Exploit the possiblities
Showing 1 - 25 of 63 RSS Feed

Operating System: Windows Vista

HP Data Protector Encrypted Communication Remote Command Execution
Posted Jun 7, 2016
Authored by Ian Lovering, Jon Barg | Site metasploit.com

This Metasploit module exploits a well known remote code execution exploit after establishing encrypted control communications with a Data Protector agent. This allows exploitation of Data Protector agents that have been configured to only use encrypted control communications. This exploit works by executing the payload with Microsoft PowerShell so will only work against Windows Vista or newer. Tested against Data Protector 9.0 installed on Windows Server 2008 R2.

tags | exploit, remote, code execution
systems | windows, vista
advisories | CVE-2016-2004
MD5 | b07495ea7e4c584173df19bfad7af491
.NET Framework 4.6 DLL Hijacking
Posted Apr 12, 2016
Authored by Yorick Koster, Securify B.V.

A DLL side loading vulnerability was found in the .NET Framework version 4.6 when running on Windows Vista or Windows 7. This issue can be exploited by luring a victim into opening an Office document from the attacker's share. An attacker can use this issue to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system. If the WebDAV Mini-Redirector is enabled, it is possible to exploit this issue over the internet. This issue can be exploited even if the Office document is opened in Protected View.

tags | advisory, arbitrary
systems | windows, vista, 7
advisories | CVE-2016-0148
MD5 | 9d6218459b0672ff015bd46081a7d5cd
BDA MPEG2 Transport Information Filter DLL Hijacking
Posted Feb 11, 2016
Authored by Yorick Koster, Securify B.V.

A DLL side loading vulnerability was found in the BDA MPEG2 Transport Information Filter that ships with Windows Vista. This issue can be exploited by loading the filter as an embedded OLE object. When instantiating the object Windows will try to load the DLL ehTrace.dll from the current working directory. If an attacker convinces the user to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system.

tags | advisory, arbitrary
systems | windows, vista
advisories | CVE-2016-0041
MD5 | 03d0994a8891ad04f91944e661be197c
NPS Datastore Server DLL Hijacking
Posted Feb 11, 2016
Authored by Yorick Koster, Securify B.V.

A DLL side loading vulnerability was found in the NPS Datastore server DLL that ships with Windows Vista. This issue can be exploited by loading the affected DLL as an embedded OLE object. When instantiating the object Windows will try to load the DLL iasdatastore2.dll from the current working directory. If an attacker convinces the user to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system.

tags | advisory, arbitrary
systems | windows, vista
advisories | CVE-2016-0041
MD5 | 170d90f9095d8cc1c7d35ab9cd4b5937
MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python
Posted Nov 14, 2014
Authored by Haifei Li, sinn3r, juan vazquez | Site metasploit.com

This Metasploit module exploits a vulnerability found in Windows Object Linking and Embedding (OLE) allowing arbitrary code execution, bypassing the patch MS14-060, for the vulnerability publicly known as "Sandworm", on systems with Python for Windows installed. Windows Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be vulnerable. However, based on our testing, the most reliable setup is on Windows platforms running Office 2013 and Office 2010 SP2. Please keep in mind that some other setups such as those using Office 2010 SP1 may be less stable, and may end up with a crash due to a failure in the CPackage::CreateTempFileName function.

tags | exploit, arbitrary, code execution, python
systems | windows, vista
advisories | CVE-2014-6352
MD5 | fe028a266ecc2e632fcaf3aa8b0dd614
MS14-064 Microsoft Windows OLE Package Manager Code Execution
Posted Nov 13, 2014
Authored by Haifei Li, sinn3r, juan vazquez | Site metasploit.com

This Metasploit module exploits a vulnerability found in Windows Object Linking and Embedding (OLE) allowing arbitrary code execution, publicly exploited in the wild as MS14-060 patch bypass. The Microsoft update tried to fix the vulnerability publicly known as "Sandworm". Platforms such as Windows Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be vulnerable. However, based on our testing, the most reliable setup is on Windows platforms running Office 2013 and Office 2010 SP2. And please keep in mind that some other setups such as using Office 2010 SP1 might be less stable, and sometimes may end up with a crash due to a failure in the CPackage::CreateTempFileName function.

