exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 26 - 50 of 96 RSS Feed

Files

Milton Webdav 2.7.0.1 XXE Injection
Posted Nov 2, 2015
Authored by Mikhail Egorov

Milton Webdav version 2.7.0.1 suffers from an XXE injection vulnerability.

tags | exploit, xxe
advisories | CVE-2015-7326
SHA-256 | 46b29fcbd281a787022982aa5892c003ff7312833ef3f70e1d8febb584ffcc1a

Related Files

Sun Java Web Start Double Quote Injection
Posted Jun 13, 2013
Authored by Rh0 | Site metasploit.com

This Metasploit module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. Parameters intial-heap-size and max-heap-size in a JNLP file can contain a double quote which is not properly sanitized when creating the command line for javaw.exe. This allows the injection of the -XXaltjvm option to load a jvm.dll from a remote UNC path into the java process. Thus an attacker can execute arbitrary code in the context of a browser user. This flaw was fixed in Oct. 2012 and affects JRE <= 1.6.35 and <= 1.7.07. In order for this module to work, it must be ran as root on a server that does not serve SMB. Additionally, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. Alternatively an UNC path containing a jvm.dll can be specified with an own SMB server.

tags | exploit, java, remote, web, arbitrary, root
advisories | CVE-2012-1533, OSVDB-86348
SHA-256 | 03e81d85cf7b77c63f98b9875e24d7c92e3dd03261f33f78773cc25fedd945f5
Sun Java Web Start Double Quote Injection
Posted Jun 10, 2013
Authored by Rh0 | Site metasploit.com

This Metasploit module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. Parameters intial-heap-size and max-heap-size in a JNLP file can contain a double quote which is not properly sanitized when creating the command line for javaw.exe. This allows the injection of the -XXaltjvm option to load a jvm.dll from a remote UNC path into the java process. Thus an attacker can execute arbitrary code in the context of a browser user. This flaw was fixed in Oct. 2012 and affects JRE <= 1.6.35 and <= 1.7.07. In order for this module to work, it must be ran as root on a server that does not serve SMB. Additionally, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. Alternatively an UNC path containing a jvm.dll can be specified with an own SMB server.

tags | exploit, java, remote, web, arbitrary, root
advisories | CVE-2012-1533
SHA-256 | 7c4106b8276c9c6b588b2cdcba693eefaab7d0e2605a82a0728828840ed79442
Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution
Posted Jun 2, 2013
Authored by rgod, juan vazquez | Site metasploit.com

This Metasploit modules exploits a vulnerability found in the Oracle WebCenter Content CheckOutAndOpenControl ActiveX. This vulnerability exists in openWebdav(), where user controlled input is used to call ShellExecuteExW(). This Metasploit module abuses the control to execute an arbitrary HTA from a remote location. This Metasploit module has been tested successfully with the CheckOutAndOpenControl ActiveX installed with Oracle WebCenter Content 11.1.1.6.0.

tags | exploit, remote, arbitrary, activex
advisories | CVE-2013-1559, OSVDB-92386
SHA-256 | b0e1c2b4d5000f5d54ab03faad81b1e6f76cdaf93878521b78deb176531d5582
Red Hat Security Advisory 2013-0131-01
Posted Jan 8, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0131-01 - The gnome-vfs2 packages provide the GNOME Virtual File System, which is the foundation of the Nautilus file manager. neon is an HTTP and WebDAV client library embedded in the gnome-vfs2 packages. A denial of service flaw was found in the neon Extensible Markup Language parser. Visiting a malicious DAV server with an application using gnome-vfs2 could possibly cause the application to consume an excessive amount of CPU and memory.

tags | advisory, web, denial of service
systems | linux, redhat
advisories | CVE-2009-2473
SHA-256 | 3c057a76e0d6c5aba4fb9501b417669da14d9d512290ed6a069391e767f2a71d
IBM System Director Agent DLL Injection
Posted Dec 7, 2012
Authored by Kingcope, Bernhard Mueller, juan vazquez | Site metasploit.com

This Metasploit module abuses the "wmicimsv" service on IBM System Director Agent 5.20.3 to accomplish arbitrary DLL injection and execute arbitrary code with SYSTEM privileges. In order to accomplish remote DLL injection it uses a WebDAV service as disclosed by kingcope on December 2012. Because of this, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3, but disabled by default on Windows 2003 SP2.

