![]() |
Penetration Test Report - Generated using Exploit Pack
Thu, 07 Dec 2017 11:39:59 CET
subtile
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
something for the header
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Name: ABBS-Audio-Media-Player-3.1-(.lst)
|
Module type: clientside
|
Platform: windows
|
# Exploit Title: ABBS Audio Media Player v3.1 (.lst) Buffer Overflow# Version: v3.1# Date: 2013-05-04
|
|
|
|
Name: ActFax-4.31---Local-System
|
Module type: clientside
|
Platform: windows
|
#Title: ActFax 4.31 Local Privilege Escalation Exploit#Author: Craig Freyman (@cd1zz)#Discovered: July 10, 2012#Vendor Notified: June 12, 2012#Description: http://www.pwnag3.com/2012/08/actfax-local-privilege-escalation.html
|
|
|
|
Name: Adobe-Flash-Mp4
|
Module type: clientside
|
Platform: windows
|
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
|
|
|
|
Name: Adobe-Reader-PDF-LibTiff
|
Module type: clientside
|
Platform: windows
|
Title: Adobe PDF LibTiff Integer Overflow Code Execution.Product: Adobe Acrobat ReaderVersion: 8.3.0, 9.3.0CVE: 2010-0188
|
|
|
|
Name: A-PDF-WAV-to-MP3-1.0.0
|
Module type: clientside
|
Platform: windows
|
# This exploit uses SEH to gain code execution, while EDB 14676 uses a direct# EIP overwrite which is operating system specific.
|
|
|
|
Name: BACnet-OPC-Client-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
# After communicating via several emails with the vendor, sharing details# about the vulnerability, as well as proof-of-concept code (I also offered# to send the exploit code for them to test themselves), it was clear that# they weren't very interested in fixing the vulnerability.
|
|
|
|
Name: BlazeDVD-Pro-player-6.1-Stack-Based-Buffer
|
Module type: clientside
|
Platform: windows
|
# BlazeDVD Pro player 6.1 Local stack based buffer overflow# Author: PuN1sh3r# Email: luiguibiker@gmail.com# Date: Mon Jul 15 03:01:37 EDT 2013# Vendor link: http://www.blazevideo.com/download.htmm# Software Link: http://www.blazevideo.com/download.php?product=BlazeDVDPro# App Version: 6.1
|
|
|
|
Name: Easy-Address-Book-Server-1.6
|
Module type: remote
|
Platform: windows
|
# By setting UserID in the cookie to a long string, we can overwrite EDX which # allows us to control execution flow when "call dword ptr [edx+28h]" is # executed. EDX is overwritten with an address pointing to a location on the # stack which in turn points to a NOP sled leading to the shellcode. This # address on the stack is brute forced, but doesn't take long since only the # 2nd byte is always different, so the address is always 0x01??B494.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: ActFax-FTP-Server
|
Module type: remote
|
Platform: windows
|
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
|
|
|
|
Name: EChat-Server-v2.5
|
Module type: remote
|
Platform: windows
|
EChat Server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied data. Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Adobe-Flash-Mp4
|
Module type: clientside
|
Platform: windows
|
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
|
|
|
|
Name: Adobe-Flash-Mp4
|
Module type: clientside
|
Platform: windows
|
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: Adobe-Acrobat-and-Reader
|
Module type: clientside
|
Platform: windows
|
Title: Adobe Acrobat and Reader "pushstring" Memory CorruptionVersion: Adobe Reader 9.3.2Analysis: http://www.abysssec.com
|
|
|
|
Name: Mac-OSX-Privilege-Escalation
|
Module type: local
|
Platform: unix
|
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
|
|
|
|
Name: Mac-OSX-Privilege-Escalation
|
Module type: local
|
Platform: unix
|
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
|
|
|
|
Name: Mac-OSX-Privilege-Escalation
|
Module type: local
|
Platform: unix
|
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
|
|
|
|
Name: AIX 3.x bugfiler Arbitrary File Creation Vulnerability
|
Module type: local
|
Platform: aix
|
AIX 3.x bugfiler Arbitrary File Creation Vulnerability
|
|
|
|
Name: AIX 4.24.3 netstat -Z Statistic Clearing Vulnerability
|
Module type: local
|
Platform: aix
|
AIX 4.24.3 netstat -Z Statistic Clearing Vulnerability
|
|
|
|
Name: Apache-mod_cgi-Shellshock
|
Module type: remote
|
Platform: linux
|
Shellshock apache mod_cgi remote exploitrhost: victim hostrport: victim port for TCP shell bindinglhost: attacker host for TCP shell reversinglport: attacker port for TCP shell reversingpages: specific cgi vulnerable pages (separated by comma)proxy: host:port proxy
|
|
|
|
Name: Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure Vulnerability
|
Module type: local
|
Platform: linux
|
Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure Vulnerability
|
|
|
|
Name: ActFax-FTP-Server
|
Module type: remote
|
Platform: windows
|
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
|
|
|
|
Name: ActFax-FTP-Server
|
Module type: remote
|
Platform: windows
|
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
|
|
|
|
Name: ActFax-FTP-Server
|
Module type: remote
|
Platform: windows
|
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
|
|
|
|
Name: Test
|
Module type: remote
|
Platform: linux
|
goes here
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: BIG-Ant-Server-XPLT
|
Module type: remote
|
Platform: windows
|
BigAnt Server version 2.50 SEH Overwrite - 0day remote buffer overflow exploit suffer because it fails to perform adequate boundary-checks.Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application.Failed exploit attempts will result in a denial-of-service condition.