tags | exploit, arbitrary, code execution
systems | windows, vista
advisories | CVE-2014-6352
MD5 | 287aac6ebe839f0d40b82e5df2f514da
MS14-060 Microsoft Windows OLE Package Manager Code Execution
Posted Oct 18, 2014
Authored by sinn3r, juan vazquez, temp66 | Site metasploit.com

This Metasploit module exploits a vulnerability found in Windows Object Linking and Embedding (OLE) allowing arbitrary code execution, publicly known as "Sandworm". Platforms such as Windows Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be vulnerable.

tags | exploit, arbitrary, code execution
systems | windows, vista
advisories | CVE-2014-4114
MD5 | 54a27b76276520aaeb0364e75244fd14
SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write
Posted Mar 6, 2014
Authored by Brendan Coles, Mohamed Shetta | Site metasploit.com

This Metasploit module exploits a remote arbitrary file write vulnerability in SolidWorks Workgroup PDM 2014 SP2 and prior. For targets running Windows Vista or newer the payload is written to the startup folder for all users and executed upon next user logon. For targets before Windows Vista code execution can be achieved by first uploading the payload as an exe file, and then upload another mof file, which schedules WMI to execute the uploaded payload. This Metasploit module has been tested successfully on SolidWorks Workgroup PDM 2011 SP0 on Windows XP SP3 (EN) and Windows 7 SP1 (EN).

tags | exploit, remote, arbitrary, code execution
systems | windows, xp, vista, 7
MD5 | 616b6529ac383dc0589643283677afc7
HP LoadRunner lrFileIOService ActiveX WriteFileString Remote Code Execution
Posted Sep 4, 2013
Authored by juan vazquez, Brian Gorenc | Site metasploit.com

This Metasploit module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileString method, which allow the user to write arbitrary files. It's abused to drop a payload embedded in a dll, which is later loaded through the Init() method from the lrMdrvService control, by abusing an insecure LoadLibrary call. This Metasploit module has been tested successfully on IE8 on Windows XP. Virtualization based on the Low Integrity Process, on Windows Vista and 7, will stop this module because the DLL will be dropped to a virtualized folder, which isn't used by LoadLibrary.

tags | exploit, arbitrary, activex
systems | windows, xp, vista
advisories | CVE-2013-4798, OSVDB-95642
MD5 | 5f7630ca27a1c56598761f3e375ec40d
MS13-005 HWND_BROADCAST Low to Medium Integrity Privilege Escalation
Posted Jul 29, 2013
Authored by Tavis Ormandy, Axel Souchet | Site metasploit.com

The Windows kernel does not properly isolate broadcast messages from low integrity applications from medium or high integrity applications. This allows commands to be broadcasted to an open medium or high integrity command prompts allowing escalation of privileges. We can spawn a medium integrity command prompt, after spawning a low integrity command prompt, by using the Win+Shift+# combination to specify the position of the command prompt on the taskbar. We can then broadcast our command and hope that the user is away and doesn't corrupt it by interacting with the UI. Broadcast issue affects versions Windows Vista, 7, 8, Server 2008, Server 2008 R2, Server 2012, RT. But Spawning a command prompt with the shortcut key does not work in Vista so you will have to check if the user is already running a command prompt and set SPAWN_PROMPT false. The WEB technique will execute a powershell encoded payload from a Web location. The FILE technique will drop an executable to the file system, set it to medium integrity and execute it. The TYPE technique will attempt to execute a powershell encoded payload directly from the command line but it may take some time to complete.

tags | exploit, web, kernel
systems | windows, vista
advisories | CVE-2013-0008, OSVDB-88966
MD5 | bf765133ef2a04116cd29a63ed9e4763
Meterpreter Swaparoo Windows Backdoor Method
Posted May 20, 2013
Authored by Un0wn_X

Swaparoo - Windows backdoor method for Windows Vista/7/8. This code sneaks a backdoor command shell in place of Sticky Keys prompt or Utilman assistant at login screen.

tags | shell
systems | windows, vista
MD5 | 5ba973630c7fefa07216d9a81e22f571
NTR ActiveX Control Check() Method Buffer Overflow
Posted Sep 22, 2012
Authored by Carsten Eiram, juan vazquez | Site metasploit.com

This Metasploit module exploits a vulnerability found in NTR ActiveX 1.1.8. The vulnerability exists in the Check() method, due to the insecure usage of strcat to build a URL using the bstrParams parameter contents, which leads to code execution under the context of the user visiting a malicious web page. In order to bypass DEP and ASLR on Windows Vista and Windows 7 JRE 6 is needed.

