Microsoft DirectWrite / AFDKO – Heap-Based Buffer Overflow in OpenType Font Handling in readEncoding
-----=====[ Background ]=====-----
windows
windows 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Microsoft DirectWrite / AFDKO – Stack Corruption in OpenType Font Handling Due to Incorrect Handling of blendArray
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Interpreter Stack Underflow in OpenType Font Handling Due to Missing CHKUFLOW
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Use of Uninitialized Memory While Freeing Resources in var_loadavar
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Stack-Based Buffer Overflow in do_set_weight_vector_cube for Large nAxes
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Stack Corruption in OpenType Font Handling Due to Negative nAxes
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Stack Corruption in OpenType Font Handling Due to Negative cubeStackDepth
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Stack Corruption in OpenType Font Handling due to Out-of-Bounds cubeStackDepth
----=====[ Background ]=====-----
Microsoft Windows – Font Subsetting DLL Heap-Based Out-of-Bounds Read in MergeFonts
-----=====[ Background ]=====-----
Microsoft Exchange 2003 – base64-MIME Remote Code Execution
# Python 2.7 (included with ImmunityDBG)
Microsoft Windows Font Cache Service – Insecure Sections Privilege Escalation
Windows: Windows Font Cache Service Insecure Sections EoP
Microsoft Windows – ‘CmpAddRemoveContainerToCLFSLog’ Arbitrary File/Directory Creation
Windows: CmpAddRemoveContainerToCLFSLog Arbitrary File/Directory Creation EoP
GSearch 1.0.1.0 – Denial of Service (PoC)
# Exploit Title: GSearch v1.0.1.0 - Denial of Service (PoC)
EA Origin < 10.5.38 - Remote Code Execution
# Exploit Title: EA Origin
Tuneclone 2.20 – Local SEH Buffer Overflow
# Exploit Title: TuneClone Local Seh Exploit
HC10 HC.Server Service 10.14 – Remote Invalid Pointer Write
[+] Credits: John Page (aka hyp3rlinx)
Aida64 6.00.5100 – ‘Log to CSV File’ Local SEH Buffer Overflow
#!/usr/bin/python
ProShow 9.0.3797 – Local Privilege Escalation
#!/usr/bin/python
Microsoft Windows – AppX Deployment Service Local Privilege Escalation (3)
CVE-2019-0841 BYPASS #2
VMware WorkStation 12.5.3 – Virtual Machine Escape
# VMware Escape Exploit
DVD X Player 5.5 Pro – Local Buffer Overflow (SEH)
# Exploit Title: DVDXPlayer 5.5 Pro Local Buffer Overflow with SEH
Nvidia GeForce Experience Web Helper – Command Injection
Press CTRL+V+Enter
Microsoft Windows Remote Desktop – ‘BlueKeep’ Denial of Service
import socket, sys, struct
Free SMTP Server 2.5 – Denial of Service (PoC)
#Exploit Title: Free SMTP Server - Local Denial of Service Crash (PoC)
Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass
# Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL
Pidgin 2.13.0 – Denial of Service (PoC)
# -*- coding: utf-8 -*-
Fast AVI MPEG Joiner – ‘License Name’ Denial of Service (PoC)
# Exploit Title: Fast AVI MPEG Joiner Dos Exploit
Microsoft Internet Explorer Windows 10 1809 17763.316 – Scripting Engine Memory Corruption
# Exploit Title: Microsoft Internet Explorer Windows 10 1809 17763.316 - Scripting Engine Memory Corruption
Cyberoam General Authentication Client 2.1.2.7 – ‘Server Address’ Denial of Service (PoC)
#Exploit Title: Cyberoam General Authentication Client 2.1.2.7 - Denial of Service (PoC)
Cyberoam Transparent Authentication Suite 2.1.2.5 – ‘NetBIOS Name’ Denial of Service (PoC)
#Exploit Title: Cyberoam Transparent Authentication Suite 2.1.2.5 - 'NetBIOS Name' Denial of Service (PoC)
Cyberoam Transparent Authentication Suite 2.1.2.5 – ‘Fully Qualified Domain Name’ Denial of Service (PoC)
#Exploit Title: Cyberoam Transparent Authentication Suite 2.1.2.5 - 'Fully Qualified Domain Name' Denial of Service (...
Cyberoam SSLVPN Client 1.3.1.30 – ‘HTTP Proxy’ Denial of Service (PoC)
#Exploit Title: Cyberoam SSLVPN Client 1.3.1.30 - 'HTTP Proxy' Denial of Service (PoC)
Cyberoam SSLVPN Client 1.3.1.30 – ‘Connect To Server’ Denial of Service (PoC)
#Exploit Title: Cyberoam SSLVPN Client 1.3.1.30 - 'Connect To Server' Denial of Service (PoC)
Axessh 4.2 – ‘Log file name’ Local Stack-based Buffer Overflow
# Title: Axessh 4.2 - 'Log file name' Local Stack-based Buffer Overflow
Microsoft Windows – AppX Deployment Service Local Privilege Escalation (2)
There is still a vuln in the code triggered by CVE-2019-0841
Microsoft Windows 10 (17763.379) – Install DLL
edit: Figure out how this works for yourself. I can't be bothered. It's a really hard race, doubt anyone will be able...
Microsoft Windows 10 1809 – ‘CmKeyBodyRemapToVirtualForEnum’ Arbitrary Key Enumeration Privilege Escalation
Windows: CmKeyBodyRemapToVirtualForEnum Arbitrary Key Enumeration EoP
Terminal Services Manager 3.2.1 – Denial of Service
# -*- coding: utf-8 -*-
NetAware 1.20 – ‘Share Name’ Denial of Service (PoC)
# -*- coding: utf-8 -*-
NetAware 1.20 – ‘Add Block’ Denial of Service (PoC)
# -*- coding: utf-8 -*-
Microsoft Internet Explorer 11 – Sandbox Escape
Inject into IE11.
Microsoft Windows (x86/x64) – ‘Error Reporting’ Discretionary Access Control List / Local Privilege Escalation
EDIT: Apparently this was patched earlier this month.. so whatever.
TapinRadio 2.11.6 – ‘Uername’ Denial of Service (PoC)
#Exploit Title: TapinRadio 2.11.6 - 'Uername' Denial of Service (PoC)
TapinRadio 2.11.6 – ‘Address’ Denial of Service (PoC)
#Exploit Title: TapinRadio 2.11.6 - 'Address' Denial of Service (PoC)
RarmaRadio 2.72.3 – ‘Username’ Denial of Service (PoC)
#Exploit Title: RarmaRadio 2.72.3 - 'Username' Denial of Service (PoC)
RarmaRadio 2.72.3 – ‘Server’ Denial of Service (PoC)
#Exploit Title: RarmaRadio 2.72.3 - 'Server' Denial of Service (PoC)