<< Previous Next >>
exploitation
Hey Dan,
Freaking THANK YOU first and foremost. I've been waiting for someone to say that for days now, and was just about to myself.
Just because everyone and their brother want's to show off that they can compile & run some software (herp a derp, good job) DOESN'T mean they should immediately post it here. I tested it against an OLDER KERNEL on purpose because I actually read the headers and the exploit worked as expected. I knew that this was responsibly disclosed, so it was already patched on any system that I updated. If you don't have the proper symbols, then the exploit doesn't have the proper offsets, and the exploit will fail. Plain and simple. *THEN* there's people who don't even bother to read that "Red Hat does not support Econet by default". DOES NOT. As in the exploit WON'T WORK!
It's pathetic that the original exploit dev has to waste his time saying the same thing 5 times.
</rant>
perform this as well.
Details follow:
It was discovered that KVM did not correctly initialize certain CPU
registers. A local attacker could exploit this to crash the system, leading
to a denial of service. (CVE-2010-3698)
Thomas Pollet discovered that the RDS network protocol did not check
certain iovec buffers. A local attacker could exploit this to crash the
system or possibly execute arbitrary code as the root user. (CVE-2010-3865)
“Exploit creation – The random approach” or “Playing with random to build
exploits”
Sunday, September 21, 2008
By Nelson Brito <nbrito@sekure.org>
-[ Introduction
It is just a matter of time to get things worse on the Internet. We saw
worms getting more and more sophisticated in last decade, and, believe me,
it could be worst. Nowadays we have botnets and a lot of worms and the
Release mode: User release
*Vulnerability Information*
Class: Input Validation Error
Remotely Exploitable: Yes
Locally Exploitable: Yes
Client-side Exploitable: No
Bugtraq ID: 27944
CVE Name: CVE-2008-0923
In general, a standard system update will make all the necessary changes.
Details follow:
Auke van Slooten discovered that PHP incorrectly handled certain xmlrpc
requests. An attacker could exploit this issue to cause the PHP server to
crash, resulting in a denial of service. This issue only affected Ubuntu
6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-0397)
It was discovered that the pseudorandom number generator in PHP did not
provide the expected entropy. An attacker could exploit this issue to
I understand that this is a vain hope that bugtraq will start posting something useful.
Author:Michael Brooks (Rook)<br>
Application:OpenClassifieds 1.7.0.3<br>
download: http://open-classifieds.com/download/<br>
Exploit chain:captcha bypass->sqli(insert)->persistant xss on front page<br>
If registration is required an extra link in the chain is added:<br>
Exploit chain:blind sqli(select)->captcha bypass->sqli(insert)->persistant xss on front page<br>
sites with SEO url's enabled:<br>
"powered by Open Classifieds" inurl:"publish-a-new-ad.htm" (85,000 results)<br>
or default urls:<br>
all the necessary changes.
Details follow:
Tavis Ormandy discovered that the Linux kernel did not properly implement
exception fixup. A local attacker could exploit this to crash the kernel,
leading to a denial of service. (CVE-2010-3086)
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local attacker could
exploit this to gain root privileges. (CVE-2010-3859)
Summary
=======
The SSH server implementation in Cisco IOS XR Software contains a
vulnerability that an unauthenticated, remote user could exploit to
cause a denial of service condition.
An attacker could trigger this vulnerability by sending a crafted SSH
version 2 packet that may cause a new SSH connection handler process to
crash. Repeated exploitation may cause each new SSH connection handler
."Password ='" .$Password2 ."' WHERE ID ='" .$ID ."'";
$results = mysql_query($sqlquery);
-----------------[ source code end ]-----------------------------------
Example exploit:
-------------------------------------------------------------------------------
<html>
<head><title>CruxCMS 3.0.0 Unauthorized Password Reset PoC by waraxe</title></head>
<body><center>
<form action="http://localhost/cruxcms.3.0.0/manager/passwordreset.php" method="post">
Hi Mustlive,
I'm not sure if there's a need to discuss or clarify this any further.
