bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2798 commits 1 branch 0 tags 258 MiB
Commit graph

30 commits

Author SHA1 Message Date
Exploit-DB
e07f33f24d DB: 2023-08-22 
17 changes to exploits/shellcodes/ghdb

EuroTel ETL3100 - Transmitter Authorization Bypass (IDOR)
EuroTel ETL3100 - Transmitter Default Credentials
EuroTel ETL3100 - Transmitter Unauthenticated Config/Log Download

Color Prediction Game v1.0 - SQL Injection

Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)

Dolibarr Version 17.0.1 - Stored XSS

Global - Multi School Management System Express v1.0- SQL Injection

OVOO Movie Portal CMS v3.3.3 - SQL Injection

PHPJabbers Business Directory Script v3.2 - Multiple Vulnerabilities

Taskhub CRM Tool 2.8.6 - SQL Injection

Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions
TSPlus 16.0.0.0 - Remote Work Insecure Credential storage
TSplus 16.0.0.0 - Remote Work Insecure Files and Folders
TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions

Linux/x64 - memfd_create ELF loader Shellcode (170 bytes)
 2023-08-22 00:16:22 +00:00
Exploit-DB
3de26153c8 DB: 2023-04-02 
23 changes to exploits/shellcodes/ghdb

ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS)

Hughes Satellite Router HX200 v8.3.1.14 -  Remote File Inclusion

Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated)

TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated)

GeoVision Camera GV-ADR2701 - Authentication Bypass

AD Manager Plus 7122 - Remote Code Execution (RCE)

Enlightenment v0.25.3 - Privilege escalation

Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)

Apache 2.4.x - Buffer Overflow

perfSONAR v4.4.5 - Partial Blind CSRF

SugarCRM 12.2.0 - Remote Code Execution (RCE)

XCMS v1.83 - Remote Command Execution (RCE)

Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS)

GitLab v15.3 - Remote Code Execution (RCE) (Authenticated)

AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS)

NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit

Splashtop 8.71.12001.0 - Unquoted Service Path

Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS)

FlipRotation v1.0 decoder - Shellcode (146 bytes)

Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes)

macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
 2023-04-02 00:16:21 +00:00
Offensive Security
de260aeac6 DB: 2021-10-30 
95 changes to exploits/shellcodes

Product Key Explorer 4.2.7 - 'multiple' Denial of Service (PoC)
Managed Switch Port Mapping Tool 2.85.2 - Denial of Service (PoC)
AgataSoft PingMaster Pro 2.1 - Denial of Service (PoC)
Nsauditor 3.2.2.0 - 'Event Description' Denial of Service (PoC)
WordPress Plugin WPGraphQL 1.3.5 - Denial of Service
Sandboxie 5.49.7 - Denial of Service (PoC)
WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service (PoC)
iDailyDiary 4.30 - Denial of Service (PoC)
RarmaRadio 2.72.8 - Denial of Service (PoC)
DupTerminator 1.4.5639.37199 - Denial of Service (PoC)
Color Notes 1.4 - Denial of Service (PoC)
Macaron Notes great notebook 5.5 - Denial of Service (PoC)
My Notes Safe 5.3 - Denial of Service (PoC)

n+otes 1.6.2 - Denial of Service (PoC)

Telegram Desktop 2.9.2 - Denial of Service (PoC)

Mini-XML 3.2 - Heap Overflow
Solaris 10 (Intel) - 'dtprintinfo' Local Privilege Escalation (2)
Solaris 10 (Intel) - 'dtprintinfo' Local Privilege Escalation (3)
Solaris 10 (SPARC) - 'dtprintinfo' Local Privilege Escalation (1)
Solaris 10 (SPARC) - 'dtprintinfo' Local Privilege Escalation (2)

MariaDB 10.2 - 'wsrep_provider' OS Command Execution

Microsoft Internet Explorer 11 and WPAD service 'Jscript.dll' - Use-After-Free

Visual Studio Code 1.47.1 - Denial of Service (PoC)

DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)

MySQL User-Defined (Linux) x32 / x86_64 - 'sys_exec' Local Privilege Escalation (2)

Cmder Console Emulator 1.3.18 - 'Cmder.exe' Denial of Service (PoC)

GNU Wget < 1.18 - Arbitrary File Upload (2)

WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting (XSS)

E-Learning System 1.0 - Authentication Bypass

PEEL Shopping 9.3.0 - 'Comments' Persistent Cross-Site Scripting

GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting

EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Persistent Cross-Site Scripting

Selea Targa 512 IP OCR-ANPR Camera - Stream Disclosure (Unauthenticated)

Library System 1.0 - Authentication Bypass

Web Based Quiz System 1.0 - 'name' Persistent Cross-Site Scripting

Dolibarr ERP 11.0.4 - File Upload Restrictions Bypass (Authenticated RCE)

GetSimple CMS My SMTP Contact Plugin 1.1.1 - Cross-Site Request Forgery

GravCMS 1.10.7 - Unauthenticated Arbitrary File Write (Metasploit)

Umbraco v8.14.1 - 'baseUrl' SSRF

Cacti 1.2.12 - 'filter' SQL Injection

GetSimple CMS Custom JS 0.1 - Cross-Site Request Forgery

Internship Portal Management System 1.0 - Remote Code Execution(Unauthenticated)
Markdown Explorer 0.1.1 - Persistent Cross-Site Scripting
Xmind 2020 - Persistent Cross-Site Scripting
Tagstoo 2.0.1 - Persistent Cross-Site Scripting
SnipCommand 0.1.0 - Persistent Cross-Site Scripting
Moeditor 0.2.0 - Persistent Cross-Site Scripting
Marky 0.0.1 - Persistent Cross-Site Scripting
StudyMD 0.3.2 - Persistent Cross-Site Scripting
Freeter 1.2.1 - Persistent Cross-Site Scripting
Markright 1.0 - Persistent Cross-Site Scripting
Markdownify 1.2.0 - Persistent Cross-Site Scripting
Anote 1.0 - Persistent Cross-Site Scripting
Subrion CMS 4.2.1 - Arbitrary File Upload
Printable Staff ID Card Creator System 1.0 - 'email' SQL Injection

Schlix CMS 2.2.6-6 - Arbitary File Upload (Authenticated)

Selenium 3.141.59 - Remote Code Execution (Firefox/geckodriver)

CHIYU IoT Devices - Denial of Service (DoS)

Zenario CMS 8.8.52729 - 'cID' SQL injection (Authenticated)

TextPattern CMS 4.8.7 - Remote Command Execution (Authenticated)

WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal

Atlassian Jira Server Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)

Scratch Desktop 3.17 - Remote Code Execution

Church Management System 1.0 - Arbitrary File Upload (Authenticated)

Phone Shop Sales Managements System 1.0 - Arbitrary File Upload

Zoo Management System 1.0 - 'Multiple' Persistent Cross-Site-Scripting (XSS)

WordPress Plugin Current Book 1.0.1 - 'Book Title' Persistent Cross-Site Scripting

ForgeRock Access Manager 14.6.3 - Remote Code Execution (RCE) (Unauthenticated)

KevinLAB BEMS 1.0 - Authentication Bypass

Event Registration System with QR Code 1.0 - Authentication Bypass

CloverDX 5.9.0 - Cross-Site Request Forgery (CSRF)

Panasonic Sanyo CCTV Network Camera 2.03-0x - Cross-Site Request Forgery (Change Password)

qdPM 9.2 - Password Exposure (Unauthenticated)
ApacheOfBiz 17.12.01 - Remote Command Execution (RCE)
Movable Type 7 r.5002 - XMLRPC API OS Command Injection (Metasploit)

GeoVision Geowebserver 5.3.3 - Local FIle Inclusion

Simple Phone Book 1.0 - 'Username' SQL Injection (Unauthenticated)

Umbraco CMS 8.9.1 - Directory Traversal

Traffic Offense Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)

Dolibarr ERP 14.0.1 - Privilege Escalation

Compro Technology IP Camera - 'killps.cgi' Denial of Service (DoS)

Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation

Phpwcms 1.9.30 - Arbitrary File Upload

Windows/x86 - Download File (http://10.10.10.5:8080/2NWyfQ9T.hta) Via mshta + Execute + Stager Shellcode (143 bytes)
Linux/x64 - Bind_tcp (0.0.0.0:4444) + Password (12345678) + Shell (/bin/sh) Shellcode (142 bytes)
Linux/x64 - execve _cat /etc/shadow_ Shellcode (66 bytes)
Windows/x86 - Add User Alfred to Administrators/Remote Desktop Users Group Shellcode (240 bytes)
Windows/x64 - Dynamic Null-Free WinExec PopCalc Shellcode (205 Bytes)
Windows/x64 - Dynamic NoNull Add RDP Admin (BOKU:SP3C1ALM0V3) Shellcode (387 Bytes)
Linux/x86 - setreuid(0) + execve(_/bin/sh_) Shellcode (29 bytes)
Linux/x86 - Bind (User Specified Port) Shell (/bin/sh) Shellcode (102 bytes)
Linux/x86 - Reverse (dynamic IP and port/TCP) Shell (/bin/sh) Shellcode (86 bytes)
Linux/x86 - Egghunter Reverse TCP Shell dynamic IP and port Shellcode
Windows/x86 - WinExec PopCalc PEB & Export Directory Table NullFree Dynamic Shellcode (178 bytes)
Windows/x86 - MessageBoxA PEB & Export Address Table NullFree/Dynamic Shellcode (230 bytes)
 2021-10-30 05:02:09 +00:00
Offensive Security
f33a724e0b DB: 2021-10-29 
58 changes to exploits/shellcodes

Yenkee Hornet Gaming Mouse - 'GM312Fltr.sys' Denial of Service (PoC)
Easy CD & DVD Cover Creator 4.13 - Denial of Service (PoC)
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Device Reboot (Unauthenticated)
ProFTPD 1.3.7a - Remote Denial of Service
glFTPd 2.11a - Remote Denial of Service
Hasura GraphQL 1.3.3 - Denial of Service
Sticky Notes & Color Widgets 1.4.2 - Denial of Service (PoC)
NBMonitor 1.6.8 - Denial of Service (PoC)
Nsauditor 3.2.3 - Denial of Service (PoC)
Sticky Notes Widget Version 3.0.6 - Denial of Service (PoC)
Secure Notepad Private Notes 3.0.3 - Denial of Service (PoC)
Post-it 5.0.1 - Denial of Service (PoC)
Notex the best notes 6.4 - Denial of Service (PoC)
SmartFTP Client 10.0.2909.0 - 'Multiple' Denial of Service (PoC)
Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial of Service (PoC)
GeoGebra Graphing Calculato‪r‬ 6.0.631.0 - Denial Of Service (PoC)
GeoGebra Classic 5.0.631.0-d - Denial of Service (PoC)
GeoGebra CAS Calculato‪r‬ 6.0.631.0 - Denial of Service (PoC)
Backup Key Recovery 2.2.7 - Denial of Service (PoC)
memono Notepad Version 4.2 - Denial of Service (PoC)

Disk Sorter Enterprise 13.6.12 - 'Disk Sorter Enterprise' Unquoted Service Path

Cyberfox Web Browser 52.9.1 - Denial of Service (PoC)
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Hard coded Credentials Shell Access
vsftpd 3.0.3 - Remote Denial of Service

Dlink DSL2750U - 'Reboot' Command Injection

PHPGurukul Hostel Management System 2.1 - Cross-site request forgery (CSRF) to Cross-site Scripting (XSS)

Netsia SEBA+ 0.16.1 - Add Root User (Metasploit)

Arteco Web Client DVR/NVR - 'SessionId' Brute Force

Resumes Management and Job Application Website 1.0 - Authentication Bypass
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Command Injection (Authenticated)
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Authentication Bypass
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Remote Code Execution
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Factory Reset (Unauthenticated)
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Config Download (Unauthenticated)
'customhs_js_content' - 'customhs_js_content' Cross-Site Request Forgery
Regis Inventory And Monitoring System 1.0 - 'Item List' Persistent Cross-Site Scripting

rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (1)

Mini Mouse 9.3.0 - Local File inclusion

rconfig 3.9.6 - Arbitrary File Upload

Sipwise C5 NGCP CSC - 'Multiple' Persistent Cross-Site Scripting (XSS)

Rocket.Chat 3.12.1 - NoSQL Injection (Unauthenticated)

OpenEMR 5.0.1.3 - Authentication Bypass
VMware vCenter Server 7.0 - Remote Code Execution (RCE) (Unauthenticated)
WordPress Plugin Supsystic Contact Form 1.7.18 - 'label' Stored Cross-Site Scripting (XSS)

Patient Appointment Scheduler System 1.0 - Persistent Cross-Site Scripting

Apartment Visitor Management System (AVMS) 1.0 - 'username' SQL Injection
Budget and Expense Tracker System 1.0 - Authenticated Bypass
Budget and Expense Tracker System 1.0 - Remote Code Execution (RCE) (Unauthenticated)

FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - 'Add Admin' Cross-Site Request Forgery (CSRF)

WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS)

Blood Bank System 1.0 - Authentication Bypass

Lodging Reservation Management System 1.0 - Authentication Bypass

Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read

Linux/x64 - /sbin/halt -p Shellcode (51 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (17 bytes)
Linux/x64 - execve(/bin/sh) Shellcode (21 bytes) (2)
Linux/x86 - execve /bin/sh Shellcode (fstenv eip GetPC technique) (70 bytes_ xor encoded)

Windows/x86 - Bind TCP shellcode / Dynamic PEB & EDT method null-free Shellcode (415 bytes)
 2021-10-29 05:02:12 +00:00
Offensive Security
a250e82458 DB: 2021-10-12 
176 changes to exploits/shellcodes

Yenkee Hornet Gaming Mouse - 'GM312Fltr.sys' Denial-Of-Service (PoC)

Product Key Explorer 4.2.7 - 'multiple' Denial of Service (PoC)

jQuery UI 1.12.1 - Denial of Service (DoS)
AgataSoft PingMaster Pro 2.1 - Denial of Service (PoC)
Nsauditor 3.2.2.0 - 'Event Description' Denial of Service (PoC)
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Device Reboot (Unauthenticated)
ProFTPD 1.3.7a - Remote Denial of Service
glFTPd 2.11a - Remote Denial of Service
Hasura GraphQL 1.3.3 - Denial of Service
WordPress Plugin WPGraphQL 1.3.5 - Denial of Service
Telegram Desktop 2.9.2 - Denial of Service (PoC)
SmartFTP Client 10.0.2909.0 - 'Multiple' Denial of Service
Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial-Of-Service (PoC)
GeoGebra Graphing Calculato‪r‬ 6.0.631.0 - Denial Of Service (PoC)
GeoGebra Classic 5.0.631.0-d - Denial of Service (PoC)
GeoGebra CAS Calculato‪r‬ 6.0.631.0 - Denial of Service (PoC)

Microsoft Internet Explorer 8/11 and WPAD service 'Jscript.dll' - Use-After-Free

MySQL User-Defined (Linux) x32 / x86_64 - 'sys_exec' Local Privilege Escalation (2)

Cyberfox Web Browser 52.9.1 - Denial-of-Service (PoC)

Cmder Console Emulator 1.3.18 - 'Cmder.exe' Denial-of-Service (PoC)
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Hard coded Credentials Shell Access
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm
vsftpd 3.0.3 - Remote Denial of Service

GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution (2)

PEEL Shopping 9.3.0 - 'Comments/Special Instructions' Stored Cross-Site Scripting

Arteco Web Client DVR/NVR - 'SessionId' Brute Force

Resumes Management and Job Application Website 1.0 - Multiple Stored XSS

Library System 1.0 - Authentication Bypass Via SQL Injection

MyBB Timeline Plugin 1.0 - Cross-Site Scripting / CSRF

SonicWall SSL-VPN 8.0.0.0 - 'shellshock/visualdoor' Remote Code Execution (Unauthenticated)

Web Based Quiz System 1.0 - 'MCQ options' Persistent/Stored Cross-Site Scripting

Web Based Quiz System 1.0 - 'name' Persistent/Stored Cross-Site Scripting

Online Ordering System 1.0 - Arbitrary File Upload to Remote Code Execution

MagpieRSS 0.72 - 'url' Command Injection and Server Side Request Forgery
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Command Injection (Authenticated)
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Authentication Bypass
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Remote Code Execution
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Factory Reset (Unauthenticated)
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Config Download (Unauthenticated)
GetSimple CMS Custom JS Plugin 0.1 - CSRF to Persistent XSS
Regis Inventory And Monitoring System 1.0 - 'Item List' Stored XSS

rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (1)

Mini Mouse 9.3.0 - Local File inclusion / Path Traversal

GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF to RCE

Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass

rconfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (2)

GravCMS 1.10.7 - Unauthenticated Arbitrary YAML Write/Update (Metasploit)

GetSimple CMS My SMTP Contact Plugin 1.1.2 - CSRF to Stored XSS to RCE

Sipwise C5 NGCP CSC - 'Multiple' Stored/Reflected Cross-Site Scripting (XSS)

Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution

Zenario CMS 8.8.52729 - 'cID' Blind & Error based SQL injection (Authenticated)

OpenEMR 5.0.1.3 - '/portal/account/register.php' Authentication Bypass

VMware vCenter Server RCE 6.5 / 6.7 / 7.0 - Remote Code Execution (RCE) (Unauthenticated)

Scratch Desktop 3.17 - Cross-Site Scripting/Remote Code Execution (XSS/RCE)

Church Management System 1.0 - Unrestricted File Upload to Remote Code Execution (Authenticated)

Zoo Management System 1.0 - 'Multiple' Stored Cross-Site-Scripting (XSS)

WordPress Plugin Current Book 1.0.1 - 'Book Title and Author field' Stored Cross-Site Scripting (XSS)

KevinLAB BEMS 1.0 - Unauthenticated SQL Injection / Authentication Bypass

Event Registration System with QR Code 1.0 - Authentication Bypass & RCE

CloverDX 5.9.0 - Cross-Site Request Forgery (CSRF) to Remote Code Execution (RCE)

Panasonic Sanyo CCTV Network Camera 2.03-0x - 'Disable Authentication / Change Password' CSRF

ApacheOfBiz 17.12.01 - Remote Command Execution (RCE) via Unsafe Deserialization of XMLRPC arguments

WordPress Plugin LifterLMS 4.21.1 - Access Other Student Grades/Answers via IDOR

GeoVision Geowebserver 5.3.3 - LFI / XSS / HHI / RCE

Umbraco CMS 8.9.1 - Path traversal and Arbitrary File Write (Authenticated)

Traffic Offense Management System 1.0 - SQLi to Remote Code Execution (RCE) (Unauthenticated)

Compro Technology IP Camera - 'killps.cgi' Denial-of-Service (DoS)

OpenSIS 8.0 'modname' - Directory/Path Traversal

Patient Appointment Scheduler System 1.0 - Persistent/Stored XSS

Apartment Visitor Management System (AVMS) 1.0 - SQLi to RCE

FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - 'Add Admin' Cross-Site Request Forgery (CSRF)

Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation

PlaceOS 1.2109.1 - Open Redirection

Blood Bank System 1.0 - SQL Injection / Authentication Bypass

Lodging Reservation Management System 1.0 - SQL Injection / Authentication Bypass

Atlassian Jira Server/Data Center 8.16.0 - Arbitrary File Read

Linux/x64 - Reverse (127.1.1.1:4444/TCP) Shell (/bin/sh) Shellcode (123 Bytes)
Linux/x86 - Bind Socat (0.0.0.0:1000/TCP) Shell (Bash) Shellcode (113 bytes)
Linux/x86 - Bind (0.0.0.0:13377/TCP) Shell (/bin/sh) Shellcode (65 bytes)
Windows/x86 - Download File (http://10.10.10.5:8080/2NWyfQ9T.hta) Via mshta + Execute + Stager Shellcode (143 bytes)
Linux/x64 - Bind_tcp (0.0.0.0:4444) + Password (12345678) + Shell (/bin/sh) Shellcode (142 bytes)
Linux/x64 - execve _cat /etc/shadow_ Shellcode (66 bytes)
Windows/x86 - Add User Alfred to Administrators/Remote Desktop Users Group Shellcode (240 bytes)
Windows/x64 - Dynamic Null-Free WinExec PopCalc Shellcode (205 Bytes)
Windows/x64 - Dynamic NoNull Add RDP Admin (BOKU:SP3C1ALM0V3) Shellcode (387 Bytes)

Linux/x86 - execve /bin/sh Shellcode (fstenv eip GetPC technique) (70 bytes_ xor encoded)
Windows/x86 - WinExec PopCalc PEB & Export Directory Table NullFree Dynamic Shellcode (178 bytes)
Windows/x86 - Bind TCP shellcode / Dynamic PEB & EDT method null-free Shellcode (415 bytes)
 2021-10-12 05:02:16 +00:00
Offensive Security
b4c96a5864 DB: 2021-09-03 
28807 changes to exploits/shellcodes
 2021-09-03 20:19:21 +00:00
Offensive Security
36c084c351 DB: 2021-09-03 
45419 changes to exploits/shellcodes

2 new exploits/shellcodes

Too many to list!
 2021-09-03 13:39:06 +00:00
Offensive Security
3fa3a8be65 DB: 2021-01-26 
8 changes to exploits/shellcodes

