bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
904 commits 1 branch 0 tags 359 MiB
Commit graph

904 commits

This branch
This branch
All branches
Author SHA1 Message Date
Offensive Security
b51e0f27d5 DB: 2016-07-17 
52 new exploits

Linux/ARM - setuid(0) & execve(_/bin/sh___/bin/sh__0) (38 bytes)

Linux/x86 - unlink(/etc/passwd) & exit() (35 bytes)
Linux i686 - pacman -S <package> (default package: backdoor) (64 bytes)
Linux i686 - pacman -R <package> (59 bytes)
Linux i686 - pacman -S <package> (default package: backdoor) (64 bytes)
Linux i686 - pacman -R <package> (59 bytes)
JITed stage-0 shellcode
JITed exec notepad Shellcode
Win32 - JITed stage-0 shellcode
Win32 - JITed exec notepad Shellcode
Win32 - Mini HardCode WinExec&ExitProcess Shellcode (16 bytes)
JITed egg-hunter stage-0 shellcode
Win32/XP SP3 (RU) - WinExec+ExitProcess cmd shellcode (12 bytes)
Win32 - Mini HardCode WinExec&ExitProcess Shellcode (16 bytes)
Windows - JITed egg-hunter stage-0 shellcode
Win32/XP SP3 (RU) - WinExec+ExitProcess cmd shellcode (12 bytes)

Linux/x86 - nc -lvve/bin/sh -p13377 shellcode
Linux/x86 - polymorphic forkbombe - (30 bytes)
Linux/x86 - forkbomb
Linux/x86 - polymorphic forkbombe (30 bytes)
Linux/x86 - forkbomb
Linux/x86_64 - execve(_/bin/sh_); shellcode (30 bytes)
Linux/x86 - sends _Phuck3d!_ to all terminals (60 bytes)
Linux/x86_64 - execve(_/bin/sh_); shellcode (30 bytes)
Linux/x86 - sends _Phuck3d!_ to all terminals (60 bytes)

Linux/x86 - polymorphic execve(_/bin/bash___-p__NULL) (57 bytes)
Linux/x86 - execve(_/usr/bin/wget__ _aaaa_); (42 bytes)
Linux/x86 - sys_execve(_/bin/sh__ _0__ _0_) with umask 16 (sys_umask(14)) (45 bytes)
Linux/x86 - execve(_/usr/bin/wget__ _aaaa_); (42 bytes)
Linux/x86 - sys_execve(_/bin/sh__ _0__ _0_) with umask 16 (sys_umask(14)) (45 bytes)
Linux/x86 - Disable randomize stack addresse (106 bytes)
Linux/x86 - pwrite(_/etc/shadow__ hash_ 32_ 8) Shellcode 83
Linux/x86 - alphanumeric Bomb FORK Shellcode (117 bytes)
Linux/x86 - Disable randomize stack addresse (106 bytes)
Linux/x86 - pwrite(_/etc/shadow__ hash_ 32_ 8) Shellcode 83
Linux/x86 - alphanumeric Bomb FORK Shellcode (117 bytes)

Linux/x86 - Shellcode Polymorphic - setuid(0) + chmod(_/etc/shadow__ 0666) Shellcode (61 bytes)

Linux/x86 - kill all running process (11 bytes)
Linux/x86 - sys_execve(_/bin/sh__ _-c__ _reboot_) shellcode (45 bytes)
Linux/x86 - sys_setuid(0) & sys_setgid(0) & execve (_/bin/sh_) shellcode (39 bytes)
Linux/x86 - sys_execve(_/bin/sh__ _-c__ _reboot_) shellcode (45 bytes)
Linux/x86 - sys_setuid(0) & sys_setgid(0) & execve (_/bin/sh_) shellcode (39 bytes)
Linux/x86 - unlink _/etc/shadow_ shellcode (33 bytes)
Linux/x86 - hard / unclean reboot (29 bytes)
Linux/x86 - hard / unclean reboot (33 bytes)
Linux/x86 - unlink _/etc/shadow_ shellcode (33 bytes)
Linux/x86 - hard / unclean reboot (29 bytes)
Linux/x86 - hard / unclean reboot (33 bytes)
Linux/x86 - chown root:root /bin/sh shellcode (48 bytes)
Linux/x86 - give all user root access when execute /bin/sh (45 bytes)
Linux/x86 - chown root:root /bin/sh shellcode (48 bytes)
Linux/x86 - give all user root access when execute /bin/sh (45 bytes)

Linux/ARM - setuid(0) & kill(-1_ SIGKILL) (28 bytes)

Linux/ARM - execve(_/bin/sh___/bin/sh__0) (30 bytes)

Linux/ARM - polymorphic chmod(_/etc/shadow__ 0777) (84 bytes)

Linux/ARM - chmod(_/etc/shadow__ 0777) Shellcode (35 bytes)

Linux/ARM - Disable ASLR Security (102 bytes)

Linux/x86 - bind shell port 64533 (97 bytes)

Safari JS JITed shellcode - exec calc (ASLR/DEP bypass)
Windows - Safari JS JITed shellcode - exec calc (ASLR/DEP bypass)

Win32 - Write-to-file Shellcode

Linux/x86_64 - execve(_/sbin/iptables__ [_/sbin/iptables__ _-F_]_ NULL) (49 bytes)

Linux/x86 - netcat bindshell port 8080 (75 bytes)

Shellcode Checksum Routine (18 bytes)
Win32 - Shellcode Checksum Routine (18 bytes)

Win32/XP SP3 (TR) - Add Admin Account Shellcode (127 bytes)
Win32/XP Pro SP3 (EN) 32-bit - add new local administrator (113 bytes)
Win32 - add new local administrator (326 bytes)
Win32/XP Pro SP3 (EN) 32-bit - add new local administrator (113 bytes)
Win32 - add new local administrator (326 bytes)

Win32 - speaking shellcode

Linux/x86 - netcat bindshell port 6666 (69 bytes)

DNS Reverse Download and Exec Shellcode
Windows - DNS Reverse Download and Exec Shellcode

Linux/x86_32 - ConnectBack with SSL connection (422 bytes)
Linux/x86 - ConnectBack with SSL connection (422 bytes)

Linux/x86 - egghunt shellcode (29 bytes)
Linux/MIPS - execve /bin/sh (48 bytes)
Linux/MIPS - add user(UID 0) with password (164 bytes)
Linux/MIPS - execve /bin/sh (48 bytes)
Linux/MIPS - add user(UID 0) with password (164 bytes)

Linux/x86 - execve(/bin/dash) (42 bytes)

Linux/x86 - chmod (777 /etc/passwd & /etc/shadow)_ Add New Root User (ALI/ALI) & Execute /bin/sh (378 bytes)

Linux/x86 - Obfuscated Shellcode chmod 777 (/etc/passwd + /etc/shadow) & Add New Root User & Execute /bin/bash (521 bytes)

Linux/x86 - rmdir (37 bytes)

Linux/MIPS - execve (36 bytes)

Windows XP x86-64 - Download & execute (Generator)

Linux/x86 - /etc/passwd Reader (58 bytes)

Linux - execve /bin/sh (23 bytes)
Linux/x86 - execve /bin/sh (23 bytes)

Linux/x86/x86_64 - reverse_tcp Shellcode
Linux x86 & x86_64 - reverse_tcp Shellcode
Linux/x86/x86_64 - tcp_bind Shellcode
Linux/x86/x86_64 - Read etc/passwd Shellcode
Linux x86 & x86_64 - tcp_bind Shellcode
Linux x86 & x86_64 - Read etc/passwd Shellcode

.Net Framework - Execute Native x86 Shellcode
Win32 .Net Framework - Execute Native x86 Shellcode
 2016-07-17 05:07:02 +00:00
Offensive Security
0a9242663c DB: 2016-07-16 
2 new exploits

BSD Passive Connection Shellcode
BSD - Passive Connection Shellcode

FreeBSD i386/AMD64 Execve /bin/sh - Anti-Debugging
FreeBSD i386/AMD64 - Execve /bin/sh (Anti-Debugging)

freebsd/x86 rev connect_ recv_ jmp_ return results (90 bytes)
freebsd/x86 - rev connect_ recv_ jmp_ return results (90 bytes)

freebsd/x86 portbind 4883 with auth shellcode
freebsd/x86 - portbind 4883 with auth shellcode

freebsd/x86 - execve /bin/sh (23 bytes) (2)
freebsd/x86 - execve /bin/sh (2) (23 bytes)

freebsd/x86 chown 0:0 _ chmod 6755 & execve /tmp/sh (44 bytes)
freebsd/x86 - chown 0:0 _ chmod 6755 & execve /tmp/sh (44 bytes)

Windows xp/sp1 generate portbind payload
Windows XP SP1 - portbind payload (Generator)
Linux/x86 - shellcode generator / null free
Alphanumeric Shellcode Encoder Decoder
Utility for generating HTTP/1.x requests for shellcodes
Multi-Format Shellcode Encoding Tool - Beta 2.0 (w32)
Linux/x86 - shellcode null free (Generator)
Alphanumeric Shellcode Encoder/Decoder
HTTP/1.x requests for shellcodes  (Generator) (18+ bytes / 26+ bytes)
Multi-Format Shellcode Encoding Tool - Beta 2.0 (Win32) (Generator)
Cisco IOS Connectback Shellcode 1.0
Cisco IOS Bind Shellcode 1.0
Cisco IOS Tiny Shellcode 1.0
Cisco IOS Shellcode And Exploitation Techniques (BlackHat)
Cisco IOS - Connectback Shellcode
Cisco IOS - Bind Shellcode 1.0 (116 bytes)
Cisco IOS - Tiny Shellcode
Cisco IOS - Shellcode And Exploitation Techniques (BlackHat)
Linux/mips - (Linksys WRT54G/GL) port bind shellcode (276 bytes)
Linux/mips - (Linksys WRT54G/GL) execve shellcode (60 bytes)
Linux/mips - execve /bin/sh (56 bytes)
Linux/ppc - execve /bin/sh (60 bytes)
Linux/ppc - read & exec shellcode (32 bytes)
Linux/ppc - connect back execve /bin/sh (240 bytes)
Linux/ppc - execve /bin/sh (112 bytes)
Linux/MIPS (Linksys WRT54G/GL) - port bind shellcode (276 bytes)
Linux/MIPS (Linksys WRT54G/GL) - execve shellcode (60 bytes)
Linux/MIPS - execve /bin/sh (56 bytes)
Linux/PPC - execve /bin/sh (60 bytes)
Linux/PPC - read & exec shellcode (32 bytes)
Linux/PPC - connect back execve /bin/sh (240 bytes)
Linux/PPC - execve /bin/sh (112 bytes)

Linux/x86 - listens for shellcode on tcp/5555 and jumps to it
Linux/x86 - listens for shellcode on tcp/5555 and jumps to it (83 bytes)

Linux/x86-64 - setuid(0) + execve(/bin/sh) (49 bytes)
Linux/x86_64 - setuid(0) + execve(/bin/sh) (49 bytes)
Linux/x86 - File unlinker (18 bytes + file path length)
Linux/x86 - Perl script execution (99 bytes + script length)
Linux/x86 - file reader (65 bytes + pathname)
Linux/x86 - File unlinker (18+ bytes)
Linux/x86 - Perl script execution (99+ bytes)
Linux/x86 - file reader (65+ bytes)

Linux x86 shellcode obfuscator
Linux/x86 - shellcode obfuscator

Linux/86 setreuid(geteuid_ geteuid) + execve(/bin/sh) shellcode
Linux/x86 - setreuid(geteuid_ geteuid) + execve(/bin/sh) shellcode

Linux/x86 - rm -rf / attempts to block the process from being stopped
Linux/x86 - rm -rf / attempts to block the process from being stopped (132 bytes)
Linux/x86 - HTTP/1.x GET_ Downloads and execve() (111 bytes+)
Linux/x86 - executes command after setreuid (9 + 40 bytes + cmd)
Linux/x86 - HTTP/1.x GET_ Downloads and execve() (111+ bytes)
Linux/x86 - executes command after setreuid (49+ bytes)

Linux/x86 - HTTP/1.x GET_ Downloads and JMP - (68 bytes+)
Linux/x86 - HTTP/1.x GET_ Downloads and JMP - (68+ bytes)
Linux/x86 - examples of long-term payloads hide-wait-change (.s)
Linux/x86 - examples of long-term payloads hide-wait-change 187 bytes+
Linux/x86 - examples of long-term payloads hide-wait-change (.s) (187+ bytes)
Linux/x86 - examples of long-term payloads hide-wait-change (187+ bytes)

