| Penetration Test Report - Generated using Exploit Pack Thu, 07 Dec 2017 11:39:59 CET subtile

Overview and Results | 1. Executive Summary
something for the header
Vulnerability Details | 2. List of Findings
Name: ABBS-Audio-Media-Player-3.1-(.lst) | Module type: clientside | Platform: windows
# Exploit Title: ABBS Audio Media Player v3.1 (.lst) Buffer Overflow# Version: v3.1# Date: 2013-05-04
Name: ActFax-4.31---Local-System | Module type: clientside | Platform: windows
#Title: ActFax 4.31 Local Privilege Escalation Exploit#Author: Craig Freyman (@cd1zz)#Discovered: July 10, 2012#Vendor Notified: June 12, 2012#Description: http://www.pwnag3.com/2012/08/actfax-local-privilege-escalation.html
Name: Adobe-Flash-Mp4 | Module type: clientside | Platform: windows
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
Name: Adobe-Reader-PDF-LibTiff | Module type: clientside | Platform: windows
Title: Adobe PDF LibTiff Integer Overflow Code Execution.Product: Adobe Acrobat ReaderVersion: 8.3.0, 9.3.0CVE: 2010-0188
Name: A-PDF-WAV-to-MP3-1.0.0 | Module type: clientside | Platform: windows
# This exploit uses SEH to gain code execution, while EDB 14676 uses a direct# EIP overwrite which is operating system specific.
Name: BACnet-OPC-Client-Buffer-Overflow | Module type: clientside | Platform: windows
# After communicating via several emails with the vendor, sharing details# about the vulnerability, as well as proof-of-concept code (I also offered# to send the exploit code for them to test themselves), it was clear that# they weren't very interested in fixing the vulnerability.
Name: BlazeDVD-Pro-player-6.1-Stack-Based-Buffer | Module type: clientside | Platform: windows
# BlazeDVD Pro player 6.1 Local stack based buffer overflow# Author: PuN1sh3r# Email: luiguibiker@gmail.com# Date: Mon Jul 15 03:01:37 EDT 2013# Vendor link: http://www.blazevideo.com/download.htmm# Software Link: http://www.blazevideo.com/download.php?product=BlazeDVDPro# App Version: 6.1
Name: Easy-Address-Book-Server-1.6 | Module type: remote | Platform: windows
# By setting UserID in the cookie to a long string, we can overwrite EDX which # allows us to control execution flow when "call dword ptr [edx+28h]" is # executed. EDX is overwritten with an address pointing to a location on the # stack which in turn points to a NOP sled leading to the shellcode. This # address on the stack is brute forced, but doesn't take long since only the # 2nd byte is always different, so the address is always 0x01??B494.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: ActFax-FTP-Server | Module type: remote | Platform: windows
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
Name: EChat-Server-v2.5 | Module type: remote | Platform: windows
EChat Server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied data. Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Adobe-Flash-Mp4 | Module type: clientside | Platform: windows
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
Name: Adobe-Flash-Mp4 | Module type: clientside | Platform: windows
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: Adobe-Acrobat-and-Reader | Module type: clientside | Platform: windows
Title: Adobe Acrobat and Reader "pushstring" Memory CorruptionVersion: Adobe Reader 9.3.2Analysis: http://www.abysssec.com
Name: Mac-OSX-Privilege-Escalation | Module type: local | Platform: unix
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
Name: Mac-OSX-Privilege-Escalation | Module type: local | Platform: unix
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
Name: Mac-OSX-Privilege-Escalation | Module type: local | Platform: unix
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
Name: AIX 3.x bugfiler Arbitrary File Creation Vulnerability | Module type: local | Platform: aix
AIX 3.x bugfiler Arbitrary File Creation Vulnerability
Name: AIX 4.24.3 netstat -Z Statistic Clearing Vulnerability | Module type: local | Platform: aix
AIX 4.24.3 netstat -Z Statistic Clearing Vulnerability
Name: Apache-mod_cgi-Shellshock | Module type: remote | Platform: linux
Shellshock apache mod_cgi remote exploitrhost: victim hostrport: victim port for TCP shell bindinglhost: attacker host for TCP shell reversinglport: attacker port for TCP shell reversingpages: specific cgi vulnerable pages (separated by comma)proxy: host:port proxy
Name: Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure Vulnerability | Module type: local | Platform: linux
Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure Vulnerability
Name: ActFax-FTP-Server | Module type: remote | Platform: windows
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
Name: ActFax-FTP-Server | Module type: remote | Platform: windows
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
Name: ActFax-FTP-Server | Module type: remote | Platform: windows
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
Name: Test | Module type: remote | Platform: linux
goes here
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: BIG-Ant-Server-XPLT | Module type: remote | Platform: windows
BigAnt Server version 2.50 SEH Overwrite - 0day remote buffer overflow exploit suffer because it fails to perform adequate boundary-checks.Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application.Failed exploit attempts will result in a denial-of-service condition.