|
|
|
|
Name: BIG-Ant-Server-XPLT
|
Module type: remote
|
Platform: windows
|
BigAnt Server version 2.50 SEH Overwrite - 0day remote buffer overflow exploit suffer because it fails to perform adequate boundary-checks.Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application.Failed exploit attempts will result in a denial-of-service condition.
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Kolibri-Server
|
Module type: remote
|
Platform: windows
|
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
|
|
|
|
Name: Kolibri-Server
|
Module type: remote
|
Platform: windows
|
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
|
|
|
|
Name: Kolibri-Server
|
Module type: remote
|
Platform: windows
|
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-Word-2007-RTF
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: ABBS-Audio-Media-Player-3.1-(.lst)
|
Module type: clientside
|
Platform: windows
|
# Exploit Title: ABBS Audio Media Player v3.1 (.lst) Buffer Overflow# Version: v3.1# Date: 2013-05-04
|
|
|
|
Name: ActFax-4.31---Local-System
|
Module type: clientside
|
Platform: windows
|
#Title: ActFax 4.31 Local Privilege Escalation Exploit#Author: Craig Freyman (@cd1zz)#Discovered: July 10, 2012#Vendor Notified: June 12, 2012#Description: http://www.pwnag3.com/2012/08/actfax-local-privilege-escalation.html
|
|
|
|
Name: Adobe-Flash-Mp4
|
Module type: clientside
|
Platform: windows
|
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
|
|
|
|
Name: Adobe-Reader-PDF-LibTiff
|
Module type: clientside
|
Platform: windows
|
Title: Adobe PDF LibTiff Integer Overflow Code Execution.Product: Adobe Acrobat ReaderVersion: 8.3.0, 9.3.0CVE: 2010-0188
|
|
|
|
Name: A-PDF-WAV-to-MP3-1.0.0
|
Module type: clientside
|
Platform: windows
|
# This exploit uses SEH to gain code execution, while EDB 14676 uses a direct# EIP overwrite which is operating system specific.
|
|
|
|
Name: BACnet-OPC-Client-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
# After communicating via several emails with the vendor, sharing details# about the vulnerability, as well as proof-of-concept code (I also offered# to send the exploit code for them to test themselves), it was clear that# they weren't very interested in fixing the vulnerability.
|
|
|
|
Name: BlazeDVD-Pro-player-6.1-Stack-Based-Buffer
|
Module type: clientside
|
Platform: windows
|
# BlazeDVD Pro player 6.1 Local stack based buffer overflow# Author: PuN1sh3r# Email: luiguibiker@gmail.com# Date: Mon Jul 15 03:01:37 EDT 2013# Vendor link: http://www.blazevideo.com/download.htmm# Software Link: http://www.blazevideo.com/download.php?product=BlazeDVDPro# App Version: 6.1
|
|
|
|
Name: Easy-Address-Book-Server-1.6
|
Module type: remote
|
Platform: windows
|
# By setting UserID in the cookie to a long string, we can overwrite EDX which # allows us to control execution flow when "call dword ptr [edx+28h]" is # executed. EDX is overwritten with an address pointing to a location on the # stack which in turn points to a NOP sled leading to the shellcode. This # address on the stack is brute forced, but doesn't take long since only the # 2nd byte is always different, so the address is always 0x01??B494.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: ActFax-FTP-Server
|
Module type: remote
|
Platform: windows
|
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
|
|
|
|
Name: EChat-Server-v2.5
|
Module type: remote
|
Platform: windows
|
EChat Server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied data. Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Adobe-Flash-Mp4
|
Module type: clientside
|
Platform: windows
|
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
|
|
|
|
Name: Adobe-Flash-Mp4
|
Module type: clientside
|
Platform: windows
|
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: PC-Man-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command# Date : 12/02/2015 # Author: R-73eN# Software: PCMan FTP Server v2.0.7# Tested On Windows Xp SP3
|
|
|
|
Name: Adobe-Acrobat-and-Reader
|
Module type: clientside
|
Platform: windows
|
Title: Adobe Acrobat and Reader "pushstring" Memory CorruptionVersion: Adobe Reader 9.3.2Analysis: http://www.abysssec.com
|
|
|
|
Name: Mac-OSX-Privilege-Escalation
|
Module type: local
|
Platform: unix
|
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
|
|
|
|
Name: Mac-OSX-Privilege-Escalation
|
Module type: local
|
Platform: unix
|
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
|
|
|
|
Name: Mac-OSX-Privilege-Escalation
|
Module type: local
|
Platform: unix
|
Apple Mac OS X contains a flaw in the Admin Framework that is triggered when checking XPC entitlements. This may allow a process to gain administrative privileges without properly authenticating.
