This Metasploit module exploits sendmail's well-known historical debug mode to escape to a shell and execute commands in the SMTP RCPT TO command. This vulnerability was exploited by the Morris worm in 1988-11-02. Cliff Stoll reports on the worm in the epilogue of The Cuckoo's Egg. Currently only cmd/unix/reverse and cmd/unix/generic are supported.
916044331d126eab8e387612884dc927This Metasploit module exploits a stack buffer overflow in fingerd on 4.3BSD. This vulnerability was exploited by the Morris worm in 1988-11-02. Cliff Stoll reports on the worm in the epilogue of The Cuckoo's Egg.
ed1eb77912bc6cc0c8fcd9813c7bc2b6This Metasploit module exploits a command injection vulnerability on WiFi Pineapples versions 2.0 and below and pineapple versions prior to 2.4. We use a combination of default credentials with a weakness in the anti-csrf generation to achieve command injection on fresh pineapple devices prior to configuration. Additionally if default credentials fail, you can enable a brute force solver for the proof-of-ownership challenge. This will reset the password to a known password if successful and may interrupt the user experience. These devices may typically be identified by their SSID beacons of 'Pineapple5_....'; details derived from the TospoVirus, a WiFi Pineapple infecting worm.
6decdeddc87bc1b4e2eab5e2ce78b412Whitepaper that discusses types of computer worms and how metamorphic worms differ from the rest.
4ae6e561c0c9dbfec13ce2965d4d8a49Some Linksys E-Series Routers are vulnerable to an unauthenticated OS command injection. This vulnerability was used from the so called "TheMoon" worm. There are many Linksys systems that might be vulnerable including E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000, E900. This Metasploit module was tested successfully against an E1500 v1.0.5.
efd9a1fb2aa6013c587f6a0d62ca6b44Proof of concept exploit used by the recent Linksys worm (known as "Moon"). Exploits blind command injection in tmUnblock.cgi.
98029f878e6fe6748f2a3f31170306c5Linksys E-Series unauthenticated remote command execution exploit that leverages the same vulnerability as used in the "Moon" worm.
e5e8a82bab2ad32c6f6fbad03561fa32Whitepaper called To Kill a Centrifuge - A Technical Analysis of What Stuxnet's Creators Tried to Achieve.
378b0d6b52e08452f849a30292b24badWormtrack is a network IDS that helps detect scanning worms on a local area network by monitoring anomalous ARP traffic. This allows detection of scanning threats on the network, without having privileged access on a switch to set up a dedicated monitor port, nor does it require a constant updating of the rules engine to address new threats.
82df762231b40c0bacfb4861cb2b105cPHP-Nuke versions 7.0, 8.1 and 8.1.35 wormable remote code execution exploit.
eb272c6ff1c00e0c3cdc8c49150c4be4This Metasploit module exploits a format string vulnerability in the LPRng print server. This vulnerability was discovered by Chris Evans. There was a publicly circulating worm targeting this vulnerability, which prompted RedHat to pull their 7.0 release. They consequently re-released it as "7.0-respin".
6d35b4aae06d6486bf87ed8f10cfbfb4This Metasploit module exploits the FTP server component of the Sasser worm. By sending an overly long PORT command the stack can be overwritten.
d43c04ad521b75f49917fecff05e6333Whitepaper called How Conficker makes use of MS08-067.
89a1d4338199280d5e76e4e9fa342747Whitepaper called Using "ShoutBoxes" to control malicious software.
551ed6acbcc96e5e1cda2bfd514bbbebTechnical Cyber Security Alert TA09-088A - US-CERT is aware of public reports indicating a widespread infection of the Conficker worm, which can infect a Microsoft Windows system from a thumb drive, a network share, or directly across a network if the host is not patched with MS08-067.
11f2942a818aea1b0588694b2e6fb165Whitepaper called Exploiting Web 2.0, Real Life XSS-Worm.
6f43b52656e363dadf4f84b3c9cf8ce7The Visitor Messages add-on for vBulletin version 3.7.3 suffers from cross site scripting and cross site request forgery vulnerabilities. This is a worm exploit that takes advantage of these issues.
a4bd6a31749a23236f15aac1e67d2032The 5th ACM Workshop On Recurring Malcode (WORM) 2007 Call For Papers has been announced. It will be held on November 2, 2007 in Alexandria, VA, USA.
22042d6df89712ab5d890a119d751158Technical Cyber Security Alert TA07-059A - A worm is exploiting a vulnerability in the telnet daemon (in.telnetd) on unpatched Sun Solaris systems. The vulnerability allows the worm (or any attacker) to log in via telnet (23/tcp) with elevated privileges.
3c73f4b71f6456ca1c51dfdb2699536cThis code shows how to send hidden data steganographed into a simulation of common (worm) traffic.
556f37cbd09cef7aaa5b1ac44a48cf4eA Win32 tool for easing/automating the process of creating IDS/IPS signatures for SMTP based worms, providing a comfortable GUI, including raw base64 variants and Snort signatures support. This tarball is the source version.
bdf32a59c2698f26abe112066a65967dA Win32 tool for easing/automating the process of creating IDS/IPS signatures for SMTP based worms, providing a comfortable GUI, including raw base64 variants and Snort signatures support. This tarball is the binary executable version.
1d3642adf9dab516eb15d202c3fc7ba4vthrottle is an implementation of an SMTP throttling engine for Sendmail servers, based upon M. Williamson's mechanisms, as described in his 2003 Usenix Security paper. It allows the administrator to control how much email users and hosts may send, hindering the rapid spread of viruses, worms, and spam. Exceptions can be made using a whitelist mechanism, which can be generated manually or with the included tool vmeasure.
54bbcfefd188d4132efa6a21b37bb8caAdvanced Polymorphic Worms: Evading IDS by Blending with Normal Traffic.
3590541dd2f42d7182e4d09494dcf016Anomalous Payloadbased Worm Detection and Signature Generation.
fa3d6697c273b49489b40e166f7818c5
© 2020 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed