all things security
Showing 1 - 22 of 22 RSS Feed

Files from John Leitch

Real NameJohn Leitch
Email addressjohn.leitch5 at gmail.com
Websiteautosectools.com
First Active2014-04-10
Last Active2016-04-11
View User Profile
Perl 5.22 VDir::MapPathA/W Out-Of-Bounds Reads / Buffer Over-Reads
Posted Apr 11, 2016
Authored by John Leitch

Perl version 5.22 suffers from two out-of-bounds reads and multiple small buffer over-read vulnerabilities in the VDir::MapPathA and VDir::MapPathW functions that could potentially be exploited to achieve arbitrary code execution.

tags | exploit, arbitrary, perl, vulnerability, code execution
advisories | CVE-2015-8608
MD5 | 7bd4f274aa06f06b50d992e05391c4ad
SnappingTurtle Web Exploitation Tool 0.1.0411.1609
Posted Apr 11, 2016
Authored by John Leitch

Exploit web applications with SnappingTurtle, a cross-platform tool written in Aphid and compiled into Python. SnappingTurtle can exploit SQL injection, arbitrary upload, local file inclusion, and cross-site scripting.

Changes: Improved PHP shell polymorphism. Multiple reliability improvements for LFI to RCE. Several functional improvements to SQL injection.
tags | tool, web, arbitrary, local, xss, sql injection, python, file inclusion
systems | unix
MD5 | 2be7b508b3f9e65340cbf87c0fa81573
SnappingTurtle: A Web Exploitation Tool
Posted Mar 24, 2016
Authored by John Leitch

This is a cross platform web exploitation tool written in Aphid and compiled into Python. Currently supports exploitation of PHP local file inclusion and SQL injection with more on the way.

tags | tool, web, local, php, sql injection, python, file inclusion
systems | unix
MD5 | 3c787629c70598ece396bcbe1b3e750d
Python 2.7 check_multiply_size() Integer Overflow
Posted Nov 2, 2015
Authored by John Leitch

Several functions within the imageop module are vulnerable to exploitable buffer overflows due to unsafe arithmetic in check_multiply_size(). The problem exists because the check to confirm that size == product / y / x does not take remainders into account.

tags | advisory, overflow
MD5 | c0d5beed5205da28e1e53b71191859e6
Python 2.7 Hotshot pack_string Heap Buffer Overflow
Posted Nov 2, 2015
Authored by John Leitch

Python version 2.7 hotshot module suffers from a heap buffer overflow due to a memcpy in the pack_string function at line 633.

tags | exploit, overflow, python
MD5 | f1c3a22ae9e1578337b2d49d8f157aff
Python 3.6 audioop.lin2adpcm Buffer Over-Read
Posted Nov 2, 2015
Authored by John Leitch

Python versions 2.7 and 3.4 through 3.6 audioop.lin2adpcm function suffers from a buffer over-read caused by unchecked access to stepsizeTable at line 1436 of Modules\audioop.c.

tags | advisory, python
MD5 | 8fd04559881dffdf8c326ab397ef5309
Python 3.6 audioop.adpcm2lin Buffer Over-Read
Posted Nov 2, 2015
Authored by John Leitch

Python versions 2.7 and 3.4 through 3.6 audioop.adpcm2lin function suffers from a buffer over-read caused by unchecked access to stepsizeTable at line 1545 of Modules\audioop.c.

tags | advisory, python
MD5 | 8f7957712172174e8434592d61af6c90
Python 3.5 Bytearray Pop And Remove Buffer Over-Read
Posted Nov 2, 2015
Authored by John Leitch

Python versions 2.7 and 3.2 through 3.5 bytearray pop and remove methods suffer from buffer over-reads caused by memmove use under the assumption that PyByteArrayObject ob_size is less than ob_alloc, leading to a single byte over-read. This condition can be triggered by creating a bytearray from a range of length 0x10, then calling pop with a valid index.

tags | advisory, python
MD5 | d77ffcd44c3ef49ea3629c746de84811
Python 2.7 array.fromstring Use After Free
Posted Nov 2, 2015
Authored by John Leitch

