599 matches found
看我手动解密wdLinux所有PHP文件
简要描述： wdLinux的PHP文件,加密超级简单,大家快来挖洞呀 wdcpv2.5.tar.gz里面的PHP已经全部解密 详细说明： 偶然看到wdLinux这套系统, 发现使用PHP插件进行加密的, 觉得很好玩就尝试解密. 漏洞证明： 算法超级简单, 有一个写死的key, 10位. 加密的时候首先用zlib压缩, 然后按照一定算法逐个和这个key做xor运算. 最后补一个文件头作为识别码. 已经成功全盘解密, 贴个文件: 最后贴下perl代码吧: sub wddecode my @data = unpack 'C', substr readfile $0, 9; my @key =...
Linux/x86 - Reverse TCP (127.1.1.1:1337/TCP) Shell Shellcode (74 bytes)
Linux/x86 - Reverse TCP 127.1.1.1:1337/TCP Shell Shellcode 74 bytes. Shellcode exploit for Linuxx86 platform / Title: Shell Reverse TCP Shellcode - 74 bytes Platform: Linux/x86 Date: 2014-07-25 Author: Julien Ahrens @MrTuxracer Website: http://www.rcesecurity.com Disassembly of section .text:...
ARM Polymorphic execve("/bin/sh", ["/bin/sh"], NULL) Shellcode Generator
No description provided by source. / Title: Generator polymorphic shellcode on ARM architecture Date: 2010-07-07 Tested on: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Database of shellcodes http://www.shell-storm.org/shellcode/...
Linux/ARM - Polymorphic execve("/bin/sh", ["/bin/sh"], NULL); - XOR 88 encoded - 78 bytes
No description provided by source. / Title: Linux/ARM - Polymorphic execve/bin/sh, /bin/sh, NULL; - XOR 88 encoded - 78 bytes Date: 2010-06-28 Tested on: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Database of shellcodes...
linux/x86 if(read(fd,buf,512)<=2) _exit(1) else buf(); 29 bytes
No description provided by source. / h3ll-core.c by Charles Stevenson [email protected] I made this as a chunk you can paste in to make modular remote exploits. I use it as a first stage payload when I desire to follow up with a real large payload of goodness. This actually is a bit larger than...
MIPS Linux XOR Shellcode Encoder (60 Bytes)
No description provided by source. include fcntl.h include stdio.h include unistd.h include sys/types.h include sys/stat.h include stdlib.h include string.h define DEBUG 0 / entropy at phiral.net mips linux shellcode xor encoder \xAB\xCD is overwritten with jmp back offset \x00\x00 is overwritten...
linux/x86 execve("/bin/sh", ["/bin/sh", NULL]) 25 bytes
No description provided by source. / Linux/x86 execve/bin/sh, /bin/sh, NULL - 25 bytes - [email protected] / char shellcode = \x31\xc0 // xor %eax, %eax \x50 // push %eax \x68\x2f\x2f\x73\x68 // push $0x68732f2f \x68\x2f\x62\x69\x6e // push $0x6e69622f \x89\xe3 // mov %esp, %ebx \x50 // push %eax...
125 bind port to 6778 XOR encoded polymorphic linux shellcode .
No description provided by source. / Title : bind port to 6678 XOR encoded polymorphic linux shellcode . Name : 125 bind port to 6678 XOR encoded polymorphic linux shellcode . Date : Tue Jul 6 01:52:33 WIT 2010 Author : gunslinger yudha.gunslingeratgmail.com Web : http://devilzc0de.org blog :...
62 bytes setreuid(0,0) execve("/bin/sh",NULL,NULL) XOR Encoded Linux Shellcode
No description provided by source. / Author : gunslinger yudha.gunslingeratgmail.com Web : http://devilzc0de.org blog : http://gunslingerc0de.wordpress.com tested on : linux debian special thanks to : r0073r inj3ct0r.com, d3hydr8 darkc0de.com, ty miller projectshellcode.com, jonathan...
