what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 55 RSS Feed

Files from Brandon Perry

First Active2012-09-07
Last Active2021-10-12
Moodle Authenticated Spelling Binary Remote Code Execution
Posted Oct 12, 2021
Authored by Brandon Perry | Site metasploit.com

Moodle allows an authenticated user to define spellcheck settings via the web interface. The user can update the spellcheck mechanism to point to a system-installed aspell binary. By updating the path for the spellchecker to an arbitrary command, an attacker can run arbitrary commands in the context of the web application upon spellchecking requests. This Metasploit module also allows an attacker to leverage another privilege escalation vuln. Using the referenced XSS vuln, an unprivileged authenticated user can steal an admin sesskey and use this to escalate privileges to that of an admin, allowing the module to pop a shell as a previously unprivileged authenticated user. This module was tested against Moodle version 2.5.2 and 2.2.3.

tags | exploit, web, arbitrary, shell
advisories | CVE-2013-3630, CVE-2013-4341
SHA-256 | ac6f5ab057f512464caba3ae5c9eb29729a37923234846241c7451944f72ebf8
OpenEXR 2.2.0 Crash
Posted May 15, 2017
Authored by Brandon Perry

This archive contains a zip file of EXR images that cause segmentation faults in the OpenEXR library version 2.2.0.

tags | exploit
SHA-256 | 1865e85495f25d1e947a73c7cddc392c1eb7891d3c07ba9b51859f7909ea697b
FreeTDS Denial Of Service
Posted May 11, 2017
Authored by Brandon Perry

This archive contains numerous TDS streams that cause segmentation faults in the FreeTDS library. The 'tsql' binary was used for the fuzzing, so these most likely only affect client-side functionality. These have been resolved on master and the 1.0 branch.

tags | exploit, denial of service
SHA-256 | 66f3f4a74d00b0e618225737ba456b7a11922247bc49c5ae8f7ef7ad115866f7
Oracle Outside In File ID Library 8.5.3 Memory Corruption
Posted Sep 18, 2016
Authored by Brandon Perry

Oracle Outside In File ID library version 8.5.3 suffers from a memory corruption issue.

tags | exploit
SHA-256 | 9c8ae6dc6a9a6d7b3b12479fd7a07ef5b5ceea818473f03193e8c865a379ff34
PrinceXML Wrapper Class Command Injection
Posted Jul 6, 2016
Authored by Brandon Perry

Wrapper classes provided by PrinceXML appear to suffer from command injection vulnerabilities.

tags | exploit, vulnerability
SHA-256 | af3f900b8ea8475a7548d9c557b237e3693679f81551df21a63dddf1a022c03f
Apache Xerces-C XML Parser Crash
Posted Jun 29, 2016
Authored by Brandon Perry

The Xerces-C XML parser fails to successfully parse a DTD that is deeply nested, and this causes a stack overflow, which makes a denial of service attack against many applications possible by an unauthenticated attacker. Apache Xerces-C XML Parser library versions prior to 3.1.4 are affected.

tags | advisory, denial of service, overflow
advisories | CVE-2016-4463
SHA-256 | a0b966184480f64c7fc857680e37cc670d35cc9e4cccf14b0d26c6528bbbdd5a
libical 0.47 / 1.0 Crash
Posted Jun 25, 2016
Authored by Brandon Perry

libical versions 0.47 and 1.0 suffer from a crash issue.

tags | exploit
SHA-256 | e314583b6bf83ffbfdfd9a7a4875334a7dbd17311c08e56a43e14b40b4d360a7
Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection
Posted May 17, 2016
Authored by sinn3r, Brandon Perry | Site metasploit.com

This Metasploit module exploits a vulnerability found in Dell SonicWALL Scrutinizer. The methodDetail parameter in exporters.php allows an attacker to write arbitrary files to the file system with an SQL Injection attack, and gain remote code execution under the context of SYSTEM for Windows, or as Apache for Linux. Authentication is required to exploit this vulnerability, but this module uses the default admin:admin credential.