MyBB Timeline Plugin 1.0 - Cross-Site Scripting / CSRF
Collabtive 3.1 - 'address' Persistent Cross-Site Scripting
CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS
CASAP Automated Enrollment System 1.0 - 'route' Stored XSS
Library System 1.0 - 'category' SQL Injection
Klog Server 2.4.1 - Unauthenticated Command Injection (Metasploit)

Linux/x64 - Bind_tcp (0.0.0.0:4444) + Password (12345678) + Shell (/bin/sh) Shellcode (142 bytes)
 2021-01-26 05:01:58 +00:00
Offensive Security
62b25db87d DB: 2021-01-20 
2 changes to exploits/shellcodes

osTicket 1.14.2 - SSRF

Linux/x64 - Reverse (127.1.1.1:4444) Shell (/bin/sh) Shellcode (123 Bytes)
 2021-01-20 05:02:00 +00:00
Offensive Security
91f4f8025d DB: 2021-01-13 
4 changes to exploits/shellcodes

Gila CMS 2.0.0 - Remote Code Execution (Unauthenticated)
Cemetry Mapping and Information System 1.0 - Multiple SQL Injections
SmartAgent 3.1.0 - Privilege Escalation

Linux/x86 - bind shell on port 13377 Shellcode (65 bytes)
 2021-01-13 05:01:55 +00:00
Offensive Security
720fabd066 DB: 2020-07-28 
114 changes to exploits/shellcodes

Notepad++ < 7.7 (x64)  - Denial of Service

winrar 5.80 64bit - Denial of Service
WinRAR 5.80 (x64) - Denial of Service

Linux Kernel 4.4.0-21 (Ubuntu 16.04 x64) - Netfilter target_offset Out-of-Bounds Privilege Escalation
Linux Kernel 4.4.0-21 (Ubuntu 16.04 x64) - Netfilter 'target_offset' Out-of-Bounds Privilege Escalation

TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change

Microsoft Windows 7 SP1 x86 - GDI Palette Objects Local Privilege Escalation (MS17-017)
Microsoft Windows 7 SP1 (x86) - GDI Palette Objects Local Privilege Escalation (MS17-017)

Microsoft Word 2007 (x86) - Information Disclosure

IKARUS anti.virus 2.16.7 - 'ntguard_x64' Local Privilege Escalation

ASX to MP3 Converter 1.82.50 (Windows 2003 x86) - '.asx' Local Stack Overflow
Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation
Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation
Linux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation
Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation
Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation
Linux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation

Microsoft Internet Explorer 11 (Windows 7 x64/x86) - vbscript Code Execution
Microsoft Internet Explorer 11 (Windows 7 x86/x64) - vbscript Code Execution

Linux Kernel 2.6.x / 3.10.x / 4.14.x (RedHat / Debian / CentOS) (x64) - 'Mutagen Astronomy' Local Privilege Escalation

R 3.4.4 (Windows 10 x64) - Buffer Overflow (DEP/ASLR Bypass)

MySQL User-Defined (Linux) (x32/x86_64) - 'sys_exec' Local Privilege Escalation
MySQL User-Defined (Linux) (x86) - 'sys_exec' Local Privilege Escalation

Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH)

Microsoft Windows (x84/x64) - 'Error Reporting' Discretionary Access Control List / Local Privilege Escalation
Microsoft Windows (x86/x64) - 'Error Reporting' Discretionary Access Control List / Local Privilege Escalation

Microsoft Windows (x86) - Task Scheduler' .job' Import Arbitrary Discretionary Access Control List Write / Local Privilege Escalation

R 3.4.4 (Windows 10 x64) - Buffer Overflow SEH (DEP/ASLR Bypass)

Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation
Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x64) - 'AF_PACKET' Race Condition Privilege Escalation

Microsoft Windows 7 build 7601 (x86) - Local Privilege Escalation

Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)

Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path

DEWESoft X3 SP1 (64-bit) - Remote Command Execution
DEWESoft X3 SP1 (x64) - Remote Command Execution

CompleteFTP Professional 12.1.3 - Remote Code Execution

TeamCity Agent XML-RPC 10.0 - Remote Code Execution

eGroupWare 1.14 - 'spellchecker.php' Remote Command Execution

FreeBSD x86 / x64 - execve(/bin/sh) Anti-Debugging Shellcode (140 bytes)
FreeBSD x86/x64 - execve(/bin/sh) Anti-Debugging Shellcode (140 bytes)

Linux/x86 - /usr/bin/head -n99 cat etc/passwd Shellcode (61 Bytes)

Linux/x86 - Kill All Processes Shellcode (14 bytes)
Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)
Linux/x86 - adduser (User) to /etc/passwd Shellcode (74 bytes)
Linux/x86 - execve /bin/sh Shellcode (25 bytes)
Linux/x86 - Reverse Shell NULL free 127.0.0.1:4444 Shellcode (91 bytes)
Linux/x86 - execve(/bin/sh) socket reuse Shellcode (42 bytes)
Linux/x86 - (NOT|ROT+8 Encoded) execve(/bin/sh) null-free Shellcode (47 bytes)
Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)
Linux/x86 - adduser (User) to /etc/passwd Shellcode (74 bytes)
Linux/x86 - execve /bin/sh Shellcode (25 bytes)
Linux/x86 - Reverse Shell NULL free 127.0.0.1:4444 Shellcode (91 bytes)
Linux/x86 - execve(/bin/sh) socket reuse Shellcode (42 bytes)
Linux/x86 - (NOT|ROT+8 Encoded) execve(/bin/sh) null-free Shellcode (47 bytes)
Linux/x86 - Execve() Alphanumeric Shellcode (66 bytes)
Linux/x86 - Random Bytes Encoder + XOR/SUB/NOT/ROR execve(/bin/sh) Shellcode (114 bytes)
Linux/x86 - Execve() Alphanumeric Shellcode (66 bytes)
Linux/x86 - Random Bytes Encoder + XOR/SUB/NOT/ROR execve(/bin/sh) Shellcode (114 bytes)
Windows/x86 - Dynamic Bind Shell + Null-Free Shellcode (571 Bytes)
Linux/x86 - Bind Shell Generator Shellcode (114 bytes)
Windows/x86 - Dynamic Bind Shell + Null-Free Shellcode (571 Bytes)
Linux/x86 - Bind Shell Generator Shellcode (114 bytes)
Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
Linux\x86 - 'reboot' polymorphic Shellcode (26 bytes)
Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
Linux/x86 - 'reboot' polymorphic Shellcode (26 bytes)
Windows/x86 - MSVCRT System + Dynamic Null-free + Add RDP Admin + Disable Firewall + Enable RDP Shellcode (644 Bytes)
Linux/x64 - Password (P3WP3Wl4ZerZ) + Bind (0.0.0.0:4444/TCP) Shell (/bin/bash) + Null-free Shellcode (272 Bytes)
Windows/x86 - MSVCRT System + Dynamic Null-free + Add RDP Admin + Disable Firewall + Enable RDP Shellcode (644 Bytes)
Linux/x64 - Password (P3WP3Wl4ZerZ) + Bind (0.0.0.0:4444/TCP) Shell (/bin/bash) + Null-free Shellcode (272 Bytes)
 2020-07-28 05:01:59 +00:00
Offensive Security
1979df6cb3 DB: 2020-06-19 
51 changes to exploits/shellcodes

Tor Browser < 0.3.2.10 - Use After Free (PoC)
Notepad++ < 7.7 (x64)  - Denial of Service
SpotIE Internet Explorer Password Recovery 2.9.5 - 'Key' Denial of Service
InputMapper 1.6.10 - Denial of Service

SurfOffline Professional 2.2.0.103 - 'Project Name' Denial of Service (SEH)

XnConvert 1.82 - Denial of Service (PoC)

SpotFTP FTP Password Recovery 3.0.0.0 - 'Key' Denial of Service (PoC)

SpotDialup 1.6.7 - 'Key' Denial of Service (PoC)

Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC)

FreeBSD 12.0 - 'fd' Local Privilege Escalation
iOS < 12.4.1 - 'Jailbreak' Local Privilege Escalation
Easy File Sharing Web Server 7.2 - 'New User' Local Overflow (SEH)

DeviceViewer 3.12.0.1 - Arbitrary Password Change

Winrar 5.80 - XML External Entity Injection

Microsoft Windows Media Center WMV / WMA 6.3.9600.16384 - Code Execution

Siemens TIA Portal - Remote Command Execution

Android 7 < 9 - Remote Code Execution
CoreFTP 2.0 Build 674 SIZE - Directory Traversal (Metasploit)
CoreFTP 2.0 Build 674 MDTM - Directory Traversal (Metasploit)
CTROMS Terminal OS Port Portal - 'Password Reset' Authentication Bypass (Metasploit)

MyBB < 1.8.21 - Remote Code Execution

Nagios XI 5.6.5 - Remote Code Execution / Root Privilege Escalation

Webmin < 1.920 - 'rpc.cgi' Remote Code Execution (Metasploit)

Wolters Kluwer TeamMate 3.1 - Cross-Site Request Forgery

Publisure Hybrid - Multiple Vulnerabilities

NetGain EM Plus 10.1.68 - Remote Command Execution

Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection

WordPress Plugin ARforms 3.7.1 - Arbitrary File Deletion

DotNetNuke 9.3.2 - Cross-Site Scripting

VehicleWorkshop 1.0 - 'bookingid' SQL Injection
WordPress Plugin Tutor.1.5.3 - Local File Inclusion
WordPress Plugin tutor.1.5.3 - Persistent Cross-Site Scripting
WordPress Plugin Wordfence.7.4.5 - Local File Disclosure
WordPress Plugin contact-form-7 5.1.6 - Remote File Upload

WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion

WordPress Plugin WOOF Products Filter for WooCommerce 1.2.3 - Persistent Cross-Site Scripting

WordPress Plugin WP Sitemap Page 1.6.2 - Persistent Cross-Site Scripting
Joomla! 3.9.0 < 3.9.7 - CSV Injection
PlaySMS 1.4.3 - Template Injection / Remote Code Execution
Wing FTP Server - Authenticated CSRF (Delete Admin)

WordPress Plugin Custom Searchable Data System - Unauthenticated Data M]odification

UADMIN Botnet 1.0 - 'link' SQL Injection

Joomla! Component ACYMAILING 3.9.0 - Unauthenticated Arbitrary File Upload

Wordpress Plugin PicUploader 1.0 - Remote File Upload

PHP-Fusion 9.03.50 - 'panels.php' Remote Code Execution

WordPress Plugin Helpful 2.4.11 - SQL Injection

Prestashop 1.7.6.4 - Cross-Site Request Forgery

WordPress Plugin Simple File List 5.4 - Remote Code Execution

Library CMS Powerful Book Management System 2.2.0 - Session Fixation

Joomla! J2 Store 3.3.11 - 'filter_order_Dir' SQL Injection (Authenticated)
Joomla! J2 Store 3.3.11 - 'filter_order_Dir' Authenticated SQL Injection

Beauty Parlour Management System 1.0 - Authentication Bypass

Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)

Windows/x64 - WinExec Add-Admin Dynamic Null-Free Shellcode (210 Bytes)
Windows/x64 - WinExec Add-Admin (ROOT/I@mR00T$) Dynamic Null-Free Shellcode (210 Bytes)

Linux/x64 - Password Protected Bindshell + Null-free Shellcode (272 Bytes)
Linux/x64 - Password (P3WP3Wl4ZerZ) + Bind (0.0.0.0:4444/TCP) Shell (/bin/bash) + Null-free Shellcode (272 Bytes)
 2020-06-19 05:02:01 +00:00
Offensive Security
7b87f30fbc DB: 2020-04-25 
5 changes to exploits/shellcodes

Popcorn Time 6.2 - 'Update service' Unquoted Service Path
EspoCRM 5.8.5 - Privilege Escalation
Edimax EW-7438RPn 1.13 - Remote Code Execution
Furukawa Electric ConsciusMAP 2.8.1 - Remote Code Execution

Linux/x64 - Password Protected Bindshell + Null-free Shellcode (272 Bytes)
 2020-04-25 05:01:51 +00:00
Offensive Security
b84d953124 DB: 2020-03-24 
10 changes to exploits/shellcodes

ProficySCADA for iOS 5.0.25920 - 'Password' Denial of Service (PoC)
Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service (PoC)

CyberArk PSMP 10.9.1 - Policy Restriction Bypass

PHPMailer < 5.2.18 - Remote Code Execution (Bash)
FIBARO System Home Center 5.021 - Remote File Include
rConfig 3.9.4 - 'search.crud.php' Remote Command Injection
Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection

Windows\x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes)
Windows\x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
Windows/x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes)
Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
Linux\x86 - 'reboot' polymorphic Shellcode (26 bytes)
 2020-03-24 05:01:50 +00:00
Offensive Security
8cbf7883c1 DB: 2020-02-11 
11 changes to exploits/shellcodes

Dota 2 7.23f - Denial of Service (PoC)
usersctp - Out-of-Bounds Reads in sctp_load_addresses_from_init
iOS/macOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand()
Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow
Ricoh Driver - Privilege Escalation (Metasploit)
D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)
OpenSMTPD - MAIL FROM Remote Code Execution (Metasploit)
Forcepoint WebSecurity 8.5 - Reflective Cross-Site Scripting
LearnDash WordPress LMS Plugin 3.1.2 - Reflective Cross-Site Scripting

Linux/x86 - Bind Shell Generator Shellcode (114 bytes)
 2020-02-11 05:02:02 +00:00
Offensive Security
c7085a57b4 DB: 2020-01-09 
9 changes to exploits/shellcodes

Cisco DCNM JBoss 10.4 - Credential Leakage
EBBISLAND EBBSHAVE 6100-09-04-1441 - Remote Buffer Overflow
ASTPP VoIP 4.0.1 - Remote Code Execution
JetBrains TeamCity 2018.2.4 - Remote Code Execution
Codoforum 4.8.3 - 'input_txt' Persistent Cross-Site Scripting
Online Book Store 1.0 - Unauthenticated Remote Code Execution
Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape
Sony Playstation 4 (PS4) < 6.72 - WebKit Code Execution (PoC)

Linux/x86 - Random Bytes Encoder + XOR/SUB/NOT/ROR execve(/bin/sh) Shellcode (114 bytes)
 2020-01-09 05:02:04 +00:00
Offensive Security
95c6eeab79 DB: 2020-01-07 
33 changes to exploits/shellcodes

NetShareWatcher 1.5.8.0 - 'Name' Denial Of Service
NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)
SpotIE 2.9.5 - 'Key' Denial of Service (PoC)
Dnss Domain Name Search Software - 'Key' Denial of Service (PoC)
BlueAuditor 1.7.2.0 - 'Name' Denial of Service (PoC)
ShareAlarmPro Advanced Network Access Control - 'Key' Denial of Service (PoC)
NetShareWatcher 1.5.8.0 - 'Key' Denial of Service (PoC)
Dnss Domain Name Search Software - 'Name' Denial of Service (PoC)
TextCrawler Pro3.1.1 - Denial of Service (PoC)
RemShutdown 2.9.0.0 - 'Key' Denial of Service (PoC)
Backup Key Recovery Recover Keys Crashed Hard Disk Drive 2.2.5 - 'Key' Denial of Service (PoC)
RemShutdown 2.9.0.0 - 'Name' Denial of Service (PoC)
NBMonitor 1.6.6.0 - 'Key' Denial of Service (PoC)
Office Product Key Finder 1.5.4 - Denial of Service (PoC)
SpotFTP FTP Password Recovery 3.0.0.0 - 'Name' Denial of Service (PoC)
SpotMSN 2.4.6 - 'Name' Denial of Service (PoC)
SpotIM 2.2 - 'Name' Denial Of Service
FTPGetter Professional 5.97.0.223 -  Denial of Service (PoC)
Duplicate Cleaner Pro 4 - Denial of Service (PoC)
Microsoft Outlook VCF cards - Denial of Service (PoC)
Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path
Windows - Shell COM Server Registrar Local Privilege Escalation
Dairy Farm Shop Management System 1.0 - 'username' SQL Injection
Complaint Management System 4.0 - 'cid' SQL injection
IBM RICOH Infoprint 1532 Printer - Persistent Cross-Site Scripting
Subrion CMS 4.0.5 - Cross-Site Request Forgery (Add Admin)
Hostel Management System 2.0 - 'id' SQL Injection
elaniin CMS 1.0 - Authentication Bypass
Small CRM 2.0 - Authentication Bypass
Voyager 1.3.0 - Directory Traversal
Codoforum 4.8.3 - Persistent Cross-Site Scripting
Django < 3.0 < 2.2 < 1.11 - Account Hijack

Linux/x86 - Execve() Alphanumeric Shellcode (66 bytes)
 2020-01-07 05:02:07 +00:00
Offensive Security
caad53ed8d DB: 2019-10-31 
6 changes to exploits/shellcodes

WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of Service
JavaScriptCore - GetterSetter Type Confusion During DFG Compilation
Ajenti 2.1.31 - Remote Code Exection (Metasploit)
Citrix StoreFront Server 7.15 - XML External Entity Injection
iSeeQ Hybrid DVR WH-H4 2.0.0.P - (get_jpeg) Stream Disclosure

Linux/x86 - (NOT|ROT+8 Encoded) execve(/bin/sh) null-free Shellcode (47 bytes)
 2019-10-31 05:01:41 +00:00
Offensive Security
a464ad083a DB: 2019-10-23 
5 changes to exploits/shellcodes

winrar 5.80 - XML External Entity Injection
Total.js CMS 12 - Widget JavaScript Code Injection (Metasploit)
Moxa EDR-810 - Command Injection / Information Disclosure

Linux/x86 - execve(/bin/sh) socket reuse Shellcode (42 bytes)
 2019-10-23 05:01:41 +00:00
Offensive Security
588067072a DB: 2019-10-17 
15 changes to exploits/shellcodes

sudo 1.8.28 - Security Bypass
sudo 1.2.27 - Security Bypass
Lavasoft 2.3.4.7 - 'LavasoftTcpService' Unquoted Service Path
Zilab Remote Console Server 3.2.9 - 'zrcs' Unquoted Service Path
X.Org X Server 1.20.4 - Local Stack Overflow
LiteManager 4.5.0 - 'romservice' Unquoted Serive Path
Solaris xscreensaver 11.4 - Privilege Escalation
Mikogo 5.2.2.150317 - 'Mikogo-Service' Unquoted Serive Path

Whatsapp 2.19.216 - Remote Code Execution
Accounts Accounting 7.02 - Persistent Cross-Site Scripting
CyberArk Password Vault 10.6 - Authentication Bypass

Linux/x86 -  Add User to /etc/passwd Shellcode (59 bytes)
Linux/x86 - adduser (User) to /etc/passwd Shellcode (74 bytes)
Linux/x86 - execve /bin/sh Shellcode (25 bytes)
Linux/x86 - Reverse Shell NULL free 127.0.0.1:4444 Shellcode (91 bytes)
 2019-10-17 05:01:44 +00:00
Offensive Security
c4b3e48aea DB: 2019-10-11 
10 changes to exploits/shellcodes

Windows Kernel - win32k.sys TTF Font Processing Pool Corruption in win32k!ulClearTypeFilter
Windows Kernel - NULL Pointer Dereference in nt!MiOffsetToProtos While Parsing Malformed PE File
Windows Kernel - Out-of-Bounds Read in CI!CipFixImageType While Parsing Malformed PE File
Windows Kernel - Out-of-Bounds Read in nt!MiParseImageLoadConfig While Parsing Malformed PE File
Windows Kernel - Out-of-Bounds Read in CI!HashKComputeFirstPageHash While Parsing Malformed PE File
Windows Kernel - Out-of-Bounds Read in nt!MiRelocateImage While Parsing Malformed PE File

ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (Metasploit_ DEP Bypass)

freeFTP 1.0.8 - Remote Buffer Overflow
freeFTP 1.0.8 - 'PASS' Remote Buffer Overflow
SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery
TP-Link TL-WR1043ND 2 - Authentication Bypass

Linux/x86 -  Add User to /etc/passwd Shellcode (59 bytes)
 2019-10-11 05:01:46 +00:00
Offensive Security
0a59eb70a8 DB: 2019-08-21 
3 changes to exploits/shellcodes

SilverSHielD 6.x - Local Privilege Escalation

WordPress Add Mime Types Plugin 2.2.1 - Cross-Site Request Forgery

Linux/x86_64 - Bind Shell (/bin/sh) with Configurable Password Shellcode (129 bytes)
Linux/x86_64 - Reverse Shell (/bin/sh) with Configurable Password Shellcode (120 bytes)
Linux/x86_64 - Bind (4444/TCP) Shell (/bin/sh) + Password (pass) Shellcode (129 bytes)
Linux/x86_64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (pass) Shellcode (120 bytes)

Linux/MIPS64 - Reverse (localhost:4444/TCP) Shell Shellcode (157 bytes)
 2019-08-21 05:02:32 +00:00
Offensive Security
998fb1eeec DB: 2019-08-14 
6 changes to exploits/shellcodes

Steam Windows Client - Local Privilege Escalation
Agent Tesla Botnet - Arbitrary Code Execution
AZORult Botnet - SQL Injection

