bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
exploit-db-mirror/exploits/windows/remote/19435.html
Offensive Security 880bbe402e DB: 2019-03-08 
14991 changes to exploits/shellcodes

HTC Touch - vCard over IP Denial of Service

TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities

PeerBlock 1.1 - Blue Screen of Death

WS10 Data Server - SCADA Overflow (PoC)

Symantec Endpoint Protection 12.1.4013 - Service Disabling
Memcached 1.4.33 - 'Crash' (PoC)
Memcached 1.4.33 - 'Add' (PoC)
Memcached 1.4.33 - 'sasl' (PoC)
Memcached 1.4.33 - 'Crash' (PoC)
Memcached 1.4.33 - 'Add' (PoC)
Memcached 1.4.33 - 'sasl' (PoC)

Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow

man-db 2.4.1 - 'open_cat_stream()' Local uid=man

CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation

CDRecord's ReadCD - Local Privilege Escalation
Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH)
FreeBSD - Intel SYSRET Privilege Escalation (Metasploit)

CCProxy 6.2 - 'ping' Remote Buffer Overflow

Savant Web Server 3.1 - Remote Buffer Overflow (2)

Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow

Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow
QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit)
Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit)
Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)
Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)
TeamCity < 9.0.2 - Disabled Registration Bypass
OpenSSH SCP Client - Write Arbitrary Files
Kados R10 GreenBee - Multiple SQL Injection
WordPress Core 5.0 - Remote Code Execution
phpBB 3.2.3  - Remote Code Execution

Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator)
Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes)
Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
2019-03-08 05:01:50 +00:00

81 lines
No EOL
4.2 KiB
HTML
Raw Blame History

# source: https://www.securityfocus.com/bid/548/info
#
# A vulnerability affects Microsoft's Jet 3.51 and 4.0 driver (MSJET35.DLL and MSJET40.DLL).
#
# This vulnerability could allow an attacker to create malicious '.xls' or '.doc' files incorporating VBA shell commands. When the file is opened, the shell commands contained in the file will execute on the target system. Command execution will occur in the context of the user that is opening the file.
#
# The file could be distributed via email, the web (including in hidden frames), or any number of methods.
#
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Author" CONTENT="yeahright">
<META NAME="GENERATOR" CONTENT="edit.com">
<TITLE>exshell jexploit</TITLE>
</HEAD>
<BODY TEXT="#330033" BGCOLOR="#FFFFFF" LINK="#0000EE" VLINK="#551A8B" ALINK="#FF0000">
<FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>This
is a benign demonstration of the Jet 3.51 vulnerability documented by J.C.G.
Cuartango.</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>This
vulnerability affects users of Office95/97 with Jet database engine versions
around 3.5 (tested 3.51.1029.00)</FONT></FONT></FONT>
<P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>On the bottom of
this page is an invisible, embedded .xls file that will do a few things
if you double-click it:</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>1.&nbsp;
Get a welcome note from ftp.aol.com and write it to your hd as c:\ftptest.txt</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>2.&nbsp;
Write a log file of the ftp session to your hd as c:\jexploit.log</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>3.&nbsp;
Open regedit.exe on your computer.</FONT></FONT></FONT>
<P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>There
are no macros, so there are no macro warnings.&nbsp; There are currently
(8/3/99) no AV products to stop this.</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>This
could be changed slightly to format your hd without prompts or perform
several other devastating functions.</FONT></FONT></FONT>
<P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>The
purpose of this demonstration is as follows:</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>1.&nbsp;
To have some innocent fun.</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>2.&nbsp;
To demonstrate how to have fun.</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>3.&nbsp;
To show the vulnerabilities in yet another M$ product.</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>4.&nbsp;
To alert the AV people that they need to work on this problem.</FONT></FONT></FONT>
<P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>If you use IE
or see a broken link next to the arrow just click <A HREF="shell.xls"> here.</A>
&nbsp;&nbsp;Probably your browser can't view embedded xls.</FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>
The malicious potential of this exploit is great.</FONT></FONT></FONT>
<P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>
Have a nice day!!!&nbsp;&nbsp;&nbsp;-ßrootFôrce</FONT></FONT></FONT>
<p>&nbsp;<p>
<BODY TEXT="#330033" BGCOLOR="#FFFFFF" LINK="#0000EE" VLINK="#551A8B" ALINK="#FF0000">
<FONT COLOR="#993366"><FONT FACE="Felix Titling"><FONT SIZE=+1>this
is a test of the emergency broadcast system.</FONT></FONT></FONT>
<P><FONT FACE="Felix Titling"><FONT COLOR="#993366"><FONT SIZE=+1>click
this here thingy to test==></FONT></FONT></FONT>&nbsp;
<EMBED src="shell.xls" width=50 height=50></EMBED>
</BODY>
</HTML>
<IMG SRC="http://geo.yahoo.com/serv?s=76000007&t=933696590" WIDTH=1 HEIGHT=1>
<!-- <SERVICE NAME="toto"> -->
<SCRIPT LANGUAGE="javascript">
<!--
window.open('/toto?s=76000007', '_geo_toto', 'width=515,height=125');
// -->
</SCRIPT>
<!-- </SERVICE> -->
Reference in a new issue View git blame Copy permalink