tags | exploit, remote, arbitrary, php, code execution, sql injection
systems | linux, windows
advisories | CVE-2014-4977
SHA-256 | 46eef5e2e82adcace1eb86cca34fa1691dfc435af8857a0821e91b120976f5fc
Dell SonicWall Scrutinizer 11.0.1 SQL Injection / Code Execution
Posted May 10, 2016
Authored by mr_me, Brandon Perry

Dell SonicWall Scrutinizer versions 11.0.1 and below setUserSkin/deleteTab SQL injection / remote code execution exploit that leverages a vulnerability found by Brandon Perry in July of 2014.

tags | exploit, remote, code execution, sql injection
SHA-256 | 6dc759bc14a238d30a49e98bea0afabd99f1ed4bda69fec060f0fc09e8cf5e1a
Raritan PowerIQ Default Accounts
Posted Sep 10, 2015
Authored by Brandon Perry

Raritan PowerIQ ships with three default backdoor credentials left in.

tags | exploit
SHA-256 | 2dcd98105d78a18b206ac52d081745dcf42c639e862b7b25a8d8a0c7ab5e2c5e
Symantec Endpoint Protection Manager Authentication Bypass / Code Execution
Posted Aug 17, 2015
Authored by Brandon Perry, Markus Wulftange | Site metasploit.com

This Metasploit module exploits three separate vulnerabilities in Symantec Endpoint Protection Manager in order to achieve a remote shell on the box as NT AUTHORITY\SYSTEM. The vulnerabilities include an authentication bypass, a directory traversal and a privilege escalation to get privileged code execution.

tags | exploit, remote, shell, vulnerability, code execution
advisories | CVE-2015-1486, CVE-2015-1487, CVE-2015-1489
SHA-256 | 55479cb3065f838f82cc61df0c4fdee54d41ee44aace24351aecba453e3be8c5
Joomla J2Store 3.1.6 SQL Injection
Posted Jul 11, 2015
Authored by Brandon Perry

Joomla J2Store extension version 3.1.6 suffers from multiple remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
SHA-256 | 2495ca05c8e312061ad70427868645898c2ed7b6d86871b75506ad32b299c074
OS Solution OSProperty 2.8.0 SQL Injection
Posted Apr 29, 2015
Authored by Brandon Perry

OS Solution OSProperty version 2.8.0 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | afb9d76a0580b59eef035727449af6742f88e1ec6208060bf24d021e74f952d4
Joomla ECommerce-WD 1.2.5 SQL Injection
Posted Mar 19, 2015
Authored by Brandon Perry

Joomla ECommerce-WD plugin version 1.2.5 suffers from multiple remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
SHA-256 | cc4be435a403cd80f5b4f40120c961b2dbee70db21b36e683a07c11ebdb15757
Raritan PowerIQ 4.1 / 4.2 / 4.3 Code Execution
Posted Mar 12, 2015
Authored by Brandon Perry

Raritan PowerIQ versions 4.1, 4.2, and 4.3 ship with a Rails 2 web interface with a hardcoded session secret. This can be used to achieve unauthenticated remote code execution as the nginx user on vulnerable systems.

tags | exploit, remote, web, code execution
SHA-256 | 681c8bb72ae6628420487909d37bf9e367efcdc762196f727263b8b5ca086eda
Solarwinds Orion Service SQL Injection
Posted Mar 3, 2015
Authored by Brandon Perry

Various remote SQL injection vulnerabilities exist in the core Orion service used in most of the Solarwinds products. Affected products include Network Performance Monitor below version 11.5, NetFlow Traffic Analyzer below version 4.1, Network Configuration Manager below version 7.3.2, IP Address Manager below version 4.3, User Device Tracker below version 3.2, VoIP

tags | exploit, remote, web, vulnerability, sql injection
advisories | CVE-2014-9566
SHA-256 | 40f0cfd35789791a3221e29e1e315107c0ccf98e5d5f17f0defa24fafd955c3f
eTouch Samepage 4.4.0.0.239 SQL Injection / File Read
Posted Feb 13, 2015
Authored by Brandon Perry

eTouch Samepage version 4.4.0.0.239 suffers from remote SQL injection and arbitrary file read vulnerabilities.