Linux/Tru64 alpha - execve(/bin/sh) Shellcode (108 bytes)
Linux/x86 - execve(_/bin/sh_) + tolower() Shellcode
Linux/x86 - Multiple In-Memory Modules (Prompt + Privilege Restore + Break­ Chroot Jail + Backdoor) + Signature Evasion Shellcode
 2019-08-14 05:02:24 +00:00
Offensive Security
880bbe402e DB: 2019-03-08 
14991 changes to exploits/shellcodes

HTC Touch - vCard over IP Denial of Service

TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities

PeerBlock 1.1 - Blue Screen of Death

WS10 Data Server - SCADA Overflow (PoC)

Symantec Endpoint Protection 12.1.4013 - Service Disabling
Memcached 1.4.33 - 'Crash' (PoC)
Memcached 1.4.33 - 'Add' (PoC)
Memcached 1.4.33 - 'sasl' (PoC)
Memcached 1.4.33 - 'Crash' (PoC)
Memcached 1.4.33 - 'Add' (PoC)
Memcached 1.4.33 - 'sasl' (PoC)

Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow

man-db 2.4.1 - 'open_cat_stream()' Local uid=man

CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation

CDRecord's ReadCD - Local Privilege Escalation
Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH)
FreeBSD - Intel SYSRET Privilege Escalation (Metasploit)

CCProxy 6.2 - 'ping' Remote Buffer Overflow

Savant Web Server 3.1 - Remote Buffer Overflow (2)

Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow

Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow
QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit)
Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit)
Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)
Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)
TeamCity < 9.0.2 - Disabled Registration Bypass
OpenSSH SCP Client - Write Arbitrary Files
Kados R10 GreenBee - Multiple SQL Injection
WordPress Core 5.0 - Remote Code Execution
phpBB 3.2.3  - Remote Code Execution

Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator)
Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
 2019-03-08 05:01:50 +00:00
Offensive Security
1b31850a46 DB: 2018-12-25 
15 changes to exploits/shellcodes

Angry IP Scanner for Linux 3.5.3 - Denial of Service (PoC)
Google Chrome 70 - SQLite Magellan Crash (PoC)
Microsoft Windows - 'MsiAdvertiseProduct' Arbitrary File Copy/Read
Keybase keybase-redirector - '$PATH' Local Privilege Escalation
Adobe Flash ActiveX Plugin 28.0.0.137 - Remote Code Execution (PoC)
Netatalk - Bypass Authentication
Kubernetes - (Unauthenticated) Arbitrary Requests
Kubernetes - (Authenticated) Arbitrary Requests
WSTMart 2.0.8 - Cross-Site Scripting
WSTMart 2.0.8 - Cross-Site Request Forgery (Add Admin)
FrontAccounting 2.4.5 - 'SubmitUser' SQL Injection
phpMyAdmin 4.8.4 - 'AllowArbitraryServer' Arbitrary File Read
PhpSpreadsheet < 1.5.0 - XML External Entity (XXE)

Linux/x86 - Kill All Processes Shellcode (14 bytes)
 2018-12-25 05:01:44 +00:00
Offensive Security
60710bbfd9 DB: 2018-12-05 
19 changes to exploits/shellcodes

Microsoft Lync for Mac 2011 - Injection Forced Browsing/Download
Wireshark - 'cdma2k_message_ACTIVE_SET_RECORD_FIELDS' Stack Corruption
Wireshark - 'find_signature' Heap Out-of-Bounds Read
Xorg X11 Server (AIX) - Local Privilege Escalation
Emacs - movemail Privilege Escalation (Metasploit)
OpenSSH < 7.7 - User Enumeration (2)
HP Intelligent Management - Java Deserialization RCE (Metasploit)
Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass
DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting
NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage
KeyBase Botnet 1.5 - SQL Injection
Dolibarr ERP/CRM 8.0.3 - Cross-Site Scripting
DomainMOD 4.11.01 - Custom Domain Fields Cross-Site Scripting
DomainMOD 4.11.01 - Custom SSL Fields Cross-Site Scripting
NUUO NVRMini2 3.9.1 - Authenticated Command Injection
DomainMOD 4.11.01 - Registrar Cross-Site Scripting
FreshRSS 1.11.1 - Cross-Site Scripting

Linux/x86 - /usr/bin/head -n99 cat etc/passwd Shellcode (61 Bytes)
Linux/x64 - Reverse (0.0.0.0:1907/TCP) Shell Shellcode (119 Bytes)
 2018-12-05 05:01:44 +00:00
Offensive Security
1db36d5e8b DB: 2018-01-18 
76 changes to exploits/shellcodes

Printoxx - Local Buffer Overflow (PoC)
Picpuz 2.1.1 - Buffer Overflow (Denial of Service) (PoC)
Printoxx - Local Buffer Overflow (PoC)
Picpuz 2.1.1 - Buffer Overflow (Denial of Service) (PoC)
Microsoft Edge Chakra JIT - Incorrect Bounds Calculation
Microsoft Edge Chakra - 'JavascriptGeneratorFunction::GetPropertyBuiltIns' Type Confusion
Microsoft Edge Chakra - Incorrect Scope Handling
Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes (2)
Microsoft Edge Chakra JIT - Out-of-Bounds Write
Microsoft Edge Chakra - 'AsmJSByteCodeGenerator::EmitCall' Out-of-Bounds Read
Microsoft Edge Chakra JIT - Stack-to-Heap Copy
Transmission - RPC DNS Rebinding
Master IP CAM 01 - Multiple Vulnerabilities
Zomato Clone Script - Arbitrary File Upload
Reservo Image Hosting Script 1.5 - Cross-Site Scripting
D-Link DSL-2640R - Unauthenticated DNS Change
Belkin N600DB Wireless Router - Multiple Vulnerabilities
SugarCRM 3.5.1 - Cross-Site Scripting

Linux/x86 - HTTP Server (8800/TCP) + Fork Shellcode (166 bytes)
Linux/x86 - HTTP Server (8800/TCP) + fork() Shellcode (166 bytes)

Linux/x86 - Append RSA key to /root/.ssh/authorized_keys2 Shellcode (295 bytes)
Linux/x86 - Append RSA Key to /root/.ssh/authorized_keys2 Shellcode (295 bytes)

Linux/x86 - Set System Time to 0 + exit Shellcode (12 bytes)
Linux/x86 - Set System Time to 0 + exit() Shellcode (12 bytes)

Linux/x86 - chmod 0666 /etc/shadow + exit Shellcode (36 bytes)
Linux/x86 - chmod 0666 /etc/shadow + exit() Shellcode (36 bytes)

Linux/x86 - Add Root User (xtz) To /etc/passwd Shellcode (59 bytes)
Linux/x86 - Add Root User (xtz) To /etc/passwd + No Password Shellcode (59 bytes)

Linux/x86 - Quick (yet conditional_ eax != 0 and edx == 0) exit Shellcode (4 bytes)
Linux/x86 - Quick (yet conditional_ eax != 0 and edx == 0) + exit() Shellcode (4 bytes)

Linux/x86 - write(0__Hello core!\n__12) + Exit Shellcode (36/43 bytes)
Linux/x86 - write(0__Hello core!\n__12) + exit() Shellcode (36/43 bytes)

Linux/x86 - execve(/bin/sh) Standard Opcode Array Payload Shellcode (21 bytes)
Linux/x86 - execve(/bin/sh) + Standard Opcode Array Payload Shellcode (21 bytes)

Linux/x86 - Alphanumeric Encoder (IMUL Method) Shellcode (88 bytes)
Linux/x86 - Alphanumeric Encoded (IMUL Method) Shellcode (88 bytes)

Linux/x86 - execve(/bin/sh) Alphanumeric Shellcode (392 bytes)
Linux/x86 - execve(/bin/sh) + Alphanumeric Shellcode (392 bytes)

Linux/x86 - Add Root User (t00r) + Anti-IDS Shellcode (116 bytes)
Linux/x86 - Add Root User (t00r) To /etc/passwd + Anti-IDS Shellcode (116 bytes)

Linux/x86 - Add Root User (t00r) Shellcode (82 bytes)
Linux/x86 - Add Root User (t00r) To /etc/passwd Shellcode (82 bytes)

Linux/x86 - Add Root User (z) Shellcode (70 bytes)
Linux/x86 - Add Root User (z) To /etc/passwd Shellcode (70 bytes)

Windows x86 - PEB _Kernel32.dll_ ImageBase Finder Alphanumeric Shellcode (67 bytes)
Windows x86 - PEB _Kernel32.dll_ ImageBase Finder + Alphanumeric Shellcode (67 bytes)

Linux/x86 - unlink(/etc/passwd) + exit() Shellcode (35 bytes)

Linux/x86 - Add Root User (toor) To /etc/passwd + exit() Shellcode (107 bytes)
Linux/x86 - Add Root User (toor) To /etc/passwd + No password + exit() Shellcode (107 bytes)
Linux/x86 - pwrite(_/etc/shadow__ hash_ 32_ 8) Shellcode (83 bytes)
Linux/x86 - Fork Bomb Alphanumeric Shellcode (117 bytes)
Linux/x86 - pwrite(/etc/shadow_ (md5 hash of agix)_ 32_ 8) Shellcode (83 bytes)
Linux/x86 - Fork Bomb + Alphanumeric Shellcode (117 bytes)

Linux/x86 - unlink _/etc/shadow_ Shellcode (33 bytes)
Linux/x86 - unlink /etc/shadow Shellcode (33 bytes)

Linux/x86-64 - Add Root User (shell-storm/leet) Shellcode (390 bytes)
Linux/x86-64 - Add Root User (shell-storm/leet) To /etc/{shadow_passwd} Shellcode (390 bytes)

Linux - Bind TCP (31337/TCP) Netcat Shell + Polymorphic Shellcode (91 bytes)
Linux/x86 - Bind TCP (31337/TCP) Netcat Shell + Polymorphic Shellcode (91 bytes)

Linux/ARM - Add Root User (shell-storm/toor) Shellcode (151 bytes)
Linux/ARM - Add Root User (shell-storm/toor) To /etc/passwd Shellcode (151 bytes)

FreeBSD/x86 - Bind TCP (31337/TCP) Shell (/bin/sh) + Fork Shellcode (111 bytes)
FreeBSD/x86 - Bind TCP (31337/TCP) Shell (/bin/sh) + fork() Shellcode (111 bytes)
Linux/x86 - Reverse TCP (localhost:8080/TCP) Shell + SSL Shellcode (422 bytes)
Linux/SuperH (sh4) - Add Root User (shell-storm/toor) Shellcode (143 bytes)
Linux/x86 - Reverse TCP (localhost:8080/TCP) Shell + SSL Shellcode (422 bytes)
Linux/SuperH (sh4) - Add Root User (shell-storm/toor) To /etc/passwd Shellcode (143 bytes)

Linux/MIPS - Add Root User (rOOt/pwn3d) Shellcode (164 bytes)
Linux/MIPS - Add Root User (rOOt/pwn3d) To /etc/passwd Shellcode (164 bytes)

Linux/x86 - setuid(0) + setgid(0) + Add Root User (iph) To /etc/passwd + Polymorphic Shellcode
Linux/x86 - setuid(0) + setgid(0) + Add Root User (iph) To /etc/passwd + No Password Polymorphic Shellcode

Linux/x86-64 - Add Root User (t0r/Winner) Shellcode (189 bytes)
Linux/x86-64 - Add Root User (t0r/Winner) To /etc/passwd Shellcode (189 bytes)
Linux/x86 - chmod 777 (/etc/passwd + /etc/shadow) + Add Root User (ALI/ALI) + Execute /bin/sh Shellcode (378 bytes)
Linux/x86 - chmod 777 (/etc/passwd + /etc/shadow) + Add Root User (ALI/ALI) + setreuid + Execute /bin/bash Obfuscated Shellcode (521 bytes)
Linux/x86 - chmod 777 (/etc/passwd + /etc/shadow) + Add Root User (ALI/ALI) To /etc/passwd + Execute /bin/sh Shellcode (378 bytes)
Linux/x86 - chmod 777 (/etc/passwd + /etc/shadow) + Add Root User (ALI/ALI) To /etc/passwd + setreuid + Execute /bin/bash Obfuscated Shellcode (521 bytes)

Linux/x86-64 - execve(_/bin/sh\0__NULL_NULL) Position Independent Alphanumeric Shellcode (87 bytes)
Linux/x86-64 - execve(_/bin/sh\0__NULL_NULL) + Position Independent + Alphanumeric Shellcode (87 bytes)

Linux/x86 - execve(/bin/sh) Shellcode (23 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (23 bytes) (1)

Linux/x86 - Create File With Permission 7775 + exit Shellcode (Generator)
Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator)

Linux/x86-64 - Bind TCP (4442/TCP) Ncat Shell + SSL + Multi-Channel (4444-4447/TCP) + Persistant + Fork + IPv4/6 + Password + Null-Free Shellcode (176 bytes)
Linux/x86-64 - Bind TCP (4442/TCP) Ncat Shell + SSL + Multi-Channel (4444-4447/TCP) + Persistant + fork() + IPv4/6 + Password + Null-Free Shellcode (176 bytes)
Linux/x86-64 - Bind TCP Stager (4444/TCP) + Egghunter Shellcode (157 bytes)
Linux/x86-64 - Add User (pwned/$pass$) Using open_write_close Shellcode (358 bytes)
Linux/x86-64 - Add User (pwned/$pass$) Using echo cmd Shellcode (273 bytes)
Linux/x86-64 - Bind TCP (4444/TCP) + Stager + Egghunter Shellcode (157 bytes)
Linux/x86-64 - Add User (pwned/$pass$) Using open_write_close To /etc/{shadow_passwd} Shellcode (358 bytes)
Linux/x86-64 - Add User (pwned/$pass$) Using echo cmd To /etc/{shadow_passwd} Shellcode (273 bytes)
Linux/x86 - execve(/bin/sh /tmp/p00p) Shellcode (70 bytes)
Linux/x86 - execve(/bin/ash) + exit() Shellcode (34 bytes)
Linux/x86 - Add Root User To /etc/passwd + No Password + exit() Shellcode (83 bytes)
Linux/x86 - setuid() + execve() + exit() Shellcode (44 bytes)
Linux/x86 - chmod(/bin/sh_04775) + set sh +s Shellcode (31 bytes)
Linux/x86 - socket-proxy Shellcode (372 bytes) (Generator)
Linux/x86 - setresuid(0_0_0) + execve(/bin/sh) + exit() Shellcode (41 bytes)
Linux/x86 - Reverse TCP (www.netric.org:45295/TCP) Shell (/bin/sh) Shellcode (131 bytes)
Linux/x86 - Bind TCP (45295/TCP) Shell (/bin/sh) + fork() Shellcode (200 bytes)
Linux/x86 - /sbin/iptables --flush Shellcode (69 bytes)
Linux/x86 - setuid(0) + execve(/bin/sh) Shellcode (29 bytes)
Linux/x86 - setuid(0) + execve(/bin/sh_ 0_ 0) Shellcode (27 bytes)
Linux/x86 - setuid(0) + chmod(/etc/shadow_ 0666) Shellcode (37 bytes)
Linux/x86 - pwrite(/etc/shadow_ (md5 hash of agix)_ 32_ 8) Shellcode (89 bytes)
Linux/x86 - Remote File Download Shellcode (42 bytes)
Linux/x86 - CDRom Ejecting Shellcode (46 bytes)
Linux/x86 - sethostname(PwNeD !!_ 8) Shellcode (32 bytes)
Linux/x86 - exit(0) Shellcode (8 bytes)
Linux/x86 - sync Shellcode (6 bytes)
Linux/x86 - execve(/bin/sh_ -c_ ping localhost)  Shellcode (55 bytes)
Linux/x86 - rmdir(_/tmp/willdeleted_) Shellcode (41 bytes)
Linux/x86 - setdomainname(_th1s s3rv3r h4s b33n h1j4ck3d !!_) Shellcode (58 bytes)
Linux/x86 - execve(/bin/sh) + Polymorphic Shellcode (26 bytes)
Linux/x86 - Force unmount /media/disk Shellcode (33 bytes)
Linux/x86 - chmod(/etc/shadow_ 0666) + ASCII Shellcode (443 bytes)
Linux/x86 - CDRom Ejecting + Polymorphic Shellcode (74 bytes)
Linux/x86 - Bind TCP (31337/TCP) Shell + Polymorphic Shellcode (125 bytes)
Linux/x86 - /sbin/iptables -POUTPUT DROP Shellcode (60 bytes)
Linux/x86 - /usr/bin/killall snort Shellcode (46 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (21 bytes) (3)
Linux/x86 - execve(/bin/sh) Shellcode (21 bytes) (5)
Linux/x86 - execve(/bin/dash) Shellcode (49 bytes)
Linux/x86 - execve(/bin/cat_ /etc/shadow_ NULL) Shellcode (42 bytes)
Linux/x86 - /etc/init.d/apparmor teardown Shellcode (53 bytes)
Linux/x86 - setreuid() + /sbin/iptables -F + exit(0) Shellcode (76 bytes)
Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (28 bytes)
Linux/x86 - mkdir(hacked) + exit() Shellcode (36 bytes)
Linux/x86 - Stager Reads Second Stage From STDIN Shellcode (14 bytes)
Linux/x86 - iptables --flush Shellcode (43 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (23 bytes) (2)
Linux/x86 - Force Reboot Shellcode (36 bytes)
Linux/x86 - execve(chmod 0777 /etc/shadow) Shellcode (57 bytes)
Linux/x86 - Bind TCP (1111/TCP) Shell + SO_REUSEADDR Set (Avoiding SIGSEGV) Shellcode (103 bytes)
Linux/x86 - Reverse TCP (127.1.1.1:55555/TCP) Shell Shellcode (72 bytes)
Linux/x86 - Bind TCP (Random TCP Port) Shell Shellcode (65 bytes)
Linux/x86 - Bind TCP (1111/TCP) Shell + GetPC/Call/Ret Method Shellcode (89 bytes)
Linux/x86 - Bind TCP (1111/TCP) Shell Shellcode (73 bytes)
Linux/x86 - Bind TCP (Random TCP Port) Shell Shellcode (57 bytes)
Linux/x86 - Egghunter Shellcode (38 bytes)

Linux/x86 - execve(/bin/sh) Shellcode (21 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (21 bytes) (4)

Linux/x86 - chmod 777 /etc/sudoers Shellcode (36 bytes)
 2018-01-18 05:02:25 +00:00
Offensive Security
909c94ce89 DB: 2018-01-17 
78 changes to exploits/shellcodes

OBS studio 20.1.3 - Local Buffer Overflow
OBS Studio 20.1.3 - Local Buffer Overflow

Seagate Personal Cloud - Multiple Vulnerabilities

AIX - execve /bin/sh Shellcode (88 bytes)
AIX - execve(/bin/sh) Shellcode (88 bytes)
BSD/PPC - execve /bin/sh Shellcode (128 bytes)
BSD/x86 - setuid(0) + execve /bin/sh Shellcode (30 bytes)
BSD/PPC - execve(/bin/sh) Shellcode (128 bytes)
BSD/x86 - setuid(0) + execve(/bin/sh) Shellcode (30 bytes)
BSD/x86 - execve /bin/sh Shellcode (27 bytes)
BSD/x86 - execve /bin/sh + setuid(0) Shellcode (29 bytes)
BSD/x86 - execve(/bin/sh) Shellcode (27 bytes)
BSD/x86 - execve(/bin/sh) + setuid(0) Shellcode (29 bytes)
BSD/x86 - execve /bin/sh Encoded Shellcode (49 bytes)
BSD/x86 - execve /bin/sh Encoded Shellcode (57 bytes)
BSD/x86 - execve(/bin/sh) Encoded Shellcode (49 bytes)
BSD/x86 - execve(/bin/sh) + Encoded Shellcode (57 bytes)
BSDi/x86 - execve /bin/sh Shellcode (45 bytes)
BSDi/x86 - execve /bin/sh Shellcode (46 bytes)
BSDi/x86 - execve /bin/sh ToUpper Encoded Shellcode (97 bytes)
FreeBSD x86 / x64 - execve /bin/sh Anti-Debugging Shellcode (140 bytes)
BSDi/x86 - execve(/bin/sh) Shellcode (45 bytes)
BSDi/x86 - execve(/bin/sh) Shellcode (46 bytes)
BSDi/x86 - execve(/bin/sh) ToUpper Encoded Shellcode (97 bytes)
FreeBSD x86 / x64 - execve(/bin/sh) Anti-Debugging Shellcode (140 bytes)

FreeBSD/x86 - execve /bin/cat /etc/master.passwd Null-Free Shellcode (65 bytes)
FreeBSD/x86 - execve(/bin/cat /etc/master.passwd) Null-Free Shellcode (65 bytes)