tags | exploit, web, code execution, activex
systems | windows, vista, 7
advisories | CVE-2012-0266, OSVDB-78252
MD5 | d9429e02b0749c6070e28df7c47954a1
Internet Explorer Script Interjection Code Execution
Posted Sep 7, 2012
Authored by Derek Soeder

The vulnerability described in this document can be exploited by a malicious Web page to execute arbitrary code with low integrity. Active scripting must be enabled, and the present exploitation techniques require that font downloading be set to "Enable" or "Prompt" and that the "mailto:" protocol be present. (These requirements are satisfied by default on Windows XP, Windows Vista, and Windows 7.) The user is presented with a message box which must be dismissed before code execution can occur.

tags | advisory, web, arbitrary, code execution, protocol
systems | windows, xp, vista, 7
MD5 | 29f0774b1970da1d137c7138635a612d
Internet Explorer Script Interjection Code Execution
Posted Aug 17, 2012
Authored by Derek Soeder

The vulnerability described in this document can be exploited by a malicious Web page to execute arbitrary code with low integrity. Active scripting must be enabled, and the present exploitation techniques require that font downloading be set to "Enable" or "Prompt" and that the "mailto:" protocol be present. (These requirements are satisfied by default on Windows XP, Windows Vista, and Windows 7.) The user is presented with a message box which must be dismissed before code execution can occur.

tags | advisory, web, arbitrary, code execution, protocol
systems | windows, xp, vista, 7
MD5 | 2bb799fb1562340d2c8f75004b44d362
Mandriva Linux Security Advisory 2012-081
Posted May 24, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-081 - Security issues were identified and fixed in mozilla firefox. Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Using the Address Sanitizer tool, security researcher Aki Helin from OUSPG found that IDBKeyRange of indexedDB remains in the XPConnect hashtable instead of being unlinked before being destroyed. Security research firm iDefense reported that researcher wushi of team509 discovered a memory corruption on Windows Vista and Windows 7 systems with hardware acceleration disabled or using incompatible video drivers. Various other issues have also been addressed.

tags | advisory
systems | linux, windows, mandriva, vista, 7
advisories | CVE-2012-0468, CVE-2012-0467, CVE-2012-0469, CVE-2012-0470, CVE-2012-0471, CVE-2012-0472, CVE-2012-0473, CVE-2012-0474, CVE-2012-0477, CVE-2012-0478, CVE-2011-3062, CVE-2012-0479
MD5 | 1b834a8034e8e9eb2a5c612ce032d3ce
Quest InTrust Annotation Objects Uninitialized Pointer
Posted Apr 13, 2012
Authored by rgod, mr_me | Site metasploit.com

This Metasploit module exploits an uninitialized variable vulnerability in the Annotation Objects ActiveX component. The activeX component loads into memory without opting into ALSR so this module exploits the vulnerability against windows Vista and Windows 7 targets. A large heap spray is required to fulfill the requirement that EAX points to part of the ROP chain in a heap chunk and the calculated call will hit the pivot in a separate heap chunk. This will take some time in the users browser.

tags | exploit, activex
systems | windows, vista, 7
advisories | OSVDB-80662
MD5 | a673fc29a3cf976653bc571ec7e98a0f
CCMPlayer 1.5 Stack Buffer Overflow
Posted Dec 3, 2011
Authored by Rh0 | Site metasploit.com

This Metasploit module exploits a stack based buffer overflow in CCMPlayer 1.5. Opening a m3u playlist with a long track name, a SEH exception record can be overwritten with parts of the controllable buffer. SEH execution is triggered after an invalid read of an injectable address, thus allowing arbitrary code execution. This Metasploit module works on multiple Windows platforms including: Windows XP SP3, Windows Vista, and Windows 7.

tags | exploit, overflow, arbitrary, code execution
systems | windows, xp, vista, 7
advisories | OSVDB-77453
MD5 | 3aae8f1a871387793558f0a991da878c
ACDSee FotoSlate PLP File id Parameter Overflow
Posted Oct 10, 2011
Authored by Parvez Anwar, juan vazquez | Site metasploit.com