tags | exploit, remote, arbitrary
systems | windows
advisories | CVE-2009-0880, OSVDB-52616, OSVDB-88102
SHA-256 | 57ad1d7f1d323cfb6acd126a3292c26cbc21aecfac9b4ae0aa47d8c45a07aaad
IBM System Director Remote DLL Load
Posted Dec 3, 2012
Authored by Kingcope

By sending a specially crafted request to a vulnerable IBM System Director sever, an attacker can force it to load a DLL remotely from a WebDAV share. Versions 5.20.3 and below are vulnerable.

tags | exploit
advisories | CVE-2009-0880
SHA-256 | 5b0844509e5300f20406447ea01c59ffdb5453dd39d48137328aaef28c1026af
KeyHelp ActiveX LaunchTriPane Remote Code Execution
Posted Oct 11, 2012
Authored by rgod, juan vazquez | Site metasploit.com

This Metasploit module exploits a code execution vulnerability in the KeyScript ActiveX control from keyhelp.ocx. It is packaged in several products or GE, such as Proficy Historian 4.5, 4.0, 3.5, and 3.1, Proficy HMI/SCADA 5.1 and 5.0, Proficy Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Driver between 7.20 and 7.42. When the control is installed with these products, the function "LaunchTriPane" will use ShellExecute to launch "hh.exe", with user controlled data as parameters. Because of this, the "-decompile" option can be abused to write arbitrary files on the remote system. Code execution can be achieved by first uploading the payload to the remote machine, and then upload another mof file, which enables Windows Management Instrumentation service to execute it. Please note that this module currently only works for Windows before Vista. On the other hand, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3

tags | exploit, remote, arbitrary, code execution, activex
systems | windows
advisories | CVE-2012-2516, OSVDB-83311
SHA-256 | ddfde3a6cd95fb91cc1c6b3a0ce469bb1d439179f47acc6c7c8348a5fef601f0
AP NetWeaver HostControl Command Injection
Posted Aug 30, 2012
Authored by Michael Jordon, juan vazquez | Site metasploit.com

This Metasploit module exploits a command injection vulnerability in the SAPHostControl Service, by sending a specially crafted SOAP request to the management console. In order to deal with the spaces and length limitations, a WebDAV service is created to run an arbitrary payload when accessed as a UNC path. Because of this, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3, but disabled by default on Windows 2003 SP2.

tags | exploit, arbitrary
systems | windows
advisories | OSVDB-84821
SHA-256 | 4e670b1726c47184e28c99e0f1609238c9d24b4114df6fa4e834cfd4001f7777
Ubisoft uplay 2.0.3 Active X Control Arbitrary Code Execution
Posted Aug 7, 2012
Authored by Tavis Ormandy, Richard Hicks, phillips321, Ben Campbell | Site metasploit.com

The uplay ActiveX component allows an attacker to execute any command line action. User must sign in, unless auto-sign in is enabled and uplay is not already running. Due to the way the malicious executable is served (WebDAV), the module must be run on port 80, so please ensure you have proper privileges. Ubisoft released patch 2.04 as of Mon 20th July.

tags | exploit, activex
advisories | OSVDB-84402
SHA-256 | b06a8a97e093f62b1f9d8ff1ae71702688d1cb47e94160036dd253ab69142e43
Liferay 6.0.5 ce WebDAV File Reading
Posted Apr 21, 2012
Authored by Jelmer Kuperus

By creating a specially crafted webdav request that contains an external entity it is possible to read files from Liferay Portal version 6.0.5 ce. Proof of concept code included.

tags | exploit, proof of concept
systems | linux
SHA-256 | 3cd00ba5d2fefa08a9eafaa941c8ee4bdbf23dae39cb2ccf5da00cbf88d064e4
Sun Java Web Start Plugin Command Line Argument Injection (2012)
Posted Feb 24, 2012
Authored by jduck | Site metasploit.com

