bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2022-11-10

Browse source 
2776 changes to exploits/shellcodes/ghdb
This commit is contained in:
Offensive Security 2022-11-10 16:39:50 +00:00
parent fba9658f51
commit d63de06c7a
2774 changed files with 3267 additions and 3998 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
exploits/aix/local/45938.pl
View file

@ -138,5 +138,4 @@ print "[-] Cleaning up /etc/passwd and removing /tmp/wow.ksh \n";
$result = `su wow "-c cp /tmp/passwd.backup /etc/passwd && echo 'wow::0:0::/:/usr/bin/ksh' >> /etc/passwd" && rm /tmp/wow.ksh`;
print "[-] Done \n";
print "[+] 'su wow' for root shell \n";
print "[+] 'su wow' for root shell \n";

2
exploits/android/dos/38555.txt
View file

@ -35,4 +35,4 @@ In this code snippet, the data.buf_out.num_planes value is attacker-controlled "
Proof-of-concept code to trigger this issue (from a privileged shell) is attached (m2m1shot_compat.c).
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38555.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38555.zip

2
exploits/android/dos/38557.txt
View file

@ -56,4 +56,4 @@ One ioctl should have valid data, the other should fail
At this point ctx->mm will now have invalid or free data (free if the forked process dies). Proof-of-concept code to trigger this condition is attached (fimg2d-lock.c)
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38557.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38557.zip

2
exploits/android/dos/38610.txt
View file

@ -26,4 +26,4 @@ I/DEBUG ( 2958): #03 pc 000000000042ec00 /system/priv-app/SecGallery2015/
To reproduce, download the file and open it in Gallery
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38610.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38610.zip

2
exploits/android/dos/38611.txt
View file

@ -31,4 +31,4 @@ To reproduce, download the attached file and wait, or trigger media scanning by
adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38611.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38611.zip

2
exploits/android/dos/38612.txt
View file

@ -37,4 +37,4 @@ To reproduce, download the image file and wait, or trigger media scanning by cal
adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38612.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38612.zip

2
exploits/android/dos/38613.txt
View file

@ -28,4 +28,4 @@ To reproduce, download the file and open it in Gallery.
This issue was tested on a SM-G925V device running build number LRX22G.G925VVRU1AOE2.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38613.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38613.zip

2
exploits/android/dos/38614.txt
View file

@ -55,4 +55,4 @@ adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/she
This issue was tested on a SM-G925V device running build number LRX22G.G925VVRU1AOE2.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38614.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38614.zip

2
exploits/android/dos/39424.txt
View file

@ -37,4 +37,4 @@ adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/she
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39424.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39424.zip

2
exploits/android/dos/39425.txt
View file

@ -29,4 +29,4 @@ adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/she
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39425.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39425.zip

2
exploits/android/dos/39629.txt
View file

@ -159,4 +159,4 @@ prNdisReq->ndisOidContent is in a static allocation of size 0x1000, and prIwReqD
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39629.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39629.zip

2
exploits/android/dos/39651.txt
View file

@ -55,4 +55,4 @@ Reported to Android here: https://code.google.com/p/android/issues/detail?id=185
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39651.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39651.zip

2
exploits/android/dos/39685.txt
View file

@ -42,4 +42,4 @@ Where XXXXXX should be uninitialized memory from the heap.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39685.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39685.zip

2
exploits/android/dos/39686.txt
View file

@ -86,4 +86,4 @@ I’ve provided a PoC which exploits the issue in ICrypto::decrypt. I will just
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39686.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39686.zip

2
exploits/android/dos/39921.txt
View file

@ -92,4 +92,4 @@ cpsr 0x80070030 -2147024848
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39921.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39921.zip

2
exploits/android/dos/40381.txt
View file

@ -140,4 +140,4 @@ If there is e.g. some system_app that performs permissions checks (which use the
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40381.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40381.zip

2
exploits/android/dos/40449.txt
View file

@ -36,4 +36,4 @@ Its logcat output looks like this:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40449.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40449.zip

2
exploits/android/dos/40515.txt
View file

@ -142,4 +142,4 @@ a uint32_t is smaller than a binder_uintptr_t.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40515.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40515.zip

2
exploits/android/dos/40876.txt
View file

@ -165,4 +165,4 @@ Fixed in the November security bulletin at https://source.android.com/security/b
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40876.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40876.zip

2
exploits/android/dos/40945.txt
View file

@ -135,4 +135,4 @@ Fixed in https://source.android.com/security/bulletin/2016-12-01.html
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40945.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40945.zip

