session Stack Overflow Exploit Tested on Version 4.1 RC2 on Windows XP SP3 Vulnerable program download page : http://www.ftpshell.com/downloadclient.htm Coded by zec Feel yourself freely to get into touch : [email protected] / package ftpbof; import java.io.DataOutputStream;...

Heap overflow

Heap-based buffer overflow in the Microsoft Terminal Services Client ActiveX control running RDP 6.1 on Windows XP SP2, Vista SP1 or SP2, or Server 2008 Gold or SP2; or 5.2 or 6.1 on Windows XP SP3; allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods, a...

Double free

Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted RPC message to a Windows XP SP2 or SP3 or Server 2003 SP2 system, or cause a denial of service via a crafted RPC message to a Vista Gold, SP1, or SP2 or...

Integer overflow

Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute arbitrary code on a Windows 2000 SP4 system via a crafted AVI file, or cause a denial of service on a Windows XP SP2 or SP3, Server 2003 SP2, Vista Gold, SP1, ...