Name: BIG-Ant-Server-XPLT | Module type: remote | Platform: windows
BigAnt Server version 2.50 SEH Overwrite - 0day remote buffer overflow exploit suffer because it fails to perform adequate boundary-checks.Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application.Failed exploit attempts will result in a denial-of-service condition.
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Kolibri-Server | Module type: remote | Platform: windows
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
Name: Kolibri-Server | Module type: remote | Platform: windows
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
Name: Kolibri-Server | Module type: remote | Platform: windows
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-Word-2007-RTF | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: ABBS-Audio-Media-Player-3.1-(.lst) | Module type: clientside | Platform: windows
# Exploit Title: ABBS Audio Media Player v3.1 (.lst) Buffer Overflow# Version: v3.1# Date: 2013-05-04
Name: ActFax-4.31---Local-System | Module type: clientside | Platform: windows
#Title: ActFax 4.31 Local Privilege Escalation Exploit#Author: Craig Freyman (@cd1zz)#Discovered: July 10, 2012#Vendor Notified: June 12, 2012#Description: http://www.pwnag3.com/2012/08/actfax-local-privilege-escalation.html
Name: Adobe-Flash-Mp4 | Module type: clientside | Platform: windows
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
Name: Adobe-Reader-PDF-LibTiff | Module type: clientside | Platform: windows
Title: Adobe PDF LibTiff Integer Overflow Code Execution.Product: Adobe Acrobat ReaderVersion: 8.3.0, 9.3.0CVE: 2010-0188
Name: A-PDF-WAV-to-MP3-1.0.0 | Module type: clientside | Platform: windows
# This exploit uses SEH to gain code execution, while EDB 14676 uses a direct# EIP overwrite which is operating system specific.
Name: BACnet-OPC-Client-Buffer-Overflow | Module type: clientside | Platform: windows
# After communicating via several emails with the vendor, sharing details# about the vulnerability, as well as proof-of-concept code (I also offered# to send the exploit code for them to test themselves), it was clear that# they weren't very interested in fixing the vulnerability.
Name: BlazeDVD-Pro-player-6.1-Stack-Based-Buffer | Module type: clientside | Platform: windows
# BlazeDVD Pro player 6.1 Local stack based buffer overflow# Author: PuN1sh3r# Email: luiguibiker@gmail.com# Date: Mon Jul 15 03:01:37 EDT 2013# Vendor link: http://www.blazevideo.com/download.htmm# Software Link: http://www.blazevideo.com/download.php?product=BlazeDVDPro# App Version: 6.1
Name: Easy-Address-Book-Server-1.6 | Module type: remote | Platform: windows
# By setting UserID in the cookie to a long string, we can overwrite EDX which # allows us to control execution flow when "call dword ptr [edx+28h]" is # executed. EDX is overwritten with an address pointing to a location on the # stack which in turn points to a NOP sled leading to the shellcode. This # address on the stack is brute forced, but doesn't take long since only the # 2nd byte is always different, so the address is always 0x01??B494.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: ActFax-FTP-Server | Module type: remote | Platform: windows
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
Name: EChat-Server-v2.5 | Module type: remote | Platform: windows
EChat Server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied data. Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Adobe-Flash-Mp4 | Module type: clientside | Platform: windows
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
Name: Adobe-Flash-Mp4 | Module type: clientside | Platform: windows
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: PC-Man-FTP-Server | Module type: remote | Platform: windows
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
Name: Adobe-Acrobat-and-Reader | Module type: clientside | Platform: windows
Title: Adobe Acrobat and Reader "pushstring" Memory CorruptionVersion: Adobe Reader 9.3.2Analysis: http://www.abysssec.com
Name: Mac-OSX-Privilege-Escalation | Module type: local | Platform: unix
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
Name: Mac-OSX-Privilege-Escalation | Module type: local | Platform: unix
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
Name: Mac-OSX-Privilege-Escalation | Module type: local | Platform: unix
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
Name: AIX 3.x bugfiler Arbitrary File Creation Vulnerability | Module type: local | Platform: aix
AIX 3.x bugfiler Arbitrary File Creation Vulnerability
Name: AIX 4.24.3 netstat -Z Statistic Clearing Vulnerability | Module type: local | Platform: aix
AIX 4.24.3 netstat -Z Statistic Clearing Vulnerability
Name: Apache-mod_cgi-Shellshock | Module type: remote | Platform: linux
Shellshock apache mod_cgi remote exploitrhost: victim hostrport: victim port for TCP shell bindinglhost: attacker host for TCP shell reversinglport: attacker port for TCP shell reversingpages: specific cgi vulnerable pages (separated by comma)proxy: host:port proxy
Name: Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure Vulnerability | Module type: local | Platform: linux
Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure Vulnerability
Name: ActFax-FTP-Server | Module type: remote | Platform: windows
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
Name: ActFax-FTP-Server | Module type: remote | Platform: windows
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
Name: ActFax-FTP-Server | Module type: remote | Platform: windows
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
Name: Test | Module type: remote | Platform: linux
goes here
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: BIG-Ant-Server-XPLT | Module type: remote | Platform: windows
BigAnt Server version 2.50 SEH Overwrite - 0day remote buffer overflow exploit suffer because it fails to perform adequate boundary-checks.Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application.Failed exploit attempts will result in a denial-of-service condition.
