Local Exploit

Apache+php Proof of Concept Exploit

Tarih: 3 Ocak 2006, Salı - Yazar: fuzbing - Etiketler:

/*
---------------------------------------------------------------------------
Web:  http://qb0x.net                   Author: Gabriel A. Maggiotti
Date: Febrary 03, 2002                  E-mail: gmaggiot@ciudad.com.ar
---------------------------------------------------------------------------

Summary
-------
This  is  a proof  of concept exploit for Apache/1.3.x + php_4.0.6.  This
code exploit multipart/form-data POST requests bug. This code only  crash
apache deamon, not open any shell or  execute code  in  the remote server.
PHP supports  multipart/form-data POST  requests  (as described in RFC1867)
known as POST fileuploads.  Unfourtunately there  are  several flaws in the
php_mime_split function that could be used by an attacker to execute  arbi-
trary code. I dont know if the vuln I exploit is a known vuln or not.

Microsoft Windows COM Structured Storage Local Exploit (MS05-012)

Tarih: 12 AÄŸustos 2005, Cum - Yazar: fuzbing - Etiketler:

// by Cesar Cerrudo - Argeniss - www.argeniss.com
// MS05-012 - COM Structured Storage Vulnerability - CAN-2005-0047 Exploit
//
// More exploits at www.argeniss.com/products.html
//
// Works on Win2k sp4, WinXP sp2, Win2k3 sp0
// Close all runing programs to avoid possible problems
// If it finds the section and it doesn't work remove section permissions
// from msiexec service process with WinObj or crash the msiexec service and try again
// if offsets don't work, debug and change them

#include <windows.h>
#include <stdio.h>

typedef struct _LSA_UNICODE_STRING { 
USHORT Length; 
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING;

typedef struct _OBJDIR_INFORMATION {
  UNICODE_STRING          ObjectName;
  UNICODE_STRING          ObjectTypeName;
  BYTE                    Data[1];
} OBJDIR_INFORMATION;

İçeriği paylaş

Kimler çevrimiçi

Şu an 0 kullanıcı ve 24 ziyaretçi çevrimiçi.

Kimler yeni

  • Kral_Korsan
  • hololu
  • ezgi
  • fatih
  • denizz