2
exploits/android/dos/40993.txt
View file

@ -58,4 +58,4 @@ According to the default SELinux rules as present on the SM-G935F (version XXS1A
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40993.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40993.zip

2
exploits/android/dos/41161.txt
View file

@ -67,4 +67,4 @@ The sysfs entries mentioned above are world-readable and have an SELinux context
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41161.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41161.zip

2
exploits/android/dos/41211.txt
View file

@ -30,4 +30,4 @@ This PoC uses the CFP_ROPP_* commands to modify a kernel address in the kernel V
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41211.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41211.zip

2
exploits/android/dos/41212.txt
View file

@ -38,4 +38,4 @@ This PoC disables the M bit in SCTLR_EL1.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41212.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41212.zip

2
exploits/android/dos/41218.txt
View file

@ -44,4 +44,4 @@ This PoC s2-remaps RKP's physical address range and reads from it in EL1.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41218.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41218.zip

2
exploits/android/dos/41232.txt
View file

@ -64,4 +64,4 @@ This PoC modifies an instruction within RKP's address space by repeatedly callin
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41232.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41232.zip

2
exploits/android/dos/41351.txt
View file

@ -63,4 +63,4 @@ backtrace:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41351.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41351.zip

2
exploits/android/dos/41352.txt
View file

@ -47,4 +47,4 @@ u:r:lghashstorageserver:s0
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41352.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41352.zip

2
exploits/android/dos/41353.txt
View file

@ -92,4 +92,4 @@ disable selinux enforcement.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41353.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41353.zip

2
exploits/android/dos/41354.txt
View file

@ -80,4 +80,4 @@ Here is a sample crash from a successful execution of the PoC:
Proofs of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41354.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41354.zip

2
exploits/android/dos/41355.txt
View file

@ -97,4 +97,4 @@ Here is a sample crash from a successful execution of the PoC:
Proofs of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41355.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41355.zip

2
exploits/android/dos/41981.txt
View file

@ -79,4 +79,4 @@ backtrace:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41981.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41981.zip

2
exploits/android/dos/41982.txt
View file

@ -53,4 +53,4 @@ backtrace:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41982.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41982.zip

2
exploits/android/dos/41983.txt
View file

@ -130,4 +130,4 @@ backtrace:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41983.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41983.zip

2
exploits/android/dos/42169.txt
View file

@ -61,4 +61,4 @@ backtrace:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42169.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42169.zip

2
exploits/android/dos/42170.txt
View file

@ -77,4 +77,4 @@ backtrace:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42170.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42170.zip

2
exploits/android/dos/42171.txt
View file

@ -41,4 +41,4 @@ backtrace:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42171.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42171.zip

2
exploits/android/dos/42285.txt
View file

@ -23,4 +23,4 @@ backtrace:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42285.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42285.zip

2
exploits/android/dos/43464.txt
View file

@ -83,4 +83,4 @@ The issue can also be exploited from the "isolated_app" SELinux context (and per
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/43464.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43464.zip

2
exploits/android/dos/43513.txt
View file

@ -92,4 +92,4 @@ These commands are all similarly racy (due to the getpidcon(...) usage), but are
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/43513.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43513.zip

2
exploits/android/dos/43996.txt
View file

@ -60,4 +60,4 @@ After applying the patch, the attached PoC should be built as part of the Androi
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/43996.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43996.zip

2
exploits/android/dos/44268.txt
View file

@ -1,3 +1,3 @@
This Exploit allows arbitrary memory writes and reads. Running the specified payload within this package will write to the device's main CPU kernel, causing it to crash. More information about its origins here: http://boosterok.com/blog/broadpwn2/
Download: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/44268.zip
Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44268.zip

2
exploits/android/dos/44724.txt
View file

@ -26,4 +26,4 @@ This was tested on Samsung build number NRD90M.G93FXXU1DQJ8, which is the most r
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/44724.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44724.zip

2
exploits/android/dos/45558.txt
View file

@ -200,4 +200,4 @@ To reproduce that, follow these steps:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45558.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45558.zip

2
exploits/android/dos/45579.txt
View file

@ -48,4 +48,4 @@ Logs from the crashes on Android and iPhone are attached. Note that I modified t
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45579.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45579.zip

2
exploits/android/dos/46356.txt
View file

@ -267,4 +267,4 @@ the upstream kernel, too.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46356.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46356.zip

2
exploits/android/dos/46357.txt
View file

@ -223,4 +223,4 @@ The dmesg splat should look like this:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46357.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46357.zip

2
exploits/android/dos/46503.txt
View file

@ -161,4 +161,4 @@ You should see something like this in dmesg (if you have
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46503.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46503.zip

2
exploits/android/dos/46504.txt
View file

@ -222,4 +222,4 @@ set VM_IO, it is possible to use madvise(..., MADV_DOFORK) to clear that flag:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46504.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46504.zip

2
exploits/android/dos/46853.txt
View file

@ -52,4 +52,4 @@ WeChat will crash now if a message that contains the overwritten emoji file
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46853.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46853.zip

2
exploits/android/dos/46941.txt
View file

@ -292,4 +292,4 @@ The KASAN report points to instruction 267c in the following assembly:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46941.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46941.zip

2
exploits/android/dos/47119.txt
View file

@ -76,4 +76,4 @@ Hvec-"fright" is possible. You can own the mobile by viewing a video with payloa
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47119.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47119.zip

2
exploits/android/dos/47920.txt
View file

@ -21,4 +21,4 @@ A crash log is attached.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47920.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47920.zip

2
exploits/android/local/39757.txt
View file

@ -6,4 +6,4 @@ Qualcomm's Secure Execution Environment (QSEE) Privilege Escalation Exploit usi
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39757.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39757.zip

2
exploits/android/local/40066.txt
View file

@ -227,4 +227,4 @@ the JACK server process.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40066.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40066.zip

2
exploits/android/local/41130.txt
View file

@ -70,4 +70,4 @@ The high-level flow for executing a function in the kernel is the following:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41130.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41130.zip

2
exploits/android/local/41217.txt
View file

@ -92,4 +92,4 @@ This issue can be reproduced by simply writing code to any of these memory regio
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41217.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41217.zip

2
exploits/android/local/42601.txt
View file

@ -28,4 +28,4 @@ cedric:/ #
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42601.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42601.zip

2
exploits/android/local/45192.txt
View file

@ -344,4 +344,4 @@ and then interpreted, allowing the attacker to steal photos from the device
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45192.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45192.zip

2
exploits/android/local/45379.txt
View file

@ -95,4 +95,4 @@ I have attached an exploit for the full chain, with usage instructions in USAGE.
WARNING: As always, this exploit is intended to be used only on research devices that don't store user data. This specific exploit is known to sometimes cause data corruption.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45379.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45379.zip

2
exploits/android/local/47463.txt
View file

@ -77,4 +77,4 @@ Vendor statement from Android:
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47463.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47463.zip

2
exploits/android/local/9477.txt
View file

@ -1,6 +1,6 @@
Source for exploiting CVE-2009-2692 on Android; Hole is closed in Android kernels released August 2009 or later.
http://zenthought.org/content/file/android-root-2009-08-16-source
Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/9477.tar.gz (android-root-20090816.tar.gz)
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9477.tar.gz (android-root-20090816.tar.gz)
# milw0rm.com [2009-08-18]

2
exploits/android/remote/39640.txt
View file

@ -24,4 +24,4 @@ Credits: To the NorthBit team E.P. - My shining paladin, for assisting in boosti
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39640.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39640.zip

2
exploits/android/remote/40354.txt
View file

@ -156,4 +156,4 @@ bool Parcel::enforceInterface(const String16& interface,
Proofs of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40354.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40354.zip

2
exploits/android/remote/40874.txt
View file

@ -88,4 +88,4 @@ This notification will be of size THREAD_SIZE*2, and will therefore fill up the
Proofs of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40874.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40874.zip

2
exploits/arm/dos/40182.txt
View file

@ -78,4 +78,4 @@ I have attached a completely untested patch that should fix the x86, arm and arm
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40182.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40182.zip

2
exploits/asp/remote/15213.pl
View file

@ -10,7 +10,7 @@
# Note from Exploit-db: This very first exploit was meant to work with Padbusterdornet or Padbuster v0.2.
# A similar exploitation vector was also added lately in Padbuster v0.3:
# http://www.gdssecurity.com/l/b/2010/10/04/padbuster-v0-3-and-the-net-padding-oracle-attack/
# https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/15213.pl (padBuster.pl)
# https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15213.pl (padBuster.pl)
#
#
# Giorgio Fedon - (giorgio.fedon@mindedsecurity.com)

2
exploits/asp/webapps/14192.txt
View file

@ -17,4 +17,4 @@ Thank You For Your Perfect Web Site.
http://server/main.asp?id=5945&grp=[SQL Injection]
[~]######################################### FinisH :D #############################################[~]
[~]######################################### FinisH :D #############################################[~]