Linux - chroot()/execve() code
Linux - chroot()/execve() code (80 bytes)
Linux/x86-64 - bindshell port:4444 shellcode (132 bytes)
Linux/x86-64 - execve(/bin/sh) (33 bytes)
Linux/PPC/x86 execve(_/bin/sh__{_/bin/sh__NULL}_NULL) (99 bytes)
OS-X/PPC/x86 execve(_/bin/sh__{_/bin/sh__NULL}_NULL) (121 bytes)
Linux/x86 - unix/SPARC irix/mips execve /bin/sh irx.mips (141 bytes)
Linux/x86 - unix/SPARC execve /bin/sh (80 bytes)
Linux/x86 - bsd/x86 execve /bin/sh (38 bytes)
netbsd/x86 kill all processes shellcode (23 bytes)
netbsd/x86 callback shellcode (port 6666) (83 bytes)
netbsd/x86 setreuid(0_ 0); execve(_/bin//sh__ ..._ NULL); (29 bytes)
netbsd/x86 setreuid(0_ 0); execve(_/bin//sh__ ..._ NULL); (30 bytes)
netbsd/x86 execve /bin/sh (68 bytes)
openbsd/x86 execve(/bin/sh) (23 bytes)
openbsd/x86 portbind port 6969 (148 bytes)
openbsd/x86 add user w00w00 (112 bytes)
OS-X/ppc sync()_ reboot() (32 bytes)
OS-X/PPC execve(/bin/sh)_ exit() (72 bytes)
OS-X/PPC Add user r00t (219 bytes)
OS-X/PPC execve /bin/sh (72 bytes)
OS-X/PPC add inetd backdoor (222 bytes)
OS-X/PPC reboot (28 bytes)
OS-X/PPC setuid(0) + execve /bin/sh (88 bytes)
OS-X/PPC create /tmp/suid (122 bytes)
OS-X/PPC simple write() (75 bytes)
OS-X/PPC execve /usr/X11R6/bin/xterm (141 bytes)
sco/x86 execve(_/bin/sh__ ..._ NULL); (43 bytes)
Solaris/sparc download and execute (278 bytes)
Solaris/sparc executes command after setreuid (92 bytes + cmd)
Solaris/sparc connect-back (with XNOR encoded session) (600 bytes)
Solaris/sparc setreuid/execve (56 bytes)
Solaris/sparc portbind (port 6666) (240 bytes)
Solaris/SPARC execve /bin/sh (52 bytes)
Solaris/SPARC portbind port 6789 (228 bytes)
Solaris/SPARC connect-back (204 bytes)
Solaris/SPARC portbinding shellcode
Solaris/x86 portbind/tcp shellcode generator
Solaris/x86 setuid(0)_ execve(//bin/sh); exit(0) NULL Free (39 bytes)
Solaris/x86 setuid(0)_ execve(/bin/cat_ /etc/shadow)_ exit(0) (59 bytes)
Solaris/x86 execve /bin/sh toupper evasion (84 bytes)
Solaris/x86 add services and execve inetd (201 bytes)
Linux/x86_64 - bindshell port:4444 shellcode (132 bytes)
Linux/x86_64 - execve(/bin/sh) (33 bytes)
Linux PPC & x86 - execve(_/bin/sh__{_/bin/sh__NULL}_NULL) (99 bytes)
OS-X PPC & x86 - execve(_/bin/sh__{_/bin/sh__NULL}_NULL) (121 bytes)
Linux/x86 & unix/SPARC & irix/mips - execve /bin/sh irx.mips (141 bytes)
Linux/x86 & unix/SPARC - execve /bin/sh (80 bytes)
Linux/x86 & bsd/x86 - execve /bin/sh (38 bytes)
netbsd/x86 - kill all processes shellcode (23 bytes)
netbsd/x86 - callback shellcode (port 6666) (83 bytes)
netbsd/x86 - setreuid(0_ 0); execve(_/bin//sh__ ..._ NULL); (29 bytes)
netbsd/x86 - setreuid(0_ 0); execve(_/bin//sh__ ..._ NULL); (30 bytes)
netbsd/x86 - execve /bin/sh (68 bytes)
openbsd/x86 - execve(/bin/sh) (23 bytes)
openbsd/x86 - portbind port 6969 (148 bytes)
openbsd/x86 - add user w00w00 (112 bytes)
OS-X/ppc - sync()_ reboot() (32 bytes)
OS-X/PPC - execve(/bin/sh)_ exit() (72 bytes)
OS-X/PPC - Add user r00t (219 bytes)
OS-X/PPC - execve /bin/sh (72 bytes)
OS-X/PPC - add inetd backdoor (222 bytes)
OS-X/PPC - reboot (28 bytes)
OS-X/PPC - setuid(0) + execve /bin/sh (88 bytes)
OS-X/PPC - create /tmp/suid (122 bytes)
OS-X/PPC - simple write() (75 bytes)
OS-X/PPC - execve /usr/X11R6/bin/xterm (141 bytes)
sco/x86 - execve(_/bin/sh__ ..._ NULL); (43 bytes)
Solaris/SPARC - download and execute (278 bytes)
Solaris/SPARC - executes command after setreuid (92+ bytes)
Solaris/SPARC - connect-back (with XNOR encoded session) (600 bytes)
Solaris/SPARC - setreuid/execve (56 bytes)
Solaris/SPARC - portbind (port 6666) (240 bytes)
Solaris/SPARC - execve /bin/sh (52 bytes)
Solaris/SPARC - portbind port 6789 (228 bytes)
Solaris/SPARC - connect-back (204 bytes)
Solaris/SPARC - portbinding shellcode
Solaris/x86 - portbind/tcp shellcode (Generator)
Solaris/x86 - setuid(0)_ execve(//bin/sh); exit(0) NULL Free (39 bytes)
Solaris/x86 - setuid(0)_ execve(/bin/cat_ /etc/shadow)_ exit(0) (59 bytes)
Solaris/x86 - execve /bin/sh toupper evasion (84 bytes)
Solaris/x86 - add services and execve inetd (201 bytes)

Win32/XP SP2 (En) - cmd.exe (23 bytes)
Win32/XP SP2 (EN) - cmd.exe (23 bytes)

Win32 SEH omelet shellcode 0.1
Win32  -SEH omelet shellcode

Win32 PEB!NtGlobalFlags shellcode (14 bytes)
Win32 - PEB!NtGlobalFlags shellcode (14 bytes)
Win32 PEB Kernel32.dll ImageBase Finder Alphanumeric (67 bytes)
Win32 PEB Kernel32.dll ImageBase Finder (Ascii Printable) (49 bytes)
Win32 connectback_ receive_ save and execute shellcode
Win32 Download and Execute Shellcode Generator (browsers edition)
Win32 - PEB Kernel32.dll ImageBase Finder Alphanumeric (67 bytes)
Win32 - PEB Kernel32.dll ImageBase Finder (ASCII Printable) (49 bytes)
Win32 - connectback_ receive_ save and execute shellcode
Win32 - Download and Execute Shellcode  (Generator) (Browsers Edition) (275+ bytes)

Win32 IsDebuggerPresent ShellCode (NT/XP) (39 bytes)
Win32 (NT/XP) - IsDebuggerPresent ShellCode (39 bytes)

Win32 - Download & Exec Shellcode (226 bytes+)
Win32 - Download & Exec Shellcode (226+ bytes)
Windows 9x/NT/2000/XP Reverse Generic Shellcode without Loader (249 bytes)
Windows 9x/NT/2000/XP PEB method (29 bytes)
Windows 9x/NT/2000/XP PEB method (31 bytes)
Windows 9x/NT/2000/XP PEB method (35 bytes)
Windows 9x/NT/2000/XP - Reverse Generic Shellcode without Loader (249 bytes)
Windows 9x/NT/2000/XP - PEB method (29 bytes)
Windows 9x/NT/2000/XP - PEB method (31 bytes)
Windows 9x/NT/2000/XP - PEB method (35 bytes)

Windows/XP download and exec source
Windows XP - download and exec source

Microsoft Windows - (DCOM RPC2) Universal Shellcode
Windows - (DCOM RPC2) Universal Shellcode

Linux - setuid(0) & execve(_/sbin/poweroff -f_)
Linux - setuid(0) & execve(_/sbin/poweroff -f_) (47 bytes)

Win xp sp2 PEB ISbeingdebugged shellcode
Windows XP SP2 - PEB ISbeingdebugged shellcode

Win32 XP SP3 ShellExecuteA shellcode
Win32 XP SP3 - ShellExecuteA shellcode
Win32 XP SP3 addFirewallRule
freebsd/x86 portbind shellcode (167 bytes)
Win32 XP SP3 - addFirewallRule
freebsd/x86 - portbind shellcode (167 bytes)

Win32/XP SP2 (En + Ar) - cmd.exe (23 bytes)
Win32/XP SP2 (EN + AR) - cmd.exe (23 bytes)
Windows XP Pro Sp2 English _Message-Box_ Shellcode
Windows XP Pro Sp2 English _Wordpad_ Shellcode
Windows XP Pro SP2 English - _Message-Box_ Shellcode Null-Free (16 bytes)
Windows XP Pro SP2 English - _Wordpad_ Shellcode Null Free (12 bytes)
Linux x86 - polymorphic shellcode ip6tables -F (71 bytes)
Linux x86 - ip6tables -F (47 bytes)
Linux/x86 - polymorphic shellcode ip6tables -F (71 bytes)
Linux/x86 - ip6tables -F (47 bytes)
Linux x86 - /bin/sh (8 bytes)
Linux x86 - execve /bin/sh (21 bytes)
Linux/x86 - /bin/sh (8 bytes)
Linux/x86 - execve /bin/sh (21 bytes)

Linux x86 - disabled modsecurity (64 bytes)
Linux/x86 - disabled modsecurity (64 bytes)

Win32 Mini HardCode WinExec&ExitProcess Shellcode (16 bytes)
Win32 - Mini HardCode WinExec&ExitProcess Shellcode (16 bytes)
Win32/XP SP3 (Ru) - WinExec+ExitProcess cmd shellcode (12 bytes)
Shellcode - Win32 MessageBox (Metasploit)
JITed egg-hunter stage-0 shellcode Adjusted universal for XP/Vista/Windows 7
Linux x86 - nc -lvve/bin/sh -p13377 shellcode
Win32/XP SP3 (RU) - WinExec+ExitProcess cmd shellcode (12 bytes)
Win32 - MessageBox (Metasploit)
Windows XP/Vista/Windows 7 - JITed egg-hunter stage-0 shellcode Adjusted universal
Linux/x86 - nc -lvve/bin/sh -p13377 shellcode
Linux write() & exit(0) shellcode genearator with customizable text
Linux x86 - polymorphic forkbombe - (30 bytes)
Linux x86 forkbombe
Linux - write() & exit(0) shellcode genearator with customizable text
Linux/x86 - polymorphic forkbombe - (30 bytes)
Linux/x86 - forkbomb

Linux/x86_64 execve(_/bin/sh_); shellcode (30 bytes)
Linux/x86_64 - execve(_/bin/sh_); shellcode (30 bytes)
Linux x86 - execve(_/bin/bash___-p__NULL) (33 bytes)
Linux x86 - polymorphic execve(_/bin/bash___-p__NULL) (57 bytes)
Linux/x86 - execve(_/bin/bash___-p__NULL) (33 bytes)
Linux/x86 - polymorphic execve(_/bin/bash___-p__NULL) (57 bytes)

Linux x86 - execve(_/usr/bin/wget__ _aaaa_); (42 bytes)
Linux/x86 - execve(_/usr/bin/wget__ _aaaa_); (42 bytes)

Windows 7 Pro SP1 64 Fr (Beep) Shellcode (39 bytes)
Windows 7 Pro SP1 64 FR - (Beep) Shellcode (39 bytes)
change mode 0777 of _/etc/shadow_ with sys_chmod syscall
Linux/x86 - kill all running process
change mode 0777 of _/etc/passwd_ with sys_chmod syscall
Linux x86 - sys_execve(_/bin/sh__ _-c__ _reboot_) shellcode (45 bytes)
Linux x86 - sys_setuid(0) & sys_setgid(0) & execve (_/bin/sh_) shellcode (39 bytes)
Windows 7 x64 (cmd) Shellcode (61 bytes)
Linux x86 - unlink _/etc/shadow_ shellcode (33 bytes)
Linux x86 - hard / unclean reboot (29 bytes)
Linux x86 - hard / unclean reboot (33 bytes)
change mode 0777 of _/etc/shadow_ with sys_chmod syscall (39 bytes)
Linux/x86 - kill all running process (11 bytes)
change mode 0777 of _/etc/passwd_ with sys_chmod syscall (39 bytes)
Linux/x86 - sys_execve(_/bin/sh__ _-c__ _reboot_) shellcode (45 bytes)
Linux/x86 - sys_setuid(0) & sys_setgid(0) & execve (_/bin/sh_) shellcode (39 bytes)
Windows 7 x64 - cmd Shellcode (61 bytes)
Linux/x86 - unlink _/etc/shadow_ shellcode (33 bytes)
Linux/x86 - hard / unclean reboot (29 bytes)
Linux/x86 - hard / unclean reboot (33 bytes)

Linux - chown root:root /bin/sh x86 shellcode (48 bytes)
Linux/x86 - chown root:root /bin/sh shellcode (48 bytes)

Linux x86 - netcat connect back port 8080 (76 bytes)
Linux/x86 - netcat connect back port 8080 (76 bytes)

Allwin MessageBoxA Shellcode
Windows - MessageBoxA Shellcode

Linux/x86-64 - Disable ASLR Security (143 bytes)
Linux/x86_64 - Disable ASLR Security (143 bytes)

Polymorphic Bindport 31337 with setreuid (0_0) linux/x86
Linux/x86 - Polymorphic Bindport 31337 with setreuid (0_0) (131 bytes)

Linux/x86-64 - setuid(0) & chmod (_/etc/passwd__ 0777) & exit(0) (63 bytes)
Linux/x86_64 - setuid(0) & chmod (_/etc/passwd__ 0777) & exit(0) (63 bytes)

Linux/x86-64 - Add root user with password (390 bytes)
Linux/x86_64 - Add root user with password (390 bytes)

ShellCode WinXP SP3 SPA URLDownloadToFileA + CreateProcessA + ExitProcess
Windows XP SP3 SPA - URLDownloadToFileA + CreateProcessA + ExitProcess (176+ bytes)