FreeBSD/x86 - execve /bin/sh Encoded Shellcode (48 bytes)
FreeBSD/x86 - execve(/bin/sh) Encoded Shellcode (48 bytes)
FreeBSD/x86 - execve /bin/sh Shellcode (23 bytes) (1)
FreeBSD/x86 - execve /bin/sh Shellcode (23 bytes) (2)
FreeBSD/x86 - execve /bin/sh Shellcode (37 bytes)
FreeBSD/x86 - execve(/bin/sh) Shellcode (23 bytes) (1)
FreeBSD/x86 - execve(/bin/sh) Shellcode (23 bytes) (2)
FreeBSD/x86 - execve(/bin/sh) Shellcode (37 bytes)
FreeBSD/x86 - chown 0:0 + chmod 6755 + execve /tmp/sh Shellcode (44 bytes)
FreeBSD/x86 - execve /tmp/sh Shellcode (34 bytes)
FreeBSD/x86 - chown 0:0 + chmod 6755 + execve(/tmp/sh) Shellcode (44 bytes)
FreeBSD/x86 - execve(/tmp/sh) Shellcode (34 bytes)
FreeBSD/x86-64 - execve /bin/sh Shellcode (34 bytes)
Linux/x86 - execve Null-Free Shellcode (Generator)
FreeBSD/x86-64 - execve(/bin/sh) Shellcode (34 bytes)
Linux/x86 - execve() Null-Free Shellcode (Generator)

Linux - execve /bin/sh Polymorphic With Printable ASCII Characters Shellcode (Generator)
Linux - execve(/bin/sh) + Polymorphic + Printable ASCII Characters Shellcode (Generator)

HP-UX - execve /bin/sh Shellcode (58 bytes)
HP-UX - execve(/bin/sh) Shellcode (58 bytes)

Linux/PPC - execve /bin/sh Shellcode (60 bytes)
Linux/PPC - execve(/bin/sh) Shellcode (60 bytes)

Linux/PPC - execve /bin/sh Shellcode (112 bytes)
Linux/PPC - execve(/bin/sh) Shellcode (112 bytes)

Linux/x86 - Self-Modifying Anti-IDS /bin/sh Shellcode (35/64 bytes)
Linux/x86 - /bin/sh + Self-Modifying Anti-IDS Shellcode (35/64 bytes)
Linux/x86 - Disable Network Card Polymorphic Shellcode (75 bytes)
Linux/x86 - killall5 Polymorphic Shellcode (61 bytes)
Linux/x86 - execve /bin/sh Polymorphic Shellcode (48 bytes)
Linux/x86 - Disable Network Card + Polymorphic Shellcode (75 bytes)
Linux/x86 - killall5 + Polymorphic Shellcode (61 bytes)
Linux/x86 - execve(/bin/sh) + Polymorphic Shellcode (48 bytes)
Linux/x86 - reboot() Polymorphic Shellcode (57 bytes)
Linux/x86 - chmod 666 /etc/shadow Polymorphic Shellcode (54 bytes)
Linux/x86 - reboot() + Polymorphic Shellcode (57 bytes)
Linux/x86 - chmod 666 /etc/shadow + Polymorphic Shellcode (54 bytes)

Linux/x86 - execve read Shellcode (92 bytes)
Linux/x86 - execve() Read Shellcode (92 bytes)
Linux/x86 - setuid(0) + execve /bin/sh Shellcode (28 bytes)
Linux/x86 - execve /bin/sh Shellcode (22 bytes)
Linux/x86 - setuid(0) + execve(/bin/sh) Shellcode (28 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (22 bytes)

Linux/x86 - execve /bin/sh (Re-Use Of Strings In .rodata) Shellcode (16 bytes)
Linux/x86 - execve(/bin/sh) (Re-Use Of Strings In .rodata) Shellcode (16 bytes)

Linux/x86 - Bind TCP (31337/TCP) Shell (/bin/sh) + setuid Shellcode (96 bytes)
Linux/x86 - Bind TCP (31337/TCP) Shell (/bin/sh) + setuid() Shellcode (96 bytes)

Linux/x86 - execve Diassembly Obfuscation Shellcode (32 bytes)
Linux/x86 - execve() Diassembly Obfuscation Shellcode (32 bytes)

Linux/x86 - execve /bin/sh Shellcode (24 bytes) (2)
Linux/x86 - execve(/bin/sh) Shellcode (24 bytes) (2)
Linux/x86 - execve /bin/sh + '.ZIP' Header Shellcode (28 bytes)
Linux/x86 - execve /bin/sh + '.RTF' Header Shellcode (30 bytes)
Linux/x86 - execve /bin/sh + '.RIFF' Header Shellcode (28 bytes)
Linux/x86 - execve /bin/sh + '.BMP' Bitmap Header Shellcode (27 bytes)
Linux/x86 - execve(/bin/sh) + '.ZIP' Header Shellcode (28 bytes)
Linux/x86 - execve(/bin/sh) + '.RTF' Header Shellcode (30 bytes)
Linux/x86 - execve(/bin/sh) + '.RIFF' Header Shellcode (28 bytes)
Linux/x86 - execve(/bin/sh) + '.BMP' Bitmap Header Shellcode (27 bytes)
Linux/x86 - execve /bin/sh Anti-IDS Shellcode (40 bytes)
Linux/x86 (Intel x86 CPUID) - execve /bin/sh XORED Encoded Shellcode (41 bytes)
Linux/x86 - execve /bin/sh Shellcode +1 Encoded (39 bytes)
Linux/x86 - execve(/bin/sh) + Anti-IDS Shellcode (40 bytes)
Linux/x86 (Intel x86 CPUID) - execve(/bin/sh) XORED Encoded Shellcode (41 bytes)
Linux/x86 - execve(/bin/sh) Shellcode +1 Encoded (39 bytes)

Linux/x86 - Anti-Debug Trick (INT 3h trap) + execve /bin/sh Shellcode (39 bytes)
Linux/x86 - Anti-Debug Trick (INT 3h trap) + execve(/bin/sh) Shellcode (39 bytes)
Linux/x86 - setreuid(0_ 0) + execve /bin/sh Shellcode (31 bytes)
Linux/x86 - execve /bin/sh + PUSH Shellcode (23 bytes)
Linux/x86 - setreuid(0_ 0) + execve(/bin/sh) Shellcode (31 bytes)
Linux/x86 - execve(/bin/sh) + PUSH Shellcode (23 bytes)

Linux/x86 - execve /bin/sh Standard Opcode Array Payload Shellcode (21 bytes)
Linux/x86 - execve(/bin/sh) Standard Opcode Array Payload Shellcode (21 bytes)
Linux/x86 - execve /bin/sh sysenter Opcode Array Payload Shellcode (23 bytes)
Linux/x86 - execve /bin/sh sysenter Opcode Array Payload Shellcode (27 bytes)
Linux/x86 - execve /bin/sh sysenter Opcode Array Payload Shellcode (45 bytes)
Linux/x86 - Break chroot (../ 20x Loop) + execve /bin/sh Shellcode (66 bytes)
Linux/x86 - execve(/bin/sh) sysenter Opcode Array Payload Shellcode (23 bytes)
Linux/x86 - execve(/bin/sh) sysenter Opcode Array Payload Shellcode (27 bytes)
Linux/x86 - execve(/bin/sh) sysenter Opcode Array Payload Shellcode (45 bytes)
Linux/x86 - Break chroot (../ 20x Loop) + execve(/bin/sh) Shellcode (66 bytes)

Linux/x86 - setreuid + execve Shellcode (31 bytes)
Linux/x86 - setreuid() + execve() Shellcode (31 bytes)

Linux/x86 - execve code Shellcode (23 bytes)
Linux/x86 - execve() Shellcode (23 bytes)
Linux/x86 - execve /bin/sh Alphanumeric Shellcode (392 bytes)
Linux/IA32 - execve /bin/sh 0xff-Free Shellcode (45 bytes)
Linux/x86 - symlink /bin/sh xoring Shellcode (56 bytes)
Linux/x86 - execve(/bin/sh) Alphanumeric Shellcode (392 bytes)
Linux/IA32 - execve(/bin/sh) 0xff-Free Shellcode (45 bytes)
BSD/x86 - symlink /bin/sh + XORing Encoded Shellcode (56 bytes)
Linux/x86 - Add Root User (t00r) Anti-IDS Shellcode (116 bytes)
Linux/x86 - chmod 666 /etc/shadow Anti-IDS Shellcode (75 bytes)
Linux/x86 - symlink . /bin/sh Shellcode (32 bytes)
Linux/x86 - Add Root User (t00r) + Anti-IDS Shellcode (116 bytes)
Linux/x86 - chmod 666 /etc/shadow + Anti-IDS Shellcode (75 bytes)
BSD/x86 - symlink . /bin/sh Shellcode (32 bytes)
Linux/x86 - execve /bin/sh Shellcode (29 bytes)
Linux/x86 - execve /bin/sh Shellcode (24 bytes) (3)
Linux/x86 - execve /bin/sh Shellcode (38 bytes)
Linux/x86 - execve /bin/sh Shellcode (30 bytes)
Linux/x86 - execve /bin/sh + setreuid(12_12) Shellcode (50 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (29 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (24 bytes) (3)
Linux/x86 - execve(/bin/sh) Shellcode (38 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (30 bytes)
Linux/x86 - execve(/bin/sh) + setreuid(12_12) Shellcode (50 bytes)
Linux/x86 - Break chroot (../ 10x Loop) Shellcode (34 bytes)
Linux/x86 - Break chroot (../ 10x Loop) Shellcode (46 bytes)
Linux/x86 - Break chroot + execve /bin/sh Shellcode (80 bytes)
Linux/x86 - execve /bin/sh Anti-IDS Shellcode (58 bytes)
Linux/x86 - execve /bin/sh XOR Encoded Shellcode (55 bytes)
Linux/x86 - execve /bin/sh ToLower Encoded Shellcode (41 bytes)
Linux/x86 - setreuid(0_0) + execve /bin/sh Shellcode (46+ bytes)
Linux/x86 - execve /bin/sh ToLower Encoded Shellcode (55 bytes)
Linux/x86 - Break chroot (../ 10x Loop) Shellcode (28 bytes)
OpenBSD/x86 - Load Kernel Module (/tmp/o.o) Shellcode (66 bytes)
BSD/x86 - setuid(0) + Break chroot (../ 10x Loop) Shellcode (46 bytes)
Linux/x86 - Break chroot + execve(/bin/sh) Shellcode (80 bytes)
Linux/x86 - execve(/bin/sh) + Anti-IDS Shellcode (58 bytes)
Linux/x86 - execve(/bin/sh) XOR Encoded Shellcode (55 bytes)
Linux/x86 - execve(/bin/sh) ToLower Encoded Shellcode (41 bytes)
Linux/x86 - setreuid(0_0) + execve(/bin/sh) Shellcode (46+ bytes)
Linux/x86 - execve(/bin/sh) ToLower Encoded Shellcode (55 bytes)

Linux/x86 - setreuid(0_ 0) + Break chroot (mkdir/chdir/chroot _../_) + execve /bin/sh Shellcode (132 bytes)
Linux/x86 - setreuid(0_ 0) + Break chroot (mkdir/chdir/chroot _../_) + execve(/bin/sh) Shellcode (132 bytes)

Linux/x86-64 - execve /bin/sh Shellcode (33 bytes)
Linux/x86-64 - execve(/bin/sh) Shellcode (33 bytes)
Linux/x86 / Unix/SPARC / IRIX/MIPS - execve /bin/sh Shellcode (141 bytes)
Linux/x86 / Unix/SPARC - execve /bin/sh Shellcode (80 bytes)
BSD/x86 / Linux/x86 - execve /bin/sh Shellcode (38 bytes)
Linux/x86 / Unix/SPARC / IRIX/MIPS - execve(/bin/sh) Shellcode (141 bytes)
Linux/x86 / Unix/SPARC - execve(/bin/sh) Shellcode (80 bytes)
BSD/x86 / Linux/x86 - execve(/bin/sh) Shellcode (38 bytes)
NetBSD/x86 - execve /bin/sh Shellcode (68 bytes)
OpenBSD/x86 - execve /bin/sh Shellcode (23 bytes)
NetBSD/x86 - execve(/bin/sh) Shellcode (68 bytes)
OpenBSD/x86 - execve(/bin/sh) Shellcode (23 bytes)

OSX/PPC - execve /bin/sh Shellcode (72 bytes)
OSX/PPC - execve(/bin/sh) Shellcode (72 bytes)

OSX/PPC - setuid(0) + execve /bin/sh Shellcode (88 bytes)
OSX/PPC - setuid(0) + execve(/bin/sh) Shellcode (88 bytes)

OSX/PPC - execve /usr/X11R6/bin/xterm Shellcode (141 bytes)
OSX/PPC - execve(/usr/X11R6/bin/xterm) Shellcode (141 bytes)

Solaris/SPARC - Download File (http://evil-dl/) + Execute (/tmp/ff) Shellcode (278 bytes)
Solaris/MIPS - Download (http://10.1.1.2:80/evil-dl) + Execute (/tmp/ff) Shellcode (278 bytes)
Solaris/SPARC - Reverse TCP (44434/TCP) Shell + XNOR Encoded Shellcode (600 bytes) (Generator)
Solaris/SPARC - setreuid + execve Shellcode (56 bytes)
Solaris/MIPS - Reverse TCP (10.0.0.3:44434/TCP) Shell + XNOR Encoded Traffic Shellcode (600 bytes) (Generator)
Solaris/SPARC - setreuid + execve() Shellcode (56 bytes)
Solaris/SPARC - execve /bin/sh Shellcode (52 bytes)
Solaris/SPARC - Bind TCP (6789/TCP) Shell (/bin/sh) Shellcode (228 bytes)
Solaris/SPARC - Reverse TCP (192.168.1.4:5678/TCP) Shell (/bin/sh) Shellcode (204 bytes)
Solaris/SPARC - execve(/bin/sh) Shellcode (52 bytes)
Solaris/SPARC - Bind TCP (6789/TCP) Shell (/bin/sh) Shellcode (228 bytes)
Solaris/SPARC - Reverse TCP (192.168.1.4:5678/TCP) Shell (/bin/sh) Shellcode (204 bytes)

Solaris/x86 - setuid(0) + execve(//bin/sh) + exit(0) Null-Free Shellcode (39 bytes)
Solaris/x86 - setuid(0) + execve(/bin/sh) + exit(0) Null-Free Shellcode (39 bytes)
Solaris/x86 - execve /bin/sh ToUpper Encoded Shellcode (84 bytes)
Solaris/x86 - inetd Add Service + execve Shellcode (201 bytes)
UnixWare - execve /bin/sh Shellcode (95 bytes)
Solaris/x86 - execve(/bin/sh) ToUpper Encoded Shellcode (84 bytes)
Solaris/x86 - inetd Add Service + execve() Shellcode (201 bytes)
UnixWare - execve(/bin/sh) Shellcode (95 bytes)

Linux/x86 - execve Shellcode (51 bytes)
Linux/x86 - execve() Shellcode (51 bytes)

Linux/x86 - setuid + Break chroot (mkdir/chdir/chroot '...') + execve /bin/sh Shellcode (79 bytes)
Linux/x86 - setuid() + Break chroot (mkdir/chdir/chroot '...') + execve(/bin/sh) Shellcode (79 bytes)

Linux/x86 - ip6tables -F Polymorphic Shellcode (71 bytes)
Linux/x86 - ip6tables -F + Polymorphic Shellcode (71 bytes)

Linux/x86 - execve /bin/cat /etc/passwd Shellcode (43 bytes)
Linux/x86 - execve(/bin/cat /etc/passwd) Shellcode (43 bytes)
Linux/x86 - execve /bin/sh Shellcode (8 bytes)
Linux/x86 - execve /bin/sh Shellcode (21 bytes) (2)
Linux/x86 - execve(/bin/sh) Shellcode (8 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (21 bytes) (2)

Linux/x86-64 - execve /bin/sh Shellcode (25 bytes) (2)
Linux/x86 - execve(/bin/sh) Shellcode (25 bytes) (2)

Linux/x86 - Fork Bomb Polymorphic Shellcode (30 bytes)
Linux/x86 - Fork Bomb + Polymorphic Shellcode (30 bytes)

Linux/x86-64 - execve /bin/sh Shellcode (30 bytes)
Linux/x86-64 - execve(/bin/sh) Shellcode (30 bytes)

Linux/x86 - execve(_/bin/bash___-p__NULL) Polymorphic Shellcode (57 bytes)
Linux/x86 - execve(_/bin/bash___-p__NULL) + Polymorphic Shellcode (57 bytes)

Linux/x86 - setuid(0) + chmod 0666 /etc/shadow Polymorphic Shellcode (61 bytes)
Linux/x86 - setuid(0) + chmod 0666 /etc/shadow + Polymorphic Shellcode (61 bytes)

Linux/x86 - sys_setuid(0) + sys_setgid(0) + execve (_/bin/sh_) Shellcode (39 bytes)
Linux/x86 - sys_setuid(0) + sys_setgid(0) + execve(_/bin/sh_) Shellcode (39 bytes)
Linux/x86 - execve /bin/sh Polymorphic Shellcode (116 bytes)
Linux/ARM - chmod 0777 /etc/shadow Polymorphic Shellcode (84 bytes)
Linux/x86 - execve(/bin/sh) + Polymorphic Shellcode (116 bytes)
Linux/ARM - chmod 0777 /etc/shadow + Polymorphic Shellcode (84 bytes)

Linux/ARM - execve(_/bin/sh__ [_/bin/sh_]_ NULL) XOR 88 Encoded Polymorphic Shellcode (78 bytes)
Linux/ARM - execve(_/bin/sh__ [_/bin/sh_]_ NULL) + XOR 88 Encoded + Polymorphic Shellcode (78 bytes)

Linux - Write SUID Root Shell (/tmp/.hiddenshell) Polymorphic Shellcode (161 bytes)
Linux - Write SUID Root Shell (/tmp/.hiddenshell) + Polymorphic Shellcode (161 bytes)

Linux - Bind TCP (6778/TCP) Shell + XOR Encoded Polymorphic Shellcode (125 bytes)
Linux/x86 - Bind TCP (6778/TCP) Shell + XOR Encoded + Polymorphic Shellcode (125 bytes)
Linux/ARM - execve(_/bin/sh__ [_/bin/sh_]_ NULL) Polymorphic Shellcode (Generator)
Linux - Find All Writeable Folder In FileSystem Polymorphic Shellcode (91 bytes)
Linux/ARM - execve(_/bin/sh__ [_/bin/sh_]_ NULL) + Polymorphic Shellcode (Generator)
Linux/x86 - Find All Writeable Folder In FileSystem + Polymorphic Shellcode (91 bytes)

Linux/x86-64 - execve(_/sbin/iptables__ [_/sbin/iptables__ _-F_]_ NULL) Shellcode (49 bytes)
Linux/x86-64 - Flush IPTables Rules (execve(_/sbin/iptables__ [_/sbin/iptables__ _-F_]_ NULL)) Shellcode (49 bytes)

Linux/x86 - execve /bin/sh Polymorphic Null-Free Shellcode (46 bytes)
Linux/x86 - execve(/bin/sh) + Polymorphic Null-Free Shellcode (46 bytes)

Windows Mobile 6.5 TR (WinCE 5.2) - MessageBox Shellcode (ARM)
Windows Mobile 6.5 TR (WinCE 5.2)/ARM - MessageBox Shellcode

OSX/Intel x86-64 - setuid shell Shellcode (51 bytes)
OSX/x86-64 - setuid() + Shell(/bin/sh) Shellcode (51 bytes)
Linux/x86 - Bind TCP (6666/TCP) Netcat (/usr/bin/netcat) Shell (/bin/sh) + Polymorphic XOR Encoded Shellcode (69/93 bytes)
OSX/Intel x86-64 - Reverse TCP (FFFFFFFF:4444/TCP) Shell (/bin/sh) Shellcode (131 bytes)
Linux/x86 - Bind TCP (6666/TCP) Netcat (/usr/bin/netcat) Shell (/bin/sh) + Polymorphic + XOR Encoded Shellcode (69/93 bytes)
OSX/x86-64 - Reverse TCP (FFFFFFFF:4444/TCP) Shell (/bin/sh) Shellcode (131 bytes)
OSX - Universal ROP + Reverse TCP Shell Shellcode
Linux/MIPS - execve /bin/sh Shellcode (52 bytes)
OSX/x86-64 - Universal ROP + Reverse TCP Shell Shellcode
Linux/MIPS - execve(/bin/sh) Shellcode (52 bytes)

Linux/MIPS - execve /bin/sh Shellcode (48 bytes)
Linux/MIPS - execve(/bin/sh) Shellcode (48 bytes)

Linux/x86-64 - execve /bin/sh Shellcode (52 bytes)
Linux/x86-64 - execve(/bin/sh) Shellcode (52 bytes)

Linux/x86 - setuid(0) + setgid(0) + Add Root User (iph) To /etc/passwd Polymorphic Shellcode
Linux/x86 - setuid(0) + setgid(0) + Add Root User (iph) To /etc/passwd + Polymorphic Shellcode

Linux/x86 - execve /bin/dash Shellcode (42 bytes)
Linux/x86 - execve(/bin/dash) Shellcode (42 bytes)

Linux/x86 - execve /bin/sh + Socket Re-Use Shellcode (50 bytes)
Linux/x86 - execve(/bin/sh) + Socket Re-Use Shellcode (50 bytes)

Linux/MIPS - execve /bin/sh Shellcode (36 bytes)
Linux/MIPS - execve(/bin/sh) Shellcode (36 bytes)

Linux/x86 - execve /bin/sh ROT13 Encoded Shellcode (68 bytes)
Linux/x86 - execve(/bin/sh) ROT13 Encoded Shellcode (68 bytes)