Please refer to my earlier posts, and for the sake of saving some of our
time & efforts, avoid drawing tangents about scripts and noscripts (I've
clarified both earlier) & weasel words (security vulnerability and nntp
exploit - irrelevent in this case).
JS or no-JS, this issue is nothing new, this behavior is well-defined and a
necessity and definitely not a URI (of any kind) exploit or a security
vulnerability.
Some last specifics (mostly reiterating what I said in my earlier posts) -
2. Vulnerability Information
----------------------------------------------------------------------------------------------
Class: SQL Injection, Insecure File Upload, Cross Site Scripting,
Filepath Disclosure
Remotely Exploitable: Yes
Locally Exploitable: No
3. Vulnerability Description
----------------------------------------------------------------------------------------------
A crafted SSL or HTTP packet may cause a DoS condition on a Cisco
ASA device that is configured to terminate SSL VPN connections. This
vulnerability can also be triggered to any interface where ASDM access
is enabled. A successful attack may result in a reload of the device. A
TCP three-way handshake is not needed to exploit this vulnerability.
This vulnerability is documented in Cisco Bug ID CSCsv52239 and has
been assigned Common Vulnerabilities and Exposures (CVE) identifiers
CVE-2009-1156.
http://www.adobe.com/products/reader/
http://www.adobe.com/products/acrobatpro/
II. DESCRIPTION
Remote exploitation of a heap based buffer overflow vulnerability in
Adobe Systems Inc.'s Reader and Acrobat could allow an attacker to
execute arbitrary code with the privileges of the current user.
The vulnerability occurs when parsing a JBIG2-encoded stream inside of a
PDF file. JBIG2 is an image encoding format that is primarily used for
********************************************************************************************
Multiple Vendor Anti-Virus Software Malicious WebPage Detection Bypass
hackers.
NOTIFICATION:
this exploit are based on Andrey Bayora "magic of magic byte" but with some development.
This proof of concept was created for educational purposes only,Use the code it at your own risk.
The author will not be responsible for any damages.
*********************************************************************************************
Exploit Information:
Date: 2008/19/08
Multiple Vendor Anti-Virus Software Malicious WebPage Detection Bypass
[_] Discovred by : DATA_SNIPER
[_] Greets to: hacker c&c Team , Arab4Services team on www.arab4services.net , AT4RE Team on www.at4re.com
[_] Special thanks go to: Andrey Bayora and all arabian hackers specialy algerian hackers.
NOTIFICATION:
this exploit are based on Andrey Bayora "magic of magic byte" but with some development.
This proof of concept was created for educational purposes only,Use the code it at your own risk.
The author will not be responsible for any damages.
*********************************************************************************************
Exploit Information:
Date: 2008/19/08
-------------------------------------------
-------- Test results below ---------------
-------------------------------------------
filetype.vim
strong : EXPLOIT FAILED
weak : EXPLOIT FAILED
tarplugin : EXPLOIT FAILED
tarplugin.updated: VULNERABLE
zipplugin : VULNERABLE
xpm.vim
# AmnPardaz Security Research Team
#
# Title: Academic Web Tools CMS Multiple Vulnerabilities
# Vendor: www.yektaweb.com
# Vulnerable Version: 1.4.2.8 and prior versions
# Exploit: Available
# Impact: Medium
# Fix: N/A
# Original Advisory: www.bugreport.ir/?/44
###################################################################################
# AmnPardaz Security Research Team
#
# Title: Academic Web Tools CMS Multiple Vulnerabilities
# Vendor: www.yektaweb.com
# Vulnerable Version: 1.4.2.8 and prior versions
# Exploit: Available
# Impact: Medium
# Fix: N/A
# Original Advisory: www.bugreport.ir/?/44
###################################################################################
# AmnPardaz Security Research Team
#
# Title: Academic Web Tools CMS Multiple Vulnerabilities
# Vendor: www.yektaweb.com
# Vulnerable Version: 1.4.2.8 and prior versions
# Exploit: Available
# Impact: Medium
# Fix: N/A
# Original Advisory: www.bugreport.ir/?/44
###################################################################################
Opencosmo Security
http://www.opencosmo.com
http://www.opencosmo.com/news.php?readmore=15
VigileCMS <= 1.8 Stealth Remote Command Execution Exploit
Crediti: The:Paradox
Applicazione: VigileCMS
Versione: 1.8
Impatto: Remote Command Execution
Rischio: [3/5]
Vendors contacted: IBM Corp.