Polymorphic /bin/sh x86 linux shellcode
Linux/x86 - Polymorphic /bin/sh shellcode (116 bytes)

Linux/ARM chmod(_/etc/shadow__ 0777) Shellcode (35 bytes)
Linux/ARM - chmod(_/etc/shadow__ 0777) Shellcode (35 bytes)

Linux x86 - bind shell port 64533 (97 bytes)
Linux/x86 - bind shell port 64533 (97 bytes)

125 bind port to 6778 XOR encoded polymorphic linux shellcode
Linux - 125 bind port to 6778 XOR encoded polymorphic

ARM Polymorphic - execve(_/bin/sh__ [_/bin/sh_]_ NULL) Shellcode Generator
ARM - Polymorphic execve(_/bin/sh__ [_/bin/sh_]_ NULL) Shellcode (Generator)

Win32 - Write-to-file Shellcode

Linux/x86-64 - execve(_/sbin/iptables__ [_/sbin/iptables__ _-F_]_ NULL) (49 bytes)
Linux/x86_64 - execve(_/sbin/iptables__ [_/sbin/iptables__ _-F_]_ NULL) (49 bytes)

Linux x86 - netcat bindshell port 8080 (75 bytes)
Linux/x86 - netcat bindshell port 8080 (75 bytes)

Linux x86 - /bin/sh Null-Free Polymorphic Shellcode (46 bytes)
Linux/x86 - /bin/sh Null-Free Polymorphic Shellcode (46 bytes)

Shellcode Checksum Routine
Shellcode Checksum Routine (18 bytes)

Win32/XP SP3 (Tr) - Add Admin Account Shellcode (127 bytes)
Win32/XP SP3 (TR) - Add Admin Account Shellcode (127 bytes)

Windows Mobile 6.5 TR (WinCE 5.2) MessageBox Shellcode (ARM)
Windows Mobile 6.5 TR (WinCE 5.2) - MessageBox Shellcode (ARM)

Windows Mobile 6.5 TR Phone Call Shellcode
Windows Mobile 6.5 TR - Phone Call Shellcode

Win32/xp pro sp3 (EN) 32-bit - add new local administrator (113 bytes)
Win32/XP Pro SP3 (EN) 32-bit - add new local administrator (113 bytes)
ARM Bindshell port 0x1337
ARM Bind Connect UDP Port 68
ARM Loader Port 0x1337
ARM ifconfig eth0 and Assign Address
ARM - Bindshell port 0x1337
ARM - Bind Connect UDP Port 68
ARM - Loader Port 0x1337
ARM - ifconfig eth0 and Assign Address

w32 speaking shellcode
Win32 - speaking shellcode
BSD x86 connect back Shellcode (81 bytes)
BSD x86 portbind + fork shellcode (111 bytes)
bds/x86 - connect back Shellcode (81 bytes)
bds/x86 - portbind + fork shellcode (111 bytes)

OS-X/Intel reverse_tcp shell x86_64 (131 bytes)
OS-X/Intel - reverse_tcp shell x86_64 (131 bytes)

Allwin WinExec add new local administrator + ExitProcess Shellcode
Windows - WinExec add new local administrator + ExitProcess Shellcode (279 bytes)

Linux x86 - ASLR deactivation (83 bytes)
Linux/x86 - ASLR deactivation (83 bytes)

Linux/x86-32 - ConnectBack with SSL connection (422 bytes)
Linux/x86_32 - ConnectBack with SSL connection (422 bytes)

SuperH (sh4) Add root user with password
SuperH (sh4) - Add root user with password (143 bytes)

Linux x86 egghunt shellcode
Linux/x86 - egghunt shellcode (29 bytes)

OSX - Universal ROP shellcode
OS-X - Universal ROP shellcode

52 byte Linux MIPS execve
Linux/MIPS - execve (52 bytes)

MIPS Linux XOR Shellcode Encoder (60 bytes)
Linux/MIPS - XOR Shellcode Encoder (60 bytes)

Linux/x86-64 - execve(/bin/sh) (52 bytes)
Linux/x86_64 - execve(/bin/sh) (52 bytes)

Linux/x86 - Search For php/html Writable Files and Add Your Code
Linux/x86 - Search For php/html Writable Files and Add Your Code (380+ bytes)

Linux x86_64 - add user with passwd (189 bytes)
Linux/x86_64 - add user with passwd (189 bytes)

Linux x86 - chmod 666 /etc/passwd & /etc/shadow (57 bytes)
Linux/x86 - chmod 666 /etc/passwd & /etc/shadow (57 bytes)

ntop 1.x - -i Local Format String
ntop 1.x - i Local Format String
(Raspberry Pi) Linux/ARM - reverse_shell (tcp_10.1.1.2_0x1337)
(Raspberry Pi) Linux/ARM - execve(_/bin/sh__ [0]_ [0 vars]) (30 bytes)
(Raspberry Pi) Linux/ARM - chmod(_/etc/shadow__ 0777) (41 bytes)
Linux/ARM (Raspberry Pi) - reverse_shell (tcp_10.1.1.2_0x1337) (72 bytes)
Linux/ARM (Raspberry Pi) - execve(_/bin/sh__ [0]_ [0 vars]) (30 bytes)
Linux/ARM (Raspberry Pi) - chmod(_/etc/shadow__ 0777) (41 bytes)

Allwin URLDownloadToFile + WinExec + ExitProcess Shellcode
Windows - URLDownloadToFile + WinExec + ExitProcess Shellcode

MIPS Little Endian Shellcode
MIPS Little Endian - Shellcode

Media Player Classic 6.4.9 - - FLI File Remote Buffer Overflow
Media Player Classic 6.4.9 - FLI File Remote Buffer Overflow

Linux x86 - Socket Re-use Shellcode (50 bytes)
Linux/x86 - Socket Re-use Shellcode (50 bytes)

Linux x86 - chmod (777 /etc/passwd & /etc/shadow)_ Add New Root User (ALI/ALI) & Execute /bin/sh
Linux/x86 - chmod (777 /etc/passwd & /etc/shadow)_ Add New Root User (ALI/ALI) & Execute /bin/sh (378 bytes)

Obfuscated Shellcode Linux x86 - chmod 777 (/etc/passwd + /etc/shadow) & Add New Root User & Execute /bin/bash
Linux/x86 - Obfuscated Shellcode chmod 777 (/etc/passwd + /etc/shadow) & Add New Root User & Execute /bin/bash (521 bytes)

Mouse Media Script 1.6 - - Stored XSS
Mouse Media Script 1.6 - Stored XSS

Linux x86 - rmdir (37 bytes)
Linux/x86 - rmdir (37 bytes)

Linux x64 - Bind TCP port shellcode (81 bytes_ 96 with password)
Linux/x64 - Bind TCP port shellcode (81 bytes / 96 bytes with password)

Linux x64 - Reverse TCP connect (77 to 85 bytes_ 90 to 98 with password)
Linux/x64 - Reverse TCP connect (77 to 85 bytes / 90 to 98 bytes with password)
Windows x86 - Obfuscated Shellcode Add Administrator User/Pass ALI/ALI & Add ALI To RDP Group & Enable RDP From Registry & STOP Firewall & Auto Start Terminal Service (1218 Bytes)
Windows x64 -  Obfuscated Shellcode Add Administrator User/Pass ALI/ALI & Add ALI To RDP Group & Enable RDP From Registry & STOP Firewall & Auto Start Terminal Service (1218 Bytes)
Windows x86 - Obfuscated Shellcode Add Administrator User/Pass ALI/ALI & Add ALI To RDP Group & Enable RDP From Registry & STOP Firewall & Auto Start Terminal Service (1218 bytes)
Windows x64 - Obfuscated Shellcode Add Administrator User/Pass ALI/ALI & Add ALI To RDP Group & Enable RDP From Registry & STOP Firewall & Auto Start Terminal Service (1218 bytes)

Linux MIPS - execve (36 bytes)
Linux/MIPS - execve (36 bytes)

Win x86-64 - Download & execute (Generator)
Windows XP x86-64 - Download & execute (Generator)
Linux x86 - Egg-hunter (20 bytes)
Linux x86 - Typewriter Shellcode Generator
Linux/x86 - Egg-hunter (20 bytes)
Linux/x86 - Typewriter Shellcode (Generator)

Linux/x86 - execve _/bin/sh_ - shellcode (35 bytes)
Linux/x86 - execve _/bin/sh_ shellcode (35 bytes)

Linux custom execve-shellcode Encoder/Decoder
Linux - custom execve-shellcode Encoder/Decoder
Linux x86 - Execve /bin/sh Shellcode Via Push (21 bytes)
Linux x86-64 - Execve /bin/sh Shellcode Via Push (23 bytes)
Linux/x86 - Execve /bin/sh Shellcode Via Push (21 bytes)
Linux/x86_64 - Execve /bin/sh Shellcode Via Push (23 bytes)

Linux x86 - /bin/nc -le /bin/sh -vp 17771 Shellcode (58 bytes)
Linux/x86 - /bin/nc -le /bin/sh -vp 17771 Shellcode (58 bytes)

Linux/x86 - execve /bin/sh shellcode (21 bytes) (2)
Linux/x86 - execve /bin/sh shellcode (2) (21 bytes)

Linux - execve(/bin/sh) (30 bytes)
Linux/x86_64 - execve(/bin/sh) (30 bytes)

Linux 64 bit - Encoded execve shellcode
Linux 64bit - Encoded execve shellcode

Linux x86 /bin/sh ROT7 Encoded Shellcode
Linux/x86 - /bin/sh ROT7 Encoded Shellcode

Win32/xp[TR] sp3 - MessageBox (24 bytes)
Win32/XP SP3 (TR) - MessageBox (24 bytes)

Linux x86 - Egg Hunter Shellcode (19 bytes)
Linux/x86 - Egg Hunter Shellcode (19 bytes)

Windows x86 - user32!MessageBox _Hello World!_ (199 Bytes Null-Free)
Windows x86 - user32!MessageBox _Hello World!_ Null-Free (199 bytes)

Linux x86 - /bin/sh ROL/ROR Encoded Shellcode
Linux/x86 - /bin/sh ROL/ROR Encoded Shellcode

OS X x64 /bin/sh Shellcode - NULL Byte Free (34 bytes)
OS-X x64 - /bin/sh Shellcode - NULL Byte Free (34 bytes)

Mainframe/System Z Bind Shell
Mainframe/System Z - Bind Shell

Linux/x86 - execve(_/bin/cat__ [_/bin/cat__ _/etc/passwd_]_ NULL)
Linux/x86 - execve(_/bin/cat__ [_/bin/cat__ _/etc/passwd_]_ NULL) (75 bytes)

OS X x64 - tcp bind shellcode_ NULL byte free (144 bytes)
OS-X x64 - tcp bind shellcode_ NULL byte free (144 bytes)

Linux x86_64 - /bin/sh
Linux/x86_64 - /bin/sh

Linux x86_64 - execve Shellcode (22 bytes)
Linux/x86_64 - execve Shellcode (22 bytes)

Linux x86_64 - Bindshell with Password (92 bytes)
Linux/x86_64 - Bindshell with Password (92 bytes)

Linux x64 - egghunter (24 bytes)
Linux/x64 - egghunter (24 bytes)

Linux x86_64 - Polymorphic execve Shellcode (31 bytes)
Linux/x86_64 - Polymorphic execve Shellcode (31 bytes)

Windows XP-10 - Null-Free WinExec Shellcode (Python)
Windows XP<10 - Null-Free WinExec Shellcode (Python)

x64 Linux Bind TCP Port Shellcode
Linux/x64 - Bind TCP Port Shellcode (103 bytes)

x86_64 Linux bind TCP port shellcode
Linux/x86_64 - bind TCP port shellcode (103 bytes)

Linux/x86 - execve _/bin/sh_ - shellcode 24 byte
Linux/x86 - execve _/bin/sh_ shellcode (24 bytes)
Linux x86_64 - Egghunter (18 bytes)
Linux x86 - Egg-hunter (13 bytes)
Linux/x86_64 - Egghunter (18 bytes)
Linux/x86 - Egg-hunter (13 bytes)

WordPress Booking Calendar Contact Form Plugin <=1.1.23 - Unauthenticated SQL injection
WordPress Booking Calendar Contact Form Plugin <= 1.1.23 - Unauthenticated SQL injection

x86_64 Linux xor/not/div Encoded execve Shellcode
Linux/x86_64 - xor/not/div Encoded execve Shellcode (54 bytes)

WordPress Booking Calendar Contact Form Plugin <=1.1.23 - Shortcode SQL Injection
WordPress Booking Calendar Contact Form Plugin <= 1.1.23 - Shortcode SQL Injection

Linux x86/x86_64 reverse_tcp Shellcode
Linux/x86/x86_64 - reverse_tcp Shellcode
Linux x86/x86_64 tcp_bind Shellcode
Linux x86/x86_64 Read etc/passwd Shellcode
Linux/x86/x86_64 - tcp_bind Shellcode
Linux/x86/x86_64 - Read etc/passwd Shellcode

WordPress Booking Calendar Contact Form <=1.1.24 - Multiple Vulnerabilities
WordPress Booking Calendar Contact Form <= 1.1.24 - Multiple Vulnerabilities

x86_64 Linux shell_reverse_tcp with Password - Polymorphic Version (1)
Linux/x86_64 - shell_reverse_tcp with Password - Polymorphic Version (1) (122 bytes)
x86_64 Linux shell_reverse_tcp with Password - Polymorphic Version (2)
Linux x86 Download & Execute Shellcode
Linux x86_64 - Polymorphic Execve-Stack (47 bytes)
Linux/x86_64 - shell_reverse_tcp with Password - Polymorphic Version (2) (135 bytes)
Linux/x86 - Download & Execute Shellcode
Linux/x86_64 - Polymorphic Execve-Stack (47 bytes)