Linux/x86 - execve /bin/sh Obfuscated Shellcode (40 bytes)
Linux/x86 - execve(/bin/sh) Obfuscated Shellcode (40 bytes)

Linux/x86 - execve /bin/sh Shellcode (35 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (35 bytes)
Linux/x86 - Custom execve Shellcode (Encoder/Decoder) (Generator)
Linux/x86 - execve /bin/sh (Push Method) Shellcode (21 bytes)
Linux/x86-64 - execve /bin/sh Via Push Shellcode (23 bytes)
Linux/x86 - 'Followtheleader' Custom execve() Shellcode (Encoder/Decoder) (Generator)
Linux/x86 - execve(/bin/sh) (Push Method) Shellcode (21 bytes)
Linux/x86-64 - execve(/bin/sh) Via Push Shellcode (23 bytes)
Linux/x86 - execve /bin/sh Shellcode (26 bytes)
Linux/x86 - execve /bin/sh Shellcode (21 bytes) (1)
Linux/x86 - execve(/bin/sh) Shellcode (26 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (21 bytes) (1)

Linux/x86-64 - execve /bin/sh Null-Free Shellcode (30 bytes)
Linux/x86-64 - execve(/bin/sh) Null-Free Shellcode (30 bytes)

Linux/x86 - execve /bin/sh Shellcode (23 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (23 bytes)
Linux/x86-64 - execve Encoded Shellcode (57 bytes)
Linux/x86 - execve /bin/sh ROT7 Encoded Shellcode
Linux/x86-64 - execve() Encoded Shellcode (57 bytes)
Linux/x86 - execve(/bin/sh) ROT7 Encoded Shellcode

Linux/x86 - execve /bin/sh ROL/ROR Encoded Shellcode
Linux/x86 - execve(/bin/sh) ROL/ROR Encoded Shellcode

OSX/x86-64 - execve /bin/sh Null-Free Shellcode (34 bytes)
OSX/x86-64 - execve(/bin/sh) Null-Free Shellcode (34 bytes)

Linux/x86 - execve /bin/bash Shellcode (31 bytes)
Linux/x86 - execve(/bin/bash) Shellcode (31 bytes)

Linux/x86-64 - execve /bin/sh Shellcode (34 bytes)
Linux/x86-64 - execve(/bin/sh) Shellcode (34 bytes)

Linux/x86-64 - execve Shellcode (22 bytes)
Linux/x86-64 - execve() Shellcode (22 bytes)

Linux/x86-64 - execve Polymorphic Shellcode (31 bytes)
Linux/x86-64 - execve() + Polymorphic Shellcode (31 bytes)

Linux/x86 - execve /bin/sh Shellcode (24 bytes) (1)
Linux/x86 - execve(/bin/sh) Shellcode (24 bytes) (1)

Linux/x86-64 - execve XOR/NOT/DIV Encoded Shellcode (54 bytes)
Linux/x86-64 - execve() XOR/NOT/DIV Encoded Shellcode (54 bytes)

Linux/x86-64 - execve Stack Polymorphic Shellcode (47 bytes)
Linux/x86-64 - execve() Stack + Polymorphic Shellcode (47 bytes)
Linux/x86-64 - execve /bin/sh Shellcode (26 bytes)
Linux/x86-64 - execve /bin/sh Shellcode (25 bytes) (1)
Linux/x86-64 - execve /bin/bash Shellcode (33 bytes)
Linux/x86-64 - execve(/bin/sh) Shellcode (26 bytes)
Linux/x86-64 - execve(/bin/sh) Shellcode (25 bytes) (1)
Linux/x86-64 - execve(/bin/bash) Shellcode (33 bytes)

Linux/x86-64 - execve XOR Encoded Shellcode (84 bytes)
Linux/x86-64 - execve() XOR Encoded Shellcode (84 bytes)

Linux/x86 - execve /bin/sh + ASLR Bruteforce Shellcode
Linux/x86 - execve(/bin/sh) + ASLR Bruteforce Shellcode

Linux/x86 - execve /bin/sh Shellcode (19 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (19 bytes)
OSX/PPC - Remote findsock by recv() Key Shellcode
OSX/PPC - Reverse TCP Shell (/bin/csh) Shellcode
OSX/PPC - Stager Sock Find MSG_PEEK Shellcode
OSX/PPC - Stager Sock Find Shellcode
OSX/PPC - Stager Sock Reverse Shellcode
OSX/PPC - Bind TCP (8000/TCP) Shell + OSXPPCLongXOR Encoded Shellcode (300 bytes)
OSX/PPC - execve(/bin/sh) Shellcode
OSX/PPC - execve(/bin/sh_[/bin/sh]_NULL) + exit() Shellcode (72 bytes)
OSX/x86 - execve(/bin/sh) Shellcode (24 bytes)
Linux/x86 - Add User (t00r/t00r) PexFnstenvSub Encoded Shellcode (116 bytes)
BSD/x86 - setuid(0) + Break chroot (../ 10x Loop) + execute /bin/sh Shellcode (57 bytes)
BSD/x86 - setuid(0) + Break chroot (../ 10x Loop) + Bind TCP (2222/TCP) Shell Shellcode (133 bytes)
BSD/x86 - Bind TCP (2222/TCP) Shell Shellcode (100 bytes)
Linux/x86 - setuid(0) + Load Kernel Module (/tmp/o.o) Shellcode (67 bytes)
Linux/x86 - setuid(0) + Break chroot (../ 10x Loop) Shellcode (34 bytes)
Solaris/SPARC - setreuid(geteuid()) + setregid(getegid()) + execve(/bin/sh) Shellcode
Solaris/SPARC - Bind TCP (2001/TCP) Shell (/bin/sh) Shellcode
Solaris/SPARC - Bind TCP Shell Shellcode
Solaris/x86 - setuid(0) + /bin/cat /etc/shadow Shellcode (61 bytes)
Solaris/x86 - execve(/bin/sh) Shellcode (43 bytes)
BSD/x86 - setuid(0) + Break chroot (../ 10x Loop) Shellcode (34 bytes)
OpenBSD/x86 - setuid(0) + Load Kernel Module (/tmp/o.o) Shellcode (74 bytes)
BSD/x86 - Break chroot (../ 10x Loop) Shellcode (28 bytes)
BSD/x86 - Break chroot (../ 10x Loop) Shellcode (40 bytes)
Linux/x86 - Flush IPTables Rules (/sbin/iptables -F) + exit() Shellcode (58 bytes)
Linux/x86 - Flush IPChains Rules (/sbin/ipchains -F) + exit() Shellcode (64 bytes)
Linux/x86 - Flush IPChains Rules (/sbin/ipchains -F) Shellcode (58 bytes)
BSD/x86 - symlink /bin/sh sh Shellcode (39 bytes)
Linux/x86 - symlink /bin/sh sh Shellcode (36 bytes)
BSD/x86 - Write to /etc/passwd with uid(0) + gid(0) Shellcode (74 bytes)
Linux/x86 - Write to /etc/passwd with uid(0) + gid(0) Shellcode (74 bytes)
BSD/x86 - execve(/bin/sh) + seteuid(0) Shellcode (31 bytes)
BSD/x86 - execve(/bin/sh) Shellcode (28 bytes)
Linux/x86 - Bind TCP (3879/TCP) Shell (/bin/sh) Shellcode (113 bytes)
Linux/x86 - Add Root User (w00w00) To /etc/passwd Shellcode (104 bytes)
Linux/x86 - Disable Shadowing Shellcode (42 bytes)
Linux/x86 - setuid(0) + execve(/bin/sh) Shellcode (27 bytes)
Linux/x86 - exit(0) / exit(1) Shellcode (3/4 bytes)
Linux/x86 - setuid(0) + execve(/bin/sh_0) Shellcode (25 bytes)
Linux/x86 - setuid(0) + setgid(0) + execve(/bin/sh_[/bin/sh_NULL])) Shellcode (25 bytes)
Linux/x86 - execve(/sbin/shutdown_/sbin/shutdown 0) Shellcode (36 bytes)
Linux/x86 - execve(/sbin/reboot_/sbin/reboot) Shellcode (28 bytes)
Linux/x86 - execve(/sbin/halt_/sbin/halt) Shellcode (27 bytes)
Linux/x86 - Bind TCP (64713/TCP) Shell (/bin/sh) Shellcode (83 bytes)
Linux/x86 - setuid(0) + execve(_/bin/sh__0_0) Shellcode (28 bytes)
Linux/x86 - execve(/bin/sh_0_0) Shellcode (21 bytes)
Linux/x86 - fork() + setreuid(0_ 0) + execve(cp /bin/sh /tmp/sh; chmod 4755 /tmp/sh) Shellcode (126 bytes)
Linux/x86 - Audio (knock knock knock) via /dev/dsp + setreuid(0_0) + execve() Shellcode (566 bytes)
Linux/x86 - Add Root User (w000t) + No Password Shellcode (177 bytes)
Linux/x86 - execve(/sbin/ipchains -F) Shellcode (70 bytes)
Linux/x86 - execve(/sbin/iptables -F) Shellcode (70 bytes)

Linux/x86-64 - execve /bin/sh -c reboot Shellcode (89 bytes)
Linux/x86-64 - execve(/bin/sh) -c reboot Shellcode (89 bytes)

Linux/x86 - execve /bin/bash -c Arbitrary Command Execution Null-Free Shellcode (72 bytes)
Linux/x86 - execve(/bin/bash -c) Arbitrary Command Execution Null-Free Shellcode (72 bytes)

Linux/x86-64 - execve /bin/sh Shellcode (22 bytes)
Linux/x86-64 - execve(/bin/sh) Shellcode (22 bytes)
Linux/x86-64 - setuid(0) + execve(/bin/sh) Polymorphic Shellcode (31 bytes)
Linux/x86-64 - Flush IPTables Rules (/sbin/iptables -F) Polymorphic Shellcode (47 bytes)
Linux/x86-64 - setuid(0) + execve(/bin/sh) + Polymorphic Shellcode (31 bytes)
Linux/x86-64 - Flush IPTables Rules (/sbin/iptables -F) + Polymorphic Shellcode (47 bytes)

Linux/x86-64 - Reverse Netcat Shell (127.0.0.1:1234) Polymorphic Shellcode (106 bytes)
Linux/x86-64 - Reverse Netcat Shell (127.0.0.1:1234) + Polymorphic Shellcode (106 bytes)

Linux/x86 - execve /bin/dash Shellcode (30 bytes)
Linux/x86 - execve(/bin/dash) Shellcode (30 bytes)

Linux/x86 - execve(/bin/sh) Polymorphic Shellcode (53 bytes)
Linux/x86 - execve(/bin/sh) + Polymorphic Shellcode (53 bytes)

FreeBSD/x86-64 - execve /bin/sh Shellcode (28 bytes)
FreeBSD/x86-64 - execve(/bin/sh) Shellcode (28 bytes)

FreeBSD/x86 - //sbin/pfctl -F all Shellcode (47 bytes)
FreeBSD/x86 - /sbin/pfctl -F all Shellcode (47 bytes)

FreeBSD - reboot() Shellcode (15 Bytes)
FreeBSD/x86 - reboot() Shellcode (15 bytes)

Linux/x86-64 - execve(_/sbin/iptables__ [_/sbin/iptables__ _-F_]_ NULL) Shellcode (43 bytes)
Linux/x86-64 - Flush IPTables Rules (execve(_/sbin/iptables__ [_/sbin/iptables__ _-F_]_ NULL)) Shellcode (43 bytes)

Linux/x86-64 - Add Root User (shell-storm/leet) Polymorphic Shellcode (273 bytes)
Linux/x86-64 - Add Root User (shell-storm/leet) + Polymorphic Shellcode (273 bytes)
Linux/x86-64 - execve /bin/sh Shellcode (21 bytes)
Linux/x86 - execve /bin/sh Shellcode (21 bytes)
Linux/x86-64 - execve(/bin/sh) Shellcode (21 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (21 bytes)

Linux/x86-64 - execve /bin/sh Shellcode (31 bytes) (2)
Linux/x86-64 - execve(/bin/sh) Shellcode (31 bytes) (2)
Linux/x86-64 - execve /bin/sh Shellcode (31 bytes) (1)
Linux/x86 - execve /bin/sh + setuid(0) + setgid(0) XOR Encoded Shellcode (66 bytes)
Linux/x86-64 - execve /bin/sh Shellcode (24 bytes)
Linux/x86-64 - execve(/bin/sh) Shellcode (31 bytes) (1)
Linux/x86 - execve(/bin/sh) + setuid(0) + setgid(0) XOR Encoded Shellcode (66 bytes)
Linux/x86-64 - execve(/bin/sh) Shellcode (24 bytes)

Linux/x86 - execve /bin/sh Shellcode (24 bytes)
Linux/x86 - execve(/bin/sh) Shellcode (24 bytes)

Linux/x86 - execve(/bin/sh) Polymorphic Shellcode (30 bytes)
Linux/x86 - execve(/bin/sh) + Polymorphic Shellcode (30 bytes)
 2018-01-17 05:02:19 +00:00
Offensive Security
2d8b561a5d DB: 2018-01-09 
26 changes to exploits/shellcodes

Need for Speed 2 - Remote Client Buffer Overflow
Need for Speed 2 - Remote Client Buffer Overflow (PoC)

Red Faction 1.20 - Server Reply Remote Buffer Overflow
Red Faction 1.20 - Server Reply Remote Buffer Overflow (PoC)

Medal of Honor - Remote Buffer Overflow
Medal of Honor - Remote Buffer Overflow (PoC)

Monolith Games - Local Buffer Overflow
Monolith Games - Local Buffer Overflow (PoC)

BaSoMail - Multiple Buffer Overflow Denial of Service Vulnerabilities
BaSoMail - Multiple Buffer Overflow (Denial of Service) (PoC) Vulnerabilities

Orbz Game 2.10 - Remote Buffer Overflow
Orbz Game 2.10 - Remote Buffer Overflow (PoC)

Painkiller 1.35 - in-game cd-key alpha-numeric Buffer Overflow
Painkiller 1.35 - in-game cd-key alpha-numeric Buffer Overflow (PoC)

KNet Web Server 1.04c - Buffer Overflow Denial of Service
KNet Web Server 1.04c - Buffer Overflow (Denial of Service) (PoC)

ProRat Server 1.9 (Fix-2) - Buffer Overflow Crash
ProRat Server 1.9 (Fix-2) - Buffer Overflow / Crash (PoC)

Mozilla Products - 'Host:' Buffer Overflow Denial of Service String
Mozilla Products - 'Host:' Buffer Overflow (Denial of Service) (PoC) String

Virtools Web Player 3.0.0.100 - Buffer Overflow Denial of Service
Virtools Web Player 3.0.0.100 - Buffer Overflow (Denial of Service) (PoC)

FlatFrag 0.3 - Buffer Overflow / Denial of Service
FlatFrag 0.3 - Buffer Overflow (Denial of Service) (PoC)

zawhttpd 0.8.23 - GET Remote Buffer Overflow Denial of Service
zawhttpd 0.8.23 - GET Remote Buffer Overflow (Denial of Service) (PoC)

TinyFTPD 1.4 - 'USER' Remote Buffer Overflow Denial of Service
TinyFTPD 1.4 - 'USER' Remote Buffer Overflow (Denial of Service) (PoC)

Genecys 0.2 - Buffer Overflow / NULL pointer Denial of Service
Genecys 0.2 - Buffer Overflow / NULL Pointer (Denial of Service)

PunkBuster < 1.229 - WebTool Service Remote Buffer Overflow Denial of Service
PunkBuster < 1.229 - WebTool Service Remote Buffer Overflow (Denial of Service) (PoC)

FlashFXP 3.4.0 build 1145 - Remote Buffer Overflow Denial of Service
FlashFXP 3.4.0 build 1145 - Remote Buffer Overflow (Denial of Service) (PoC)

Snort 2.6.1 - DCE/RPC Preprocessor Remote Buffer Overflow Denial of Service
Snort 2.6.1 - DCE/RPC Preprocessor Remote Buffer Overflow (Denial of Service) (PoC)

TFTP Server 1.3 - Remote Buffer Overflow Denial of Service
TFTP Server 1.3 - Remote Buffer Overflow (Denial of Service) (PoC)

LeadTools Raster - Dialog File_D Object Remote Buffer Overflow
LeadTools Raster - Dialog File_D Object Remote Buffer Overflow (PoC)

LeadTools Raster ISIS Object 'LTRIS14e.DLL 14.5.0.44' - Remote Buffer Overflow
LeadTools Raster ISIS Object 'LTRIS14e.DLL 14.5.0.44' - Remote Buffer Overflow (PoC)

Xserver 0.1 Alpha - POST Remote Buffer Overflow
Xserver 0.1 Alpha - 'POST' Remote Buffer Overflow (PoC)

Microsoft SQL Server - Distributed Management Objects 'sqldmo.dll' Buffer Overflow
Microsoft SQL Server - Distributed Management Objects 'sqldmo.dll' Buffer Overflow (PoC)

QuickTime Player 7.3.1.70 - 'RTSP' Buffer Overflow
QuickTime Player 7.3.1.70 - 'RTSP' Buffer Overflow (PoC)

Crystal Reports XI Release 2 (Enterprise Tree Control) - ActiveX Buffer Overflow / Denial of Service
Crystal Reports XI Release 2 (Enterprise Tree Control) - ActiveX Buffer Overflow (Denial of Service) (PoC)

Surgemail 39e-1 - Authenticated IMAP Remote Buffer Overflow Denial of Service
Surgemail 39e-1 - Authenticated IMAP Remote Buffer Overflow (Denial of Service) (PoC)

Google Picasa 3.5 - Local Buffer Overflow (Denial of Service)
Google Picasa 3.5 - Local Buffer Overflow (Denial of Service) (PoC)
Printoxx - Local Buffer Overflow
Picpuz 2.1.1 - Buffer Overflow Denial of Service (PoC)
Printoxx - Local Buffer Overflow (PoC)
Picpuz 2.1.1 - Buffer Overflow (Denial of Service) (PoC)

Apollo Player 37.0.0.0 - '.aap' Buffer Overflow Denial of Service
Apollo Player 37.0.0.0 - '.aap' Buffer Overflow (Denial of Service) (PoC)

Switch Sound File Converter - '.mpga' Buffer Overflow Denial of Service
Switch Sound File Converter - '.mpga' Buffer Overflow (Denial of Service) (PoC)
Wireshark 1.2.5 - LWRES getaddrbyname Stack Buffer Overflow
Xerox Workcenter 4150 - Remote Buffer Overflow
Wireshark 1.2.5 - 'LWRES getaddrbyname' Stack Buffer Overflow (PoC)
Xerox Workcenter 4150 - Remote Buffer Overflow (PoC)

iPhone / iTouch FtpDisc 1.0 - Buffer Overflow / Denial of Service
iPhone / iTouch FtpDisc 1.0 - Buffer Overflow (Denial of Service) (PoC)

Aircrack-NG Tools svn r1675 - Remote Heap Buffer Overflow
Aircrack-NG Tools svn r1675 - Remote Heap Buffer Overflow (PoC)
Mocha LPD 1.9 - Remote Buffer Overflow Denial of Service (PoC)
FontForge - '.BDF' Font File Stack Buffer Overflow
Mocha LPD 1.9 - Remote Buffer Overflow (Denial of Service) (PoC)
FontForge - '.BDF' Font File Stack Buffer Overflow (PoC)

Multiple Vendor AgentX++ - Stack Buffer Overflow
Multiple Vendor AgentX++ - Stack Buffer Overflow (PoC)

Attachmate Reflection Standard Suite 2008 - ActiveX Buffer Overflow
Attachmate Reflection Standard Suite 2008 - ActiveX Buffer Overflow (PoC)

Haihaisoft PDF Reader OCX Control 1.1.2.0 - Remote Buffer Overflow
Haihaisoft PDF Reader OCX Control 1.1.2.0 - Remote Buffer Overflow (PoC)

FTP Client 0.17-19build1 ACCT (Ubuntu 10.04) - Buffer Overflow
FTP Client 0.17-19build1 ACCT (Ubuntu 10.04) - Buffer Overflow (PoC)

LeadTools ActiveX Raster Twain 16.5 - 'LtocxTwainu.dll' Buffer Overflow
LeadTools ActiveX Raster Twain 16.5 - 'LtocxTwainu.dll' Buffer Overflow (PoC)

Altova DatabaseSpy 2011 - Project File Handling Buffer Overflow
Altova DatabaseSpy 2011 - Project File Handling Buffer Overflow (PoC)

Platinum SDK Library - POST UPnP 'sscanf' Buffer Overflow
Platinum SDK Library - POST UPnP 'sscanf' Buffer Overflow (PoC)

Native Instruments Traktor Pro 1.2.6 - Stack Buffer Overflow
Native Instruments Traktor Pro 1.2.6 - Stack Buffer Overflow (PoC)

Hanso Player 1.4.0.0 - Buffer Overflow Skinfile (Denial of Service)
Hanso Player 1.4.0.0 - 'Skinfile' Buffer Overflow (Denial of Service)
Real player 14.0.2.633 - Buffer Overflow / Denial of Service
GOM Media Player 2.1.6.3499 - Buffer Overflow / Denial of Service
Real player 14.0.2.633 - Buffer Overflow (Denial of Service) (PoC)
GOM Media Player 2.1.6.3499 - Buffer Overflow (Denial of Service) (PoC)