Release mode: COORDINATED RELEASE
*Vulnerability Information*
Class: Input validation error
Remotely Exploitable: Yes
Locally Exploitable: Yes
Bugtraq ID: N/A
CVE Name: N/A
*Vulnerability Description*
Integrity Impact: Complete
Availability Impact: Complete
CVSSv2 Temporal Score: 7.8
Exploitability: Proof-of-Concept
Remediation Level: Official Fix
Report Confidence: Confirmed
[CVE-2007-4000/VU#377544]
kadmind uninitialized pointer
Integrity Impact: Complete
Availability Impact: Complete
CVSSv2 Temporal Score: 7.8
Exploitability: Proof-of-Concept
Remediation Level: Official Fix
Report Confidence: Confirmed
[CVE-2007-4000/VU#377544]
kadmind uninitialized pointer
of personal information and breach notification
(Take special notice if you fall under special regulations like
HIPAA or SOX)
3. Create a document to present to the company leadership:
. a. Prepare a complete analysis of the vulnerability including the
exact steps needed to repeat the exploit
b. Make sure that your documentation includes a risk analysis
(without the standard FUD)
c. Make sure that your documentation includes the research on
protection of personal information and breach notification
d. Make sure that your documentation includes both technical
this to crash the browser or possibly run arbitrary code as the user
invoking the program. (CVE-2010-1208, CVE-2010-1209, CVE-2010-1211,
CVE-2010-1212)
An integer overflow was discovered in how Firefox processed plugin
parameters. An attacker could exploit this to crash the browser or possibly
run arbitrary code as the user invoking the program. (CVE-2010-1214)
A flaw was discovered in the Firefox JavaScript engine. If a user were
tricked into viewing a malicious site, a remote attacker code execute
arbitrary JavaScript with chrome privileges. (CVE-2010-1215)
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2010-1200, CVE-2010-1201,
CVE-2010-1202, CVE-2010-1203)
A flaw was discovered in the way plugin instances interacted. An attacker
could potentially exploit this and use one plugin to access freed memory from a
second plugin to execute arbitrary code with the privileges of the user
invoking the program. (CVE-2010-1198)
An integer overflow was discovered in Firefox. If a user were tricked into
viewing a malicious site, an attacker could overflow a buffer and cause a
all the necessary changes.
Details follow:
Thomas Pollet discovered that the RDS network protocol did not check
certain iovec buffers. A local attacker could exploit this to crash the
system or possibly execute arbitrary code as the root user. (CVE-2010-3865)
Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did
not correctly clear kernel memory. A local attacker could exploit this to
read kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)
the corresponding updates for the Linux kernel for use with EC2.
Original advisory details:
Thomas Pollet discovered that the RDS network protocol did not check
certain iovec buffers. A local attacker could exploit this to crash the
system or possibly execute arbitrary code as the root user. (CVE-2010-3865)
Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did
not correctly clear kernel memory. A local attacker could exploit this to
read kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)
- firefox-3.0: safe and easy web browser from Mozilla
Details:
It was discovered that there was a vulnerability in the memory handling of
certain types of content. An attacker could exploit this to possibly run
arbitrary code as the user running Firefox. (CVE-2011-0081)
It was discovered that Firefox incorrectly handled certain JavaScript
requests. An attacker could exploit this to possibly run arbitrary code as
the user running Firefox. (CVE-2011-0069)
- thunderbird: mail/news client with RSS and integrated spam filter support
Details:
It was discovered that there was a vulnerability in the memory handling of
certain types of content. An attacker could exploit this to possibly run
arbitrary code as the user running Thunderbird. (CVE-2011-0081)
It was discovered that Thunderbird incorrectly handled certain JavaScript
requests. If JavaScript were enabled, an attacker could exploit this to
possibly run arbitrary code as the user running Thunderbird.
<<Previous Next>>
|