This Metasploit module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. The arguments passed to Java Web Start are not properly validated, allowing injection of arbitrary arguments to the JVM. By utilizing the lesser known -J option, an attacker can take advantage of the -XXaltjvm option, as discussed previously by Ruben Santamarta. This method allows an attacker to execute arbitrary code in the context of an unsuspecting browser user. In order for this module to work, it must be ran as root on a server that does not serve SMB. Additionally, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled.

tags | exploit, java, web, arbitrary, root
advisories | CVE-2012-0500, OSVDB-79227
SHA-256 | 81161207244c8e7484b4277932284c0018d20eb38ceb3a2c62bd1e994ede6a05
SciTools Understand 2.6 DLL Loading Code Execution
Posted Feb 8, 2012
Authored by LiquidWorm | Site zeroscience.mk

A vulnerability in SciTools Understand version 2.6 is caused due to the application loading libraries (wintab32.dll) in an insecure manner. This can be exploited to load arbitrary libraries by tricking a user into opening an Understand Project file (.UDB) located on a remote WebDAV or SMB share.

tags | exploit, remote, arbitrary
SHA-256 | 5cda689106931a122f885350c46515532ff0a47fdb0e7ef0f9f15038b40dc6e7
XAMPP WebDAV PHP Upload
Posted Jan 6, 2012
Site metasploit.com

This Metasploit module exploits weak WebDAV passwords on XAMPP servers. It uses supplied credentials to upload a PHP payload and execute it.

tags | exploit, php
SHA-256 | 266b96091c73fa65688997de64ad65104556726a23ade7379e1e3b33659a86e7
Exploit WebDAV... The Garage Way
Posted Dec 26, 2011
Authored by Dhiraj Datar

This is a brief whitepaper discussing how to exploit a webDAV enabled server.

tags | paper
SHA-256 | a83e8be5f3033d52a2124e642c22eef3daba9c97b7e1e1ccfcd667ad9b5499e4
Apple Safari file:// Arbitrary Code Execution
Posted Oct 17, 2011
Authored by sinn3r, Aaron Sigel | Site metasploit.com

This Metasploit module exploits a vulnerability found in Apple Safari on OSX platform. A policy issue in the handling of file:// URLs may allow arbitrary remote code execution under the context of the user. In order to trigger arbitrary remote code execution, the best way seems to be opening a share on the victim machine first (this can be SMB/WebDav/FTP, or a fileformat that OSX might automount), and then execute it in /Volumes/[share]. If there's some kind of bug that leaks the victim machine's current username, then it's also possible to execute the payload in /Users/[username]/Downloads/, or else bruteforce your way to getting that information. Please note that non-java payloads (*.sh extension) might get launched by Xcode instead of executing it, in that case please try the Java ones instead.

tags | exploit, java, remote, arbitrary, code execution
systems | apple
advisories | CVE-2011-3230
SHA-256 | 813e7b6681dffdbb170749ba71603be94be65c52baeeeffe39b6f94697d09ec4
Devilzc0de E-Zine #3
Posted Sep 14, 2011
Authored by tempe_mendoan

Devilzc0de E-Zine Volume #3 - Topics include Hacktivism and Generation X, Cyberpunk or Mercenaries, WebDAV Vulnerability Exploitation, and more. Written in Indonesian.

tags | magazine
SHA-256 | 9adf7063abb50280f393b167258e6cc3ba1406211cdf116d4907e9165fc07270
Ubuntu Security Notice USN-1144-1
Posted Jun 7, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1144-1 - Joe Schaefer discovered that the Subversion mod_dav_svn module for Apache did not properly handle certain baselined WebDAV resource requests. A remote attacker could use this flaw to cause the service to crash, leading to a denial of service. Ivan Zhakov discovered that the Subversion mod_dav_svn module for Apache did not properly handle certain requests. A remote attacker could use this flaw to cause the service to consume all available resources, leading to a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service
systems | linux, ubuntu
advisories | CVE-2011-1752, CVE-2011-1783, CVE-2011-1921
SHA-256 | dc4f540e7ee2341aac8668b2ed2bf1bf6b9d56d947a475c7968ae45cb6f86b67
Mandriva Linux Security Advisory 2011-106
Posted Jun 4, 2011
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-106 - The mod_dav_svn Apache HTTPD server module will dereference a NULL pointer if asked to deliver baselined WebDAV resources which can lead to a denial of service. The mod_dav_svn Apache HTTPD server module may in certain scenarios enter a logic loop which does not exit and which allocates emory in each iteration, ultimately exhausting all the available emory on the server which can lead to a denial of service. The mod_dav_svn Apache HTTPD server module may leak to remote users the file contents of files configured to be unreadable by those users.