BulletProof FTP Client 2010 - Buffer Overflow
BulletProof FTP Client 2010 - Buffer Overflow (PoC)

KnFTP 1.0.0 Server - Multiple Buffer Overflows (Denial of Service) (PoC)
KnFTP 1.0.0 Server - Multiple Buffer Overflows (Denial of Service) (SEH) (PoC)

Oracle DataDirect - Multiple Native Wire Protocol ODBC Drivers HOST Attribute Stack Buffer Overflows
Oracle DataDirect - Multiple Native Wire Protocol ODBC Drivers HOST Attribute Stack Buffer Overflows (PoC)

CSF Firewall - Buffer Overflow
CSF Firewall - Buffer Overflow (PoC)

Tracker Software pdfSaver ActiveX 3.60 - 'pdfxctrl.dll' Stack Buffer Overflow (SEH)
Tracker Software pdfSaver ActiveX 3.60 - 'pdfxctrl.dll' Stack Buffer Overflow (SEH) (PoC)

Edraw Diagram Component 5 - ActiveX Buffer Overflow Denial of Service
Edraw Diagram Component 5 - ActiveX Buffer Overflow (Denial of Service) (PoC)

Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT - ActiveX Control PlayerPT.ocx sprintf Buffer Overflow
Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT - ActiveX Control PlayerPT.ocx sprintf Buffer Overflow (PoC)

Asterisk - 'ast_parse_digest()' Stack Buffer Overflow
Asterisk - 'ast_parse_digest()' Stack Buffer Overflow (PoC)

GIMP 2.6 script-fu < 2.8.0 - Buffer Overflow
GIMP 2.6 script-fu < 2.8.0 - Buffer Overflow (PoC)

Apple iTunes 10.6.1.7 - '.m3u' Walking Heap Buffer Overflow
Apple iTunes 10.6.1.7 - '.m3u' Walking Heap Buffer Overflow (PoC)

Qbik WinGate 3.0/Pro 4.0.1/Standard 4.0.1 - Buffer Overflow Denial of Service
Qbik WinGate 3.0/Pro 4.0.1/Standard 4.0.1 - Buffer Overflow (Denial of Service) (PoC)

Lattice Diamond Programmer 1.4.2 - Buffer Overflow
Lattice Diamond Programmer 1.4.2 - Buffer Overflow (PoC)
Ipswitch IMail 5.0 - Whois32 Daemon Buffer Overflow Denial of Service
Ipswitch IMail 5.0 - Imapd Buffer Overflow Denial of Service
Ipswitch IMail 5.0 - LDAP Buffer Overflow Denial of Service
Ipswitch IMail 5.0 - IMonitor Buffer Overflow Denial of Service
Ipswitch IMail 5.0/6.0 - Web Service Buffer Overflow Denial of Service
Ipswitch IMail 5.0 - Whois32 Daemon Buffer Overflow (Denial of Service) (PoC)
Ipswitch IMail 5.0 - Imapd Buffer Overflow (Denial of Service) (PoC)
Ipswitch IMail 5.0 - LDAP Buffer Overflow (Denial of Service) (PoC)
Ipswitch IMail 5.0 - IMonitor Buffer Overflow (Denial of Service) (PoC)
Ipswitch IMail 5.0/6.0 - Web Service Buffer Overflow (Denial of Service) (PoC)

Netscape Enterprise Server 3.6 - SSL Buffer Overflow Denial of Service
Netscape Enterprise Server 3.6 - SSL Buffer Overflow (Denial of Service) (PoC)

Ipswitch IMail 5.0.5/5.0.6/5.0.7 - POP3 Denial of Service / Buffer Overflow
Ipswitch IMail 5.0.5/5.0.6/5.0.7 - POP3 Denial of Service / Buffer Overflow (PoC)

Gene6 G6 FTP Server 2.0 - Buffer Overflow Denial of Service
Gene6 G6 FTP Server 2.0 - Buffer Overflow (Denial of Service) (PoC)

RedHat Linux 6.x - X Font Server Denial of Service / Buffer Overflow
RedHat Linux 6.x - X Font Server Buffer Overflow (Denial of Service)

Computalynx CProxy Server 3.3 SP2 - Buffer Overflow Denial of Service
Computalynx CProxy Server 3.3 SP2 - Buffer Overflow (Denial of Service) (PoC)

Cerberus FTP Server 1.x - Buffer Overflow Denial of Service
Cerberus FTP Server 1.x - Buffer Overflow (Denial of Service) (PoC)

Microsoft SQL Server 2000 - SQLXML Buffer Overflow
Microsoft SQL Server 2000 - 'SQLXML' Buffer Overflow (PoC)

Microsoft SQL Server 2000 / Microsoft Jet 4.0 Engine - Unicode Buffer Overflow
Microsoft SQL Server 2000 / Microsoft Jet 4.0 Engine - Unicode Buffer Overflow (PoC)

Intellicom 1.3 - 'NetBiterConfig.exe Hostname' Data Remote Stack Buffer Overflow
Intellicom 1.3 - 'NetBiterConfig.exe Hostname' Data Remote Stack Buffer Overflow (PoC)

Hotfoon Dialer 4.0 - Buffer Overflow
Hotfoon Dialer 4.0 - Buffer Overflow (PoC)

IISPop 1.161/1.181 - Remote Buffer Overflow Denial of Service
IISPop 1.161/1.181 - Remote Buffer Overflow (Denial of Service) (PoC)

Linksys Devices 1.42/1.43 - GET Buffer Overflow
Linksys Devices 1.42/1.43 - 'GET' Buffer Overflow (PoC)

iCal 3.7 - Remote Buffer Overflow
iCal 3.7 - Remote Buffer Overflow (PoC)

Microsoft Windows NT/2000 - 'cmd.exe' CD Buffer Overflow
Microsoft Windows NT/2000 - 'cmd.exe' CD Buffer Overflow (PoC)

Dr.Web 4.x - Virus Scanner Folder Name Buffer Overflow
Dr.Web 4.x - Virus Scanner Folder Name Buffer Overflow (PoC)

Xeneo Web Server 2.2.10 - Undisclosed Buffer Overflow
Xeneo Web Server 2.2.10 - Undisclosed Buffer Overflow (PoC)

Microsoft NetMeeting 2.1/3.0.1 4.4.3385 - CALLTO URL Buffer Overflow
Microsoft NetMeeting 2.1/3.0.1 4.4.3385 - CALLTO URL Buffer Overflow (PoC)

Zoner Photo Studio 15 b3 - Buffer Overflow
Zoner Photo Studio 15 b3 - Buffer Overflow (PoC)

Novell Netware Enterprise Web Server 5.1/6.0 - CGI2Perl.NLM Buffer Overflow
Novell Netware Enterprise Web Server 5.1/6.0 - 'CGI2Perl.NLM' Buffer Overflow (PoC)

IBM U2 UniVerse 10.0.0.9 - uvrestore Buffer Overflow
IBM U2 UniVerse 10.0.0.9 - 'uvrestore' Buffer Overflow (PoC)

Avant Browser 8.0.2 - 'HTTP Request' Buffer Overflow
Avant Browser 8.0.2 - 'HTTP Request' Buffer Overflow (PoC)

NullSoft Winamp 2.81/2.91/3.0/3.1 - MIDI Plugin 'IN_MIDI.dll' Track Data Size Buffer Overflow
NullSoft Winamp 2.81/2.91/3.0/3.1 - MIDI Plugin 'IN_MIDI.dll' Track Data Size Buffer Overflow (PoC)

myServer 0.4.x - 'cgi-lib.dll' Remote Buffer Overflow
myServer 0.4.x - 'cgi-lib.dll' Remote Buffer Overflow (PoC)

EffectOffice Server 2.6 - Remote Service Buffer Overflow
EffectOffice Server 2.6 - Remote Service Buffer Overflow (PoC)

Surfboard HTTPd 1.1.9 - Remote Buffer Overflow
Surfboard HTTPd 1.1.9 - Remote Buffer Overflow (PoC)

1st Class Internet Solutions 1st Class Mail Server 4.0 - Remote Buffer Overflow
1st Class Internet Solutions 1st Class Mail Server 4.0 - Remote Buffer Overflow (PoC)

Blaxxun Contact 3D - X-CC3D Browser Object Buffer Overflow
Blaxxun Contact 3D - X-CC3D Browser Object Buffer Overflow (PoC)

Mcafee FreeScan CoMcFreeScan Browser - Object Buffer Overflow
Mcafee FreeScan CoMcFreeScan Browser - Object Buffer Overflow (PoC)

Foxit Reader 5.4.4.1128 Firefox Plugin - 'npFoxitReaderPlugin.dll' Stack Buffer Overflow
Foxit Reader 5.4.4.1128 Firefox Plugin - 'npFoxitReaderPlugin.dll' Stack Buffer Overflow (PoC)

DeleGate 7.8.x/8.x - SSLway Filter Remote Stack Buffer Overflow
DeleGate 7.8.x/8.x - SSLway Filter Remote Stack Buffer Overflow (PoC)

VMware Workstation - 'vprintproxy.exe' TrueType NAME Tables Heap Buffer Overflow
VMware Workstation - 'vprintproxy.exe' TrueType NAME Tables Heap Buffer Overflow (PoC)

aGSM 2.35 Half-Life Server - Info Response Buffer Overflow
aGSM 2.35 Half-Life Server - Info Response Buffer Overflow (PoC)

cURL - Buffer Overflow
cURL - Buffer Overflow (PoC)

TagScanner 5.1 - Stack Buffer Overflow
TagScanner 5.1 - Stack Buffer Overflow (PoC)

Linux Kernel - 'SCTP_GET_ASSOC_STATS()' Stack Buffer Overflow
Linux Kernel - 'SCTP_GET_ASSOC_STATS()' Stack Buffer Overflow (PoC)

Allied Telesyn TFTP (AT-TFTP) Server/Daemon 2.0 - Stack Buffer Overflow Denial of Service
Allied Telesyn TFTP (AT-TFTP) Server/Daemon 2.0 - Stack Buffer Overflow (Denial of Service) (PoC)

QwikMail 0.3 - HELO Command Buffer Overflow
QwikMail 0.3 - 'HELO' Buffer Overflow (PoC)

NullSoft Winamp 5.0.x - Variant 'IN_CDDA.dll' Remote Buffer Overflow
NullSoft Winamp 5.0.x - Variant 'IN_CDDA.dll' Remote Buffer Overflow (PoC)

Huawei SNMPv3 Service - Multiple Buffer Overflow Vulnerabilities
Huawei SNMPv3 Service - Multiple Buffer Overflow Vulnerabilities (PoC)

Star Wars Jedi Knight: Jedi Academy 1.0.11 - Buffer Overflow
Star Wars Jedi Knight: Jedi Academy 1.0.11 - Buffer Overflow (PoC)

AN HTTPD - 'CMDIS.dll' Remote Buffer Overflow
AN HTTPD - 'CMDIS.dll' Remote Buffer Overflow (PoC)

Serva 32 TFTP 2.1.0 - Buffer Overflow Denial of Service
Serva 32 TFTP 2.1.0 - Buffer Overflow (Denial of Service) (PoC)

Orenosv HTTP/FTP Server 0.8.1 - 'CGISSI.exe' Remote Buffer Overflow
Orenosv HTTP/FTP Server 0.8.1 - 'CGISSI.exe' Remote Buffer Overflow (PoC)

Linux Kernel 2.2.x/2.3.x/2.4.x/2.5.x/2.6.x - ELF Core Dump Local Buffer Overflow
Linux Kernel 2.2.x/2.3.x/2.4.x/2.5.x/2.6.x - ELF Core Dump Local Buffer Overflow (PoC)

PlanetDNS PlanetFileServer - Remote Buffer Overflow
PlanetDNS PlanetFileServer - Remote Buffer Overflow (PoC)

Alt-N MDaemon 8.0 - IMAP Server CREATE Remote Buffer Overflow
Alt-N MDaemon 8.0 - IMAP Server CREATE Remote Buffer Overflow (PoC)

Ubiquiti airCam RTSP Service 1.1.5 - Buffer Overflow
Ubiquiti airCam RTSP Service 1.1.5 - Buffer Overflow (PoC)

LeapFTP Client 2.7.3/2.7.4 - '.LSQ' File Remote Buffer Overflow
LeapFTP Client 2.7.3/2.7.4 - '.LSQ' File Remote Buffer Overflow (PoC)

VbsEdit 5.9.3 - '.smi' Buffer Overflow
VbsEdit 5.9.3 - '.smi' Buffer Overflow (PoC)

Microsoft Windows XP/2000/2003 - MHTML URI Buffer Overflow
Microsoft Windows XP/2000/2003 - MHTML URI Buffer Overflow (PoC)

AGEphone 1.28/1.38 - SIP Packet Handling Buffer Overflow
AGEphone 1.28/1.38 - SIP Packet Handling Buffer Overflow (PoC)

DSocks 1.3 - 'Name' Buffer Overflow
DSocks 1.3 - 'Name' Buffer Overflow (PoC)

IcoFX 2.5.0.0 - '.ico' Buffer Overflow
IcoFX 2.5.0.0 - '.ico' Buffer Overflow (PoC)
Microsoft Class Package Export Tool 5.0.2752 - 'Clspack.exe' Local Buffer Overflow
Microsoft Windows XP - 'cmd.exe' Buffer Overflow
Microsoft Class Package Export Tool 5.0.2752 - 'Clspack.exe' Local Buffer Overflow (PoC)
Microsoft Windows XP - 'cmd.exe' Buffer Overflow (PoC)

Packeteer PacketShaper 8.0 - Multiple Buffer Overflow Denial of Service Vulnerabilities
Packeteer PacketShaper 8.0 - Multiple Buffer Overflow (Denial of Service) (PoC) Vulnerabilities

Bochs 2.3 - Buffer Overflow / Denial of Service
Bochs 2.3 - Buffer Overflow (Denial of Service) (PoC)

Blue Coat Systems K9 Web Protection 32.36 - Remote Buffer Overflow
Blue Coat Systems K9 Web Protection 32.36 - Remote Buffer Overflow (PoC)
Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (1)
Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (2)
Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (1)
Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (2)

T1lib - intT1_Env_GetCompletePath Buffer Overflow
T1lib - 'intT1_Env_GetCompletePath' Buffer Overflow (PoC)

Foxmail Email Client 6.5 - 'mailto' Buffer Overflow
Foxmail Email Client 6.5 - 'mailto' Buffer Overflow (PoC)
Microsoft Windows Media Digital Rights Management - ActiveX Control Buffer Overflow
Yahoo! Toolbar 1.4.1 Helper - Class ActiveX Control Remote Buffer Overflow Denial of Service
Microsoft Windows Media Digital Rights Management - ActiveX Control Buffer Overflow (PoC)
Yahoo! Toolbar 1.4.1 Helper - Class ActiveX Control Remote Buffer Overflow (Denial of Service) (PoC)

Xine-Lib 1.1.9 - 'rmff_dump_cont()' Remote Heap Buffer Overflow
Xine-Lib 1.1.9 - 'rmff_dump_cont()' Remote Heap Buffer Overflow (PoC)

Titan FTP Server 6.05 build 550 - 'DELE' Remote Buffer Overflow
Titan FTP Server 6.05 build 550 - 'DELE' Remote Buffer Overflow (PoC)

MW6 Technologies Aztec - ActiveX 'Data' Buffer Overflow
MW6 Technologies Aztec - ActiveX 'Data' Buffer Overflow (PoC)

MW6 Technologies MaxiCode - ActiveX 'Data' Buffer Overflow
MW6 Technologies MaxiCode - ActiveX 'Data' Buffer Overflow (PoC)

Trend Micro OfficeScan - Buffer Overflow / Denial of Service
Trend Micro OfficeScan - Buffer Overflow (Denial of Service) (PoC)

ICQ 6 - 'Personal Status Manager' Remote Buffer Overflow
ICQ 6 - 'Personal Status Manager' Remote Buffer Overflow (PoC)

Catia V5-6R2013 - 'CATV5_AllApplications' Stack Buffer Overflow
Catia V5-6R2013 - 'CATV5_AllApplications' Stack Buffer Overflow (PoC)

Catia V5-6R2013 - 'CATV5_Backbone_Bus' Stack Buffer Overflow
Catia V5-6R2013 - 'CATV5_Backbone_Bus' Stack Buffer Overflow (PoC)

NASA Ames Research Center BigView 1.8 - '.PNM' Stack Buffer Overflow
NASA Ames Research Center BigView 1.8 - '.PNM' Stack Buffer Overflow (PoC)

ZoneAlarm Security Suite 7.0 - AntiVirus Directory Path Buffer Overflow
ZoneAlarm Security Suite 7.0 - AntiVirus Directory Path Buffer Overflow (PoC)

A10 Networks ACOS 2.7.0-P2 (build: 53) - Buffer Overflow
A10 Networks ACOS 2.7.0-P2 (Build 53) - Buffer Overflow (PoC)

Internet Download Manager 5.15 Build 3 - Language File Parsing Buffer Overflow
Internet Download Manager 5.15 Build 3 - Language File Parsing Buffer Overflow (PoC)

Jzip - Buffer Overflow (SEH Unicode) (Denial of Service)
Jzip - Buffer Overflow (Denial of Service) (SEH Unicode)

Sendmail 8.12.x - 'X-header' Remote Heap Buffer Overflow
Sendmail 8.12.x - 'X-header' Remote Heap Buffer Overflow (PoC)

BaoFeng Storm 3.9.62 - '.Playlist' File Buffer Overflow
BaoFeng Storm 3.9.62 - '.Playlist' File Buffer Overflow (PoC)

Adobe Flash Player 10.0.22 and AIR - URI Parsing Heap Buffer Overflow
Adobe Flash Player 10.0.22 / AIR - URI Parsing Heap Buffer Overflow (PoC)

Novell Groupwise Client 7.0.3.1294 - 'gxmim1.dll' ActiveX Control Buffer Overflow
Novell Groupwise Client 7.0.3.1294 - 'gxmim1.dll' ActiveX Control Buffer Overflow (PoC)

Sun Java System Web Server 6.1/7.0 - 'TRACE' Heap Buffer Overflow
Sun Java System Web Server 6.1/7.0 - 'TRACE' Heap Buffer Overflow (PoC)

Xerox WorkCentre - PJL Daemon Buffer Overflow
Xerox WorkCentre - PJL Daemon Buffer Overflow (PoC)

Zeus Web Server 4.x - 'SSL2_CLIENT_HELLO' Remote Buffer Overflow
Zeus Web Server 4.x - 'SSL2_CLIENT_HELLO' Remote Buffer Overflow (PoC)

Gracenote CDDBControl - ActiveX Control 'ViewProfile' Method Heap Buffer Overflow
Gracenote CDDBControl - ActiveX Control 'ViewProfile' Method Heap Buffer Overflow (PoC)

Mocha W32 LPD 1.9 - Remote Buffer Overflow
Mocha W32 LPD 1.9 - Remote Buffer Overflow (PoC)

Ubisoft Rayman Legends 1.2.103716 - Remote Stack Buffer Overflow
Ubisoft Rayman Legends 1.2.103716 - Remote Stack Buffer Overflow (PoC)

BulletProof FTP Client 2010 - Buffer Overflow (SEH)
BulletProof FTP Client 2010 - Buffer Overflow (SEH) (PoC)

Unreal Engine 2.5 - 'UpdateConnectingMessage()' Remote Stack Buffer Overflow
Unreal Engine 2.5 - 'UpdateConnectingMessage()' Remote Stack Buffer Overflow (PoC)

D-Link WBR-2310 1.0.4 - GET Remote Buffer Overflow
D-Link WBR-2310 1.0.4 - 'GET' Remote Buffer Overflow (PoC)

HTML Help Workshop 1.4 - Buffer Overflow (SEH)
HTML Help Workshop 1.4 - Buffer Overflow (SEH) (PoC)

Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - '.wax' File Buffer Overflow / Denial of Service EIP Overwrite
Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - '.wax' File Buffer Overflow (Denial of Service) (PoC) EIP Overwrite

TRENDnet SecurView Wireless Network Camera TV-IP422WN - 'UltraCamX.ocx' Stack Buffer Overflow
TRENDnet SecurView Wireless Network Camera TV-IP422WN - 'UltraCamX.ocx' Stack Buffer Overflow (PoC)
Mediacoder 0.8.33 build 5680 - '.m3u' Buffer Overflow (SEH) (Denial of Service)
Mediacoder 0.8.33 build 5680 - '.lst' Buffer Overflow (SEH) (Denial of Service)
Mediacoder 0.8.33 build 5680 - '.m3u' Buffer Overflow (Denial of Service) (SEH) (PoC)
Mediacoder 0.8.33 build 5680 - '.lst' Buffer Overflow (Denial of Service) (SEH) (PoC)

G-WAN 2.10.6 - Buffer Overflow / Denial of Service
G-WAN 2.10.6 - Buffer Overflow (Denial of Service) (PoC)

Opera Web Browser 11.52 - Escape Sequence Stack Buffer Overflow Denial of Service
Opera Web Browser 11.52 - Escape Sequence Stack Buffer Overflow (Denial of Service) (PoC)

