exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 8 of 8 RSS Feed

Files from h0ng10

First Active2012-09-05
Last Active2015-05-23
Lenovo System Update Privilege Escalation
Posted May 23, 2015
Authored by h0ng10, Sofiane Talmat, Micahel Milvich | Site metasploit.com

The named pipe, \SUPipeServer, can be accessed by normal users to interact with the System update service. The service provides the possibility to execute arbitrary commands as SYSTEM if a valid security token is provided. This token can be generated by calling the GetSystemInfoData function in the DLL tvsutil.dll. Please, note that the System Update is stopped by default but can be started/stopped calling the Executable ConfigService.exe.

tags | exploit, arbitrary
advisories | CVE-2015-2219
SHA-256 | a1b4e2c233f7b4436e33e4531fa6f85ed939d5f69470091600ce9b27ca87965a
TWiki Debugenableplugins Remote Code Execution
Posted Mar 19, 2015
Authored by h0ng10, Netanel Rubin | Site metasploit.com

TWiki versions 4.0.x through 6.0.0 contain a vulnerability in the Debug functionality. The value of the debugenableplugins parameter is used without proper sanitization in an Perl eval statement which allows remote code execution.

tags | exploit, remote, perl, code execution
advisories | CVE-2014-7236
SHA-256 | 850efe714be5e6548a264c1cce672a60aa1ae5a53559548aa9e9d66cf64f53b5
iPass Mobile Client Service Privilege Escalation
Posted Mar 18, 2015
Authored by h0ng10 | Site metasploit.com

The named pipe, \IPEFSYSPCPIPE, can be accessed by normal users to interact with the iPass service. The service provides a LaunchAppSysMode command which allows to execute arbitrary commands as SYSTEM.

tags | exploit, arbitrary
SHA-256 | 1b0c49a5daa22309c31f3ebfc498ee87664cbe412bded297b0f3fac32d95a90b
WordPress Pixabay Images PHP Code Upload
Posted Feb 4, 2015
Authored by h0ng10 | Site metasploit.com

This Metasploit module exploits multiple vulnerabilities in the WordPress plugin Pixabay Images version 2.3.6. The plugin does not check the host of a provided download URL which can be used to store and execute malicious PHP code on the system.

tags | exploit, php, vulnerability
SHA-256 | d111cecf145c4dabb425662dffda4d1cf8b9241d370037c752f93b57412ecb27
ManageEngine Eventlog Analyzer Arbitrary File Upload
Posted Sep 12, 2014
Authored by h0ng10 | Site metasploit.com

This Metasploit module exploits a file upload vulnerability in ManageEngine Eventlog Analyzer. The vulnerability exists in the agentUpload servlet which accepts unauthenticated file uploads and handles zip file contents in a insecure way. By combining both weaknesses a remote attacker can achieve remote code execution. This Metasploit module has been tested successfully on versions v7.0 - v9.9 b9002 in Windows and Linux. Versions between 7.0 and < 8.1 are only exploitable via EAR deployment in the JBoss server, while versions 8.1+ are only exploitable via a JSP upload.

tags | exploit, remote, code execution, file upload
systems | linux, windows
advisories | CVE-2014-6037
SHA-256 | 7a0773137d222dd2f47bbc5c83d57f0b5cff637f5610d1a372378c64bc78f404
Adobe IndesignServer 5.5 SOAP Server Arbitrary Script Execution
Posted Dec 6, 2012
Authored by juan vazquez, h0ng10 | Site metasploit.com

This Metasploit module abuses the "RunScript" procedure provided by the SOAP interface of Adobe InDesign Server, to execute arbitrary vbscript (Windows) or applescript(OSX). The exploit drops the payload on the server and must be removed manually.

tags | exploit, arbitrary
systems | windows, apple
advisories | OSVDB-87548
SHA-256 | a474d8f16474af9f0443d62d7ed406752fc73bffa28c33ce13eddc4d8ac8e269
Network Shutdown Module 3.21 Remote PHP Code Injection
Posted Nov 29, 2012
Authored by sinn3r, h0ng10 | Site metasploit.com

This Metasploit module exploits a vulnerability in lib/dbtools.inc which uses unsanitized user input inside a eval() call. Additionally the base64 encoded user credentials are extracted from the database of the application. Please note that in order to be able to steal credentials, the vulnerable service must have at least one USV module (an entry in the "nodes" table in mgedb.db).

tags | exploit
advisories | OSVDB-83199
SHA-256 | ca94d18543aafa961d153b779642fdaf4da2fc45b207ec0756a59de101a2cf5d
JBoss DeploymentFileRepository WAR Deployment
Posted Sep 5, 2012
Authored by Patrick Hof, Jens Liebchen, h0ng10 | Site metasploit.com

This Metasploit module can be used to execute a payload on JBoss servers that have an exposed HTTPAdaptor's JMX Invoker exposed on the "JMXInvokerServlet". By invoking the methods provided by jboss.admin:DeploymentFileRepository a stager is deployed to finally upload the selected payload to the target. The DeploymentFileRepository methods are only available on Jboss 4.x and 5.x.

tags | exploit
advisories | CVE-2007-1036, OSVDB-33744
SHA-256 | c6b0010812e226801e4d081ec2319bf266148f85a99286b7a0ea268acccbcd45
Page 1 of 1
Back1Next

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    3 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close