what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 3 of 3

Files from Micheal Cottingham

PostgreSQL CREATE LANGUAGE Execution

Posted Apr 9, 2016

Authored by Micheal Cottingham, midnitesnake, Nixawk | Site metasploit.com

Some installations of Postgres 8 and 9 are configured to allow loading external scripting languages. Most commonly this is Perl and Python. When enabled, command execution is possible on the host. To execute system commands, loading the "untrusted" version of the language is necessary. This requires a superuser. This is usually postgres. The execution should be platform-agnostic, and has been tested on OS X, Windows, and Linux. This Metasploit module attempts to load Perl or Python to execute system commands. As this dynamically loads a scripting language to execute commands, it is not necessary to drop a file on the filesystem. Only Postgres 8 and up are supported.

tags | exploit, perl, python

systems | linux, windows, apple, osx

SHA-256 | 35a6a49124ad62dab21bd8ac5c63333438e1b0e3ebfa9c2ae8f568b3ec88f1c1

Download | Favorite | View

mybbs142-multi.txt

Posted Oct 27, 2008

Authored by Micheal Cottingham

MyBB version 1.4.2 suffers from cross site scripting and remote code execution vulnerabilities.

tags | exploit, remote, vulnerability, code execution, xss

SHA-256 | 7cd7c424c1fe432f5291c6c5a945c4b21961ebd7c63f0678a83419ea7b5c08fc

Download | Favorite | View

Zero Day Initiative Advisory 06-013

Posted May 21, 2006

Authored by Tipping Point, Micheal Cottingham | Site zerodayinitiative.com

ZDI-06-013 - A flaw in TippingPoint SMS servers exists within the web management interface. Due to insufficient protections on specific directories, an attacker with access to the web interface may be able to view benign data such as the user manual. In the event that the device was being used for backup purposes, it may be possible for an attacker to identify additional information such as configuration settings.

tags | advisory, web

advisories | CVE-2006-0993

SHA-256 | 22e745de119fd16e72ea102484da600590711500bd803c123254c0378073e114

Download | Favorite | View