exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 51 RSS Feed

Files from patrick

First Active1999-08-17
Last Active2015-03-24
WordPress Foxypress uploadify.php Arbitrary Code Execution
Posted Mar 24, 2015
Authored by patrick, Sammy FORGIT | Site metasploit.com

This Metasploit module exploits an arbitrary PHP code execution flaw in the WordPress blogging software plugin known as Foxypress. The vulnerability allows for arbitrary file upload and remote code execution via the uploadify.php script. The Foxypress plugin versions 0.4.1.1 to 0.4.2.1 are vulnerable.

tags | exploit, remote, arbitrary, php, code execution, file upload
SHA-256 | b017c0df7061322735956c2e5f849f22a187dfba7fc928876d14b674c70fddd8
WordPress plugin Foxypress uploadify.php Arbitrary Code Execution
Posted Jun 12, 2012
Authored by patrick, Sammy FORGIT | Site metasploit.com

This Metasploit module exploits an arbitrary PHP code execution flaw in the WordPress blogging software plugin known as Foxypress. The vulnerability allows for arbitrary file upload and remote code execution via the uploadify.php script. The Foxypress plug-in versions 0.4.2.1 and below are vulnerable.

tags | exploit, remote, arbitrary, php, code execution, file upload
advisories | OSVDB-82652
SHA-256 | da0008da963d30190b80ec624d76b37a43a7996230c2eda836dbddf9adef1f96
Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow
Posted Jun 7, 2012
Authored by patrick | Site metasploit.com

This Metasploit module can be used to execute arbitrary code on IIS servers that expose the /msadc/msadcs.dll Microsoft Data Access Components (MDAC) Remote Data Service (RDS) DataFactory service. The service is exploitable even when RDS is configured to deny remote connections (handsafe.reg). The service is vulnerable to a heap overflow where the RDS DataStub 'Content-Type' string is overly long. Microsoft Data Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.

tags | exploit, remote, overflow, arbitrary
advisories | CVE-2002-1142, OSVDB-14502
SHA-256 | 5b8f51f6304db9028ffb31a8630bc9126a8b59e8dff7370fae1e12b8fd591199
Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution
Posted Jun 7, 2012
Authored by patrick | Site metasploit.com

This Metasploit module can be used to execute arbitrary commands on IIS servers that expose the /msadc/msadcs.dll Microsoft Data Access Components (MDAC) Remote Data Service (RDS) DataFactory service using VbBusObj or AdvancedDataFactory to inject shell commands into Microsoft Access databases (MDBs), MSSQL databases and ODBC/JET Data Source Name (DSN). Based on the msadcs.pl v2 exploit by Rain.Forest.Puppy, which was actively used in the wild in the late Ninties. MDAC versions affected include MDAC 1.5, 2.0, 2.0 SDK, 2.1 and systems with the MDAC Sample Pages for RDS installed, and NT4 Servers with the NT Option Pack installed or upgraded 2000 systems often running IIS3/4/5 however some vulnerable installations can still be found on newer Windows operating systems. Note that newer releases of msadcs.dll can still be abused however by default remote connections to the RDS is denied. Consider using VERBOSE if you're unable to successfully execute a command, as the error messages are detailed and useful for debugging. Also set NAME to obtain the remote hostname, and METHOD to use the alternative VbBusObj technique.

tags | exploit, remote, arbitrary, shell
systems | windows
advisories | CVE-1999-1011
SHA-256 | 382234f494b3e6be1ceaa9dc39e8b06bf8faad703997a8f0eec9259b5d187113
Webster HTTP Server GET Buffer Overflow
Posted Nov 5, 2010
Authored by patrick | Site metasploit.com

This exploits a stack buffer overflow in the Webster HTTP server. The server and source code was released within an article from the Microsoft Systems Journal in February 1996 titled "Write a Simple HTTP-based Server Using MFC and Windows Sockets".

tags | exploit, web, overflow
systems | windows
advisories | CVE-2002-2268
SHA-256 | 0d341c47e7cabeb02b12b776372115f798017f23cece248d2f04a7073ce91809
Network Associates PGP KeyServer 7 LDAP Buffer Overflow
Posted Nov 5, 2010
Authored by patrick | Site metasploit.com

This Metasploit module exploits a stack overflow in the LDAP service that is part of the NAI PGP Enterprise product suite. This Metasploit module was tested against PGP KeyServer v7.0. Due to space restrictions, egghunter is used to find our payload - therefore you may wish to adjust WfsDelay.

