[Full-disclosure] 0-day XP SP2 wmf exploit (some details)

There is some details for wannabees : 1. 'Bad' wmf record: 07 00 00 00 length of record in words FC 02 type CreateBrushIndirect 08 00 00 00 00 00 00 80 'packed' good old Win16 days LOGBRUSH data: 08 00 - 'packed' lpStyle may be BSDIBPATTERNPT 6 or BSDIBPATTERN8X8 8 00 00 00 00 - COLORREF any 00 8...

CVE-2006-3945

The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service crash by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption...

CVE-2006-3944

Microsoft Internet Explorer 6 on Windows XP SP2 is affected by CVE-2006-3944. The vulnerability concerns the Forms.ListBox.1 object, where the ListWidth property set to 0x7fffffff can trigger an integer overflow, and set to 0x7ffffffe can cause a null dereference, leading to a denial of service (...

CVE-2006-3915

CVE-2006-3915 affects Microsoft Internet Explorer 6 on Windows XP SP2. The vulnerability allows a remote actor to crash the browser by iterating over a native function (demonstrated with window.alert), triggering a null dereference and resulting in a denial of service. The provided sources docume...

trionPWN.pl.txt

greetz... !/usr/bin/perl p0c Tested on Windows XP SP2 with triton 1.0.4 c0rrupt -at- f34r -dot- us This exploits the sipxtapi vuln in triton which was patched.. sometime ago.. The exploit sends a specially crafted udp packet to the triton client which leads to command execution through a buffer...

CVE-2006-3910

Summary: CVE-2006-3910 affects Internet Explorer 6 on Windows XP SP2 when Outlook is installed. The issue arises from calling the NewDefaultItem function of an OVCtl (OVCtl.OVCtl.1) ActiveX object, causing a null dereference and a remote denial of service (crash). Details provided by sources: The...

CVE-2006-3898

Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service application crash by calling the Click method of the Internet.HHCtrl.1 ActiveX object before initializing the URL, which triggers a null dereference...

AIM Triton 1.0.4 (SipXtapi) Remote Buffer Overflow Exploit (PoC)

No description provided by source. !/usr/bin/perl p0c Tested on Windows XP SP2 with triton 1.0.4 c0rrupt -at- f34r -dot- us This exploits the sipxtapi vuln in triton which was patched.. sometime ago.. The exploit sends a specially crafted udp packet to the triton client which leads to command...

CVE-2006-3730

Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service crash and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory copy...

Microsoft Works - Buffer Overflows / Denial of Service (DoS)-Vulnerabilities

Microsoft Works - Buffer Overflows / Denial of Service DoS-Vulnerabilities ... discovered by Benjamin Tobias Franz Affected Vendor: Microsoft Affected Product: Microsoft Works Description: Microsoft Works Spreadsheet wksss.exe fails to handle specially crafted files. All supported file formats...

msie-heap.txt

// MoBB Demonstration function Demo var a = new ActiveXObject"Internet.HHCtrl.1"; var b = unescape"XXXX"; while b.length Clicking the button below may crash your browser!...

Microsoft Office 2000/2002 - Property Code Execution

source: https://www.securityfocus.com/bid/18911/info Microsoft Office is prone to a code-execution vulnerability. This is due to a failure to handle exceptional conditions. Successfully exploiting this issue allows attackers to corrupt process memory and to execute arbitrary code in the context o...

Microsoft Word 2000/2003 - Hlink Local Buffer Overflow

!/bin/perl Microsoft Word hlink 0-day by SYS 49152 this POC works only with: win 2ksp4 ENG + word 2000/XP all versions. win XP ENG sp1/sp2 + word XP 2002 SP3. Word 2003 is not vulnerable. bindshell on port 49152 hey kids.. I hope you know how to use winzip :- to get in contact with me...

Microsoft Internet Explorer 6 - Internet.HHCtrl Heap Overflow

Microsoft Internet Explorer 6 - Internet.HHCtrl Heap Overflow // MoBB Demonstration function Demo var a = new ActiveXObject"Internet.HHCtrl.1"; var b = unescape"XXXX"; while b.length Clicking the button below may crash your browser! milw0rm.com 2006-07-07...

Microsoft Internet Explorer 6 - Table.Frameset NULL Dereference

Microsoft Internet Explorer 6 - Table.Frameset NULL Dereference // MoBB Demonstration function Demo var a = document.createElement'table'; var b = document.createElement'frameset'; a.appendChildb; Clicking the button below may crash your browser! milw0rm.com 2006-07-07...

Microsoft Internet Explorer 6 - 'Internet.HHCtrl' Heap Overflow

// MoBB Demonstration function Demo var a = new ActiveXObject"Internet.HHCtrl.1"; var b = unescape"XXXX"; while b.length Clicking the button below may crash your browser! milw0rm.com 2006-07-07...

WinRAR 3.60 Beta 6 (French) - SFX Path Local Stack Overflow

WinRAR 3.60 Beta 6 French - SFX Path Local Stack Overflow """ WinRAR - Stack Overflows in SelF - eXtracting Archives ====================================================== Tested Versions..: WinRAR 3.60 beta 4 Original Author.............: posidron Shellcode Stuffing .........: muts XP SP2 French...

WinRAR 3.60 Beta 6 - SFX Path Local Stack Overflow

WinRAR 3.60 Beta 6 - SFX Path Local Stack Overflow """ WinRAR - Stack Overflows in SelF - eXtracting Archives ====================================================== Tested Versions..: WinRAR 3.60 beta 4 Original Author.............: posidron Shellcode Stuffing .........: muts """ import os, sys...

CesarFTP099g-py.txt

!/usr/bin/python CesarFtp 0.99g 0day Exploit Proof of Concept: execute calc.exe Tested on XP sp2 polish Bug found by h07 [email protected] Date: 10.06.2006 from socket import shellcode = execute calc.exe "\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"...

Pico Zip 4.01 (Long Filename) Buffer Overflow Exploit

Exploit for unknown platform in category local exploits ===================================================== Pico Zip 4.01 Long Filename Buffer Overflow Exploit ===================================================== !/usr/bin/perl Pico Zip v. 4.01 Long Filename Buffer Overflow Original advisory -...