exploit the possibilities
Showing 1 - 25 of 272 RSS Feed

Files from hyp3rlinx

Email addressprivate
Websitehyp3rlinx.altervista.org
First Active2015-04-28
Last Active2019-01-29
View User Profile
CloudMe Sync 1.11.2 Buffer Overflow
Posted Jan 29, 2019
Authored by hyp3rlinx, Matteo Malvica

CloudMe Sync version 1.11.2 buffer overflow exploit with DEP bypass for WoW64.

tags | exploit, overflow
advisories | CVE-2018-6892
MD5 | 6c6eec765b43cb302857a4db976b3285
Microsoft Windows Contact File HTML Link Injection Remote Code Execution
Posted Jan 23, 2019
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Microsoft Windows has a flaw where a contact file can be leveraged with a malicious mailto: link to achieve code execution.

tags | exploit, code execution
systems | windows
MD5 | 8da8aed6efa36cf9b75b407094e89ecd
Microsoft Windows .contact Arbitrary Code Execution
Posted Jan 16, 2019
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw is due to the processing of ".contact" files <c:Url> node param which takes an expected website value, however if an attacker references an executable file it will run that instead without warning instead of performing expected web navigation. This is dangerous and would be unexpected to an end user.

tags | exploit, remote, web, arbitrary
systems | windows
MD5 | 400f7619bf34f3975072761dde4b36b7
Microsoft Windows VCF Remote Code Execution
Posted Jan 11, 2019
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of VCard files. Crafted data in a VCard file can cause Windows to display a dangerous hyperlink. The user interface fails to provide any indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of the current user.

tags | exploit, remote, arbitrary
systems | windows
MD5 | b357f9ac49a1d5e1b09b2def64c183cf
NEC Univerge Sv9100 WebPro 6.00.00 Predictable Session ID / Cleartext Passwords
Posted Dec 4, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

NEC Univerge Sv9100 WebPro version 6.00.00 suffers from predictable session identifiers and cleartext password vulnerabilities.

tags | exploit, vulnerability
advisories | CVE-2018-11741, CVE-2018-11742
MD5 | 9a52c2a9711824e6df44c4ff715eb9fd
D-LINK Central WifiManager (CWM 100) 1.03 r0098 DLL Hijacking
Posted Nov 9, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

D-Link Central WiFiManager CWM-100 version 1.03 r0098 devices will load a trojan horse "quserex.dll" and will create a new thread running with SYSTEM integrity.

tags | exploit, trojan
advisories | CVE-2018-15515
MD5 | 7d5b487d0bc7a54d4746370b3f054425
D-LINK Central WifiManager (CWM 100) 1.03 r0098 Server-Side Request Forgery
Posted Nov 9, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Using a web browser or script server-side request forgery (SSRF) can be initiated against internal/external systems to conduct port scans by leveraging D-LINK's MailConnect component. The MailConnect feature on D-Link Central WiFiManager CWM-100 version 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI. This can undermine accountability of where scan or connections actually came from and or bypass the FW etc. This can be automated via script or using Web Browser.

tags | exploit, web, php, tcp
advisories | CVE-2018-15517
MD5 | d9afd3cea418548b6c3b72153c1261fe
D-LINK Central WifiManager (CWM 100) 1.03 r0098 Man-In-The-Middle
Posted Nov 9, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

The FTP Server component of the D-LINK Central WifiManager can be used as a man-in-the-middle machine allowing PORT Command bounce scan attacks. This vulnerability allows remote attackers to abuse your network and discreetly conduct network port scanning. Victims will then think these scans are originating from the D-LINK network running the afflicted FTP Server and not you. Version 1.03 r0098 is affected.

tags | exploit, remote
advisories | CVE-2018-15516
MD5 | 83571811be19f02f54e3bf44fda47807
Cisco Immunet / Cisco AMP For Endpoints Scanning Denial Of Service
Posted Nov 9, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow executable files to be launched on the system without being analyzed for threats. The vulnerability is due to improper process resource handling. Cisco Immunet versions prior to 6.2.0 and Cisco AMP For Endpoints version 6.2.0 are affected.

tags | exploit, local
systems | cisco, windows
advisories | CVE-2018-15437
MD5 | 7a4ff17f412569211f6751de8fc14501
ServersCheck Monitoring Software 14.3.3 SQL Injection
Posted Oct 23, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

ServersCheck Monitoring Software versions up through 14.3.3 suffer from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
advisories | CVE-2018-18550
MD5 | 5f20210cc21e2f7f7eeba3f2bed4a0d4
ServersCheck Monitoring Software 14.3.3 Cross Site Scripting
Posted Oct 23, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

ServersCheck Monitoring Software versions up through 14.3.3 suffer from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2018-18551
MD5 | 2073e0a7bf80bbfb06368b74de78f83f
ServersCheck Monitoring Software 14.3.3 Arbitrary File Write / DoS
Posted Oct 23, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

ServersCheck Monitoring Software versions up through suffer from arbitrary file write and denial of service vulnerabilities.

tags | exploit, denial of service, arbitrary, vulnerability
advisories | CVE-2018-18552
MD5 | 7302d602d37c84719c9794dafd55fb00
NoMachine 5.3.26 Remote Code Execution
Posted Oct 12, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