Linux x86_64 - Reverse Shell Shellcode
Linux/x86_64 - Reverse Shell Shellcode

Linux/x86_x64 - execve(/bin/sh) (26 bytes)
Linux/x86_64 - execve(/bin/sh) (26 bytes)
Linux/x86_x64 - execve(/bin/sh) (25 bytes)
Linux/x86_x64 - execve(/bin/bash) (33 bytes)
Linux/x86_64 - execve(/bin/sh) (25 bytes)
Linux/x86_64 - execve(/bin/bash) (33 bytes)

Linux/x86_64 - bindshell (PORT: 5600) (81 bytes)
Linux/x86_64 - bindshell (Pori: 5600) (81 bytes)

Windows x86 URLDownloadToFileA()+SetFileAttributesA()+WinExec()+ExitProcess() Shellcode
Windows x86 - URLDownloadToFileA()+SetFileAttributesA()+WinExec()+ExitProcess() Shellcode
Linux x86 Reverse TCP Shellcode (ipv6)
Linux x86 Shellcode - Bind TCP Port 1472 (ipv6)
Linux/x86 - Reverse TCP Shellcode (IPv6)
Linux/x86 - Bind TCP Port 1472 (IPv6) (1250 bytes)

Linux x64 - Bind Shell Shellcode Generator
Linux/x64 - Bind Shell Shellcode (Generator)

Windows Null-Free Shellcode - Primitive Keylogger to File (431 (0x01AF) bytes)
Windows - Null-Free Shellcode Primitive Keylogger to File (431 (0x01AF) bytes)

.Net Framework Execute Native x86 Shellcode
.Net Framework - Execute Native x86 Shellcode

Linux x86_64 Shellcode - Bind TCP Port 1472 (ipv6)
Linux/x86_64 - Bind TCP Port 1472 (IPv6)

Linux x86_64 Shellcode - Reverse TCP (ipv6)
Linux/x86_64 - Reverse TCP (IPv6)

Windows - Null-Free Shellcode - Functional Keylogger to File (601 (0x0259) bytes)
Windows - Null-Free Shellcode Functional Keylogger to File (601 (0x0259) bytes)

Linux x86_64 Shellcode Null-Free Reverse TCP Shell
Linux/x86_64 - Null-Free Reverse TCP Shell

Linux x86_64 Information Stealer Shellcode
Linux/x86_64 - Information Stealer Shellcode

Linux x86 - TCP Bind Shell Port 4444 (656 bytes)
Linux/x86 - TCP Bind Shell Port 4444 (656 bytes)

Linux x86_64 XOR Encode execve Shellcode
Linux/x86_64 - XOR Encode execve Shellcode

Linux/Windows/BSD x86_64 execve(_/bin//sh__ {_//bin/sh__ _-c__ _cmd_}_ NULL) Execute Command Shellcode
Linux/Windows/BSD x86_64 - execve(_/bin//sh__ {_//bin/sh__ _-c__ _cmd_}_ NULL) Execute Command Shellcode (194 bytes)
Windows x86 WinExec(_cmd.exe__0) Shellcode
Linux x86 - /bin/nc -le /bin/sh -vp13337 Shellcode (56 bytes)
Windows x86 - WinExec(_cmd.exe__0) Shellcode
Linux/x86 - /bin/nc -le /bin/sh -vp13337 Shellcode (56 bytes)

Windows x86 system(_systeminfo_) Shellcode
Windows x86 - system(_systeminfo_) Shellcode

Windows x86 ShellExecuteA(NULL_NULL__cmd.exe__NULL_NULL_1) Shellcode
Windows x86 - ShellExecuteA(NULL_NULL__cmd.exe__NULL_NULL_1) Shellcode

Linux x86 /bin/sh Shellcode + ASLR Bruteforce
Linux/x86 - /bin/sh Shellcode + ASLR Bruteforce

Linux x86_64 /etc/passwd File Sender Shellcode
Linux/x86_64 - /etc/passwd File Sender Shellcode

Linux x86 - TCP Bind Shell Port 4444 (98 bytes)
Linux/x86 - TCP Bind Shell Port 4444 (98 bytes)

Linux x86 - TCP Reverse Shellcode (75 bytes)
Linux/x86 - TCP Reverse Shellcode (75 bytes)

Linux x86-64 - Continuously-Probing Reverse Shell via Socket + Port-range + Password (172 bytes)
Linux/x86_64 - Continuously-Probing Reverse Shell via Socket + Port-range + Password (172 bytes)

Linux x86 - Reverse Shell using Xterm ///usr/bin/xterm -display 127.1.1.1:10
Linux/x86 - Reverse Shell using Xterm ///usr/bin/xterm -display 127.1.1.1:10
Clear Voyager Hotspot IMW-C910W - Arbitrary File Disclosure
 2016-07-16 05:06:26 +00:00
Offensive Security
0d018828aa DB: 2016-07-15 2016-07-15 06:29:45 +00:00
Offensive Security
13e9ec719b DB: 2016-07-14 
17 new exploits

Adobe Acrobat Reader DC 15.016.20045 - Invalid Font (.ttf ) Memory Corruption
Adobe Acrobat Reader DC 15.016.20045 - Invalid Font (.ttf ) Memory Corruption (2)
Adobe Acrobat Reader DC 15.016.20045 - Invalid Font (.ttf ) Memory Corruption (3)
Adobe Acrobat Reader DC 15.016.20045 - Invalid Font (.ttf ) Memory Corruption (4)
Adobe Acrobat Reader DC 15.016.20045 - Invalid Font (.ttf ) Memory Corruption (5)
Adobe Acrobat Reader DC 15.016.20045 - Invalid Font (.ttf ) Memory Corruption (6)
Adobe Acrobat Reader DC 15.016.20045 - Invalid Font (.ttf ) Memory Corruption (7)
Adobe Flash Player 22.0.0.192 - DefineBitsJPEG2 Memory Corruption
Adobe Flash Player 22.0.0.192 - DefineSprite Memory Corruption
Adobe Flash Player 22.0.0.192 - TAG Memory Corruption
Adobe Flash Player 22.0.0.192 - SceneAndFrameData Memory Corruption

Windows x86 URLDownloadToFileA()+SetFileAttributesA()+WinExec()+ExitProcess() Shellcode
GSX Analyzer 10.12 and 11 - Main.swf Hardcoded Superadmin Credentials
MS16-032 Secondary Logon Handle Privilege Escalation
Riverbed SteelCentral NetProfiler/NetExpress Remote Code Execution
Apache Archiva 1.3.9 - Multiple CSRF Vulnerabilities
Linux x86 Reverse Shell using Xterm  ///usr/bin/xterm -display 127.1.1.1:10
 2016-07-14 05:05:01 +00:00
Offensive Security
5cf8f533ae DB: 2016-07-13 2016-07-13 05:07:07 +00:00
Offensive Security
fc4bc08825 DB: 2016-07-12 
15 new exploits

Apache HTTPd - Arbitrary Long HTTP Headers DoS
Apache HTTPd - Arbitrary Long HTTP Headers DoS (Perl)

Apache HTTPd - Arbitrary Long HTTP Headers DoS
Apache HTTPd - Arbitrary Long HTTP Headers DoS (C)

Mercury Mail 4.01 (Pegasus) IMAP Buffer Overflow Exploit (c code)
Mercury Mail 4.01 - (Pegasus) IMAP Buffer Overflow Exploit (C) (1)

Mercury Mail 4.01 - (Pegasus) IMAP Buffer Overflow (2) (c code)
Mercury Mail 4.01 - (Pegasus) IMAP Buffer Overflow (C) (2)
Webhints <= 1.03 - Remote Command Execution Exploit (perl code) (1)
Webhints <= 1.03 - Remote Command Execution Exploit (c code) (2)
Webhints <= 1.03 - Remote Command Execution Exploit (perl code) (3)
Webhints <= 1.03 - Remote Command Execution Exploit (Perl) (1)
Webhints <= 1.03 - Remote Command Execution Exploit (C) (2)
Webhints <= 1.03 - Remote Command Execution Exploit (Perl) (3)
phpBB <= 2.0.15 - Register Multiple Users Denial of Service (Perl Code)
phpBB <= 2.0.15 - Register Multiple Users Denial of Service (C Code)
phpBB <= 2.0.15 - Register Multiple Users Denial of Service (Perl)
phpBB <= 2.0.15 - Register Multiple Users Denial of Service (C)

SimpleBBS <= 1.1 - Remote Commands Execution Exploit (c code)
SimpleBBS <= 1.1 - Remote Commands Execution Exploit (C)

Xmame 0.102 (-lang) Local Buffer Overflow Exploit (c code)
Xmame 0.102 - (lang) Local Buffer Overflow Exploit (C)

aFAQ 1.0 (faqDsp.asp catcode) Remote SQL Injection Vulnerability
aFAQ 1.0 - (faqDsp.asp catcode) Remote SQL Injection Vulnerability

Apple CFNetwork HTTP Response Denial of Service Exploit (rb code)
Apple CFNetwork - HTTP Response Denial of Service Exploit (RB)

PhpBlock a8.4 (PATH_TO_CODE) Remote File Inclusion Vulnerability
PhpBlock a8.4 - (PATH_TO_CODE) Remote File Inclusion Vulnerability

WebPortal CMS <= 0.7.4 (code) Remote Code Execution Vulnerability
WebPortal CMS <= 0.7.4 - (code) Remote Code Execution Vulnerability

emergecolab 1.0 (sitecode) Local File Inclusion Vulnerability
emergecolab 1.0 - (sitecode) Local File Inclusion Vulnerability

Simple Machines Forums (BBCode) Cookie Stealing Vulnerability
Simple Machines Forums - (BBCode) Cookie Stealing Vulnerability

Movie PHP Script 2.0 (init.php anticode) Code Execution Vulnerability
Movie PHP Script 2.0 - (init.php anticode) Code Execution Vulnerability

Kjtechforce mailman b1 (code) SQL Injection Delete Row Vulnerability
Kjtechforce mailman b1 - (code) SQL Injection Delete Row Vulnerability

WordPress Activity Log Plugin 2.3.1 - Persistent XSS

IPS Community Suite 4.1.12.3 - PHP Code Injection
Adobe Flash - ATF Processing Overflow
Adobe Flash - JXR Processing Double Free
Adobe Flash - LMZA Property Decoding Heap Corruption
Adobe Flash - ATF Image Packing Overflow
Tiki Wiki 15.1 - Unauthenticated File Upload Vulnerability (msf)

Ho' Detector (Promiscuous mode detector shellcode) (56 bytes)
Ho' Detector - Promiscuous mode detector shellcode (56 bytes)

MS16-016 mrxdav.sys WebDav Local Privilege Escalation

Ruby on Rails ActionPack Inline ERB Code Execution

Lan Messenger sending PM Buffer Overflow (UNICODE) - Overwrite SEH
Lan Messenger - sending PM Buffer Overflow (UNICODE) Overwrite SEH
Tiki Wiki CMS 15.0 - Arbitrary File Download
Belkin Router AC1200 Firmware 1.00.27 - Authentication Bypass
WordPress All in One SEO Pack Plugin 2.3.6.1 - Persistent XSS
Device42 WAN Emulator 2.3 Traceroute Command Injection
Device42 WAN Emulator 2.3 Ping Command Injection
Device42 WAN Emulator 2.3 - Traceroute Command Injection
Device42 WAN Emulator 2.3 - Ping Command Injection

Samsung Galaxy S6 Samsung Gallery - Bitmap Decoding Crash

Dell KACE K1000 File Upload
Dell KACE K1000 - File Upload

Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection
Dell SonicWALL Scrutinizer 11.01 - methodDetail SQL Injection

Valve Steam 3.42.16.13 - Local Privilege Escalation
Beauty Parlour & SPA Saloon Management System - Blind SQL Injection
Clinic Management System - Blind SQL Injection

Linux x86-64 Continuously-Probing Reverse Shell via Socket + Port-range + Password - 172 Bytes
 2016-07-12 05:05:04 +00:00
Offensive Security
76bc268c80 DB: 2016-07-11 2016-07-11 05:06:57 +00:00
Offensive Security
c9a818eb76 DB: 2016-07-10 2016-07-10 05:03:45 +00:00
Offensive Security
29f0764fac DB: 2016-07-09 
9 new exploits

Joomla <= 1.0.9 (Weblinks) Remote Blind SQL Injection Exploit
Joomla <= 1.0.9 - (Weblinks) Remote Blind SQL Injection Exploit

Microsoft Excel Malformed FEATHEADER Record Exploit (MS09-067)
Microsoft Excel - Malformed FEATHEADER Record Exploit (MS09-067)

Seo Panel 2.2.0 Cookie-Rendered Persistent XSS Vulnerability
Seo Panel 2.2.0 - Cookie-Rendered Persistent XSS Vulnerability

VLC AMV Dangling Pointer Vulnerability
VLC - AMV Dangling Pointer Vulnerability

Movable Type 4.2x_ 4.3x Web Upgrade Remote Code Execution
Movable Type 4.2x_ 4.3x - Web Upgrade Remote Code Execution