tags | exploit, overflow
advisories | CVE-2001-1320
SHA-256 | da96c2a19be199b131c7fc8a865bf1900872f9605e31b1421acca3503f58840f
Amlibweb NetOpacs webquery.dll Stack Overflow
Posted Aug 5, 2010
Authored by patrick | Site metasploit.com

This Metasploit module exploits a stack overflow in Amlib's Amlibweb Library Management System (NetOpacs). The webquery.dll API is available through IIS requests. By specifying an overly long string to the 'app' parameter, SeH can be reliably overwritten allowing for arbitrary remote code execution. In addition, it is possible to overwrite EIP by specifying an arbitrary parameter name with an '=' terminator.

tags | exploit, remote, overflow, arbitrary, code execution
SHA-256 | fe4b9c6660b9a78cd1ca60a3af4c9505711a0207a3d593097dec278c1746ef04
Qbik WinGate WWW Proxy Server URL Processing Overflow
Posted Feb 19, 2010
Authored by patrick | Site metasploit.com

This Metasploit module exploits a stack overflow in Qbik WinGate version 6.1.1.1077 and earlier. By sending malformed HTTP POST URL to the HTTP proxy service on port 80, a remote attacker could overflow a buffer and execute arbitrary code.

tags | exploit, remote, web, overflow, arbitrary
advisories | CVE-2006-2926
SHA-256 | 894f43ed9ebd305fbfb850e6148306dc62adfbc8788b34ecf2cdb98d799e4036
RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution
Posted Feb 15, 2010
Authored by patrick | Site metasploit.com

This Metasploit module abuses two flaws - a meta-character injection vulnerability in the HTTP management server of RedHat 6.2 systems running the Piranha LVS cluster service and GUI (rpm packages: piranha and piranha-gui). The vulnerability allows an authenticated attacker to execute arbitrary commands as the Apache user account (nobody) within the /piranha/secure/passwd.php3 script. The package installs with a default user and password of piranha:q which was exploited in the wild.

tags | exploit, web, arbitrary
systems | linux, redhat
advisories | CVE-2000-0322, CVE-2000-0248
SHA-256 | 442fa6c986556186edf0a94ec820206a1b661a4f27bfcc94690cc73789eca8a2
Computer Associates License Client GETCONFIG Overflow
Posted Feb 15, 2010
Authored by patrick, Thor Doomen | Site metasploit.com

This Metasploit module exploits an vulnerability in the CA License Client service. This exploit will only work if your IP address can be resolved from the target system point of view. This can be accomplished on a local network by running the 'nmbd' service that comes with Samba. If you are running this exploit from Windows and do not filter udp port 137, this should not be a problem (if the target is on the same network segment). Due to the bugginess of the software, you are only allowed one connection to the agent port before it starts ignoring you. If it wasn't for this issue, it would be possible to repeatedly exploit this bug.

tags | exploit, local, udp
systems | windows
advisories | CVE-2005-0581
SHA-256 | d3f07719ead763dc46245786376f69700d88d42ed26c7accf58521d0730e72de
Computer Associates License Server GETCONFIG Overflow
Posted Feb 15, 2010
Authored by patrick, Thor Doomen | Site metasploit.com

This Metasploit module exploits an vulnerability in the CA License Server network service. By sending an excessively long GETCONFIG packet the stack may be overwritten.

tags | exploit
advisories | CVE-2005-0581
SHA-256 | 7db5e725b318157687ab86443425c71c0753992cce2985a0cbb8dde1d0f979bc
RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow
Posted Feb 15, 2010
Authored by patrick, Trancek | Site metasploit.com

This Metasploit module exploits a stack overflow in RKD Software Barcode Application ActiveX Control 'BarCodeAx.dll'. By sending an overly long string to the BeginPrint method of BarCodeAx.dll v4.9, an attacker may be able to execute arbitrary code.

tags | exploit, overflow, arbitrary, activex
advisories | CVE-2007-3435
SHA-256 | 830fb97a12250288c3c344f312f383d28eed3c7a3ad23ca70f9078f2faa09692
Sambar 6 Search Results Buffer Overflow
Posted Feb 15, 2010
Authored by H D Moore, patrick, Andrew Griffiths | Site metasploit.com