tags | exploit, remote, arbitrary, vulnerability, sql injection, file inclusion
SHA-256 | 3d132193ed477d7d4ba1937eda3c2f767b2192990404bb7846361beb567d88c6
Wordpress Photo Gallery Unauthenticated SQL Injection User Enumeration
Posted Jan 13, 2015
Authored by Brandon Perry | Site metasploit.com

This Metasploit module exploits an unauthenticated SQL injection in order to enumerate the Wordpress users tables, including password hashes. This Metasploit module was tested against version 1.2.7.

tags | exploit, sql injection
advisories | CVE-2014-2238
SHA-256 | b0515350e4ccd496fb0e7266e0caa11158145540d2f845735488187df6eb3bf1
McAfee ePolicy Orchestrator Authenticated XXE Credential Exposure
Posted Jan 6, 2015
Authored by Brandon Perry | Site metasploit.com

This Metasploit module will exploit an authenticated XXE vulnerability to read the keystore.properties off of the filesystem. This properties file contains an encrypted password that is set during installation. What is interesting about this password is that it is set as the same password as the database 'sa' user and of the admin user created during installation. This password is encrypted with a static key, and is encrypted using a weak cipher at that (ECB).

tags | exploit, xxe
SHA-256 | 01a438afa7dd5e3323cf3bdca6d5720f8815799cc27eaf5498b39b69ad28f5a5
BMC TrackIt! 11.3 Unauthenticated Local User Password Change
Posted Dec 11, 2014
Authored by Brandon Perry

BMC TrackIt! version 11.3 suffers from an unauthenticated local user password change vulnerability.

tags | exploit, local, bypass
SHA-256 | 5fefd8b05da0065be210ad2c623884f150fbcfc0f1be8ecb4ef3325bee6f4935
Device42 Embedded Credentials
Posted Nov 26, 2014
Authored by Brandon Perry

Device42 DCIM Appliance Manager versions 5.10 and 6.0 have hardcoded credentials and also suffer from remote command injection vulnerabilities.

tags | exploit, remote, vulnerability
SHA-256 | 47d0bb4ee432dc13a705f89a07909d8cdbdeeb3f951e98bf1888d524fb84ce61
Device42 Traceroute Command Injection
Posted Nov 26, 2014
Authored by Brandon Perry | Site metasploit.com

Device42 DCIM Appliance Manager versions 5.10 and 6.0 with WAN emulator version 2.3 remote command injection exploit for Metasploit that leverages traceroute.

tags | exploit, remote
SHA-256 | e2f6512a30f338fd030b36604071a79b13a88b9fdf4c8034dc527a27aa2ff592
Device42 Ping Command Injection
Posted Nov 26, 2014
Authored by Brandon Perry | Site metasploit.com

Device42 DCIM Appliance Manager versions 5.10 and 6.0 with WAN emulator version 2.3 remote command injection exploit for Metasploit that leverages ping.

tags | exploit, remote
SHA-256 | 09e949ee2c12810265edcb0ba195795b730ea412d995e215b44e58c84ea6d497
Mulesoft ESB Runtime 3.5.1 Privilege Escalation / Code Execution
Posted Oct 22, 2014
Authored by Brandon Perry

Mulesoft ESB Runtime version 3.5.1 suffers from an authenticated privilege escalation vulnerability that can lead to remote code execution.

tags | exploit, remote, code execution
SHA-256 | 08794d520edeb726f186f14cdf7b89697a8145e119476f5b25642ede0d501b5c
Drupal HTTP Parameter Key/Value SQL Injection
Posted Oct 18, 2014
Authored by Brandon Perry, Christian Mehlmauer, SektionEins | Site metasploit.com

This Metasploit module exploits the Drupal HTTP Parameter Key/Value SQL Injection (aka Drupageddon) in order to achieve a remote shell on the vulnerable instance. This Metasploit module was tested against Drupal 7.0 and 7.31 (was fixed in 7.32).

tags | exploit, remote, web, shell, sql injection
advisories | CVE-2014-3704
SHA-256 | 59c783da21c64e0178897d8573702afbd579b90f368e1d6b75b500bd779f1e7d
Page 1 of 3
Back123Next

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    14 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    11 Files
  • 8
    Dec 8th
    36 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close