Roxio CinePlayer 3.2 SonicDVDDashVRNav.DLL ActiveX Control Remote Buffer Overflow Vulnerability
Roxio CinePlayer 3.2 - SonicDVDDashVRNav.DLL ActiveX Control Remote Buffer Overflow Vulnerability

HP Client Automation Command Injection
HP Client - Automation Command Injection

Persistent Systems Client Automation Command Injection RCE
Persistent Systems Client Automation - Command Injection RCE

ElasticSearch Unauthenticated Remote Code Execution
ElasticSearch - Unauthenticated Remote Code Execution

ElasticSearch Search Groovy Sandbox Bypass
ElasticSearch - Search Groovy Sandbox Bypass

Fedora abrt Race Condition Exploit
Fedora - abrt Race Condition Exploit

ProFTPD 1.3.5 Mod_Copy Command Execution
ProFTPD 1.3.5 - Mod_Copy Command Execution

Windows ClientCopyImage Win32k Exploit
Microsoft Windows - ClientCopyImage Win32k Exploit

Wolf CMS Arbitrary File Upload To Command Execution
Wolf CMS - Arbitrary File Upload To Command Execution

Windows Kernel - Bitmap Handling Use-After-Free (MS15-061)
Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (1)

Kaseya VSA uploader.aspx Arbitrary File Upload
Kaseya Virtual System Administrator (VSA) - uploader.aspx Arbitrary File Upload

Samsung Galaxy S6 - Samsung Gallery Bitmap Decoding Crash
Samsung Galaxy S6 Samsung Gallery - Bitmap Decoding Crash
Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux 2 (MS16-008)
Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (MS16-008)
Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (2) (MS16-008)
Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (1) (MS16-008)

Microsoft Windows 7 SP1 x86 - WebDAV Privilege Escalation (MS16-016)
Microsoft Windows 7 SP1 x86 - WebDAV Privilege Escalation (MS16-016) (1)

NETGEAR ProSafe Network Management System 300 Arbitrary File Upload
NETGEAR ProSafe Network Management System 300 - Arbitrary File Upload

Windows - Secondary Logon Standard Handles Missing Sanitization Privilege Escalation (MS16-032)
Microsoft  Windows 8.1/10 - Secondary Logon Standard Handles Missing Sanitization Privilege Escalation (MS16-032)

OS X / iOS Suid Binary Logic Error Kernel Code Execution
OS X / iOS - Suid Binary Logic Error Kernel Code Execution

Novell ServiceDesk Authenticated File Upload
Novell ServiceDesk - Authenticated File Upload

Mach Race OS X Local Privilege Escalation Exploit
Mach Race OS X - Local Privilege Escalation Exploit

Oracle ATS Arbitrary File Upload
Oracle Application Testing Suite (ATS) - Arbitrary File Upload

Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (Metasploit)
HP Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (Metasploit)
WordPress Lazy Content Slider Plugin 3.4 - (Add Catetory) CSRF
Hide.Me VPN Client 1.2.4 - Privilege Escalation
InstantHMI 6.1 - Privilege Escalation
Microsoft Process Kill Utility (kill.exe) 6.3.9600.17298 - Crash PoC
Microsoft WinDbg logviewer.exe - Crash PoC
Linux x86 TCP Reverse Shellcode - 75 bytes
php Real Estate Script 3 - Arbitrary File Disclosure
CyberPower Systems PowerPanel 3.1.2 - XXE Out-Of-Band Data Retrieval
Streamo Online Radio And TV Streaming CMS - SQL Injection
 2016-07-09 05:06:22 +00:00
Offensive Security
c7daadde64 DB: 2016-07-08 
8 new exploits

WordPress Q and A (Focus Plus) FAQ Plugin 1.3.9.7 - Multiple Vulnerabilities
WordPress Huge-IT Image Gallery Plugin 1.8.9 - Multiple Vulnerabilities

Codoforum 3.4 - Stored Cross-Site Scripting
MediaCoder 0.8.43.5830 - .m3u Buffer Overflow SEH Exploit
VUPlayer 2.49 - .m3u Buffer Overflow Exploit (Win 7 DEP Bypass)

Core FTP LE 2.2 - Path Field Local Buffer Overflow
OPAC KpwinSQL - Multiple Vulnerabilities
GE Proficy HMI/SCADA CIMPLICITY 8.2 - Local Privilege Escalation
 2016-07-08 05:06:14 +00:00
Offensive Security
52cf6a3185 DB: 2016-07-07 
9 new exploits

CIMA DocuClass ECM - Multiple Vulnerabilities
24online SMS_2500i 8.3.6 build 9.0 - SQL Injection
Linux 64bit Ncat Shellcode (SSL_ MultiChannel_ Persistant_ Fork_ IPv4/6_ Password) - 176 bytes
Advanced Webhost Billing System (AWBS) 2.9.6 - Multiple Vulnerabilities
PaKnPost Pro 1.14 - Multiple Vulnerabilities
GNU Wget < 1.18 - Arbitrary File Upload/Remote Code Execution
OpenFire 3.10.2 - 4.0.1 - Multiple Vulnerabilities
Samsung Android JACK - Privilege Escalation
Nagios XI Chained Remote Code Execution
 2016-07-07 05:06:28 +00:00
Offensive Security
49a443eece DB: 2016-07-06 2016-07-06 05:02:46 +00:00
Offensive Security
b530dd470e DB: 2016-07-05 
8 new exploits

BigDump - (Cross Site Scripting/SQL Injection/Arbitrary File Upload) Multiple Vulnerabilities
BigDump 0.29b and 0.32b - Multiple Vulnerabilities

Linux - netfilter IPT_SO_SET_REPLACE Memory Corruption
Linux Kernel 3.10_ 3.18 + 4.4 - netfilter IPT_SO_SET_REPLACE Memory Corruption

Debian Exim - Spool Local Root Privilege Escalation

Ubuntu 16.04 local root exploit - netfilter target_offset OOB
Linux Kernel 4.4.0-2 (Ubuntu 16.04) - netfilter target_offset OOB Local Root Exploit
XpoLog Center 6 - Remote Command Execution CSRF
Ktools Photostore 4.7.5 - Multiple Vulnerabilities
Linux 64bit NetCat Bind Shell Shellcode - 64 bytes
WordPress Real3D FlipBook Plugin - Multiple Vulnerabilities
Linux x86 TCP Bind Shell Port 4444 - 98 bytes
WebCalendar 1.2.7 - Multiple Vulnerabilities
eCardMAX 10.5 - Multiple Vulnerabilities
 2016-07-05 05:06:28 +00:00
Offensive Security
aeca36b114 DB: 2016-07-04 
1 new exploits

Ubuntu 16.04 local root exploit - netfilter target_offset OOB
 2016-07-04 05:05:27 +00:00
Offensive Security
58c236d738 DB: 2016-07-02 
1 new exploits

Sudo 1.3.1 - 1.6.8p - Pathname Validation Local Root Exploit (OpenBSD)
Sudo 1.3.1 - 1.6.8p (OpenBSD) - Pathname Validation Local Root Exploit

Seattle Lab Software Emurl 2.0 Email Account Access Vulnerability
Seattle Lab Software Emurl 2.0 - Email Account Access Vulnerability

Phoenix Exploit Kit - Remote Code Execution
 2016-07-02 05:02:45 +00:00
Offensive Security
0fddce018e DB: 2016-07-01 
2 new exploits

phpBookingCalendar <= 1.0c - (details_view.php) Remote SQL Injection
TFT Gallery <= 0.10 - Password Disclosure Remote Exploit
phpBookingCalendar 1.0c - (details_view.php) SQL Injection
TFT Gallery 0.10 - Password Disclosure Remote Exploit

Seattle Lab Mail 5.5 - POP3 Buffer Overflow
Seattle Lab Mail (SLMail) 5.5 - POP3 Buffer Overflow

Ktools Photostore 4.7.5 - Blind SQL Injection

Easy RM to MP3 Converter 2.7.3.700 - (.m3u) Exploit with Universal DEP+ASLR Bypass
 2016-07-01 05:05:35 +00:00
Offensive Security
f74a7dfb7e DB: 2016-06-30 
13 new exploits

Symantec Antivirus - Multiple Remote Memory Corruption Unpacking RAR
Symantec Antivirus - Remote Stack Buffer Overflow in dec2lha Library
Symantec Antivirus - Heap Overflow Modifying MIME Messages
Symantec Antivirus - Integer Overflow in TNEF Decoder
Symantec Antivirus - Missing Bounds Checks in dec2zip ALPkOldFormatDecompressor::UnShrink
Symantec Antivirus - PowerPoint Misaligned Stream-cache Remote Stack Buffer Overflow
Windows 7 SP1 x86 - Privilege Escalation (MS16-014)
Lenovo ThinkPad - System Management Mode Arbitrary Code Execution Exploit
Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities
WordPress Ultimate Membership Pro Plugin 3.3 - SQL Injection
Cuckoo Sandbox Guest 2.0.1 - XMLRPC Privileged Remote Code Execution
Ubiquiti Administration Portal - CSRF to Remote Command Execution
Concrete5 5.7.3.1 - (Application::dispatch) Local File Inclusion
 2016-06-30 05:05:39 +00:00
Offensive Security
94e65060ad DB: 2016-06-29 
2 new exploits

Linux x86_64 /etc/passwd File Sender Shellcode
Untangle NGFW 12.1.0 beta - execEvil() Command Injection
 2016-06-29 05:06:40 +00:00
Offensive Security
e9145685e4 DB: 2016-06-28 
14 new exploits

Linux Netcat Reverse Shell - 32bit - 77 bytes

XM Easy Personal FTP Server 5.8 - (HELP) Remote DoS Vulnerability

Linux x86_64 execve Shellcode - 15 bytes
WordPress Ultimate Product Catalog Plugin 3.8.6 - Arbitrary File Upload
OPAC KpwinSQL - SQL Injection
Magnet Networks Tesley CPVA 642 Router – Weak WPA-PSK Passphrase Algorithm
Option CloudGate CG0192-11897 - Multiple Vulnerabilities
Kagao 3.0 - Multiple Vulnerabilities
Panda Security Multiple Products - Privilege Escalation
MyLittleForum 2.3.5 - PHP Command Injection
iBilling 3.7.0 - Stored and Reflected XSS
PInfo 0.6.9-5.1 - Local Buffer Overflow
BigTree CMS 4.2.11 - SQL Injection
HNB 1.9.18-10 - Local Buffer Overflow
Linux x86 /bin/sh Shellcode + ASLR Bruteforce
SugarCRM 6.5.18 - PHP Code Injection
Riverbed SteelCentral NetProfiler & NetExpress 10.8.7 - Multiple Vulnerabilities
 2016-06-28 05:03:46 +00:00
Offensive Security
3739831fb2 DB: 2016-06-24 
16 new exploits

Banner Exchange Script 1.0 - (targetid) Blind SQL Injection Vulnerability

PHP 5.3.3 - ibase_gen_id() off-by-one Overflow Vulnerability
ARM Bindshell port 0x1337
ARM Bind Connect UDP Port 68
ARM Loader Port 0x1337
ARM ifconfig eth0 and Assign Address
ARM Bindshell port 0x1337
ARM Bind Connect UDP Port 68
ARM Loader Port 0x1337
ARM ifconfig eth0 and Assign Address

G Data TotalCare 2011 - NtOpenKey Race Condition Vulnerability

ImpressPages CMS 3.8 - Stored XSS Vulnerability

Seagate BlackArmor NAS sg2000-2000.1331 - Cross-Site Request Forgery

Barracuda Networks #35 Web Firewall 610 6.0.1 - Filter Bypass & Persistent Vulnerability

Linux Netcat Reverse Shell - 32bit - 77 bytes

PrestaShop 1.4.4.1 modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php Multiple Parameter XSS
PrestaShop 1.4.4.1 mondialrelay (kit_mondialrelay) - Multiple Parameter XSS
Getsimple CMS 3.3.10 - Arbitrary File Upload

op5 v7.1.9 Configuration Command Execution
op5 7.1.9 - Configuration Command Execution
Alibaba Clone B2B Script - Arbitrary File Disclosure
XuezhuLi FileSharing - Directory Traversal
XuezhuLi FileSharing - (Add User) CSRF
FinderView - Multiple Vulnerabilities
 2016-06-24 05:06:19 +00:00
Offensive Security
412cc0a204 DB: 2016-06-23 
4 new exploits

Linux Kernel 2.4 - uselib() Privilege Elevation Exploit (2)
Linux Kernel 2.4 - 'uselib()' Privilege Elevation Exploit (2)

Linux Kernel 2.4.x / 2.6.x - uselib() Local Privilege Escalation Exploit (3)
Linux Kernel 2.4.x / 2.6.x - 'uselib()' Local Privilege Escalation Exploit (3)

Linux Kernel 2.6.23 <= 2.6.24 - vmsplice Local Root Exploit (1)
Linux Kernel 2.6.23 <= 2.6.24 - 'vmsplice' Local Root Exploit (1)

Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) - UDEV Local Privilege Escalation Exploit (1)
Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) - < UDEV 1.4.1 Local Privilege Escalation Exploit (1)

Linux Kernel 2.x - 'sock_sendpage()' Local Root Exploit (2)
Linux Kernel 2.x - 'sock_sendpage()' Local Root Exploit (4)

Linux Kernel 2.4 / 2.6 (RedHat Linux 9 / Fedora Core 4~11 / Whitebox 4 / CentOS 4) - 'sock_sendpage()' ring0 Root Exploit (3)
Linux Kernel 2.4 / 2.6 (RedHat Linux 9 / Fedora Core 4~11 / Whitebox 4 / CentOS 4) - 'sock_sendpage()' ring0 Root Exploit (5)