2
exploits/asp/webapps/14821.txt
View file

@ -16,4 +16,4 @@ admin page : http://site.com/[path]/admin.asp
Victem :
http://www.etoshop.com/demo/pcstore
---------------------------------------------------------
#########################################################
#########################################################

2
exploits/asp/webapps/14898.txt
View file

@ -122,4 +122,4 @@ Persistent XSS Vulnerabilities:
entity.Title = txtTitle_E.Text.Trim();
===========================================================================================
===========================================================================================

2
exploits/asp/webapps/14954.txt
View file

@ -64,4 +64,4 @@ PoC:
shell.aspx ---> http://Example.com/downloads/uploads/2010_7_25_shell.aspx
Note that : the value 2010_7_25 is the exact date of server.
===========================================================================================
===========================================================================================

2
exploits/asp/webapps/14969.txt
View file

@ -65,4 +65,4 @@ Description :
Which the Password was encrypted by SHA algorithm using .../lib/sha256.asp file.
===========================================================================================
===========================================================================================

2
exploits/asp/webapps/14991.txt
View file

@ -35,4 +35,4 @@ Description :
http://Example.com/Images/
===========================================================================================
===========================================================================================

2
exploits/asp/webapps/14999.txt
View file

@ -73,4 +73,4 @@ Persistent XSS:
}
===========================================================================================
===========================================================================================

2
exploits/asp/webapps/15058.html
View file

@ -82,4 +82,4 @@ This page remove Admins Role in VWD-CMS.
===========================================================================================
===========================================================================================

2
exploits/asp/webapps/15067.txt
View file

@ -178,4 +178,4 @@ Persistent XSS and XSRF:
---------------------------------------------------------------------------------------
===========================================================================================
===========================================================================================

2
exploits/asp/webapps/15078.txt
View file

@ -182,4 +182,4 @@ This page uploads a file
</html>
===========================================================================================
===========================================================================================

2
exploits/asp/webapps/15106.txt
View file

@ -60,4 +60,4 @@ Persistent XSS in admin section:
http://Example.com/SearchResults.aspx?q={}
===========================================================================================
===========================================================================================

2
exploits/asp/webapps/15124.txt
View file

@ -41,4 +41,4 @@ Description :
and so on.
===========================================================================================
===========================================================================================

2
exploits/asp/webapps/15160.txt
View file

@ -159,4 +159,4 @@ This page uploads a file with "xml" extension
</body>
</html>
===========================================================================================
===========================================================================================

4
exploits/asp/webapps/15703.txt
View file

@ -33,6 +33,4 @@ Personal
# KinG,Bl4ckl0rd,Turk_server
# Special Thanks : Farzad_Ho,R3dMind,rAbiN_hoOd,Falcon
# Special Thanks : Farzad_Ho,R3dMind,rAbiN_hoOd,Falcon

3
exploits/asp/webapps/16241.txt
View file

@ -23,5 +23,4 @@ http://www.site.com/news/news.asp?intSeq=69' and '0'='1 FALSE
POC
---
http://www.site.com/news/news.asp?id=256 and 1=1 TRUE
http://www.site.com/news/news.asp?id=256 and 1=0 FALSE
http://www.site.com/news/news.asp?id=256 and 1=0 FALSE

5
exploits/asp/webapps/32660.txt
View file

@ -7,7 +7,4 @@
[+] Tested on: Windows 7 and Linux
[+] Vulnerable File: default.asp
[+} Dork : intext:"Powered by CIS Manager"
[+] Exploit : http://host/site/default.asp?TroncoID=[SQL Injection]
[+] Exploit : http://host/site/default.asp?TroncoID=[SQL Injection]

2
exploits/asp/webapps/42776.txt
View file

@ -10,4 +10,4 @@
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42776.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42776.zip

2
exploits/asp/webapps/42792.txt
View file

@ -73,4 +73,4 @@ Help AG Middle East
References
----------
[1] Help AG Middle East http://www.helpag.com/
[2] Sitefinity CMS Version Notes http://www.sitefinity.com/product/version-notes
[2] Sitefinity CMS Version Notes http://www.sitefinity.com/product/version-notes

2
exploits/asp/webapps/8719.py
View file

@ -15,7 +15,7 @@
# for working with this exploit you need two asp file for updating hash you can download both from :
# www.abysssec.com/files/dana.zip
# https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/8719.zip (2009-dana.zip)
# https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8719.zip (2009-dana.zip)
# then need to upload asp files and change this "http://wwww.yourasphost.com/salt.asp?salt=" in exploit code