NoMachine versions 5.3.26 and below suffer from a remote code execution vulnerability when opening a malicious .nxs file.

tags | exploit, remote, code execution
advisories | CVE-2018-17980
MD5 | 98f0f6fe4dc505a95f06d738805d3c7a
Microsoft SQL Server Management Studio 17.9 / 18.0 Preview 4 XML Injection
Posted Oct 11, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Microsoft SQL Server Management Studio versions 17.9 and 18.0 Preview 4 suffer from an xmla filetype XML external entity injection vulnerability.

tags | exploit, sql injection
advisories | CVE-2018-8532
MD5 | f8fb22312550cc368dc913351a5406a8
Microsoft SQL Server Management Studio 17.9 / 18.0 Preview 4 XML Injection
Posted Oct 11, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Microsoft SQL Server Management Studio versions 17.9 and 18.0 Preview 4 suffer from a xel filetype XML external entity injection vulnerability.

tags | exploit, sql injection
advisories | CVE-2018-8527
MD5 | 0fb594060e86354cefaa3a12ba2181d5
Microsoft SQL Server Management Studio 17.9 / 18.0 Preview 4 XML Injection
Posted Oct 11, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Microsoft SQL Server Management Studio versions 17.9 and 18.0 Preview 4 suffer from a REGSRVR filehandling XML external entity injection vulnerability.

tags | exploit, sql injection
advisories | CVE-2018-8533
MD5 | bc7e26312d98457aeac3779548aee6d7
Microsoft Baseline Security Analyzer 2.3 XML Injection
Posted Sep 10, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Microsoft Baseline Security Analyzer version 2.3 suffers from an XML external entity injection vulnerability.

tags | exploit
MD5 | 7224f7e70a591fdfca03428610d0453c
Microsoft .NET Framework CVE-2015-6099 Analysis
Posted Sep 3, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

This whitepaper analyzes a privilege escalation vulnerability in the Microsoft .NET framework as noted in MS15-118.

tags | exploit, paper
advisories | CVE-2015-6099
MD5 | 4a014224fc35bfb528ae5d4ebe710d2d
FsPro Labs Event Log Explorer 4.6.1.2115 XML Injection
Posted Sep 1, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

FsPro Labs Event Log Explorer version 4.6.1.2115 suffers from an XML external entity injection vulnerability.

tags | exploit
advisories | CVE-2018-16252
MD5 | fad943a0c32935b55f0eee3696caaca4
Argus Surveillance DVR 4.0.0.0 SYSTEM Privilege Escalation
Posted Aug 29, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Argus Surveillance DVR version 4.0.0.0 suffers from a SYSTEM privilege escalation vulnerability.

tags | exploit
MD5 | 568a5ca14ccf6b72d34900efe6809bce
Argus Surveillance DVR 4.0.0.0 Directory Traversal
Posted Aug 29, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Argus Surveillance DVR version 4.0.0.0 suffers from file disclosure and traversal vulnerabilities.

tags | exploit, vulnerability
advisories | CVE-2018-15745
MD5 | 236a5ef23b5453a2a50a23ab72a165af
Microsoft DirectX SDK (June 2010) Xact3.exe DLL Hijacking
Posted Aug 11, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

The Microsoft DirectX SDK "Xact3.exe" cross-platform tool allows for arbitrary code execution via a trojan horse file "xbdm.dll" in the current working directory, upon opening a ".xap" project file from the same location.

tags | exploit, arbitrary, trojan, code execution
MD5 | d7f1056ce3aa140ad0e115c7bf50b3c0
Microsoft dnslint.exe DNS Tool Forced Drive-By Download
Posted Jul 20, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Microsoft's dnslint.exe tool does not verify domain names when parsing DNS text-files using the "/ql" switch making it prone to forced drive-by downloads, providing an end user is tricked into using a server text-file containing a script/binary reference instead of a normally expected domain name.

tags | exploit
MD5 | eb14060a0091ba68f6b96c6e9ef2fb25
Microsoft Windows Enterprise Mode Site List 1/2 XML Injection
Posted Jul 16, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Microsoft Windows Enterprise Mode Site List Manager versions 1 and 2 suffer from an XML external entity injection vulnerability.

tags | exploit
systems | windows
MD5 | adb95485a2175dc841aa24d2a530ed72
Microsoft Windows .library-ms Information Disclosure
Posted Jul 16, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Library description files are XML files that define libraries. Libraries aggregate items from local and remote storage locations into a single view in Windows Explorer. Library description files follow the Library Description schema and are saved as *.library-ms files. The .library-ms filetype triggers forced authentication when a user/client accesses a remote share that houses an attacker supplied ".library-ms" file, disclosing credential hashes and other identifiable computer informations.

tags | exploit, remote, local
systems | windows
MD5 | 3efbbbe3394fffedf1bbcf55f304effb
Page 1 of 11
Back12345Next

File Archive:

February 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    22 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    2 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    50 Files
  • 6
    Feb 6th
    24 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    6 Files
  • 9
    Feb 9th
    1 Files
  • 10
    Feb 10th
    1 Files
  • 11
    Feb 11th
    22 Files
  • 12
    Feb 12th
    25 Files
  • 13
    Feb 13th
    16 Files
  • 14
    Feb 14th
    32 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    10 Files
  • 17
    Feb 17th
    2 Files
  • 18
    Feb 18th
    27 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close