|
|
|
|
Name: AIX 3.x bugfiler Arbitrary File Creation Vulnerability
|
Module type: local
|
Platform: aix
|
AIX 3.x bugfiler Arbitrary File Creation Vulnerability
|
|
|
|
Name: AIX 4.24.3 netstat -Z Statistic Clearing Vulnerability
|
Module type: local
|
Platform: aix
|
AIX 4.24.3 netstat -Z Statistic Clearing Vulnerability
|
|
|
|
Name: Apache-mod_cgi-Shellshock
|
Module type: remote
|
Platform: linux
|
Shellshock apache mod_cgi remote exploitrhost: victim hostrport: victim port for TCP shell bindinglhost: attacker host for TCP shell reversinglport: attacker port for TCP shell reversingpages: specific cgi vulnerable pages (separated by comma)proxy: host:port proxy
|
|
|
|
Name: Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure Vulnerability
|
Module type: local
|
Platform: linux
|
Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure Vulnerability
|
|
|
|
Name: ActFax-FTP-Server
|
Module type: remote
|
Platform: windows
|
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
|
|
|
|
Name: ActFax-FTP-Server
|
Module type: remote
|
Platform: windows
|
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
|
|
|
|
Name: ActFax-FTP-Server
|
Module type: remote
|
Platform: windows
|
This module exploits a stack-based buffer overflow in actfax ftp Server version 4.27 and earlier. Actfax fails to check input size when parsing 'USER' command. ToDo: Add Execute Shell ToDo: Test Targets
|
|
|
|
Name: Test
|
Module type: remote
|
Platform: linux
|
goes here
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: BIG-Ant-Server-XPLT
|
Module type: remote
|
Platform: windows
|
BigAnt Server version 2.50 SEH Overwrite - 0day remote buffer overflow exploit suffer because it fails to perform adequate boundary-checks.Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application.Failed exploit attempts will result in a denial-of-service condition.
|
|
|
|
Name: BIG-Ant-Server-XPLT
|
Module type: remote
|
Platform: windows
|
BigAnt Server version 2.50 SEH Overwrite - 0day remote buffer overflow exploit suffer because it fails to perform adequate boundary-checks.Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application.Failed exploit attempts will result in a denial-of-service condition.
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
Module type: remote
|
Platform: windows
|
Easy File Sharing Web Server 7.2 - Remote SEH Based Overflow
|
|
|
|
Name: Kolibri-Server
|
Module type: remote
|
Platform: windows
|
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
|
|
|
|
Name: Kolibri-Server
|
Module type: remote
|
Platform: windows
|
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
|
|
|
|
Name: Kolibri-Server
|
Module type: remote
|
Platform: windows
|
Kolibri v2.0 is vulnerable to a remote buffer overflow attack. By sending a malformed HEAD request, we are able to overwrite both the return address and an SEH handler. Null bytes terminate the request though,but we are able to partially overwrite with a pointer to a POP + POP + RET instruction inside kolibri.exe and gain control.
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: KiTTY-Portable---Remote-Buffer-Overflow
|
Module type: clientside
|
Platform: windows
|
When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little roomfor exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit small shellcode such as windows/shell/reverse_ord_tcp (118 bytes encoded) makes KiTTY crashing after the first connection. We control the SEH overflow, but as all DLLs are SafeSEH protected, using an address from KiTTY itself has a NULL which forces us to jump backward with no extra space. We are jailed in a tight environment with little room to work with.
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office---RTF-(-ASLR---DEP-Bypass-)
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-RTF-ASLR-DEP-Bypass
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-Word-2007-RTF
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Exploit-Tutorial-1
|
Module type: local
|
Platform: linux
|
This is a module that will help you learn the basics of exploit development, the focus on this oneis a stack-buffer type of overflow and the platform used is GNU/Linux.