Linux/SuperH - sh4 - setuid(0) ; execve("/bin/sh", NULL, NULL) - 27 bytes
No description provided by source. / Linux/SuperH - sh4 - setuid0 ; execve/bin/sh, NULL, NULL - 27 bytes Tested on debian-sh4 2.6.32-5-sh7751r by Jonathan Salwan - twitter: @jonathansalwan 400054: 17 e3 mov 23,r3 400056: 4a 24 xor r4,r4 400058: 0b c3 trapa 11 40005a: 3a 23 xor r3,r3 40005c: 0b e3...
Sami FTP Server 2.0.1 - Remote Buffer Overflow Exploit (cpp)
No description provided by source. // Two includes. include fstream.h include winsock2.h // Project - Settings - Link Object/Library modules 'Ws232.lib' pragma commentlib, ws232 char MyShellCode = // XOR by \x99\x99\x99\x99. \xD9\xEE\xD9\x74\x24\xF4\x5B\x31\xC9\xB1\x59\x81\x73\x17\x99\x99...
Windows Gather Skype Saved Password Hash Extraction
This module finds saved login credentials for the Windows Skype client. The hash is in MD5 format that uses the username, a static string "\nskyper\n" and the password. The resulting MD5 is stored in the Config.xml file for the user after being XOR'd against a key generated by applying 2 SHA1...
CodeIgniter <= 2.1.4 Session Decoding Vulnerability
Class Weak encryption Remote Yes Published 6th June 2014 Credit Robin Bailey of Dionach [email protected] Vulnerable CodeIgniter = 2.1.4 Session cookies created by the CodeIgniter PHP framework contain a number of variables in a serialized PHP array. To prevent users from tampering with this cook...
Agent.btz Malware May Have Served as Starting Point for Red October, Turla
Researchers looking into the recently uncovered Turla, or Snake, cyber espionage campaign have discovered some similarities connecting it to older pieces of malware such as Agent.btz, the worm that several years ago infected U.S. military networks and eventually caused the Department of Defense t...
[CVE-2013-5112] Evernote Android Insecure Storage of PIN data / Bypass of PIN protection
Evernote Android Insecure Storage of PIN data / Bypass of PIN protection Product: Evernote Android Project Homepage: evernote.com Internal Advisory ID: c22-2013-03 / c22-2013-04 Vulnerable Versions: Android version 5.5.0 and prior Tested Version: Android 5.x Android 4.2/4.3 Vendor Notification: A...
OSX Gather Autologin Password as Root
This module will steal the plaintext password of any user on the machine with autologin enabled. Root access is required. When a user has autologin enabled System Preferences - Accounts, OSX stores their password with an XOR encoding in /private/etc/kcpassword. This module requires Metasploit:...
IE Zero Day Watering Hole Attack Injects Malware into Memory
Microsoft may be promising a relatively light Patch Tuesday release tomorrow, but that doesn’t mean its researchers and developers won’t have their hands full. Not only is Microsoft busy on a patch for the TIFF zero day vulnerability reported two weeks ago, but now another previously unreported...
Byte XORi Encoder
Mips Web server exploit friendly xor encoder. This encoder has been found useful on situations where '&' 0x26 is a badchar. Since 0x26 is the xor's opcode on MIPS architectures, this one is based on the xori instruction. This module requires Metasploit: https://metasploit.com/download Current...
Byte XORi Encoder
Mips Web server exploit friendly xor encoder. This encoder has been found useful on situations where '&' 0x26 is a badchar. Since 0x26 is the xor's opcode on MIPS architectures, this one is based on the xori instruction. This module requires Metasploit: https://metasploit.com/download Current...
ARRIS DG860A - NVRAM Backup Password Disclosure
ARRIS DG860A - NVRAM Backup Password Disclosure ! /usr/bin/env ruby ARRIS DG860A NVRAM Backup 'Compressor/Decompressor', it really does xor? Gleaned from scmix executable in firmware dump. Backup file is world readable without authentication and contains password information in plain text...