Name: BIG-Ant-Server-XPLT | Module type: remote | Platform: windows
BigAnt Server version 2.50 SEH Overwrite - 0day remote buffer overflow exploit suffer because it fails to perform adequate boundary-checks.Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application.Failed exploit attempts will result in a denial-of-service condition.
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow | Module type: remote | Platform: windows
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
Name: Kolibri-Server | Module type: remote | Platform: windows
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
Name: Kolibri-Server | Module type: remote | Platform: windows
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
Name: Kolibri-Server | Module type: remote | Platform: windows
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: KiTTY-Portable---Remote-Buffer-Overflow | Module type: clientside | Platform: windows
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-) | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-Word-2007-RTF | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Exploit-Tutorial-1 | Module type: local | Platform: linux
This is a module that will help you learn the basics of exploit development, the focus on this oneis a stack-buffer type of overflow and the platform used is GNU/Linux.
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: VFU-4.10-1.1---Buffer-Overflow | Module type: clientside | Platform: linux
# VFU v4.10-1.1 is prone to a stack-based buffer overflow# vulnerability because the application fails to perform adequate# boundary-checks on user-supplied input.## An attacker can exploit this issue to execute arbitrary code in the# context of the application. Failed exploit attempts will result in a# denial-of-service condition.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-Chat-Server-3.1 | Module type: remote | Platform: windows
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Easy-FTP-Server-1.7.11 | Module type: remote | Platform: windows
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
Name: Skeleton-Exploit | Module type: remote | Platform: custom
Exploit information example
Name: Microsoft-Word-Record | Module type: clientside | Platform: windows
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
Name: Microsoft-Word-Record | Module type: clientside | Platform: windows
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
Name: Microsoft-Word-Record | Module type: clientside | Platform: windows
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
Name: Microsoft-Word-Record | Module type: clientside | Platform: windows
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
Name: Microsoft-Word-Record | Module type: clientside | Platform: windows
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
Name: Microsoft-Word-Record | Module type: clientside | Platform: windows
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
Name: Microsoft-Office-Word-2007-RTF | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-Word-2007-RTF | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: Microsoft-Office-Word-2007-RTF | Module type: clientside | Platform: windows
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
Name: XM-Easy-Personal-FTP-Server | Module type: remote | Platform: windows
# Because this address is relative and has a static base in this environment, I was able# to use the heap chunk address as the pointer to write at the vtable. Then a function is# called at offset 0xb0 or 0x98 and we can reliably return into a ROP payload and execute# arbitrary code.
Name: SDR-RepeatRF | Module type: local | Platform: custom
This is a module that could be used to repeat previously saved RF data for debugging purposes.In order to save or repeat RF signals an SDR is needed.
Name: SDR-RepeatRF | Module type: local | Platform: custom
This is a module that could be used to repeat previously saved RF data for debugging purposes.In order to save or repeat RF signals an SDR is needed.
Name: SDR-RepeatRF | Module type: local | Platform: custom
This is a module that could be used to repeat previously saved RF data for debugging purposes.In order to save or repeat RF signals an SDR is needed.
Name: EChat-Server-v2.5 | Module type: remote | Platform: windows
EChat Server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied data.Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application.Failed exploit attempts will result in a denial-of-service condition.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: clientside | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: clientside | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: clientside | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: clientside | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: clientside | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: clientside | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: clientside | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: WinAxePlus-8.7 | Module type: remote | Platform: windows
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
Name: SDR-SaveRF | Module type: local | Platform: custom
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
Name: SDR-RepeatRF | Module type: local | Platform: custom
This is a module that could be used to repeat previously saved RF data for debugging purposes.In order to save or repeat RF signals an SDR is needed.
Name: SDR-SaveRF | Module type: local | Platform: custom
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
Name: Skeleton-Exploit | Module type: local | Platform: custom
Exploit information example for the Skeleton module. This is an example structure you can use to create your modulesuse this module as a template or create your own.
Name: SDR-SaveRF | Module type: local | Platform: custom
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
Name: SDR-SaveRF | Module type: local | Platform: custom
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
Name: SDR-SaveRF | Module type: local | Platform: custom
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
Name: SDR-SaveRF | Module type: local | Platform: custom
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
Name: SDR-SaveRF | Module type: local | Platform: custom
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
Name: Skeleton-Exploit | Module type: local | Platform: custom
Exploit information example for the Skeleton module. This is an example structure you can use to create your modulesuse this module as a template or create your own.
Name: Skeleton-Exploit | Module type: local | Platform: custom
Exploit information example for the Skeleton module. This is an example structure you can use to create your modulesuse this module as a template or create your own.
Name: vulnerability name.. | Module type: Custom | Risk level: Low
The webserver is prone to stack buffer overflow by abusing of CVE: 123
Name: vulnerability name.. | Module type: Custom | Risk level: Low
The ftp server is prone to a heap based overflow by abusing of CVE: 123
Summary and Conclusions | 3. Recommendations

Please consider making a donation to Exploit Pack Project.