TestDisk 6.14 - Check_OS2MB Stack Buffer Overflow
TestDisk 6.14 - 'Check_OS2MB' Stack Buffer Overflow (PoC)

ZOC SSH Client - Buffer Overflow (SEH)
ZOC SSH Client - Buffer Overflow (SEH) (PoC)

WebDrive 12.2 (B4172) - Buffer Overflow
WebDrive 12.2 (B4172) - Buffer Overflow (PoC)

PFTP Server 8.0f Lite - textfield Local Buffer Overflow (SEH)
PFTP Server 8.0f Lite - textfield Local Buffer Overflow (SEH) (PoC)

Mpxplay MultiMedia Commander 2.00a - '.m3u' Stack Buffer Overflow
Mpxplay MultiMedia Commander 2.00a - '.m3u' Stack Buffer Overflow (PoC)
IKEView.exe Fox Beta 1 - Stack Buffer Overflow
IKEView.exe R60 - Stack Buffer Overflow
IKEView.exe Fox Beta 1 - Stack Buffer Overflow (PoC)
IKEView.exe R60 - Stack Buffer Overflow (PoC)

Apple Mac OSX Regex Engine (TRE) - Stack Buffer Overflow
Apple Mac OSX Regex Engine (TRE) - Stack Buffer Overflow (PoC)

Git 1.9.5 - 'ssh-agent.exe' Buffer Overflow
Git 1.9.5 - 'ssh-agent.exe' Buffer Overflow (PoC)
LanSpy 2.0.0.155 - Buffer Overflow
LanWhoIs.exe 1.0.1.120 - Stack Buffer Overflow
Last PassBroker 3.2.16 - Stack Buffer Overflow
LanSpy 2.0.0.155 - Buffer Overflow (PoC)
LanWhoIs.exe 1.0.1.120 - Stack Buffer Overflow (PoC)
Last PassBroker 3.2.16 - Stack Buffer Overflow (PoC)

Python 2.7 hotshot Module - 'pack_string' Heap Buffer Overflow
Python 2.7 hotshot Module - 'pack_string' Heap Buffer Overflow (PoC)
TECO SG2 FBD Client 3.51 - '.gfb' Overwrite Buffer Overflow (SEH)
TECO TP3-PCLINK 2.1 - '.tpc' File Handling Buffer Overflow
TECO AP-PCLINK 1.094 - '.tpc' File Handling Buffer Overflow
TECO SG2 FBD Client 3.51 - '.gfb' Overwrite Buffer Overflow (SEH) (PoC)
TECO TP3-PCLINK 2.1 - '.tpc' Handling Buffer Overflow (PoC)
TECO AP-PCLINK 1.094 - '.tpc' File Handling Buffer Overflow (PoC)
IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - _FXCLI_SetConfFileChunk Stack Buffer Overflow
IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - _FXCLI_GetConfFileChunk Stack Buffer Overflow
IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - '_FXCLI_SetConfFileChunk' Stack Buffer Overflow (PoC)
IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - '_FXCLI_GetConfFileChunk' Stack Buffer Overflow (PoC)

Advanced Encryption Package Buffer Overflow - Denial of Service
Advanced Encryption Package - Buffer Overflow (Denial of Service) (PoC)

InfraRecorder - '.m3u' File Buffer Overflow
InfraRecorder - '.m3u' File Buffer Overflow (PoC)

Autonics DAQMaster 1.7.3 - DQP Parsing Buffer Overflow Code Execution
Autonics DAQMaster 1.7.3 - DQP Parsing Buffer Overflow Code Execution (PoC)
Baumer VeriSens Application Suite 2.6.2 - Buffer Overflow
yTree 1.94-1.1 - Local Buffer Overflow
Baumer VeriSens Application Suite 2.6.2 - Buffer Overflow (PoC)
yTree 1.94-1.1 - Local Buffer Overflow (PoC)

NTPd ntp-4.2.6p5 - 'ctl_putdata()' Buffer Overflow
NTPd ntp-4.2.6p5 - 'ctl_putdata()' Buffer Overflow (PoC)

CyberCop Scanner Smbgrind 5.5 - Buffer Overflow
CyberCop Scanner Smbgrind 5.5 - Buffer Overflow (PoC)
STIMS Buffer 1.1.20 - Buffer Overflow (SEH) (Denial of Service)
STIMS Cutter 1.1.3.20 - Buffer Overflow Denial of Service
STIMS Buffer 1.1.20 - Buffer Overflow (Denial of Service) (SEH) (PoC)
STIMS Cutter 1.1.3.20 - Buffer Overflow (Denial of Service) (PoC)

4digits 1.1.4 - Local Buffer Overflow
4digits 1.1.4 - Local Buffer Overflow (PoC)

Websockify (C Implementation) 0.8.0 - Buffer Overflow
Websockify (C Implementation) 0.8.0 - Buffer Overflow (PoC)

Google Android - '/system/bin/sdcard' Stack Buffer Overflow
Google Android - '/system/bin/sdcard' Stack Buffer Overflow (PoC)

Oracle Orakill.exe 11.2.0 - Buffer Overflow
Oracle Orakill.exe 11.2.0 - Buffer Overflow (PoC)

Symantec AntiVirus - 'dec2lha Library' Remote Stack Buffer Overflow
Symantec AntiVirus - 'dec2lha Library' Remote Stack Buffer Overflow (PoC)
Symantec AntiVirus - PowerPoint Misaligned Stream-cache Remote Stack Buffer Overflow
Core FTP LE 2.2 - Path Field Local Buffer Overflow
Symantec AntiVirus - PowerPoint Misaligned Stream-cache Remote Stack Buffer Overflow (PoC)
Core FTP LE 2.2 - Path Field Local Buffer Overflow (PoC)

Micro Focus Rumba 9.3 - ActiveX Stack Buffer Overflow
Micro Focus Rumba 9.3 - ActiveX Stack Buffer Overflow (PoC)

ConQuest DICOM Server 1.4.17d - Stack Buffer Overflow
ConQuest DICOM Server 1.4.17d - Stack Buffer (PoC)

QNAP NVR/NAS - Buffer Overflow
QNAP NVR/NAS - Buffer Overflow (PoC)
Cerberus FTP Server 8.0.10.3 - 'MLST' Buffer Overflow
CDex 1.96 - Buffer Overflow
Cerberus FTP Server 8.0.10.3 - 'MLST' Buffer Overflow (PoC)
CDex 1.96 - Buffer Overflow (PoC)

Zoom Linux Client 2.0.106600.0904 - Stack-Based Buffer Overflow
Zoom Linux Client 2.0.106600.0904 - Stack-Based Buffer Overflow (PoC)

D3DGear 5.00 Build 2175 - Buffer Overflow
D3DGear 5.00 Build 2175 - Buffer Overflow (PoC)
VX Search Enterprise 10.1.12 - Denial of Service
Disk Pulse Enterprise 10.1.18 - Denial of Service
Sync Breeze Enterprise 10.1.16 - Denial of Service
DiskBoss Enterprise 8.5.12 - Denial of Service
BarcodeWiz ActiveX Control < 6.7 - Buffer Overflow (PoC)

APNGDis 2.8 - 'filename' Stack Buffer Overflow
APNGDis 2.8 - 'filename' Stack Buffer Overflow (PoC)

wifirxpower - Local Buffer Overflow
wifirxpower - Local Buffer Overflow (PoC)
pinfo 0.6.9 - Local Buffer Overflow
Dmitry 1.3a - Local Buffer Overflow
pinfo 0.6.9 - Local Buffer Overflow (PoC)
Dmitry 1.3a - Local Buffer Overflow (PoC)

Mapscrn 2.03 - Local Buffer Overflow
Mapscrn 2.03 - Local Buffer Overflow (PoC)

Stunnel 3.24/4.00 - Daemon Hijacking (PoC)
Stunnel 3.24/4.00 - Daemon Hijacking

Linux Kernel 2.4.22 - 'do_brk()' Local Privilege Escalation (PoC)
Linux Kernel 2.4.22 - 'do_brk()' Local Privilege Escalation
Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (PoC) (1)
Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (PoC) (2)
Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (1)
Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (2)

Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator (PoC)
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator

WinZip - MIME Parsing Overflow (PoC)
WinZip - MIME Parsing Overflow
glFTPd (Slackware 9.0/9.1/10.0) - Local Stack Overflow (PoC)
GNU Sharutils 4.2.1 - Local Format String (PoC)
glFTPd (Slackware 9.0/9.1/10.0) - Local Stack Overflow
GNU Sharutils 4.2.1 - Local Format String
GD Graphics Library - Local Heap Overflow (PoC)
libxml 2.6.12 nanoftp - Buffer Overflow (PoC)
GD Graphics Library - Local Heap Overflow
libxml 2.6.12 nanoftp - Buffer Overflow

WinRAR 3.4.1 - Corrupt '.ZIP' File (PoC)
WinRAR 3.4.1 - Corrupt '.ZIP' File

Exim 4.41 - 'dns_build_reverse' Local (PoC)
Exim 4.41 - 'dns_build_reverse' Local
tiffsplit (libtiff 3.8.2) - Local Stack Buffer Overflow (PoC)
Microsoft Windows - NtClose DeadLock (PoC) (MS06-030)
Microsoft Windows XP/2000 - 'Mrxsmb.sys' Local Privilege Escalation (PoC) (MS06-030)
tiffsplit (libtiff 3.8.2) - Local Stack Buffer Overflow
Microsoft Windows - NtClose DeadLock (MS06-030)
Microsoft Windows XP/2000 - 'Mrxsmb.sys' Local Privilege Escalation (MS06-030)

Microsoft Word 2000/2003 - Hlink Local Buffer Overflow (PoC)
Microsoft Word 2000/2003 - Hlink Local Buffer Overflow

Cheese Tracker 0.9.9 - Local Buffer Overflow (PoC)
Cheese Tracker 0.9.9 - Local Buffer Overflow

PHP 4.4.3/5.1.4 - 'objIndex' Local Buffer Overflow (PoC)
PHP 4.4.3/5.1.4 - 'objIndex' Local Buffer Overflow

BlazeVideo HDTV Player 2.1 - '.PLF' Local Buffer Overflow (PoC)
BlazeVideo HDTV Player 2.1 - '.PLF' Local Buffer Overflow

Rumpus 5.1 - Local Privilege Escalation / Remote FTP LIST (PoC)
Rumpus 5.1 - Local Privilege Escalation / Remote FTP LIST
PHP 4.4.6 - 'crack_opendict()' Local Buffer Overflow (PoC)
PHP 4.4.6 - 'snmpget()' Object id Local Buffer Overflow (PoC)
PHP 4.4.6 - 'crack_opendict()' Local Buffer Overflow
PHP 4.4.6 - 'snmpget()' Object id Local Buffer Overflow

PHP 4.4.6 - 'cpdf_open()' Local Source Code Disclosure (PoC)
PHP 4.4.6 - 'cpdf_open()' Local Source Code Disclosure
WinPcap 4.0 - 'NPF.SYS' Local Privilege Escalation (PoC)
Linux Kernel < 2.6.20.2 - 'IPv6_Getsockopt_Sticky' Memory Leak (PoC)
WinPcap 4.0 - 'NPF.SYS' Local Privilege Escalation
Linux Kernel < 2.6.20.2 - 'IPv6_Getsockopt_Sticky' Memory Leak

Kodak Image Viewer - TIF/TIFF Code Execution (PoC) (MS07-055)
Kodak Image Viewer - TIF/TIFF Code Execution (MS07-055)

Microsoft Jet Engine - '.MDB' File Parsing Stack Overflow (PoC)
Microsoft Jet Engine - '.MDB' File Parsing Stack Overflow

Microsoft Windows Media Player 6.4 - '.MP4' File Stack Overflow (PoC)
Microsoft Windows Media Player 6.4 - '.MP4' File Stack Overflow

DESlock+ < 3.2.6 - 'LIST' Local Kernel Memory Leak (PoC)
DESlock+ < 3.2.6 - 'LIST' Local Kernel Memory Leak

XnView 1.93.6 - '.taac' Local Buffer Overflow (PoC)
XnView 1.93.6 - '.taac' Local Buffer Overflow
OllyDBG 1.10 and ImpREC 1.7f - Export Name Buffer Overflow (PoC)
Poppler 0.8.4 - libpoppler Uninitialized pointer Code Execution (PoC)
OllyDBG 1.10 and ImpREC 1.7f - Export Name Buffer Overflow
Poppler 0.8.4 - libpoppler Uninitialized pointer Code Execution

Microsoft Windows Server 2003 - Token Kidnapping Local (PoC)
Microsoft Windows Server 2003 - Token Kidnapping Local

Debian - Symlink In Login Arbitrary File Ownership (PoC)
Debian - Symlink In Login Arbitrary File Ownership

Trend Micro Internet Security Pro 2009 - Priviliege Escalation (PoC)
Trend Micro Internet Security Pro 2009 - Priviliege Escalation

Atomix Virtual Dj Pro 6.0 - Local Stack Buffer Overflow (PoC) (SEH)
Atomix Virtual Dj Pro 6.0 - Local Stack Buffer Overflow (SEH)

Linux Kernel 2.6.31-rc7 - 'AF_LLC getsockname' 5-Byte Stack Disclosure (PoC)
Linux Kernel 2.6.31-rc7 - 'AF_LLC getsockname' 5-Byte Stack Disclosure

Portable E.M Magic Morph 1.95b - '.MOR' File Stack Buffer Overflow (PoC)
Portable E.M Magic Morph 1.95b - '.MOR' File Stack Buffer Overflow

GPG2/Kleopatra 2.0.11 - Malformed Certificate (PoC)
GPG2/Kleopatra 2.0.11 - Malformed Certificate

Alleycode 2.21 - Local Overflow (SEH) (PoC)
Alleycode 2.21 - Local Overflow (SEH)

GPG4Win GNU - Privacy Assistant (PoC)
GPG4Win GNU - Privacy Assistant

VMware Fusion 2.0.5 - vmx86 kext Local (PoC)
VMware Fusion 2.0.5 - vmx86 kext Local

Mozilla Codesighs - Memory Corruption (PoC)
Mozilla Codesighs - Memory Corruption

Winamp 5.05 < 5.13 - '.ini' Local Stack Buffer Overflow (PoC)
Winamp 5.05 < 5.13 - '.ini' Local Stack Buffer Overflow

LDAP - Injection (PoC)
LDAP - Injection

QuickZip 4.x - '.zip' Local Universal Buffer Overflow (PoC)
QuickZip 4.x - '.zip' Local Universal Buffer Overflow
ZippHo 3.0.6 - '.zip' Local Stack Buffer Overflow (PoC)
Crimson Editor r3.70 - Overwrite (SEH) (PoC)
Kenward Zipper 1.4 - Local Stack Buffer Overflow (PoC)
ZippHo 3.0.6 - '.zip' Local Stack Buffer Overflow
Crimson Editor r3.70 - Overwrite (SEH)
Kenward Zipper 1.4 - Local Stack Buffer Overflow

Stud_PE 2.6.05 - Local Stack Overflow (PoC)
Stud_PE 2.6.05 - Local Stack Overflow

Zip Unzip 6.0 - '.zip' Local Stack Buffer Overflow (PoC)
Zip Unzip 6.0 - '.zip' Local Stack Buffer Overflow

EDraw Flowchart ActiveX Control 2.3 - '.edd parsing' Buffer Overflow (PoC)
EDraw Flowchart ActiveX Control 2.3 - '.edd parsing' Buffer Overflow

Easyzip 2000 3.5 - '.zip' Local Stack Buffer Overflow (PoC)
Easyzip 2000 3.5 - '.zip' Local Stack Buffer Overflow
PhotoFiltre Studio X - '.tif' Local Buffer Overflow (PoC)
Beyond Compare 3.0.13 b9599 - '.zip' Local Stack Buffer Overflow (PoC)
PhotoFiltre Studio X - '.tif' Local Buffer Overflow
Beyond Compare 3.0.13 b9599 - '.zip' Local Stack Buffer Overflow

Shellzip 3.0 Beta 3 - '.zip' Local Stack Buffer Overflow (PoC)
Shellzip 3.0 Beta 3 - '.zip' Local Stack Buffer Overflow

Audio Converter 8.1 - Local Stack Buffer Overflow (PoC)
Audio Converter 8.1 - Local Stack Buffer Overflow
Audio Converter 8.1 - Local Stack Buffer Overflow (PoC) ROP/WPM
SureThing CD Labeler - '.m3u/.pls' Unicode Stack Overflow (PoC)
Audio Converter 8.1 - Local Stack Buffer Overflow ROP/WPM
SureThing CD Labeler - '.m3u/.pls' Unicode Stack Overflow

BlazeDVD 5.1 (Windows 7) - '.plf' File Stack Buffer Overflow (PoC) (ASLR + DEP Bypass)
BlazeDVD 5.1 (Windows 7) - '.plf' File Stack Buffer Overflow (ASLR + DEP Bypass)

Acoustica Audio Converter Pro 1.1 (build 25) -  '.mp3 / .wav / .ogg / .wma' Local Heap Overflow (PoC)
Acoustica Audio Converter Pro 1.1 (build 25) - '.mp3 / .wav / .ogg / .wma' Local Heap Overflow

Linux Kernel < 2.6.36-rc6 (RedHat / Ubuntu 10.04) - 'pktcdvd' Kernel Memory Disclosure (PoC)
Linux Kernel < 2.6.36-rc6 (RedHat / Ubuntu 10.04) - 'pktcdvd' Kernel Memory Disclosure

Oracle 10/11g - 'exp.exe?file' Local Buffer Overflow (PoC)
Oracle 10/11g - 'exp.exe?file' Local Buffer Overflow

PHP 5.3.6 - Local Buffer Overflow (ROP) (PoC)
PHP 5.3.6 - Local Buffer Overflow (ROP)

Xorg 1.4 < 1.11.2 - File Permission Change (PoC)
Xorg 1.4 < 1.11.2 - File Permission Change

Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3 - LSA Secrets

Linux Kernel 2.2.x - 'sysctl()' Memory Reading (PoC)
Linux Kernel 2.2.x - 'sysctl()' Memory Reading

Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042) (PoC)
Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042)

Linux Kernel 2.2.x/2.3/2.4.x - 'd_path()' Path Truncation (PoC)
Linux Kernel 2.2.x/2.3/2.4.x - 'd_path()' Path Truncation

HT Editor 2.0.20 - Local Buffer Overflow (ROP) (PoC)
HT Editor 2.0.20 - Local Buffer Overflow (ROP)

Linux Kernel 2.4 - SUID 'execve()' System Call Race Condition Executable File Read (PoC)
Linux Kernel 2.4 - SUID 'execve()' System Call Race Condition Executable File Read

Linux Kernel 2.6 - Console Keymap Local Command Injection (PoC)
Linux Kernel 2.6 - Console Keymap Local Command Injection

ACE Stream Media 2.1 - 'acestream://' Format String (PoC)
ACE Stream Media 2.1 - 'acestream://' Format String

Linux Kernel 3.13 - SGID Privilege Escalation (PoC)
Linux Kernel 3.13 - SGID Privilege Escalation

Comodo Internet Security - HIPS/Sandbox Escape (PoC)
Comodo Internet Security - HIPS/Sandbox Escape

Palringo 2.8.1 - Local Stack Buffer Overflow (PoC)
Palringo 2.8.1 - Local Stack Buffer Overflow
Linux Kernel (x86-64) - Rowhammer Privilege Escalation (PoC)
Rowhammer - NaCl Sandbox Escape (PoC)
Linux Kernel (x86-64) - Rowhammer Privilege Escalation
Rowhammer - NaCl Sandbox Escape

Fedora 21 setroubleshootd 3.2.22 - Local Privilege Escalation (PoC)
Fedora 21 setroubleshootd 3.2.22 - Local Privilege Escalation

Microsoft Windows - 'CNG.SYS' Kernel Security Feature Bypass (PoC) (MS15-052)
Microsoft Windows - 'CNG.SYS' Kernel Security Feature Bypass (MS15-052)

Linux (x86) - Memory Sinkhole Privilege Escalation (PoC)
Linux (x86) - Memory Sinkhole Privilege Escalation

Core FTP Server 1.2 - Local Buffer Overflow (PoC)
Core FTP Server 1.2 - Local Buffer Overflow

Microsoft Internet Explorer 11 (Windows 10) - VBScript Memory Corruption (PoC) (MS16-051)
Microsoft Internet Explorer 11 (Windows 10) - VBScript Memory Corruption (MS16-051)

VMware Virtual Machine Communication Interface (VMCI) - 'vmci.sys' (PoC)
VMware Virtual Machine Communication Interface (VMCI) - 'vmci.sys'

Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (PoC) (Write Access Method)
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method)

Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (PoC) (Write Access Method)
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method)

GNU Screen 4.5.0 - Local Privilege Escalation (PoC)
GNU Screen 4.5.0 - Local Privilege Escalation
Man-db 2.6.7.1 - Local Privilege Escalation (PoC)
Systemd 228 (SUSE 12 SP2 / Ubuntu Touch 15.04) - Local Privilege Escalation (PoC)
Man-db 2.6.7.1 - Local Privilege Escalation
Systemd 228 (SUSE 12 SP2 / Ubuntu Touch 15.04) - Local Privilege Escalation