Linux Kernel 2.4 / 2.6 (Fedora 11) - 'sock_sendpage()' Local Root Exploit (4)
Linux Kernel 2.4 / 2.6 (Fedora 11) - 'sock_sendpage()' Local Root Exploit (2)

Linux Kernel 2.4 / 2.6 - 'sock_sendpage()' Local Root Exploit (5)
Linux Kernel 2.4 / 2.6 - 'sock_sendpage()' Local Root Exploit (3)

Linux Kernel 2.4.1-2.4.37 / 2.6.1-2.6.32-rc5 - Pipe.c Privilege Escalation (3)
Linux Kernel 2.4.1-2.4.37 / 2.6.1-2.6.32-rc5 - 'Pipe.c' Privilege Escalation (3)

Linux Kernel <= 2.6.37 (Redhat / Ubuntu 10.04) - 'Full-Nelson.c' Local Privilege Escalation
Linux Kernel <= 2.6.37 (Redhat / Ubuntu 10.04) - 'Full-Nelson.c' Local Privilege Escalation (1)

Linux Kernel < 2.6.36.2 (Ubuntu 10.04) - 'Half-Nelson.c' Econet Privilege Escalation Exploit
Linux Kernel < 2.6.36.2 (Ubuntu 10.04) - 'Half-Nelson.c' Econet Privilege Escalation Exploit (2)
UNICOS 9/MAX 1.3/mk 1.5_AIX <= 4.2_libc <= 5.2.18_RedHat 4_IRIX 6_Slackware 3 NLS Vuln(1)
UNICOS 9/MAX 1.3/mk 1.5_AIX <= 4.2_libc <= 5.2.18_RedHat 4_IRIX 6_Slackware 3 NLS Vuln(2)
UNICOS 9/MAX 1.3/mk 1.5_AIX <= 4.2_libc <= 5.2.18_RedHat 4_IRIX 6_Slackware 3 NLS Vulnerability (1)
UNICOS 9/MAX 1.3/mk 1.5_AIX <= 4.2_libc <= 5.2.18_RedHat 4_IRIX 6_Slackware 3 NLS Vulnerability (2)

Linux Kernel 3.3 < 3.8 (Ubuntu/Fedora 18) - SOCK_DIAG Local Root Exploit (3)
Linux Kernel 3.3 < 3.8 (Ubuntu / Fedora 18) - 'sock_diag_handlers()' Local Root Exploit (3)

Linux Kernel <= 4.4.1 - REFCOUNT Overflow/Use-After-Free in Keyrings Local Root (2)
Linux Kernel <= 4.4.1 - REFCOUNT Overflow/Use-After-Free in Keyrings Local Root (1)
Linux Kernel <= 4.4.1 - REFCOUNT Overflow/Use-After-Free in Keyrings Local Root (2)
Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever (MSF)
Gemtek CPE7000 - WLTCS-106 sysconf.cgi Unauthenticated Remote Command Execution (MSF)
Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever (Metasploit)
Gemtek CPE7000 - WLTCS-106 sysconf.cgi Unauthenticated Remote Command Execution (Metasploit)

PCMan FTP Server 2.0.7 - RENAME Command Buffer Overflow (MSF)
PCMan FTP Server 2.0.7 - RENAME Command Buffer Overflow (Metasploit)

Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (msf)
Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (Metasploit)

Poison Ivy 2.1.x C2 Buffer Overflow (msf)
Poison Ivy 2.1.x C2 Buffer Overflow (Metasploit)

Bomgar Remote Support Unauthenticated Code Execution (msf)
Bomgar Remote Support Unauthenticated Code Execution (Metasploit)

Tomabo MP4 Player 3.11.6 - SEH Based Stack Overflow (msf)
Tomabo MP4 Player 3.11.6 - SEH Based Stack Overflow (Metasploit)

DarkComet Server Remote File Download Exploit (msf)
DarkComet Server Remote File Download Exploit (Metasploit)
PCMAN FTP 2.0.7 - ls Command Buffer Overflow (Metasploit)
Wolf CMS 0.8.2 - Arbitrary File Upload Exploit (Metasploit)
Windows x86 ShellExecuteA(NULL_NULL__cmd.exe__NULL_NULL_1) Shellcode
 2016-06-23 05:06:16 +00:00
Offensive Security
0fe9b46f79 DB: 2016-06-22 
14 new exploits

Linux Kernel <= 2.4.22 - 'do_brk' Local Root Exploit (2)
Linux Kernel <= 2.4.22 - 'do_brk()' Local Root Exploit (2)
Linux Kernel <= 2.4.23 / <= 2.6.0 - 'do_mremap' Local Proof of Concept (1)
Linux Kernel <= 2.4.23 / <= 2.6.0 - 'do_mremap' Local Proof of Concept (2)
Linux Kernel <= 2.4.23 / <= 2.6.0 - 'do_mremap()' Local Proof of Concept (1)
Linux Kernel <= 2.4.23 / <= 2.6.0 - 'do_mremap()' Local Proof of Concept (2)

Linux Kernel <= 2.4.23 / <= 2.6.0 - 'mremap()' Bound Checking Root Exploit
Linux Kernel <= 2.4.23 / <= 2.6.0 - 'mremap()' Bound Checking Root Exploit (3)

Linux Kernel <= 2.2.25 / <= 2.4.24 / <= 2.6.2 - 'mremap()' Missing 'do_munmap' Exploit
Linux Kernel <= 2.2.25 / <= 2.4.24 / <= 2.6.2 - 'mremap()' Missing 'do_munmap' Exploit (1)

Linux Kernel <= 2.4.29-rc2 - uselib() Privilege Elevation
Linux Kernel <= 2.4.29-rc2 - 'uselib()' Privilege Elevation (1)

Linux Kernel 2.4 - uselib() Privilege Elevation Exploit
Linux Kernel 2.4 - uselib() Privilege Elevation Exploit (2)

Linux Kernel 2.4.x / 2.6.x - uselib() Local Privilege Escalation Exploit
Linux Kernel 2.4.x / 2.6.x - uselib() Local Privilege Escalation Exploit (3)
Linux Kernel 2.6.17 <= 2.6.24.1 - vmsplice Local Root Exploit
Linux Kernel 2.6.23 <= 2.6.24 - vmsplice Local Root Exploit
Linux Kernel 2.6.17 <= 2.6.24.1 - 'vmsplice' Local Root Exploit (2)
Linux Kernel 2.6.23 <= 2.6.24 - vmsplice Local Root Exploit (1)

Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) - UDEV Local Privilege Escalation Exploit
Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) - UDEV Local Privilege Escalation Exploit (1)

Linux Kernel 2.6 UDEV < 141 (Gentoo / Ubuntu 8.10/9.04) - Local Privilege Escalation Exploit
Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) - UDEV < 141 Local Privilege Escalation Exploit (2)
Linux Kernel 2.x (Redhat) - sock_sendpage() Ring0 Local Root Exploit (1)
Linux Kernel 2.x - sock_sendpage() Local Root Exploit (2)
Linux Kernel 2.x (Redhat) - 'sock_sendpage()' Ring0 Local Root Exploit (1)
Linux Kernel 2.x - 'sock_sendpage()' Local Root Exploit (2)

Linux Kernel 2.4 / 2.6 (RedHat Linux 9 / Fedora Core 4~11 / Whitebox 4 / CentOS 4) - sock_sendpage() ring0 Root Exploit (1)
Linux Kernel 2.4 / 2.6 (RedHat Linux 9 / Fedora Core 4~11 / Whitebox 4 / CentOS 4) - 'sock_sendpage()' ring0 Root Exploit (3)

Linux Kernel <= 2.6.30 - atalk_getname() 8-bytes Stack Disclosure Exploit
Linux Kernel <= 2.6.30 - 'atalk_getname()' 8-bytes Stack Disclosure Exploit (1)
Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - ip_append_data() ring0 Root Exploit
Linux Kernel < 2.6.31-rc7 - AF_IRDA 29-Byte Stack Disclosure Exploit
Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - ip_append_data() ring0 Root Exploit (1)
Linux Kernel < 2.6.31-rc7 - AF_IRDA 29-Byte Stack Disclosure Exploit (2)
Linux Kernel < 2.6.19 (x86/x64) - udp_sendmsg Local Root Exploit
Linux Kernel < 2.6.19 (Debian 4) - udp_sendmsg Local Root Exploit
Linux Kernel < 2.6.19 (x86/x64) - udp_sendmsg Local Root Exploit (2)
Linux Kernel < 2.6.19 (Debian 4) - 'udp_sendmsg' Local Root Exploit (3)

Linux Kernel 2.4 / 2.6 (Fedora 11) - sock_sendpage() Local Root Exploit (2)
Linux Kernel 2.4 / 2.6 (Fedora 11) - 'sock_sendpage()' Local Root Exploit (4)

Linux Kernel 2.4 / 2.6 - sock_sendpage() Local Root Exploit (3)
Linux Kernel 2.4 / 2.6 - 'sock_sendpage()' Local Root Exploit (5)

Linux Kernel 2.4.1-2.4.37 / 2.6.1-2.6.32-rc5 - Pipe.c Privilege Escalation
Linux Kernel 2.4.1-2.4.37 / 2.6.1-2.6.32-rc5 - Pipe.c Privilege Escalation (3)

Linux Kernel <= 2.6.32 - 'pipe.c' Local Privilege Escalation Vulnerability
Linux Kernel <= 2.6.32 - 'pipe.c' Local Privilege Escalation Vulnerability (4)

Linux Kernel <= 2.6.37 (Redhat / Ubuntu 10.04) - 'Full Nelson' Local Privilege Escalation
Linux Kernel <= 2.6.37 (Redhat / Ubuntu 10.04) - 'Full-Nelson.c' Local Privilege Escalation

Linux Kernel <= 2.6.37 - Local Kernel Denial of Service
Linux Kernel <= 2.6.37 - Local Kernel Denial of Service (1)

Linux Kernel < 2.6.37-rc2 - TCP_MAXSEG Kernel Panic DoS
Linux Kernel < 2.6.37-rc2 - TCP_MAXSEG Kernel Panic DoS (2)

Linux Kernel < 2.6.36.2 (Ubuntu 10.04) - Econet Privilege Escalation Exploit
Linux Kernel < 2.6.36.2 (Ubuntu 10.04) - 'Half-Nelson.c' Econet Privilege Escalation Exploit

Linux Kernel 2.6.39 <= 3.2.2 (Gentoo / Ubuntu x86/x64) - Mempodipper Local Root (1)
Linux Kernel 2.6.39 <= 3.2.2 (Gentoo / Ubuntu x86/x64) - 'Mempodipper.c' Local Root (1)

Linux Kernel 2.0/2.1_ Digital UNIX <= 4.0 D_ FreeBSD <= 2.2.4_ HP HP-UX 10.20/11.0_ IBM AIX <= 3.2.5_ NetBSD 1.2_ Solaris <= 2.5.1 - Smurf Denial of Service Vulnerability
Linux Kernel 2.0/2.1 (Digital UNIX <= 4.0 D / FreeBSD <= 2.2.4 / HP HP-UX 10.20/11.0 / IBM AIX <= 3.2.5 / NetBSD 1.2 / Solaris <= 2.5.1) - Smurf Denial of Service Vulnerability

Linux Kernel <= 2.3_ BSD/OS <= 4.0_ FreeBSD <= 3.2_ NetBSD <= 1.4 - Shared Memory Denial of Service Vulnerability
Linux Kernel <= 2.3 (BSD/OS <= 4.0 / FreeBSD <= 3.2 / NetBSD <= 1.4) - Shared Memory Denial of Service Vulnerability

Linux Kernel 2.2.12/2.2.14/2.3.99_ RedHat 6.x - Socket Denial of Service
Linux Kernel 2.2.12/2.2.14/2.3.99 (RedHat 6.x) - Socket Denial of Service
Linux Kernel 2.2.x/2.4.0-test1_ SGI ProPack 1.2/1.3 - Capabilities Local Root (sendmail) Vulnerability (1)
Linux Kernel 2.2.x/2.4.0-test1_ SGI ProPack 1.2/1.3 - Capabilities Local Root (sendmail <= 8.10.1) Vulnerability (2)
Linux Kernel 2.2.x <= 2.4.0-test1 (SGI ProPack 1.2/1.3) - Capabilities Local Root 'sendmail' Vulnerability (1)
Linux Kernel 2.2.x <= 2.4.0-test1 (SGI ProPack 1.2/1.3) - Capabilities Local Root (sendmail <= 8.10.1) Vulnerability (2)

Linux Kernel < 3.3.x - 3.7.x (Arch Linux x86_64) - sock_diag_handlers[] Local Root
Linux Kernel < 3.3.x - 3.7.x (Arch Linux x86_64) - 'sock_diag_handlers[]' Local Root (1)

Linux Kernel <= 3.7.10 (Ubuntu 12.10 x64) - sock_diag_handlers Local Root Exploit
Linux Kernel <= 3.7.10 (Ubuntu 12.10 x64) - 'sock_diag_handlers' Local Root Exploit (2)

Linux Kernel 2.6.x - SYS_EPoll_Wait Local Integer Overflow Local Root Vulnerability (1)
Linux Kernel 2.6.x - 'SYS_EPoll_Wait' Local Integer Overflow Local Root Vulnerability (1)