tags | advisory, remote, denial of service
systems | linux, mandriva
advisories | CVE-2011-1752, CVE-2011-1783, CVE-2011-1921
SHA-256 | db5fe256ef577b1b631f68ced08339d66969930e81aff27ca5f3917b3f80347a
Secunia Security Advisory 43571
Posted Mar 25, 2011
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Debian has issued an update for pywebdav. This fixes a vulnerability, which can be exploited by malicious people to conduct SQL injection attacks.

tags | advisory, sql injection
systems | linux, debian
SHA-256 | 8d38d533407bad97f3ba59677b323427ffaa25364ae04c4a17102adb18633657
Secunia Security Advisory 43703
Posted Mar 11, 2011
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Fedora has issued an update for pywebdav. This fixes a vulnerability, which can be exploited by malicious people to conduct SQL injection attacks.

tags | advisory, sql injection
systems | linux, fedora
SHA-256 | e9c9f41f5f043c918b6c8ad0868d9445b5f1562fa47dd9b7089476fc1dda257e
Secunia Security Advisory 43602
Posted Mar 3, 2011
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A vulnerability has been reported in PyWebDAV, which can be exploited by malicious people to conduct SQL injection attacks.

tags | advisory, sql injection
SHA-256 | 319edc8865f0d249330b495ac3a35d256655b7d99780656c7d5836553958f6e4
Debian Security Advisory 2177-1
Posted Mar 2, 2011
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2177-1 - It was discovered that python-webdav, a WebDAV server implementation, contains several SQL injection vulnerabilities in the processing of user credentials.

tags | advisory, vulnerability, sql injection, python
systems | linux, debian
advisories | CVE-2011-0432
SHA-256 | ddd84c50361e28bec8d106c67025dcf746e93c18608edeca8477b57fc2898d93
Mandriva Linux Security Advisory 2011-033
Posted Feb 21, 2011
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-033 - awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a WebDAV server or NFS server. Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin directory. The updated packages have been upgraded to the latest version to address these vulnerabilities.

tags | advisory, remote, arbitrary, cgi, vulnerability
systems | linux, mandriva
advisories | CVE-2010-4367, CVE-2010-4369
SHA-256 | 9e4e32cce97beecc5b78553696c4f168221c75fb1d97782e6b9b984727fb3ed4
Microsoft Windows Shell Graphics biCompression Buffer Overflow
Posted Feb 14, 2011
Authored by Nicolas Joly, VUPEN | Site vupen.com

VUPEN Vulnerability Research Team discovered a critical vulnerability in Microsoft Windows. The vulnerability is caused by a buffer overflow error in the Windows Shell graphics processor when parsing the "biCompression" value within BMP images, which could be exploited by remote attackers to compromise a vulnerable system by tricking a user into opening or previewing a malformed Office file or browsing to a network share, UNC, or WebDAV location containing a specially crafted image.

tags | advisory, remote, overflow, shell
systems | windows
SHA-256 | e45dd38c15740c3e6e5ddc9d40c8fcbd4f3bb920137a89049bbe72c5ba971917
Microsoft Windows Shell Graphics BMP "height" Integer Overflow
Posted Feb 14, 2011
Authored by Nicolas Joly, VUPEN | Site vupen.com

VUPEN Vulnerability Research Team discovered a critical vulnerability in Microsoft Windows. The vulnerability is caused by an integer overflow error in the Windows Shell graphics processor when parsing the "height" value within BMP images, which could be exploited by remote attackers to compromise a vulnerable system by tricking a user into opening or previewing a malformed Office file or browsing to a network share, UNC, or WebDAV location containing a specially crafted image.

tags | advisory, remote, overflow, shell
systems | windows
SHA-256 | 9a72023ae91a8044eca541def5bf1939d6dd53c305c5ed8be72523cab22c8350
Page 2 of 4
Back1234Next

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close