Oracle VM VirtualBox < 5.0.32 / < 5.1.14 - Local Privilege Escalation (PoC)
Oracle VM VirtualBox < 5.0.32 / < 5.1.14 - Local Privilege Escalation

TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change (PoC)
TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change

Multiple CPUs - 'Spectre' Information Disclosure (PoC)
Multiple CPUs - 'Spectre' Information Disclosure

Linux Kernel 3.10.0-514.21.2.el7.x86_64 / 3.10.0-514.26.1.el7.x86_64 (CentOS 7) - SUID Position Independent Executable 'PIE' Local Privilege Escalation

glibc ld.so - Memory Leak / Buffer Overflow
GNU C Library Dynamic Loader glibc ld.so - Memory Leak / Buffer Overflow

Microsoft IIS 5.0 - WebDAV Remote (PoC)
Microsoft IIS 5.0 - WebDAV Remote

Microsoft Windows Server 2000 - RSVP Server Authority Hijacking (PoC)
Microsoft Windows Server 2000 - RSVP Server Authority Hijacking

ISC BIND 8.2.x - 'TSIG' Remote Stack Overflow (4)

Titan FTP Server - Long Command Heap Overflow (PoC)
Titan FTP Server - Long Command Heap Overflow

SLX Server 6.1 - Arbitrary File Creation (PoC)
SLX Server 6.1 - Arbitrary File Creation

zgv 5.5 - Multiple Arbitrary Code Executions (PoC)
zgv 5.5 - Multiple Arbitrary Code Executions

Microsoft Internet Explorer - Remote Code Execution (PoC)
Microsoft Internet Explorer - Remote Code Execution

Exim 4.43 - 'auth_spa_server()' Remote (PoC)
Exim 4.43 - 'auth_spa_server()' Remote

Microsoft Windows - DTC Remote (PoC) (MS05-051) (2)
Microsoft Windows - DTC Remote (MS05-051) (2)

Watchfire AppScan QA 5.0.x - Remote Code Execution (PoC)
Watchfire AppScan QA 5.0.x - Remote Code Execution

KarjaSoft Sami FTP Server 2.0.1 - Remote Stack Buffer Overflow (PoC)
KarjaSoft Sami FTP Server 2.0.1 - Remote Stack Buffer Overflow

Microsoft Windows Media Player 7.1 < 10 - '.BMP' Heap Overflow (PoC) (MS06-005) (2)
Microsoft Windows Media Player 7.1 < 10 - '.BMP' Heap Overflow (MS06-005) (2)

RevilloC MailServer 1.21 - 'USER' Remote Buffer Overflow (PoC)
RevilloC MailServer 1.21 - 'USER' Remote Buffer Overflow

AIM Triton 1.0.4 - 'SipXtapi' Remote Buffer Overflow (PoC)
AIM Triton 1.0.4 - 'SipXtapi' Remote Buffer Overflow

Mozilla Firefox 1.5.0.4 - JavaScript Navigator Object Code Execution (PoC)
Mozilla Firefox 1.5.0.4 - JavaScript Navigator Object Code Execution

Easy File Sharing FTP Server 2.0 - 'PASS' Remote (PoC)
Easy File Sharing FTP Server 2.0 - 'PASS' Remote

BulletProof FTP Client 2.45 - Remote Buffer Overflow (PoC)
BulletProof FTP Client 2.45 - Remote Buffer Overflow

Intel Centrino ipw2200BG - Wireless Driver Remote Overflow (PoC)
Intel Centrino ipw2200BG - Wireless Driver Remote Overflow

WebMod 0.48 - Content-Length Remote Buffer Overflow (PoC)
WebMod 0.48 - Content-Length Remote Buffer Overflow

OpenBSD - ICMPv6 Fragment Remote Execution (PoC)
OpenBSD - ICMPv6 Fragment Remote Execution

Microsoft Internet Explorer 7 - Arbitrary File Rewrite (PoC) (MS07-027)
Microsoft Internet Explorer 7 - Arbitrary File Rewrite (MS07-027)

Apple Safari 3 for Windows Beta - Remote Command Execution (PoC)
Apple Safari 3 for Windows Beta - Remote Command Execution

Flash Player/Plugin Video - File Parsing Remote Code Execution (PoC)
Flash Player/Plugin Video - File Parsing Remote Code Execution

Apple QuickTime (Multiple Browsers) - Command Execution (PoC)
Apple QuickTime (Multiple Browsers) - Command Execution

Apple QuickTime /w IE .qtl Version XAS - Remote (PoC)
Apple QuickTime /w IE .qtl Version XAS - Remote

QuickTime Player 7.3.1.70 - 'RTSP' Remote Buffer Overflow (PoC)
QuickTime Player 7.3.1.70 - 'RTSP' Remote Buffer Overflow

ImageShack Toolbar 4.5.7 - 'FileUploader' Class InsecureMethod (PoC)
ImageShack Toolbar 4.5.7 - 'FileUploader' Class InsecureMethod

HP Software Update - 'Hpufunction.dll 4.0.0.1' Insecure Method (PoC)
HP Software Update - 'Hpufunction.dll 4.0.0.1' Insecure Method

Microsoft Internet Explorer - Print Table of Links Cross-Zone Scripting (PoC)
Microsoft Internet Explorer - Print Table of Links Cross-Zone Scripting

Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC)
Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal

MicroTik RouterOS 3.13 - SNMP write (Set request) (PoC)
MicroTik RouterOS 3.13 - SNMP write (Set request)

Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload (PoC)
Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload

Opera 9.52/9.60 - Persistent Cross-Site Scripting Code Execution (PoC)
Opera 9.52/9.60 - Persistent Cross-Site Scripting Code Execution

Opera 9.61 - 'opera:historysearch' Code Execution (PoC)
Opera 9.61 - 'opera:historysearch' Code Execution

Chilkat Crypt - ActiveX Arbitrary File Creation/Execution (PoC)
Chilkat Crypt - ActiveX Arbitrary File Creation/Execution

Microsoft XML Core Services DTD - Cross-Domain Scripting (PoC) (MS08-069)
Microsoft XML Core Services DTD - Cross-Domain Scripting (MS08-069)

Google Chrome 1.0.154.46 - '(ChromeHTML://)' Injection (PoC)
Google Chrome 1.0.154.46 - '(ChromeHTML://)' Injection

GeoVision LiveX 8200 - ActiveX 'LIVEX_~1.OCX' File Corruption (PoC)
GeoVision LiveX 8200 - ActiveX 'LIVEX_~1.OCX' File Corruption

Microsoft Internet Explorer 7 (Windows 2003 SP2) - Memory Corruption (PoC) (MS09-002)
Microsoft Internet Explorer 7 (Windows 2003 SP2) - Memory Corruption (MS09-002)

Zervit Web Server 0.4 - Directory Traversal / Memory Corruption (PoC)
Zervit Web Server 0.4 - Directory Traversal / Memory Corruption

Apple Mac OSX - Java applet Remote Deserialization Remote (PoC) (2)
Apple Mac OSX - Java applet Remote Deserialization Remote (2)

VideoLAN VLC Media Player 1.0.2 - 'smb://' URI Stack Overflow (PoC)
VideoLAN VLC Media Player 1.0.2 - 'smb://' URI Stack Overflow

Microsoft Internet Explorer 5/6/7 - Memory Corruption (PoC) (MS09-054)
Microsoft Internet Explorer 5/6/7 - Memory Corruption (MS09-054)

Pegasus Mail Client 4.51 - Remote Buffer Overflow (PoC)
Pegasus Mail Client 4.51 - Remote Buffer Overflow

TLS - Renegotiation (PoC)
TLS - Renegotiation
Adobe GetPlus get_atlcom 1.6.2.48 - ActiveX Remote Execution (PoC)
Trend Micro Web-Deployment - ActiveX Remote Execution (PoC)
Adobe GetPlus get_atlcom 1.6.2.48 - ActiveX Remote Execution
Trend Micro Web-Deployment - ActiveX Remote Execution

MX Simulator Server - Remote Buffer Overflow (PoC)
MX Simulator Server - Remote Buffer Overflow
Apache OFBiz - Remote Execution (via SQL Execution) (PoC)
Apache OFBiz - Admin Creator (PoC)
Apache OFBiz - Remote Execution (via SQL Execution)
Apache OFBiz - Admin Creator

Adobe Flash / Reader - Live Malware (PoC)
Adobe Flash / Reader - Live Malware

Softek Barcode Reader Toolkit ActiveX 7.1.4.14 - 'SoftekATL.dll' Remote Buffer Overflow (PoC)
Softek Barcode Reader Toolkit ActiveX 7.1.4.14 - 'SoftekATL.dll' Remote Buffer Overflow

KingView 6.5.3 - SCADA HMI Heap Overflow (PoC)
KingView 6.5.3 - SCADA HMI Heap Overflow

Microsoft Data Access Components - Remote Overflow (PoC) (MS11-002)
Microsoft Data Access Components - Remote Overflow (MS11-002)
HP Data Protector Client 6.11 - 'EXEC_SETUP' Remote Code Execution (PoC)
HP Data Protector Client 6.11 - 'EXEC_CMD' Remote Code Execution (PoC)
HP Data Protector Client 6.11 - 'EXEC_SETUP' Remote Code Execution
HP Data Protector Client 6.11 - 'EXEC_CMD' Remote Code Execution

Solar FTP Server 2.1.1 - PASV Buffer Overflow (PoC)
Solar FTP Server 2.1.1 - PASV Buffer Overflow

Apache mod_proxy - Reverse Proxy Exposure (PoC)
Apache mod_proxy - Reverse Proxy Exposure

Quest Toad for Oracle Explain Plan Display ActiveX Control - 'QExplain2.dll 6.6.1.1115' Remote File Creation / Overwrite (PoC)
Quest Toad for Oracle Explain Plan Display ActiveX Control - 'QExplain2.dll 6.6.1.1115' Remote File Creation / Overwrite

Quest vWorkspace 7.5 Connection Broker Client - ActiveX Control 'pnllmcli.dll 7.5.304.547' SaveMiniLaunchFile() Method Remote File Creation / Overwrite (PoC)
Quest vWorkspace 7.5 Connection Broker Client - ActiveX Control 'pnllmcli.dll 7.5.304.547' SaveMiniLaunchFile() Method Remote File Creation / Overwrite

Belkin G Wireless Router Firmware 5.00.12 - Remote Code Execution (PoC)
Belkin G Wireless Router Firmware 5.00.12 - Remote Code Execution

OpenVAS Manager 4.0 - Authentication Bypass (PoC)
OpenVAS Manager 4.0 - Authentication Bypass

w3tw0rk / Pitbull Perl IRC Bot - Remote Code Execution (PoC)
w3tw0rk / Pitbull Perl IRC Bot - Remote Code Execution

Legend Perl IRC Bot - Remote Code Execution (PoC)
Legend Perl IRC Bot - Remote Code Execution

dhclient 4.1 - Bash Environment Variable Command Injection (PoC) (Shellshock)
dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)

WebDrive 12.2 (Build #4172) - Remote Buffer Overflow (PoC)
WebDrive 12.2 (Build #4172) - Remote Buffer Overflow

Endian Firewall < 3.0.0 - OS Command Injection (Python) (PoC)
Endian Firewall < 3.0.0 - OS Command Injection (Python)

Fortigate OS 4.x < 5.0.7 - SSH Backdoor Access

OpenSSHd 7.2p2 - Username Enumeration (PoC)
OpenSSHd 7.2p2 - Username Enumeration

Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution

Intel Active Management Technology - System Privileges

Xplico - Remote Code Execution (Metasploit)

Oracle WebLogic < 10.3.6 - 'wls-wsat' Component Deserialisation Remote Command Execution

S9Y Serendipity 0.7-beta1 - SQL Injection (PoC)
S9Y Serendipity 0.7-beta1 - SQL Injection

AWStats 5.7 < 6.2 - Multiple Remote (PoC)
AWStats 5.7 < 6.2 - Multiple Remote

WoltLab Burning Book 1.1.2 - SQL Injection (PoC)
WoltLab Burning Book 1.1.2 - SQL Injection

Invision Power Board 2.1.7 - ACTIVE Cross-Site Scripting / SQL Injection
Invision Power Board (IP.Board) 2.1.7 - 'ACTIVE' Cross-Site Scripting / SQL Injection

EQdkp 1.3.2f - 'user_id' Authentication Bypass (PoC)
EQdkp 1.3.2f - 'user_id' Authentication Bypass

Invision Power Board 2.3.5 - Multiple Vulnerabilities (2)
Invision Power Board (IP.Board) 2.3.5 - Multiple Vulnerabilities (2)

FOSS Gallery Public 1.0 - Arbitrary File Upload (PoC)
FOSS Gallery Public 1.0 - Arbitrary File Upload

Flatnux 2009-01-27 - Cross-Site Scripting / Iframe Injection (PoC)
Flatnux 2009-01-27 - Cross-Site Scripting / Iframe Injection

Limbo CMS 1.0.4.2 - Cross-Site Request Forgery / Privilege Escalation (PoC)
Limbo CMS 1.0.4.2 - Cross-Site Request Forgery / Privilege Escalation

Invision Power Board 3.0.0b5 - Active Cross-Site Scripting / Full Path Disclosure
Invision Power Board (IP.Board) 3.0.0b5 - Active Cross-Site Scripting / Full Path Disclosure

Fuzzylime CMS 3.03a - Local Inclusion / Arbitrary File Corruption (PoC)
Fuzzylime CMS 3.03a - Local Inclusion / Arbitrary File Corruption

IPB (nv2) Awards < 1.1.0 - SQL Injection (PoC)
IPB (nv2) Awards < 1.1.0 - SQL Injection

X-Cart Pro 4.0.13 - SQL Injection (PoC)
X-Cart Pro 4.0.13 - SQL Injection

Simple Machines Forum (SMF) 1.1.8 - 'avatar' Remote PHP File Execute (PoC)
Simple Machines Forum (SMF) 1.1.8 - 'avatar' Remote PHP File Execute

IPB 3.0.1 - SQL Injection
Invision Power Board 3.0.1 - SQL Injection

WebsiteBaker 2.8.1 - Cross-Site Request Forgery (PoC)
WebsiteBaker 2.8.1 - Cross-Site Request Forgery
BS Auto Classifieds - 'info.php' SQL Injection (PoC)
BS Business Directory - 'articlesdetails.php' SQL Injection (PoC)
BS Classifieds Ads - 'articlesdetails.php' SQL Injection (PoC)
BS Events Directory - 'articlesdetails.php' SQL Injection (PoC)
BS Auto Classifieds - 'info.php' SQL Injection
BS Business Directory - 'articlesdetails.php' SQL Injection
BS Classifieds Ads - 'articlesdetails.php' SQL Injection
BS Events Directory - 'articlesdetails.php' SQL Injection

BigACE 2.7.3 - Cross-Site Request Forgery (Change Admin Password) (PoC)
BigACE 2.7.3 - Cross-Site Request Forgery (Change Admin Password)

Exponent CMS 2.0 Beta 1.1 - Cross-Site Request Forgery (Add Administrator Account) (PoC)
Exponent CMS 2.0 Beta 1.1 - Cross-Site Request Forgery (Add Administrator Account)

SWAT Samba Web Administration Tool - Cross-Site Request Forgery (PoC)
SWAT Samba Web Administration Tool - Cross-Site Request Forgery

Plone and Zope - Remote Command Execution (PoC)
Plone and Zope - Remote Command Execution

Invision Power Board 1.0/1.1/1.2 - 'admin.php' Cross-Site Scripting
Invision Power Board (IP.Board) 1.0/1.1/1.2 - 'admin.php' Cross-Site Scripting

Invision Power Board 1.x - 'index.php' showtopic Cross-Site Scripting
Invision Power Board (IP.Board) 1.x - 'index.php' showtopic Cross-Site Scripting

Invision Power Board 1.3 - Multiple Cross-Site Scripting Vulnerabilities
Invision Power Board (IP.Board) 1.3 - Multiple Cross-Site Scripting Vulnerabilities

Invision Power Board 1.3 - 'Pop' Cross-Site Scripting
Invision Power Board (IP.Board) 1.3 - 'Pop' Cross-Site Scripting

Invision Power Board 1.3 - 'SSI.php' Cross-Site Scripting
Invision Power Board (IP.Board) 1.3 - 'SSI.php' Cross-Site Scripting

Invision Power Services Invision Board 2.0.4 - Search Action Multiple Cross-Site Scripting Vulnerabilities
Invision Power Board (IP.Board) 2.0.4 - Search Action Multiple Cross-Site Scripting Vulnerabilities

Invision Power Board 1.x/2.0.3 - SML Code Script Injection
Invision Power Board (IP.Board) 1.x/2.0.3 - SML Code Script Injection

IPB (Invision Power Board) 1.x?/2.x/3.x - Admin Account Takeover
Invision Power Board 1.x?/2.x/3.x - Admin Account Takeover

Invision Power Board 2.0.3/2.1 - 'Act' Cross-Site Scripting
Invision Power Board (IP.Board) 2.0.3/2.1 - 'Act' Cross-Site Scripting

Invision Power Board 1.0.3 - Attached File Cross-Site Scripting
Invision Power Board (IP.Board) 1.0.3 - Attached File Cross-Site Scripting

Invision Power Services Invision Board 2.1 - 'admin.php' Multiple Cross-Site Scripting Vulnerabilities
Invision Power Board (IP.Board) 2.1 - 'admin.php' Multiple Cross-Site Scripting Vulnerabilities

Invision Power Services Invision Board 2.0.4 - 'index.php?st' Cross-Site Scripting
Invision Power Board (IP.Board) 2.0.4 - 'index.php?st' Cross-Site Scripting

Invision Power Services Invision Board 2.0.4 - Calendar Action Multiple Cross-Site Scripting Vulnerabilities
Invision Power Board (IP.Board) 2.0.4 - Calendar Action Multiple Cross-Site Scripting Vulnerabilities
Invision Power Services Invision Board 2.0.4 - Print Action 't' Cross-Site Scripting
Invision Power Services Invision Board 2.0.4 - Mail Action 'MID' Cross-Site Scripting
Invision Power Services Invision Board 2.0.4 - Help Action 'HID' Cross-Site Scripting
Invision Power Board (IP.Board) 2.0.4 - Print Action 't' Cross-Site Scripting
Invision Power Board (IP.Board) 2.0.4 - Mail Action 'MID' Cross-Site Scripting
Invision Power Board (IP.Board) 2.0.4 - Help Action 'HID' Cross-Site Scripting

Invision Power Board 1.x/2.x - Multiple SQL Injections
Invision Power Board (IP.Board) 1.x/2.x - Multiple SQL Injections

Invision Power Board 3.0 - Multiple HTML Injection / Information Disclosure Vulnerabilities
Invision Power Board (IP.Board) 3.0 - Multiple HTML Injection / Information Disclosure Vulnerabilities

Invision Power Board 3.0.3 - '.txt' MIME-Type Cross-Site Scripting
Invision Power Board (IP.Board) 3.0.3 - '.txt' MIME-Type Cross-Site Scripting

IP Board 3.x - Cross-Site Request Forgery / Token Hjiacking
Invision Power Board (IP.Board) 3.x - Cross-Site Request Forgery / Token Hjiacking

Invision Power Board 4.2.1 - 'searchText' Cross-Site Scripting
Invision Power Board (IP.Board) 4.2.1 - 'searchText' Cross-Site Scripting

TOTOLINK Routers - Backdoor / Remote Code Execution (PoC)
TOTOLINK Routers - Backdoor / Remote Code Execution

IP.Board 4.x - Persistent Cross-Site Scripting
Invision Power Board (IP.Board) 4.x - Persistent Cross-Site Scripting

IP.Board 4.1.4.x - Persistent Cross-Site Scripting
Invision Power Board (IP.Board) 4.1.4.x - Persistent Cross-Site Scripting

NETGEAR R7000 - Command Injection (PoC)
NETGEAR R7000 - Command Injection

WordPress Plugin Smart Google Code Inserter < 3.5 - Authentication Bypass  / SQL Injection
WordPress Plugin Smart Google Code Inserter < 3.5 - Authentication Bypass / SQL Injection
Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration
Photos in Wifi 1.0.1 - Path Traversal
SonicWall NSA 6600/5600/4600/3600/2600/250M - Multiple Vulnerabilities
FiberHome LM53Q1 - Multiple Vulnerabilities
WordPress Plugin LearnDash 2.5.3 - Arbitrary File Upload
Vanilla < 2.1.5 - Cross-Site Request Forgery

Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE (PoC)
Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE

Joomla! 3.7.0 - 'com_fields' SQL Injection (PoC)
Joomla! 3.7.0 - 'com_fields' SQL Injection

Apache Struts 2.3.x Showcase - Remote Code Execution (PoC)
Apache Struts 2.3.x Showcase - Remote Code Execution

AIX - execve /bin/sh Shellcode (88 bytes)

Linux/x86 - chmod 777 /etc/sudoers Shellcode (36 bytes)
 2018-01-09 05:02:30 +00:00
Offensive Security
d304cc3d3e DB: 2017-11-24 
116602 new exploits

Too many to list!
 2017-11-24 20:56:23 +00:00