exploit the possibilities
Showing 1 - 14 of 14 RSS Feed

Files from Eldar Marcussen

First Active2014-09-03
Last Active2020-06-03
Sabberworm PHP CSS Code Injection
Posted Jun 3, 2020
Authored by Eldar Marcussen

Sabberworm PHP CSS parser suffers from a code injection vulnerability. Many versions are affected.

tags | exploit, php
advisories | CVE-2020-13756
MD5 | 3a39459dcc05923af09d4a4ccd02d788
HP ThinPro 6.x / 7.x Privileged Command Injection
Posted Mar 25, 2020
Authored by Eldar Marcussen

HP ThinPro versions 7.1, 7.0, 6.2.1, and 6.2 suffer from a privileged command injection vulnerability.

tags | exploit
advisories | CVE-2019-18910
MD5 | 86a3b2ec920c1057a19c890e8605ecf5
HP ThinPro 6.x / 7.x Citrix Command Injection
Posted Mar 25, 2020
Authored by Eldar Marcussen

HP ThinPro versions 7.1, 7.0, 6.2.1, and 6.2 suffer from a Citrix receiver connection wrapper command injection vulnerability.

tags | exploit
advisories | CVE-2019-18909
MD5 | 301879be06768cb2bb289a3ce523bf8d
HP ThinPro 6.x / 7.x Privilege Escalation
Posted Mar 25, 2020
Authored by Eldar Marcussen

HP ThinPro versions 7.1, 7.0, 6.2.1, and 6.2 suffer from a local privilege escalation vulnerability.

tags | exploit, local
advisories | CVE-2019-16287
MD5 | 1441843053c9dab5b6af31aa31e3e16d
HP ThinPro 6.x / 7.x Filter Bypass
Posted Mar 25, 2020
Authored by Eldar Marcussen

HP ThinPro versions 7.1, 7.0, 6.2.1, and 6.2 suffer from an application filter bypass vulnerability.

tags | exploit, bypass
advisories | CVE-2019-16286
MD5 | 68cf55b494dfadf53d25535a6c23313a
HP ThinPro 6.x / 7.x Information Disclosure
Posted Mar 25, 2020
Authored by Eldar Marcussen

HP ThinPro versions 7.1, 7.0, 6.2.1, and 6.2 suffer from a local physical access information disclosure vulnerability.

tags | exploit, local, info disclosure
advisories | CVE-2019-16285
MD5 | 255ed9d1368d7aa40e9fa99b81e489f7
LibreNMS Collectd Command Injection
Posted Sep 6, 2019
Authored by Eldar Marcussen, Shelby Pace | Site metasploit.com

This Metasploit module exploits a command injection vulnerability in the Collectd graphing functionality in LibreNMS. The to and from parameters used to define the range for a graph are sanitized using the mysqli_escape_real_string() function, which permits backticks. These parameters are used as part of a shell command that gets executed via the passthru() function, which can result in code execution.

tags | exploit, shell, code execution
advisories | CVE-2019-10669
MD5 | 4480c86153083ea98f618156ca80c47b
ABB IDAL HTTP Server Uncontrolled Format String
Posted Jun 24, 2019
Authored by Eldar Marcussen

The IDAL HTTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to bypass authentication or execute code on the server. The IDAL HTTP server does not safely handle username or cookie strings during the authentication process. Attempting to authenticate with the username "%25s%25p%25x%25n" will crash the server. Sending "%08x.AAAA.%08x.%08x" will log memory content from the stack.

tags | exploit, web
advisories | CVE-2019-7228
MD5 | c1e2be691a3acf789ade041e7211593f
ABB IDAL HTTP Server Stack-Based Buffer Overflow
Posted Jun 24, 2019
Authored by Eldar Marcussen

The IDAL HTTP server is vulnerable to a stack-based buffer overflow when receiving a large host header in a HTTP request. The host header value overflows a buffer and overwrites the Structured Exception Handler (SEH) address with a larger buffer. An unauthenticated attacker can send a Host header value of 2047 bytes or more to overflow the host headers and overwrite the SEH address which can then be leveraged to execute attacker controlled code on the server.

tags | exploit, web, overflow
advisories | CVE-2019-7232
MD5 | c4d1eb7e747d309f6eb5cd228fd543c9
ABB IDAL HTTP Server Authentication Bypass
Posted Jun 21, 2019
Authored by Eldar Marcussen

The IDAL HTTP server CGI interface contains a URL, which allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. In the IDAL CGI interface, there is a URL (/cgi/loginDefaultUser), which will create a session in an authenticated state and return the session ID along with the username and plaintext password of the user. An attacker can then login with the provided credentials or supply the string 'IDALToken=......' in a cookie which will allow them to perform privileged operations such as restarting the service with /cgi/restart.

tags | exploit, web, cgi
advisories | CVE-2019-7226
MD5 | 859c2710995c4452403cd17e5573e137
ABB IDAL FTP Server Uncontrolled Format String
Posted Jun 21, 2019
Authored by Eldar Marcussen

The IDAL FTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to bypass authentication or execute code on the server.

tags | exploit
advisories | CVE-2019-7230
MD5 | 904004a3f4b9e76ee3d9da27f7d9a6c9
ABB IDAL FTP Server Path Traversal
Posted Jun 21, 2019
Authored by Eldar Marcussen

The IDAL FTP server fails to ensure that directory change requests do not change to locations outside of the FTP servers root directory. An authenticated attacker can simply traverse outside the server root directory by changing the directory with "cd ..". An authenticated attacker can traverse to arbitrary directories on the hard disk and then use the FTP server functionality to download and upload files. An unauthenticated attacker can take advantage of the hardcoded or default credential pair exor/exor to become an authenticated attacker.

tags | exploit, arbitrary, root
advisories | CVE-2019-7227
MD5 | be5338ed28cb9ab9d011d91ec4b3cbcd
ABB IDAL FTP Server Buffer Overflow
Posted Jun 21, 2019
Authored by Eldar Marcussen

The IDAL FTP server is vulnerable to a buffer overflow where a large string is sent by an authenticated attacker that causes a buffer overflow. This overflow is handled, but terminates the process. An authenticated attacker can send a FTP command string of 472 bytes or more to overflow a buffer causing an exception that terminates the server. An unauthenticated attacker can take advantage of the hardcoded or default credential pair exor/exor to become an authenticated attacker.

tags | exploit, overflow
advisories | CVE-2019-7231
MD5 | fc10a0c030b5fa18e687345426253408
Mpay24 Payment Module 1.5 Information Disclosure / SQL Injection
Posted Sep 3, 2014
Authored by Eldar Marcussen

Mpay24 Payment Module versions 1.5 and below suffer from information disclosure and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection, info disclosure
advisories | CVE-2014-2008, CVE-2014-2009
MD5 | d91cc4e0bea733e9fd33f4bedc70a421
Page 1 of 1
Back1Next

File Archive:

June 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    10 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    15 Files
  • 4
    Jun 4th
    25 Files
  • 5
    Jun 5th
    8 Files
  • 6
    Jun 6th
    0 Files
  • 7
    Jun 7th
    0 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    0 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close