Linux Kernel 2.6.32 <= 3.x.x (CentOS) - PERF_EVENTS Local Root Exploit
Linux Kernel 2.6.32 <= 3.x.x (CentOS) - 'PERF_EVENTS' Local Root Exploit (1)

Linux Kernel < 3.8.9 (x86_64) - perf_swevent_init Local Root Exploit
Linux Kernel < 3.8.9 (x86_64) - perf_swevent_init Local Root Exploit (2)

Linux Kernel 3.4 < 3.13.2 - recvmmsg x32 compat - Proof of Concept
Linux Kernel 3.4 < 3.13.2 - recvmmsg x32 compat - Proof of Concept (1)
Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.10) - Arbitrary Write with CONFIG_X86_X32 Exploit
Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.04/13.10) - 'CONFIG_X86_X32=y' Local Root Exploit
Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.10) - Arbitrary Write with 'CONFIG_X86_X32' Exploit (2)
Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.04/13.10) - 'CONFIG_X86_X32=y' Local Root Exploit (3)

Linux Kernel 2.6.x - 'fput()' NULL Pointer Dereference Local Denial of Service Vulnerabilty

Linux Kernel 3.3 < 3.8 (Ubuntu/Fedora 18) - SOCK_DIAG Local Root Exploit
Linux Kernel 3.3 < 3.8 (Ubuntu/Fedora 18) - SOCK_DIAG Local Root Exploit (3)
Linux Kernel <= 3.2.0-23 / <= 3.5.0-23 (Ubuntu 12.04.(0_1_2) x64) - perf_swevent_init Local Root Exploit
Linux Kernel 2.6.x - 'fasync_helper()' Local Privilege Escalation Vulnerability
Linux Kernel <= 3.2.0-23 / <= 3.5.0-23 (Ubuntu 12.04.0/1/2 x64) - perf_swevent_init Local Root Exploit (3)
Linux Kernel < 2.6.28 - 'fasync_helper()' Local Privilege Escalation Vulnerability

Linux Kernel 2.6.39 <= 3.2.2 (x86/x64) - Mempodipper Local Root (2)
Linux Kernel 2.6.39 <= 3.2.2 (x86/x64) - 'Mempodipper.c' Local Root (2)

Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - overlayfs Local Root Shell
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Root Shell

Linux Kernel <= 4.3.3 (Ubuntu 14.04/15.10) - overlayfs Local Root Exploit
Linux Kernel <= 4.3.3 (Ubuntu 14.04/15.10) - 'overlayfs' Local Root Exploit (1)

Linux Kernel <= 4.3.3 - overlayfs Local Privilege Escalation
Linux Kernel <= 4.3.3 - 'overlayfs' Local Privilege Escalation (2)
DarkComet Server Remote File Download Exploit (msf)
Banshee 2.6.2 - .mp3 Crash PoC
IonizeCMS 1.0.8 - (Add Admin) CSRF
Yona CMS - (Add Admin) CSRF
Joomla Publisher Pro (com_publisher) Component - SQL Injection
Windows - gdi32.dll Multiple DIB-Related EMF Record Handlers Heap-Based Out-of-Bounds Reads/Memory Disclosure (MS16-074)
Windows Kernel - ATMFD.DLL NamedEscape 0x250C Pool Corruption (MS16-074)
Linux - ecryptfs and /proc/$pid/environ Privilege Escalation
Windows - Custom Font Disable Policy Bypass
Internet Explorer 11 - Garbage Collector Attribute Type Confusion (MS16-063)
SAP NetWeaver AS JAVA 7.1 - 7.5 - ctcprotocol Servlet XXE
SAP NetWeaver AS JAVA 7.1 - 7.5 - Directory Traversal
Radiant CMS 1.1.3 - Mutiple Persistent XSS Vulnerabilities
YetiForce CRM < 3.1 - Persistent XSS
 2016-06-22 05:06:31 +00:00
Offensive Security
da158cde92 DB: 2016-06-21 
11 new exploits

Linux Kernel 2.2. / 2.4.x - /proc Filesystem Potential Information Disclosure Vulnerability
Linux Kernel 2.2.x / 2.4.x - /proc Filesystem Potential Information Disclosure Vulnerability
WordPress Ultimate Product Catalog Plugin 3.8.1 - Privilege Escalation
Linux x86_64 execve Shellcode - 15 bytes
sNews CMS 1.7.1 - Multiple Vulnerabilities
Joomla BT Media (com_bt_media) Component - SQL Injection
Premium SEO Pack 1.9.1.3 - wp_options Overwrite
Windows XP - 10 - Download & Execute Shellcode
Tomabo MP4 Player 3.11.6 - SEH Based Stack Overflow (msf)
Airia - (Add Content) CSRF
Airia - Webshell Upload Exploit
Symphony CMS 2.6.7 - Session Fixation
ACROS Security 0patch 2016.05.19.539 - (0PatchServicex64.exe) Unquoted Service Path Privilege Escalation
 2016-06-21 05:03:48 +00:00
Offensive Security
eb4f2190bb DB: 2016-06-20 2016-06-20 05:06:31 +00:00
Offensive Security
a7daa4c3b6 DB: 2016-06-19 2016-06-19 05:05:20 +00:00
Offensive Security
929e1cb538 DB: 2016-06-18 
5 new exploits

WordPress Gravity Forms Plugin 1.8.19 - Arbitrary File Upload
Vicidial 2.11 - Scripts Stored XSS
phpATM 1.32 - Remote Command Execution (Shell Upload) on Windows Servers
phpATM 1.32 - Multiple Vulnerabilities
op5 v7.1.9 Configuration Command Execution
 2016-06-18 05:02:53 +00:00
Offensive Security
2815f48e25 DB: 2016-06-17 
12 new exploits

Linux x86_64 - Reverse Shell Shellcode

Gemalto Sentinel License Manager 18.0.1.55505 - Directory Traversal

Solarwinds Virtualization Manager - Privilege Escalation

Blat 3.2.14 - Stack Overflow

Linux/x86 - Bindshell with Configurable Port - 87 bytes

Linux x86_64 Shellcode Null-Free Reverse TCP Shell

Linux x86 TCP Bind Shell Port 4444 (656 bytes)

Tiki-Wiki CMS Calendar 14.2_ 12.5 LTS_ 9.11 LTS_ and 6.15 - Remote Code Execution

Linux/Windows/BSD x86_64 execve(_/bin//sh__ {_//bin/sh__ _-c__ _cmd_}_ NULL) Execute Command Shellcode
ATCOM PBX IP01_ IP08 _ IP4G_ IP2G4A - Authentication Bypass
Roxy Fileman 1.4.4 - Arbitrary File Upload
SlimCMS 0.1 - CSRF (Change Admin Password)
 2016-06-17 05:05:00 +00:00
Offensive Security
33dd246d8a DB: 2016-06-16 
14 new exploits

Ultrabenosaurus ChatBoard - Stored XSS
Ultrabenosaurus ChatBoard - CSRF (Send Message)
w2wiki - Multiple XSS Vulnerabilities
Hyperoptic (Tilgin) Router HG23xx - Multiple Vulnerabilities
Dokeos 2.2.1 - Blind SQL Injection
Joomla En Masse (com_enmasse) Component 5.1 - 6.4 - SQL Injection
AdobeUpdateService 3.6.0.248 - Unquoted Service Path Privilege Escalation
BookingWizz Booking System < 5.5 - Multiple Vulnerabilities
jbFileManager - Directory Traversal
PHPLive 4.4.8 - 4.5.4 - Password Recovery SQL Injection
Bomgar Remote Support Unauthenticated Code Execution (msf)
Windows 7 - win32k Bitmap Use-After-Free (MS16-062) (1)
Windows 7 - win32k Bitmap Use-After-Free (MS16-062) (2)
Google Chrome - GPU Process MailboxManagerImpl Double-Read
 2016-06-16 05:02:53 +00:00
Offensive Security
6c005f3b2b DB: 2016-06-15 
3 new exploits

Easy RM to MP3 Converter 2.7.3.700 - (.m3u) Exploit with Universal DEP+ASLR Bypass
Apache Continuum Arbitrary Command Execution
WordPress Social Stream Plugin 1.5.15 - wp_options Overwrite
Oracle Orakill.exe 11.2.0 - Buffer Overflow
 2016-06-15 05:06:23 +00:00
Offensive Security
264d15855e DB: 2016-06-14 
14 new exploits

FRticket Ticket System - Stored XSS
Viart Shopping Cart 5.0 - CSRF Shell Upload
Easy RM to MP3 Converter 2.7.3.700 - (.m3u) Exploit with Universal DEP+ASLR Bypass
Dream Gallery 2.0 - Admin Panel Authentication Bypass
Grid Gallery 1.0 - Admin Panel Authentication Bypass
Joomla PayPlans (com_payplans) Extension 3.3.6 - SQL Injection
Zabbix 2.2 - 3.0.3 - RCE with API JSON-RPC
iSQL 1.0 - Shell Command Injection
iSQL 1.0 - isql_main.c Buffer Overflow PoC
Foxit PDF Reader 1.0.1.0925 - CPDF_StreamContentParser::~CPDF_StreamContentParser Heap-Based Memory Corruption
Foxit PDF Reader 1.0.1.0925 - CPDF_DIBSource::TranslateScanline24bpp Out-of-Bounds Read
Foxit PDF Reader 1.0.1.0925 - CFX_WideString::operator= Invalid Read
Foxit PDF Reader 1.0.1.0925 -kdu_core::kdu_codestream::get_subsampling Memory Corruption
Foxit PDF Reader 1.0.1.0925 - CFX_BaseSegmentedArray::IterateIndex Memory Corruption
 2016-06-14 05:03:54 +00:00
Offensive Security
076ef173f9 DB: 2016-06-11 
23 new exploits

Poison Ivy 2.1.x C2 Buffer Overflow (msf)
Matrix42 Remote Control Host 3.20.0031 - Unquoted Path Privilege Escalation
Dell OpenManage Server Administrator 8.3 - XML External Entity Exploit
Mobiketa 1.0 - CSRF Add Admin Exploit
miniMySQLAdmin 1.1.3 - CSRF Execute SQL Query
phpMyFAQ 2.9.0 - Stored XSS
Windows x86 system(_systeminfo_) Shellcode
Armadito Antimalware - Backdoor/Bypass
Riot Games League of Legends - Insecure File Permissions Privilege Escalation
IPFire proxy.cgi RCE
IPFire Bash Environment Variable Injection (Shellshock)
Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution
OS X Kernel - Exploitable NULL Pointer Dereference in nvCommandQueue::GetHandleIndex in GeForce.kext
Android - /system/bin/sdcard Stack Buffer Overflow
OS X Kernel - Exploitable NULL Pointer Dereference in AppleMuxControl.kext
OS X Kernel - Exploitable NULL Pointer Dereference in AppleGraphicsDeviceControl
OS X Kernel - Exploitable NULL Dereference in IOAccelSharedUserClient2::page_off_resource
OS X Kernel - Exploitable NULL Dereference in CoreCaptureResponder Due to Unchecked Return Value
OS X Kernel - Exploitable NULL Pointer Dereference in IOAudioEngine
OS X Kernel - OOB Read of Object Pointer Due to Insufficient Checks in Raw Cast to enum Type
OS X Kernel - Use-After-Free Due to Bad Locking in IOAcceleratorFamily2
OS X/iOS Kernel - UAF Racing getProperty on IOHDIXController and testNetBootMethod on IOHDIXControllerUserClient
OS X Kernel - Stack Buffer Overflow in GeForce GPU Driver
 2016-06-11 05:06:22 +00:00
Offensive Security
4bc4dc0218 DB: 2016-06-10 
1 new exploits

Microsoft Word (Win/Mac) - Crash PoC
 2016-06-10 05:06:43 +00:00
Offensive Security
74f927013e DB: 2016-06-09 
1 new exploits

Drale DBTableViewer 100123 - Blind SQL Injection
 2016-06-09 05:02:54 +00:00
Offensive Security
858079a4fe DB: 2016-06-08 
5 new exploits

Linux Kernel <= 4.4.1 - REFCOUNT Overflow/Use-After-Free in Keyrings Local Root
Linux Kernel <= 4.4.1 - REFCOUNT Overflow/Use-After-Free in Keyrings Local Root (2)
Windows x86 WinExec(_cmd.exe__0) Shellcode
Linux x86 /bin/nc -le /bin/sh -vp13337 Shellcode (56 bytes)
League of Legends Screensaver - Unquoted Service Path Privilege Escalation
League of Legends Screensaver - Insecure File Permissions Privilege Escalation
Cisco EPC 3928 - Multiple Vulnerabilities
 2016-06-08 05:05:38 +00:00
Offensive Security
62962d90b0 DB: 2016-06-07 
16 new exploits

Linux Kernel < 2.6.34 (Ubuntu 11.10 x86 & x64) - CAP_SYS_ADMIN Local Privilege Escalation Exploit (2)
Linux Kernel < 2.6.34 (Ubuntu 11.10 x86/x64) - CAP_SYS_ADMIN Local Privilege Escalation Exploit (2)

Linux Kernel  2.4.4 <= 2.4.37.4 / 2.6.0 <= 2.6.30.4 - Sendpage Local Privilege Escalation (Metasploit)
Linux Kernel 2.4.4 <= 2.4.37.4 / 2.6.0 <= 2.6.30.4 - Sendpage Local Privilege Escalation (Metasploit)

Linux Kernel <= 4.4.1 - REFCOUNT Overflow/Use-After-Free in Keyrings
Linux Kernel <= 4.4.1 - REFCOUNT Overflow/Use-After-Free in Keyrings Local Root