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: VFU-4.10-1.1---Buffer-Overflow
|
Module type: clientside
|
Platform: linux
|
# VFU v4.10-1.1 is prone to a stack-based buffer overflow# vulnerability because the application fails to perform adequate# boundary-checks on user-supplied input.## An attacker can exploit this issue to execute arbitrary code in the# context of the application. Failed exploit attempts will result in a# denial-of-service condition.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-Chat-Server-3.1
|
Module type: remote
|
Platform: windows
|
Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Easy-FTP-Server-1.7.11
|
Module type: remote
|
Platform: windows
|
Easy FTP Server USER Command Remote Buffer Overflow Exploitwhen parsing the command 'USR', which leads to a stack based overflow. Easy FTP Server allow remote anonymous login by defaultexploiting these issues could allow an attacker to compromise the application, access or modify data.
|
|
|
|
Name: Skeleton-Exploit
|
Module type: remote
|
Platform: custom
|
Exploit information example
|
|
|
|
Name: Microsoft-Word-Record
|
Module type: clientside
|
Platform: windows
|
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
|
|
|
|
Name: Microsoft-Word-Record
|
Module type: clientside
|
Platform: windows
|
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
|
|
|
|
Name: Microsoft-Word-Record
|
Module type: clientside
|
Platform: windows
|
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
|
|
|
|
Name: Microsoft-Word-Record
|
Module type: clientside
|
Platform: windows
|
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
|
|
|
|
Name: Microsoft-Word-Record
|
Module type: clientside
|
Platform: windows
|
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
|
|
|
|
Name: Microsoft-Word-Record
|
Module type: clientside
|
Platform: windows
|
Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the contextof the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.This update adds support for Office 2003 SP0.
|
|
|
|
Name: Microsoft-Office-Word-2007-RTF
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-Word-2007-RTF
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: Microsoft-Office-Word-2007-RTF
|
Module type: clientside
|
Platform: windows
|
# Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass# Date : 28/02/2015 # Author : R-73eN# Software : Microsoft Office Word 2007 # Tested : Windows 7 Starter
|
|
|
|
Name: XM-Easy-Personal-FTP-Server
|
Module type: remote
|
Platform: windows
|
# Because this address is relative and has a static base in this environment, I was able# to use the heap chunk address as the pointer to write at the vtable. Then a function is# called at offset 0xb0 or 0x98 and we can reliably return into a ROP payload and execute# arbitrary code.
|
|
|
|
Name: SDR-RepeatRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to repeat previously saved RF data for debugging purposes.In order to save or repeat RF signals an SDR is needed.
|
|
|
|
Name: SDR-RepeatRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to repeat previously saved RF data for debugging purposes.In order to save or repeat RF signals an SDR is needed.
|
|
|
|
Name: SDR-RepeatRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to repeat previously saved RF data for debugging purposes.In order to save or repeat RF signals an SDR is needed.
|
|
|
|
Name: EChat-Server-v2.5
|
Module type: remote
|
Platform: windows
|
EChat Server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied data.Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application.Failed exploit attempts will result in a denial-of-service condition.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: clientside
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: clientside
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: clientside
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: clientside
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: clientside
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: clientside
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: clientside
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: WinAxePlus-8.7
|
Module type: remote
|
Platform: windows
|
WinAxe server is prone to a remote buffer overflow that could allow a malicious suer to execute arbitrary codein the context of the affected application. The exploit has been tested in Windows platforms and currently there is no fix or patch available for this program.
|
|
|
|
Name: SDR-SaveRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
|
|
|
|
Name: SDR-RepeatRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to repeat previously saved RF data for debugging purposes.In order to save or repeat RF signals an SDR is needed.
|
|
|
|
Name: SDR-SaveRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
|
|
|
|
Name: Skeleton-Exploit
|
Module type: local
|
Platform: custom
|
Exploit information example for the Skeleton module. This is an example structure you can use to create your modulesuse this module as a template or create your own.
|
|
|
|
Name: SDR-SaveRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
|
|
|
|
Name: SDR-SaveRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
|
|
|
|
Name: SDR-SaveRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
|
|
|
|
Name: SDR-SaveRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
|
|
|
|
Name: SDR-SaveRF
|
Module type: local
|
Platform: custom
|
This is a module that could be used to save RF signals for debugging purpouses or to be replayedusing a repeater, by default the destination is /tmp/saveRF
|
|
|
|
Name: Skeleton-Exploit
|
Module type: local
|
Platform: custom
|
Exploit information example for the Skeleton module. This is an example structure you can use to create your modulesuse this module as a template or create your own.
|
|
|
|
Name: Skeleton-Exploit
|
Module type: local
|
Platform: custom
|
Exploit information example for the Skeleton module. This is an example structure you can use to create your modulesuse this module as a template or create your own.
|
|
|
|
Name: vulnerability name..
|
Module type: Custom
|
Risk level: Low
|
The webserver is prone to stack buffer overflow by abusing of CVE: 123
|
|
|
|
Name: vulnerability name..
|
Module type: Custom
|
Risk level: Low
|
The ftp server is prone to a heap based overflow by abusing of CVE: 123
|
|
| |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||