GSX Analyzer 10.12/11 – ‘main.swf’ Hard-Coded Superadmin Credentials
# Exploit Title: GSX Analyzer hardcoded superadmin credentials in Main.swf
windows
windows 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Microsoft WinDbg – ‘logviewer.exe’ Crash (PoC)
[+] Credits: HYP3RLINX
InstantHMI 6.1 – Local Privilege Escalation
Title: InstantHMI - EoP: User to ADMIN
Hide.Me VPN Client 1.2.4 – Local Privilege Escalation
Title: Hide.Me VPN Client - EoP: User to SYSTEM
GE Proficy HMI/SCADA CIMPLICITY 8.2 – Local Privilege Escalation
# Exploit Title: GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit(0 day)
Cuckoo Sandbox Guest 2.0.1 – XMLRPC Privileged Remote Code Execution
# -*- coding: utf8 -*-
Lenovo ThinkPad – System Management Mode Arbitrary Code Execution
Source: https://github.com/Cr4sh/ThinkPwn
Panda Security (Multiple Products) – Local Privilege Escalation
# Exploit Title: Panda Security Privilege Escalation
VUPlayer 2.49 (Windows 7) – ‘.m3u’ Local Buffer Overflow (DEP Bypass)
#!/usr/bin/env python
Mediacoder 0.8.43.5830 – ‘.m3u’ Local Buffer Overflow (SEH)
#!/usr/bin/python
Microsoft Internet Explorer 11 (Windows 10) – VBScript Memory Corruption (MS16-051)
Source: https://github.com/theori-io/cve-2016-0189
Microsoft Windows Kernel – ‘ATMFD.dll’ NamedEscape 0x250C Pool Corruption (MS16-074)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=785
Microsoft Windows – ‘gdi32.dll’ Multiple DIB-Related EMF Record Handlers Heap Out-of-Bounds Reads/Memory Disclosure (MS16-074)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=757
Gemalto Sentinel License Manager 18.0.1.55505 – Directory Traversal
Gemalto Sentinel License Manager 18.0.1 Directory Traversal Vulnerability
Blat 3.2.14 – Stack Overflow
1. Vulnerable Product Version:
Microsoft Windows 7 – win32k Bitmap Use-After-Free (MS16-062) (2)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=747
Microsoft Windows 7 – win32k Bitmap Use-After-Free (MS16-062) (1)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=746
AdobeUpdateService 3.6.0.248 – Unquoted Service Path Privilege Escalation
----------------------------------------------------------------------------------------------------------
Easy RM to MP3 Converter 2.7.3.700 – ‘.m3u’ File (Universal ASLR + DEP Bypass)
# Exploit Title: Easy RM to MP3 Converter 2.7.3.700 (.m3u) File BoF Exploit with Universal DEP+ASLR bypass
Riot Games League of Legends – Insecure File Permissions Privilege Escalation
------------------------------------------------------------------------------------
Armadito Antimalware – Backdoor Access/Bypass
# Exploit Title : Armadito antimalware - Backdoor/Bypass
Matrix42 Remote Control Host 3.20.0031 – Unquoted Path Privilege Escalation
# Exploit Title: Matrix42 Remote Control Host - Unquoted Path Privilege Escalation
League of Legends Screensaver – Insecure File Permissions Privilege Escalation
# Exploit Title: League of Legends Screensaver Insecure File Permissions
League of Legends Screensaver – Unquoted Service Path Privilege Escalation
# Exploit Title: League of Legends Screensaver Unquoted Service Paths
Valve Steam 3.42.16.13 – Local Privilege Escalation
# Exploit Title: Valve Steam 3.42.16.13 Local Privilege Escalation
HP Data Protector A.09.00 – Encrypted Communications Arbitrary Command Execution (Metasploit)
# Exploit Title: Data Protector Encrypted Communications
VideoLAN VLC Media Player 2.2.1 – ‘DecodeAdpcmImaQT’ Buffer Overflow
In modules/codec/adpcm.c, VLC can be made to perform an out-of-bounds
HP Data Protector A.09.00 – Arbitrary Command Execution
#!/usr/bin/python
Micro Focus Rumba+ 9.4 – Multiple Stack Buffer Overflow Vulnerabilities
Micro Focus Rumba+ v9.4 Multiple Stack Buffer Overflow Vulnerabilities
Operation Technology ETAP 14.1.0 – Multiple Stack Buffer Overrun Vulnerabilities
Operation Technology ETAP 14.1.0 Multiple Stack Buffer Overrun Vulnerabilities
Operation Technology ETAP 14.1.0 – Local Privilege Escalation
Operation Technology ETAP 14.1.0 Local Privilege Escalation
VirIT Explorer Lite & Pro 8.1.68 – Local Privilege Escalation
Full title: VirIT Explorer Lite & Pro v.8.1.68 Local Privilege Escalation (System)/Arbitrary Code Execution
Microsoft Windows – ‘gdi32.dll’ Multiple ‘EMF COMMENT_MULTIFORMATS’ Record Handling (MS16-055)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=729
Microsoft Windows – ‘gdi32.dll’ Multiple ‘EMF CREATECOLORSPACEW’ Record Handling (MS16-055)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=722
Hex : Shard of Fate 1.0.1.026 – Unquoted Path Privilege Escalation
-----------------------------------------------------------------------------------------------------------------
Microsoft Excel 2010 – Crash (PoC) (2)
Microsoft Office is prone to a remote denial-of-service vulnerability.
Multiples Nexon Games – Unquoted Path Privilege Escalation
-----------------------------------------------------------------------------------------------------------------
Trend Micro – ‘CoreServiceShell.exe’ Multiple HTTP s
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=775
Microsoft Windows Media Center – ‘.MCL’ File Processing Remote Code Execution (MS16-059)
Exploit Title: Microsoft Windows Media Center .MCL File Processing Remote Code Execution Vulnerability (MS16-059)
Intuit QuickBooks Desktop 2007 < 2016 - Arbitrary Code Execution
+ Credits: Maxim Tomashevich from Thegrideon Software
FileZilla FTP Client 3.17.0.0 – Unquoted Path Privilege Escalation
-----------------------------------
CIScan 1.00 – Hostname/IP Field Overwrite (SEH) (PoC)
#!/usr/bin/python