WordPress Simple Backup Plugin 2.7.11 - Multiple Vulnerabilities
Dream Gallery 1.0 - CSRF Add Admin Exploit
Apache Continuum 1.4.2 - Multiple Vulnerabilities
Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - ShellShock Exploit
Valve Steam 3.42.16.13 - Local Privilege Escalation
ArticleSetup 1.00 - CSRF Change Admin Password
Electroweb Online Examination System 1.0 - SQL Injection
WordPress WP Mobile Detector Plugin 3.5 - Arbitrary File Upload
WordPress Creative Multi-Purpose Theme 9.1.3 - Stored XSS
WordPress WP PRO Advertising System Plugin 4.6.18 - SQL Injection
WordPress Newspaper Theme 6.7.1 - Privilege Escalation
WordPress Uncode Theme 1.3.1 - Arbitrary File Upload
WordPress Double Opt-In for Download Plugin 2.0.9 - SQL Injection
Notilus Travel Solution Software 2012 R3 - SQL Injection
rConfig 3.1.1 - Local File Inclusion
Nagios XI 5.2.7 - Multiple Vulnerabilities
 2016-06-07 05:07:41 +00:00
Offensive Security
2808c59ead DB: 2016-06-04 2016-06-04 05:06:24 +00:00
Offensive Security
2dba371921 DB: 2016-06-03 
4 new exploits

Linux Kernel 2.4 / 2.6 x86-64 - System Call Emulation Exploit
Linux Kernel 2.4 / 2.6 (x86_64) - System Call Emulation Exploit

Linux Kernel 2.6.x (<= 2.6.20 / <= 2.6.24 / <= 2.6.27_7-10) (Ubuntu 7.04/8.04/8.10 / Fedora Core 10 / OpenSuse 11.1)  - SCTP FWD Memory Corruption Remote Exploit
Linux Kernel 2.6.x (<= 2.6.20 / <= 2.6.24 / <= 2.6.27_7-10) (Ubuntu 7.04/8.04/8.10 / Fedora Core 10 / OpenSuse 11.1) - SCTP FWD Memory Corruption Remote Exploit

Linux Kernel <= 2.6.24_16-23 / <= 2.6.28.3 (Ubuntu 8.04/8.10 & Fedora Core 10) (x86-64) - set_selection() UTF-8 Off By One Local Exploit
Linux Kernel <= 2.6.24_16-23 / <= 2.6.28.3 (Ubuntu 8.04/8.10 & Fedora Core 10 x86_64) - set_selection() UTF-8 Off By One Local Exploit

Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6) - (32-bit) ip_append_data() ring0 Root Exploit
Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - ip_append_data() ring0 Root Exploit
Linux Kernel < 2.6.36-rc4-git2 - x86_64 ia32syscall Emulation Privilege Escalation
Linux Kernel 2.6.27 < 2.6.36 (x86_64) (Redhat) - compat Local Root Exploit
Linux Kernel < 2.6.36-rc4-git2 (x86_64) - ia32syscall Emulation Privilege Escalation
Linux Kernel 2.6.27 < 2.6.36 (Redhat x86_64) - compat Local Root Exploit

Linux Kernel < 2.6.34 CAP_SYS_ADMIN x86 & x64 (Ubuntu 11.10) - Local Privilege Escalation Exploit (2)
Linux Kernel < 2.6.34 (Ubuntu 11.10 x86 & x64) - CAP_SYS_ADMIN Local Privilege Escalation Exploit (2)

Linux Kernel 2.6.39 <= 3.2.2 (32-bit & 64-bit) (Gentoo / Ubuntu) - Mempodipper Local Root (1)
Linux Kernel 2.6.39 <= 3.2.2 (Gentoo / Ubuntu x86/x64) - Mempodipper Local Root (1)

Linux Kernel < 3.3.x - 3.7.x (Arch Linux x86-64) - sock_diag_handlers[] Local Root
Linux Kernel < 3.3.x - 3.7.x (Arch Linux x86_64) - sock_diag_handlers[] Local Root

Linux Kernel <= 3.7.10 (Ubuntu 12.10) (64-Bit) - sock_diag_handlers Local Root Exploit
Linux Kernel <= 3.7.10 (Ubuntu 12.10 x64) - sock_diag_handlers Local Root Exploit

Linux Kernel < 3.8.9 - x86_64 perf_swevent_init Local Root Exploit
Linux Kernel < 3.8.9 (x86_64) - perf_swevent_init Local Root Exploit

Linux Kernel <= 3.7.6  (Redhat) (32bit/64bit) - 'MSR' Driver Local Privilege Escalation
Linux Kernel <= 3.7.6 (Redhat x86/x64) - 'MSR' Driver Local Privilege Escalation

Systrace 1.x (64-Bit) - Aware Linux Kernel Privilege Escalation Vulnerability
Systrace 1.x (x64) - Aware Linux Kernel Privilege Escalation Vulnerability

Linux Kernel 2.6.x - (64 bit) Personality Handling Local Denial of Service Vulnerability
Linux Kernel 2.6.x (x64) - Personality Handling Local Denial of Service Vulnerability

Linux Kernel < 3.2.0-23  (Ubuntu 12.04) - ptrace/sysret Local Privilege Escalation
Linux Kernel < 3.2.0-23 (Ubuntu 12.04 x64) - ptrace/sysret Local Privilege Escalation

Linux Kernel 2.6.39 <= 3.2.2 (32-bit & 64-bit) - Mempodipper Local Root (2)
Linux Kernel 2.6.39 <= 3.2.2 (x86/x64) - Mempodipper Local Root (2)
Joomla SecurityCheck Extension 2.8.9 - Multiple Vulnerabilities
Liferay CE < 6.2 CE GA6 - Stored XSS
Relay Ajax Directory Manager relayb01-071706_ 1.5.1_ 1.5.3 - Unauthenticated File Upload
Websockify (C Implementation) 0.8.0 - Buffer Overflow
 2016-06-03 05:02:50 +00:00
Offensive Security
3a855523ef DB: 2016-06-02 
2 new exploits

GeekLog 2.x ImageImageMagick.php Remote File Inclusion Vulnerability
GeekLog 2.x - ImageImageMagick.php Remote File Inclusion Vulnerability

ImageMagick 6.x PNM Image Decoding Remote Buffer Overflow Vulnerability
ImageMagick 6.x - .PNM Image Decoding Remote Buffer Overflow Vulnerability

ImageMagick 6.x SGI Image File Remote Heap Buffer Overflow Vulnerability
ImageMagick 6.x - .SGI Image File Remote Heap Buffer Overflow Vulnerability

ImageMagick < 6.9.3-9 - Multiple Vulnerabilities
ImageMagick <= 6.9.3-9 / <= 7.0.1-0 - Multiple Vulnerabilities (ImageTragick)

ImageMagick Delegate Arbitrary Command Execution
ImageMagick <= 6.9.3-9 / <= 7.0.1-0 - Delegate Arbitrary Command Execution (ImageTragick)
AjaxExplorer 1.10.3.2 - Multiple Vulnerabilities
Wireshark - erf_meta_read_tag SIGSEGV
 2016-06-02 05:03:04 +00:00
Offensive Security
8164665ff7 DB: 2016-06-01 
6 new exploits

FlatPress 1.0.3 - CSRF Arbitrary File Upload
AirOS NanoStation M2 5.6-beta - Multiple Vulnerabilities
ProcessMaker 3.0.1.7 - Multiple vulnerabilities
CCextractor 0.80 - Crash PoC
Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (msf)
TCPDump 4.5.1 - Crash PoC
 2016-06-01 05:01:50 +00:00
Offensive Security
22d168d0bc DB: 2016-05-31 
3 new exploits

MySQL 5.5.45 - procedure analyse Function Denial of Service
Open Source Real Estate Script 3.6.0 - SQL Injection
Linux x86_64 XOR Encode execve Shellcode
 2016-05-31 05:03:26 +00:00
Offensive Security
ab85a62fd6 DB: 2016-05-28 
1 new exploits

PHP Realestate Script Script 4.9.0 - SQL Injection
 2016-05-28 05:05:01 +00:00
Offensive Security
2e7bce9702 DB: 2016-05-27 
9 new exploits

Real Estate Portal 4.1 - Multiple Vulnerabilities
EduSec 4.2.5 - SQL Injection
Micro Focus Rumba+ 9.4 - Multiple Stack Buffer Overflow Vulnerabilities
HP Data Protector A.09.00  - Arbitrary Command Execution
Graphite2 - GlyphCache::GlyphCache Heap-Based Buffer Overflow
Graphite2 - GlyphCache::Loader Heap-Based Overreads
Graphite2 - TtfUtil::CheckCmapSubtable12 Heap-Based Overread
Graphite2 - TtfUtil::CmapSubtable4NextCodepoint Heap-Based Overread
Graphite2 - NameTable::getName Multiple Heap-Based Out-of-Bounds Reads
 2016-05-27 05:03:14 +00:00
Offensive Security
e7c0882001 DB: 2016-05-26 
3 new exploits

Oracle ATS Arbitrary File Upload
Ubiquiti airOS Arbitrary File Upload
PowerFolder Server 10.4.321 - Remote Code Execution
 2016-05-26 05:02:47 +00:00
Offensive Security
b189e25266 DB: 2016-05-25 
1 new exploits

AfterLogic WebMail Pro ASP.NET 6.2.6 - Administrator Account Disclosure via XXE Injection
 2016-05-25 05:01:52 +00:00
Offensive Security
399580a6c2 DB: 2016-05-24 
5 new exploits

Operation Technology ETAP 14.1.0 - Local Privilege Escalation
Operation Technology ETAP 14.1.0 - Multiple Stack Buffer Overrun Vulnerabilities
Linux x86_64 Information Stealer Shellcode
Job Script by Scubez - Remote Code Execution
XenAPI 1.4.1 for XenForo - Multiple SQL Injections
 2016-05-24 05:03:46 +00:00
Offensive Security
84d38df739 DB: 2016-05-23 2016-05-23 05:03:55 +00:00
Offensive Security
931bae6679 DB: 2016-05-21 2016-05-21 05:05:57 +00:00
Offensive Security
a447a01cb8 DB: 2016-05-20 2016-05-20 06:50:49 +00:00
Offensive Security
feb7c15c11 DB: 2016-05-19 
1 new exploits

Debian OpenSSL - Predictable PRNG Bruteforce SSH Exploit (Perl)
Debian and Derivatives OpenSSL 0.9.8c-1<= 0.9.8g-9 - Predictable PRNG Bruteforce SSH Exploit (Perl)

Debian OpenSSL - Predictable PRNG Bruteforce SSH Exploit (Ruby)
Debian and Derivatives OpenSSL 0.9.8c-1<= 0.9.8g-9 - Predictable PRNG Bruteforce SSH Exploit (Ruby)

Debian OpenSSL - Predictable PRNG Bruteforce SSH Exploit (Python)
Debian and Derivatives OpenSSL 0.9.8c-1<= 0.9.8g-9 - Predictable PRNG Bruteforce SSH Exploit (Python)
PHP 4.x/5.x MySQL Safe_Mode Filesystem Circumvention Vulnerability (1)
PHP 4.x/5.x MySQL Safe_Mode Filesystem Circumvention Vulnerability (2)
PHP 4.x/5.x MySQL Safe_Mode Filesystem Circumvention Vulnerability (3)
PHP 4.x/5.x MySQL Library - 'Safe_Mode' Filesystem Circumvention Vulnerability (1)
PHP 4.x/5.x MySQL Library - 'Safe_Mode' Filesystem Circumvention Vulnerability (2)
PHP 4.x/5.x MySQL Library - 'Safe_Mode' Filesystem Circumvention Vulnerability (3)

phpliteadmin 1.1 - Multiple Vulnerabilities
phpLiteAdmin 1.1 - Multiple Vulnerabilities

PHP <= 7.0.4/5.5.33 - SNMP Format String Exploit
PHP <= 5.5.33 / <= 7.0.4  - SNMP Format String Exploit

Magento < 2.0.6 - Unauthenticated Arbitrary Unserialize -> Arbitrary Write File
 2016-05-19 05:05:38 +00:00
Offensive Security
6dc4d46521 DB: 2016-05-18 
16 new exploits

Meteocontrol WEB’log - Admin Password Disclosure
Cisco ASA Software 8.x / 9.x - IKEv1 and IKEv2 Buffer Overflow
Adobe Flash - JXR Processing Out-of-Bounds Read
Adobe Flash - Out-of-Bounds Read when Placing Object
Adobe Flash - Overflow in Processing Raw 565 Textures
Adobe Flash - Heap Overflow in ATF Processing (Image Reading)
Adobe Flash - MP4 File Stack Corruption
Adobe Flash - Type Confusion in FileReference Constructor
Adobe Flash - addProperty Use-After-Free
Adobe Flash - SetNative Use-After-Free
Windows - gdi32.dll Multiple Issues in the EMF CREATECOLORSPACEW Record Handling (MS16-055)
Windows - gdi32.dll Multiple Issues in the EMF COMMENT_MULTIFORMATS Record Handling (MS16-055)
Windows - gdi32.dll Heap-Based Buffer Overflow in ExtEscape() Triggerable via EMR_EXTESCAPE EMF Record (MS16-055)
Symantec/Norton Antivirus - ASPack Remote Heap/Pool Memory Corruption Vulnerability
Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection
SAP xMII 15.0 - Directory Traversal
 2016-05-18 05:02:15 +00:00