windows

Gh0st Client (C2 Server) – Remote Buffer Overflow (Metasploit)

##

Jungo DriverWizard WinDriver < 12.4.0 - Kernel Out-of-Bounds Write Privilege Escalation

# -*- coding: utf-8 -*-

Jungo DriverWizard WinDriver < 12.4.0 - Kernel Pool Overflow / Local Privilege Escalation (1)

# -*- coding: utf-8 -*-

Mongoose Web Server 6.5 – Cross-Site Request Forgery / Remote Code Execution

[+] Credits: John Page AKA hyp3rlinx

Dup Scout Enterprise 9.9.14 – ‘Input Directory’ Local Buffer Overflow

#!/usr/bin/python

Lotus Notes Diagnostic Tool 8.5/9.0 – Local Privilege Escalation

# Exploit Title: Lotus Notes Diagnostic Tool (nsd.exe) Privelege Escalation

Easy Vedio to PSP Converter 1.6.20 – Local Buffer Overflow (SEH)

#!/usr/bin/python

Easy RM RMVB to DVD Burner 1.8.11 – Local Buffer Overflow (SEH)

#!/usr/bin/python

Easy WMV/ASF/ASX to DVD Burner 2.3.11 – Local Buffer Overflow (SEH)

#!/usr/bin/python

Easy DVD Creator 2.5.11 – Local Buffer Overflow (SEH)

#!/usr/bin/python

Disk Pulse Enterprise 9.9.16 – Remote Buffer Overflow (SEH)

#!/usr/bin/env python

Sync Breeze Enterprise 9.9.16 – Remote Buffer Overflow (SEH)

#!/usr/bin/env python

Disk Savvy Enterprise 9.9.14 – Remote Buffer Overflow (SEH)

#!/usr/bin/env python

Dup Scout Enterprise 9.9.14 – Remote Buffer Overflow (SEH)

#!/usr/bin/env python

MP3 WAV to CD Burner 1.4.24 – Local Buffer Overflow (SEH)

#!/usr/bin/python

My Video Converter 1.5.24 – Local Buffer Overflow (SEH)

#!/usr/bin/python

Easy AVI DivX Converter 1.2.24 – Local Buffer Overflow (SEH)

#!/usr/bin/python

Easy Video to iPod/MP4/PSP/3GP Converter 1.5.20 – Local Buffer Overflow (SEH)

#!/usr/bin/python

Automated Logic WebCTRL 6.5 – Local Privilege Escalation

Automated Logic WebCTRL 6.5 Insecure File Permissions Privilege Escalation

Microsoft Windows – Escalate UAC Protection Bypass (Via COM Handler Hijack) (Metasploit)

##

VX Search Enterprise 9.9.12 – ‘Import Command’ Local Buffer Overflow

#!/usr/bin/python

Disk Savvy Enterprise 9.9.14 – ‘Import Command’ Local Buffer Overflow

#!/usr/bin/python

Disk Pulse Enterprise 9.9.16 – ‘Import Command’ Local Buffer Overflow

#!/usr/bin/python

PDF-XChange Viewer 2.5 Build 314.0 – Code Execution

# Exploit Title: PDF-XChange Viewer 2.5 (Build 314.0) Javascript API Remote Code Execution Exploit (Powershell PDF Ex...

Easy DVD Creater 2.5.11 – Local Buffer Overflow (SEH)

#!/usr/bin/python

ZKTime Web Software 2.0 – Improper Access Restrictions

Exploit Title: ZKTime Web Software 2.0 - Broken Authentication

ZKTime Web Software 2.0 – Cross-Site Request Forgery

Exploit Title: ZKTime Web Software 2.0 - Cross Site Request Forgery

MessengerScan 1.05 – Local Buffer Overflow (PoC)

#!/usr/bin/python

DSScan 1.0 – Local Buffer Overflow (PoC)

#!/usr/bin/python

Mozilla Firefox < 45.0 - 'nsHtml5TreeBuilder' Use-After-Free (EMET 5.52 Bypass)

CVE-2016-1960

MyDoomScanner 1.00 – Local Buffer Overflow (PoC)

#!/usr/bin/python

Microsoft Edge – Out-of-Bounds Access when Fetching Source

// The attached JavaScript file causes an out-of-bounds access of the source buffer when fetching the source for one ...

Adobe Flash – Invoke Accesses Trait Out-of-Bounds

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1320

Microsoft Edge 40.15063.0.0 Chakra – Incorrect JIT Optimization with TypedArray Setter #3

'use strict';

Microsoft Edge Chakra – ‘EmitNew’ Integer Overflow

let args = new Array(0x10000);

Microsoft Edge Chakra – Uninitialized Arguments (2)

function f() {

Microsoft Edge Chakra – Uninitialized Arguments (1)

function f() {

Microsoft Edge Chakra – ‘JavascriptFunction::EntryCall’ Fails to Handle ‘CallInfo’ Properly

function f() {

Microsoft Edge Chakra – ‘JavascriptArray::ConcatArgs’ Type Confusion

let a = [0];

Microsoft Edge Chakra – Incorrect JIT Optimization with TypedArray Setter #2

'use strict';

Microsoft Edge Chakra – ‘EmitAssignment’ uses the ‘this’ Register Without Initializing

class Parent {

Microsoft Edge Chakra – ‘TryUndeleteProperty’ Incorrect Usage (Denial of Service)

const kNumProperties = 100;

Microsoft Edge Chakra – ‘InterpreterStackFrame::ProcessLinkFailedAsmJsModule’ Incorrect Usage of ‘PushPopFrameHelper’ (Denial of Service)

function asmModule() {

Microsoft Edge Chakra – ‘InterpreterStackFrame::ProcessLinkFailedAsmJsModule’ Incorrectly Re-parses

class MyClass {

Microsoft Edge Chakra – Heap Buffer Overflow

POC

Microsoft Edge Chakra – NULL Pointer Dereference

POC

Microsoft Edge Chakra – Buffer Overflow

POC

Microsoft Edge Chakra – ‘chakra!Js::GlobalObject’ Integer overflow

POC

Microsoft Edge Chakra – ‘PreVisitCatch’ Missing Call

function trigger() {

Microsoft Edge 38.14393.1066.0 – ‘CInputDateTimeScrollerElement::_SelectValueInternal’ Out-of-Bounds Read