2
exploits/aspx/webapps/47793.txt
View file

@ -47,4 +47,4 @@ Thanks
@mwulftange initially discovered this vulnerability. @bao7uo wrote all of the logic for breaking RadAsyncUpload encryption, which enabled manipulating the file upload configuration object in rauPostData and subsequently exploiting insecure deserialization of that object.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47793.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47793.zip

2
exploits/beos/local/19840.txt
View file

@ -2,4 +2,4 @@ source: https://www.securityfocus.com/bid/1098/info
A direct system call containing invalid parameters through int 0x25 will cause the BeOS to crash. Reboot of the machine is required in order to regain normal functionality.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/19840.tgz
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19840.tgz

5
exploits/bsd/dos/19488.c
View file

@ -31,7 +31,4 @@ write(p[0], crap, BUFFERSIZE);
write(p[1], crap, BUFFERSIZE);
}
exit(0);
}
}

2
exploits/bsd/local/19411.txt
View file

@ -10,4 +10,4 @@ Hacker writes directly to device previously mounted as /usr, clearing file flags
Hacker mounts modified device as /usr.
Hacker installs backdoored /usr/bin/login.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/19411.tgz
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19411.tgz

2
exploits/bsd/local/23655.txt
View file

@ -2,4 +2,4 @@ source: https://www.securityfocus.com/bid/9586/info
A vulnerability has been reported to reside in the 'shmat()' system call used in the BSD kernel. Exploiting this issue may allow a local attacker to inject instructions into the memory of a privileged process.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/23655.tar.gz
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23655.tar.gz

2
exploits/bsd/remote/19520.txt
View file

@ -3,7 +3,7 @@ This exploit was leaked on the Full Disclosure mailing list:
http://seclists.org/fulldisclosure/2012/Jun/404
Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/19520.zip
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19520.zip
BSD telnetd Remote Root Exploit *ZERODAY*

3
exploits/cfm/webapps/15120.txt
View file

@ -105,5 +105,4 @@ References
* Vendor advisory: http://www.getmura.com/index.cfm/blog/critical-security-patch/
* CVE item: CVE-2010-3468
* CVE item: CVE-2010-3468

4
exploits/cfm/webapps/16225.txt
View file

@ -6,6 +6,4 @@ Dork : intext:"Powered by Alcassoft SOPHIA"
SQL
---
http://site.com/path/dsp_page.cfm?pageid=[SQL]
http://site.com/path/dsp_page.cfm?pageid=[SQL]

2
exploits/cgi/webapps/22169.pl
View file

@ -129,4 +129,4 @@ be somewhere in the html output\n";
print $recv;
print "the above is received from the server, if you have a 404 or 403, theres somethin wrong
if not, and no command output, try again..
if command ouput buggy, convert \\v to \\n with tr\n";
if command ouput buggy, convert \\v to \\n with tr\n";

2
exploits/cgi/webapps/28321.pl
View file

@ -47,4 +47,4 @@ chmod -R 777 /mail/tmp/
## Create smb backup mount point
/bin/mkdir -p /mnt/smb/
chmod 777 /mnt/smb/
chmod 777 /mnt/smb/

5
exploits/cgi/webapps/29844.txt
View file

@ -12,7 +12,4 @@ Cookie: cosign=X
Content-Type: application/x-www-form-urlencoded
Content-Length: N
required=&ref=https%3A%2F%2Fweblogin.example.com%2F&service=cosign-servicename=Y%0DLOGIN cosign=X2 1.2.3.4 username%0DREGISTER cosign=X2 1.2.3.4 cosign-servicename=Y2&login=test&password=pass&passcode=&doLogin=Log+In
required=&ref=https%3A%2F%2Fweblogin.example.com%2F&service=cosign-servicename=Y%0DLOGIN cosign=X2 1.2.3.4 username%0DREGISTER cosign=X2 1.2.3.4 cosign-servicename=Y2&login=test&password=pass&passcode=&doLogin=Log+In

3
exploits/cgi/webapps/39871.txt
View file

@ -41,5 +41,4 @@
Raw Response: MTI3LjAuMC4xCWxvY2FsaG9zdC5sb2NhbGRvbWFpbglsb2NhbGhvc3QK
Base64 Decoded: 127.0.0.1 localhost.localdomain localhost
Base64 Decoded: 127.0.0.1 localhost.localdomain localhost

2
exploits/cgi/webapps/40272.txt
View file

@ -5,4 +5,4 @@
Full Exploit:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40272.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40272.zip

2
exploits/cgi/webapps/40273.txt
View file

@ -5,4 +5,4 @@
Full Exploit:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40273.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40273.zip

Some files were not shown because too many files have changed in this diff Show more