This Metasploit module exploits a buffer overflow in ACDSee FotoSlate 4.0 Build 146 via a specially crafted id parameter in a String element. When viewing a malicious PLP file with the ACDSee FotoSlate product, a remote attacker could overflow a buffer and execute arbitrary code. This exploit has been tested on systems such as Windows XP SP3, Windows Vista, and Windows 7.

tags | exploit, remote, overflow, arbitrary
systems | windows, xp, vista, 7
advisories | CVE-2011-2595, OSVDB-75425
MD5 | dc97219886104e2e0f19efe547d104d7
DVD X Player 5.5 .plf PlayList Buffer Overflow
Posted Sep 2, 2011
Authored by n00b, sinn3r, sickness | Site metasploit.com

This Metasploit module exploits a stack-based buffer overflow on DVD X Player 5.5 Pro and Standard. By supplying a long string of data in a plf file (playlist), the MediaPlayerCtrl.dll component will attempt to extract a filename out of the string, and then copy it on the stack without any proper bounds checking, which causes a buffer overflow, and results arbitrary code execution under the context of the user. This Metasploit module has been designed to target common Windows systems such as: Windows XP SP2/SP3, Windows Vista, and Windows 7.

tags | exploit, overflow, arbitrary, code execution
systems | windows, xp, vista, 7
advisories | CVE-2007-3068, OSVDB-36956
MD5 | 8d32c2e58191795b07f93bda0d49f7d6
Microsoft Windows Vista/Server 2008 nsiproxy.sys Denial Of Service
Posted May 18, 2011
Authored by Lufeng Li

Microsoft Windows Vista/Server 2008 nsiproxy.sys local kernel denial of service exploit.

tags | exploit, denial of service, kernel, local
systems | windows, vista
MD5 | 68def17344cd2acbddce0e4ca5f238c7
Microsoft Windows OpenType CFF Driver Stack Overflow
Posted Apr 15, 2011
Authored by Sebastien Renaud, VUPEN | Site vupen.com

The VUPEN Vulnerability Research Team discovered a critical vulnerability in Microsoft Windows. The vulnerability is caused by a stack overflow error in the OpenType Compact Font Format (CFF) driver "ATMFD.dll" when processing certain operands within an OpenType font, which could be exploited by remote attackers to execute arbitrary code on a vulnerable Windows 7, Windows Server 2008, Windows Server 2008 R2, and Windows Vista systems via a malicious font, or by local attackers to gain elevated privileges on Windows XP and Windows Server 2003 systems via a malicious application.

tags | advisory, remote, overflow, arbitrary, local
systems | windows, xp, vista, 7
advisories | CVE-2011-0034
MD5 | 92cd55b8fe079cfffb6a7e5cdceb2fb1
Windows Vista/7 UAC Bypass Exploit
Posted Nov 24, 2010
Authored by noobpwnftw

Microsoft Windows Vista / 7 privilege escalation exploit that has UAC bypass.

tags | exploit
systems | windows, vista
MD5 | c47d612c00713e5ff16a5e3db8da5ad9
Windows Vista/7 lpksetup.exe DLL Hijacking
Posted Oct 27, 2010
Authored by TurboBorland

Microsoft Windows Vista/7 suffers from a DLL hijacking vulnerability in lpksetup.exe.

tags | exploit
systems | windows, vista
MD5 | 7e4c34d2de94b275886a6a3f08e0c3f5
NtUserCheckAccessForIntegrityLevel Use-After-Free Vulnerability
Posted Jul 2, 2010
Authored by MSRC

Microsoft Windows Vista / Server 2008 suffer from a NtUserCheckAccessForIntegrityLevel use-after-free vulnerability.

tags | exploit
systems | windows, vista
MD5 | fdba133e4a620dc779f96bacc2564474
Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow
Posted May 14, 2010
Authored by Snake, SkD | Site metasploit.com

This Metasploit module exploits a stack buffer overflow vulnerability in the handling of the TextBytesAtom records by Microsoft PowerPoint Viewer. According to Microsoft, the PowerPoint Viewer distributed with Office 2003 SP3 and earlier, as well as Office 2004 for Mac, are vulnerable. NOTE: The vulnerable code path is not reachable on versions of Windows prior to Windows Vista.

tags | exploit, overflow
systems | windows, vista
advisories | CVE-2010-0033
MD5 | 7bb93b9e40ea4005796927bb1b961a45
Page 1 of 3
Back123Next

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    19 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close