Python 2.7 array.fromstring() method suffers from a use after free caused by unsafe realloc use. The issue is triggered when an array is concatenated to itself via fromstring() call.

tags | exploit, python
MD5 | 25015ebb8a6741931ddef2b587049c0b
Python 2.7 strop.replace() Integer Overflow
Posted Nov 2, 2015
Authored by John Leitch

Python version 2.7 strop.replace() method suffers from an integer overflow that can be exploited to write outside the bounds of the string buffer and potentially achieve code execution. The issue can be triggered by performing a large substitution that overflows the arithmetic used in mymemreplace() to calculate the size of the new string.

tags | exploit, overflow, code execution, python
MD5 | a3589a69b3bfc5feef80c86576cdb315
Python 3.5 product_setstate() Out-Of-Bounds Read
Posted Nov 1, 2015
Authored by John Leitch

Python versions 3.3 through 3.5 suffer from a vulnerability caused by the behavior of the product_setstate() function. When called, the function loops over the state tuple provided and clamps each given index to a value within a range from 0 up to the max number of pools. Then, it loops over the pools and gets an item from the pool using the previously clamped index value. However, for the upper bound, the clamping logic is using the number of pools and not the size of the individual pool, which can result in a call to PyTuple_GET_ITEM that uses an index outside of the bounds of the pool.

tags | exploit, python
MD5 | 538e43e5be1abaf0eff6c2f1f383ca6e
Python 3.5 deque.index() Uninitialized Variable
Posted Nov 1, 2015
Authored by John Leitch

Python version 3.5 suffers from a vulnerability caused by the behavior of the newblock() function used by the collections.deque module. When called, newblock() allocates memory using PyMem_Malloc() and does not initialize it.

tags | advisory, python
MD5 | 7c7ec888f9f01a38753e0a84d3605cd9
Python 3.4 / 3.5 xmlparse_setattro() Type Confusion
Posted Oct 31, 2015
Authored by John Leitch

Python versions 3.4 and 3.5 suffer from a vulnerability caused by the behavior of the xmlparse_setattro() function. When called, the function uses the provided name argument in several conditional statements which assume that the name argument is a string. However, if a name argument is provided that is not a string, this logic will make several calls to PyUnicode_CompareWithASCIIString that expect a string, yet receive some other type of object, leading to a type confusion vulnerability.

tags | exploit, python
MD5 | 70d4f19e98a6ca159c903fd1b9a473ed
Python 3.5 time_strftime() Buffer Over-Read
Posted Oct 31, 2015
Authored by John Leitch

Python 3.5 suffers from a vulnerability caused by the behavior of the time_strftime() function. When called, the function loops over the format string provided, using strchr to search for each instance of '%'. After finding a '%', it continues to search two characters ahead, assuming that each instance is the beginning of a well formed format string token. However, if a string ends with '%', this logic will result in a call to strchr that reads off the end of the format string buffer.

tags | exploit, python
MD5 | 1cdd4118dc2118c4b2c64e9ad882eadb
Python 3.5 scan_eol() Buffer Over-Read
Posted Oct 30, 2015
Authored by John Leitch

Python 3.5 suffers from a vulnerability caused by the behavior of the scan_eol() function. When called, the function gets a line from the buffer of a BytesIO object by searching for a newline character starting at the position in the buffer. However, if the position is set to a value that is larger than the buffer, this logic will result in a call to memchr that reads off the end of the buffer.

tags | exploit, python
MD5 | 515b5867e161a589089030fb49cd7c81
PHP yaml_parse_url Double Free
Posted Oct 30, 2015
Authored by John Leitch

The yaml_* parsing functions suffers from an exploitable double free caused by the error path for the php_var_unserialize() call on line 797 of pecl/file_formats/yaml.git/parse.c.

tags | advisory
MD5 | 6535acd96143e2df25ceaf842dacb743
PHP yaml_parse_url Unsafe Deserialization
Posted Oct 30, 2015
Authored by John Leitch