This Metasploit module exploits a buffer overflow found in the /search/results.stm application that comes with Sambar 6. This code is a direct port of Andrew Griffiths's SMUDGE exploit, the only changes made were to the nops and payload. This exploit causes the service to die, whether you provided the correct target or not.

tags | exploit, overflow
advisories | CVE-2004-2086
SHA-256 | 43d90184c1c0d9d0e9d3c5ac475582ad68fe7328316423ce9e487d6c5499f98b
MS03-046 Exchange 2000 XEXCH50 Heap Overflow
Posted Dec 31, 2009
Authored by H D Moore, patrick | Site metasploit.com

This is an exploit for the Exchange 2000 heap overflow. Due to the nature of the vulnerability, this exploit is not very reliable. This Metasploit module has been tested against Exchange 2000 SP0 and SP3 running a Windows 2000 system patched to SP4. It normally takes between one and 100 connection attempts to successfully obtain a shell. This exploit is *very* unreliable.

tags | exploit, overflow, shell
systems | windows
advisories | CVE-2003-0714
SHA-256 | 26a51fce399b6448d8c4a7690d9c8391601cf7dd1c9478bdf2b4167db5d655ee
Altap Salamander 2.5 PE Viewer Buffer Overflow
Posted Nov 26, 2009
Authored by patrick | Site metasploit.com

This Metasploit module exploits a buffer overflow in Altap Salamander <= v2.5. By creating a malicious file and convincing a user to view the file with the Portable Executable Viewer plugin within a vulnerable version of Salamander, the PDB file string is copied onto the stack and the SEH can be overwritten.

tags | exploit, overflow
advisories | CVE-2007-3314
SHA-256 | ebf80be5e1b04701f27a0c9bc26e038dbcf822655731d47db5156edbcff7ef55
Apache module mod_rewrite LDAP protocol Buffer Overflow
Posted Nov 26, 2009
Authored by patrick | Site metasploit.com

This Metasploit module exploits the mod_rewrite LDAP protocol scheme handling flaw discovered by Mark Dowd, which produces an off-by-one overflow. Apache versions 1.3.29-36, 2.0.47-58, and 2.2.1-2 are vulnerable. This Metasploit module requires REWRITEPATH to be set accurately. In addition, the target must have 'RewriteEngine on' configured, with a specific 'RewriteRule' condition enabled to allow for exploitation. The flaw affects multiple platforms, however this module currently only supports Windows based installations.

tags | exploit, overflow, protocol
systems | windows
advisories | CVE-2006-3747
SHA-256 | 96b871a0195d2591844969f9bba63abc59813d3e7296ce6634f95d37eb06d859
CA iTechnology iGateway Debug Mode Buffer Overflow
Posted Nov 26, 2009
Authored by patrick | Site metasploit.com

This Metasploit module exploits a vulnerability in the Computer Associates iTechnology iGateway component. When True is enabled in igateway.conf (non-default), it is possible to overwrite the stack and execute code remotely.

tags | exploit
SHA-256 | 89d7912b65f1179a027b6b09dbe1d096244c228ce9a646375fd5feff7816a959
CA BrightStor Discovery Service TCP Overflow
Posted Nov 26, 2009
Authored by H D Moore, patrick | Site metasploit.com

This Metasploit module exploits a vulnerability in the CA BrightStor Discovery Service. This vulnerability occurs when a specific type of request is sent to the TCP listener on port 41523. This vulnerability was discovered by cybertronic@gmx.net and affects all known versions of the BrightStor product. This Metasploit module is based on the 'cabrightstor_disco' exploit by Thor Doomen.

tags | exploit, tcp
advisories | CVE-2005-2535
SHA-256 | 532219f28d50db309980d4c39dfa18dcf976499ccb5c9736a81297f410a80362
CA BrightStor Discovery Service Overflow
Posted Nov 26, 2009
Authored by H D Moore, patrick | Site metasploit.com

This Metasploit module exploits a vulnerability in the CA BrightStor Discovery Service. This vulnerability occurs when a large request is sent to UDP port 41524, triggering a stack overflow.

tags | exploit, overflow, udp
advisories | CVE-2005-0260
SHA-256 | cc02dcad9531e32e7473a4a7fa98929736e506792b9a193707c55a2b424bc463
D-Link TFTP 1.0 Long Filename Buffer Overflow
Posted Nov 26, 2009
Authored by patrick, LSO | Site metasploit.com

