Email address | private |
---|---|
First Active | 2012-01-02 |
Last Active | 2018-04-26 |
This Metasploit module exploits a Drupal property injection in the Forms API. Drupal versions 6.x, less than 7.58, 8.2.x, less than 8.3.9, less than 8.4.6, and less than 8.5.1 are vulnerable.
d8e06fe66e7a7c70257d472a150741719f1392fb6c548c25bee9d61d4f3a78cd
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016. Original exploit by Zhiniang Peng and Chen Wu.
dd14beacc3e87b7064dc160534d469a79690ec06c3cb5fdddd8acbce04733db8
This Metasploit module will generate a plugin, pack the payload into it and upload it to a server running Piwik. Superuser Credentials are required to run this module. This Metasploit module does not work against Piwik 1 as there is no option to upload custom plugins. Tested with Piwik 2.14.0, 2.16.0, 2.17.1 and 3.0.1.
71146a4e8085f48e4ba2d27e1f4312199e856feabcaf67fd03fb8887053cef9c
This exploit uses the pokemon exploit as a base and automatically generates a new passwd line. The original /etc/passwd is then backed up to /tmp/passwd.bak and overwritten with the new line. The user will be prompted for the new password when the binary is run. After running the exploit you should be able to login with the newly created user.
302fbe1148d6c5d32476fb30dc9d34045ceec15d40ea123d00c14f4b7996e6b7
WordPress version 3.5 has the XML-RPC interface enabled by default. This tool uses the Pingback API to perform portscanning.
4e148f46aa9ea85dd8ac723066ebdb2a21047032dde632464b55d619c9359123
HashCollision denial of service proof of concept exploit written in Python. It generates the payload on the fly and sends it to the server.
01da1f50ab5e7ffaf8680f1bf9bdef32b70eecac7583949ac5a2e2840b4e971a
HashCollision denial of service proof of concept exploit written in Python. It generates the payload on the fly and sends it to the server.
9ea223d1751dc755d5ba16393c4065f1bda060687cfe5211724fcb29a994c2c5
PHP 5.3.x hash collision denial of service proof of concept exploit written in Python. It generates the payload on the fly and sends it to the server.
a40ed8e7683bd70412b64514013eea3551071db4f39c244052a9d36f89460954