The PHP unserialize() function is considered unsafe due to its behavior regarding class instantiation; in cases where serialized data is attacker controlled, it can be tampered with, allowing for the instantiation of arbitrary PHP classes and thus code execution via destructor.

tags | advisory, arbitrary, php, code execution
MD5 | dae14b730720b054280ebf01f6da9cb3
PHP 5.5.12 Locale::parseLocale Double Free Memory Corruption
Posted Nov 20, 2014
Authored by John Leitch

PHP version 5.5.12 suffers from a memory corruption vulnerability that could potentially be exploited to achieve remote code execution. The vulnerability exists due to inconsistent behavior in the get_icu_value_internal function of ext\intl\locale\locale_methods.c. In most cases, get_icu_value_internal allocates memory that the caller is expected to free. However, if the first argument, loc_name, satisfies the conditions specified by the isIDPrefix macro (figure 1), and fromParseLocal is true, loc_name itself is returned. If a caller abides by contract and frees the return value of such a call, then the pointer passed via loc_name is freed again elsewhere, a double free occurs.

tags | exploit, remote, php, code execution
systems | linux
MD5 | 323fe84e8c17403ab5d6dfd1e8e10c91
Cogent DataHub Command Injection
Posted Jun 25, 2014
Authored by John Leitch, juan vazquez | Site metasploit.com

This Metasploit module exploits an injection vulnerability in Cogent DataHub prior to 7.3.5. The vulnerability exists in the GetPermissions.asp page, which makes insecure use of the datahub_command function with user controlled data, allowing execution of arbitrary datahub commands and scripts. This Metasploit module has been tested successfully with Cogent DataHub 7.3.4 on Windows 7 SP1.

tags | exploit, arbitrary, asp
systems | windows, 7
advisories | CVE-2014-3789
MD5 | d10aca0d44b8abb4b65c009880426183
Bleed Out Heartbleed Command Line Tool 1.0.1.46
Posted Apr 23, 2014
Authored by John Leitch

Bleed Out is a command line tool written in C# for targeting instances of OpenSSL made vulnerable by the prolific "Heartbleed" bug. The tool aggressively exploits the OpenSSL vulnerability, dumping both ASCII and binary data to files. It also checks the uniqueness of each chunk before persisting it, to ensure that duplicate chunks are not saved.

Changes: Added probe option. Fixed binary dump bug that caused data to be overwritten. Removed hardcoded binary blobs and added proper TLS support. Structure positions and field values within packets are now randomized, making detection more difficult. Decreased TCP send/receive timeout.
tags | exploit
advisories | CVE-2014-0160
MD5 | 2c0031e8706a254fb04809cf40633993
Bleed Out Heartbleed Command Line Tool 1.0.0.10
Posted Apr 10, 2014
Authored by John Leitch

Bleed Out is a command line tool written in C# for targeting instances of OpenSSL made vulnerable by the prolific "Heartbleed" bug. The tool aggressively exploits the OpenSSL vulnerability, dumping both ASCII and binary data to files. It also checks the uniqueness of each chunk before persisting it, to ensure that duplicate chunks are not saved.

Changes: Fixed exploitability test. Fixed argument validation. Fixed port exhaustion issue. Misc fixes. Minor CLI tweaks. Improved string searching. Added args for configuring retry. Changed target framework to .NET 4 for XP compatibility.
tags | exploit
advisories | CVE-2014-0160
MD5 | 556bee55b098ed777aa41261833a26a6
Bleed Out Heartbleed Command Line Tool 1.0.0.0
Posted Apr 10, 2014
Authored by John Leitch

Bleed Out is a command line tool written in C# for targeting instances of OpenSSL made vulnerable by the prolific "Heartbleed" bug. The tool aggressively exploits the OpenSSL vulnerability, dumping both ASCII and binary data to files. It also checks the uniqueness of each chunk before persisting it, to ensure that duplicate chunks are not saved.

tags | exploit
advisories | CVE-2014-0160
MD5 | 8d7cd7939ece8eec8251fa06723c752d
Page 1 of 1
Back1Next

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    8 Files
  • 20
    Oct 20th
    7 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close