This Metasploit module exploits a stack overflow in D-Link TFTP 1.0. By sending a request for an overly long file name, an attacker could overflow a buffer and execute arbitrary code.

tags | exploit, overflow, arbitrary
advisories | CVE-2007-1435
SHA-256 | bfbc05b4b87a6ce005b9bc1dcbf88ea34695a1c611595f570b33a38b8fe5c755
IBM Lotus Domino Sametime STMux.exe Stack Overflow
Posted Nov 26, 2009
Authored by patrick, riaf | Site metasploit.com

This Metasploit module exploits a stack overflow in Lotus Domino's Sametime Server. By sending an overly long POST request to the Multiplexer STMux.exe service we are able to overwrite SEH. Based on the exploit by Manuel Santamarina Suarez.

tags | exploit, overflow
advisories | CVE-2008-2499
SHA-256 | dbb922034950b5d503d3b1d3a1d7c5b5c97e423e24541e11f69c20a9ef2b6eba
Juniper SSL-VPN IVE JuniperSetupDLL.dll ActiveX Control Buffer Overflow
Posted Nov 26, 2009
Authored by patrick | Site metasploit.com

This Metasploit module exploits a stack overflow in the JuniperSetupDLL.dll library which is called by the JuniperSetup.ocx ActiveX control, as part of the Juniper SSL-VPN (IVE) appliance. By specifying an overly long string to the ProductName object parameter, the stack is overwritten.

tags | exploit, overflow, activex
systems | juniper
advisories | CVE-2006-2086
SHA-256 | 26f61dc73b61764daa3a06c44ab90c018a5f7c37d9a49f838a2c3b1e07f7ce49
McAfee ePolicy Orchestrator / ProtectionPilot Overflow
Posted Nov 26, 2009
Authored by H D Moore, patrick, muts, xbxice | Site metasploit.com

This is an exploit for the McAfee HTTP Server (NAISERV.exe). McAfee ePolicy Orchestrator 2.5.1 <= 3.5.0 and ProtectionPilot 1.1.0 are known to be vulnerable. By sending a large 'Source' header, the stack can be overwritten. This Metasploit module is based on the exploit by xbxice and muts. Due to size constraints, this module uses the Egghunter technique. You may wish to adjust WfsDelay appropriately.

tags | exploit, web
advisories | CVE-2006-5156
SHA-256 | 4e64f2bde60479894b56b37f3ca9106dbfee008011c45a3a524a30225b19046b
MDaemon 9.6.4 IMAPD FETCH Buffer Overflow
Posted Nov 26, 2009
Authored by patrick, Jacopo Cervini | Site metasploit.com

This Metasploit module exploits a stack overflow in the Alt-N MDaemon IMAP Server version 9.6.4 by sending an overly long FETCH BODY command. Valid IMAP account credentials are required. Credit to Matteo Memelli

tags | exploit, overflow, imap
advisories | CVE-2008-1358
SHA-256 | e1e88ec1c914159c02c88aa646f73a91ac2acbc316b4991a9d0f98473b227142
MDaemon <= 6.8.5 WorldClient form2raw.cgi Stack Overflow
Posted Nov 26, 2009
Authored by patrick | Site metasploit.com

This Metasploit module exploits a stack overflow in Alt-N MDaemon SMTP server for versions 6.8.5 and earlier. When WorldClient HTTP server is installed (default), a CGI script is provided to accept html FORM based emails and deliver via MDaemon.exe, by writing the CGI output to the Raw Queue. When X-FromCheck is enabled (also default), the temporary form2raw.cgi data is copied by MDaemon.exe and a stack based overflow occurs when an excessively long From field is specified. The RawQueue is processed every 1 minute by default, to a maximum of 60 minutes. Keep this in mind when choosing payloads or setting WfsDelay... You'll need to wait. Furthermore, this exploit uses a direct memory jump into a nopsled (which isn't very reliable). Once the payload is written into the Raw Queue by Form2Raw, MDaemon will continue to crash/execute the payload until the CGI output is manually deleted from the queue in C:\\MDaemon\\RawFiles\\*.raw.

tags | exploit, web, overflow, cgi
advisories | CVE-2003-1200
SHA-256 | 9a7e8845ddbf7fb0e6b7482b9b8e9b1da4f7b29d2b83ac012d206510dc73a91c
Page 1 of 3
Back123Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close