.:[packet storm]:.
 

 
 
about | forums | assessment | defense | papers | magazines | miscellaneous | links


To change sort order, click on the category. Sorted By: Last Modified.
.: exploits for january, 2001
File Name File Size Last Modified MD5 Checksum
hk-0.1.zip19330Dec 18 2001 11:20:21c304bfd8147a60c82839eaa4930b067a
Microsoft HK local exploit - Executes any command as SYSTEM, as described in MS01-003. Good for recovering lost admin rights. Includes C source and binary.  Homepage: http://razor.bindview.com. By Todd Sabin
prober.php3.tgz4116Nov 12 2001 11:12:553b84eccc265a9360ac00d4e6a518d991
This is wuftpd2.6.0x and qpop2.1.4 exploit ported to PHP. Even php in safe mode can not stop this script from working. Webhosting providers who provide PHP need to be careful. By Luki Rustianto
unicode_shell.pl8023Apr 24 2001 16:55:072fe5c09d88a363ca4fa10754b99b24ca
Unicode_shell.pl is an exploit for the IIS unicode bug which allows you to enter commands as if in a cmd.exe shell and uses 20 different URL's to check for the vulnerability. By B-Root
0101-exploits.tgz77851Feb 1 2001 18:34:41529b73bf0d83aa85bfa82f9b57548e48
Packet Storm new exploits for January, 2001.
bind-tsig.c13043Feb 1 2001 10:06:43cd4a8638d718185f1f26451e0817ef66
Bind-tsig.c is a trojan which pretends to be a Bind 8 exploit, but actually attacks dns1.nai.com. By Anonymous
progress-db.txt16122Jan 31 2001 10:47:12d02e5d8479bbefc220465668d82b3f20
The Progress Database Server v8.x and 9.x for Unix has several locally exploitable buffer overflows which can allow arbitrary code to run as root. Proof of concept exploit attached. By Krfinisterre
naptha-1.1.tgz5371Jan 27 2001 01:16:189e461df6b11c94a3409cd933dfbe9a0a
Naptha v1.1 is a denial of service attack against many OS's which uses established TCP connections to create a resource starvation attack. Includes three tools - bogusarp makes a bogus entry in the router's arp cache so it actually puts packets with our faked source address on the Ethernet, synsend, and srvr which replaces ackfin from Naptha 1.0. Tested against Windows 95, 98 and NT4 and more. Compiles on Linux 2.2.x, OpenBSD 2.7, FreeBSD 4.0.  Homepage: http://razor.bindview.com. By Robert Keyes
glibc-resolve-tr.sh1013Jan 26 2001 23:45:314c421f7d5f1a7e40155c52fc44daa995
Glibc prior to v2.1.9x allows local users to read any file. This shell script exploits this bug using the Openssh-2.3.0p1 binary. Tested against Debian 2.3 and Redhat 7.0. By Charles Stevenson
write.c1420Jan 26 2001 23:42:20fe5dc0ffbbd4dbd5da424b640fbbdb5b
/usr/bin/write overflow proof of concept exploit - Tested against Solaris 7 x86. By Pablo Sor
rctab.tar.gz3320Jan 26 2001 23:38:2651769f0a559e55a0fbe445c318e64d5b
Due to a various race conditions in the init level editing script /sbin/rctab it is possible for any local user to overwrite any system's file with arbitrary data. This may result in denial of service attack, local or even remote root compromise, if root runs the /sbin/rctab script. Tested against SuSE 7.0. By Ihaquer.
mscreen.c2009Jan 26 2001 23:36:200d6decf4c717851249cad2b166d2b635
SCO OpenServer v5.0.5 /usr/bin/mscreen local exploit. By K2
tru-64.su.c3121Jan 26 2001 23:32:483dd785c49420cd2ce460d0f2717087ad
Tru64 (OSF/1) /usr/bin/su local exploit - Works if executable stack is on. By K2
ecepass.tar.gz2538Jan 26 2001 23:07:1181b9fda7f3e1e97294cd43a16f4d4c76
FreeBSD ipfw+ECE proof of concept code - Using FreeBSD divert rule, all outgoing traffic will have the ECE flag added to it, bypassing ipfw if it passes established connections.  Homepage: http://sensepost.com. By Plathond
ns-shtml.pl2817Jan 26 2001 23:02:45bd9a07a89b35b15672e6de6fbc167ecf
Netscape Enterprise Server 4.0 remote root exploit - Tested against Sparc SunOS 5.7. By Fyodor
spitvt.c7352Jan 25 2001 14:08:1097dcfd07f4dcf6be30fef0197b1c1ca1
SplitVT v1.6.4 and below local format string exploit which overflows the -rcfile command line flag. Tested on Slackware 7.1, Debian 2.2.  Homepage: ftp://maxx.via.ecp.fr/spitvt. By Michel MaXX Kaempf
unitools.tgz5543Jan 24 2001 23:21:5631eb60d9e98049816c3c0907cb176c03
Unitools.tgz contains two perl scripts - unicodeloader.pl uploads files to a vulnerable IIS site, and unicodexecute3.pl includes searches for more executable directories and is more robust and stable.  Homepage: http://www.sensepost.com. By Roelof W Temmingh
thong.pl3311Jan 24 2001 23:17:55d98c376f39aee68581c072f95ed01b71
Thong.pl is a perl script which exploits several vulnerabilities found in Cisco products. Includes the Cisco Catalyst ssh Protocol Mismatch dos, Cisco 675 Web Administration dos, Cisco Catalyst 3500 XL command execution, and the Cisco IOS Software HTTP Request dos.  Homepage: http://hypoclear.cjb.net. By Hypoclear
iris-dos.c3139Jan 24 2001 14:13:09644e11c8434d6546a2ada3504d491ce1
Denial of service attack against the Iris The Network Traffic Analyzer beta 1.01. Causes Iris to hang when it the traffic is examined.  Homepage: http://www.digit-labs.org. By Grazer
tcpdump-xploit.c6629Jan 14 2001 21:34:37289510d424aa0a665ee3161b20c9abab
Tcpdump v3.5.2 remote root exploit - Tested against X86 Linux. Exploits an overflow in the AFS packet parsing which requires the snaplen (-s) to be set to 500 or greater. Fixed in v3.62.  Homepage: http://hispahack.ccc.de. By Zhodiac
arpexp.c3203Jan 13 2001 10:46:249c79d0fb32487641840dd6b081e6d8fa
Solaris /usr/sbin/arp local root stack overflow exploit.  Homepage: http://www.securityfocus.com. By Sor Pablo Sebastian, Dave Ahmed
whois.pl1422Jan 12 2001 16:24:26cab6f0b2ef5ed6f5bb75170b42fd55ac
Whois.pl is a remote exploit for Fastgraf's whois.cgi perl script. By Marco van Berkum
sa2001_01.txt3874Jan 9 2001 00:24:47461b4b78a0613c22ce2385ec0debfced
NSFOCUS Security Advisory (SA2001-01) - The NetScreen Firewall / VPN Appliance has an overflow vulnerability in the web interface which allows remote users to crash the firewall with a large URL. All current versions of ScreenOS, including v1.73r1, 2.0r6, 2.1r3 and 2.5r1 are affected. Perl exploit included. Fix available here.  Homepage: http://www.nsfocus.com. By Nsfocus Security Team
thebat.traverse.txt3859Jan 8 2001 17:44:30ca77c4383a98f689f532016cfb080be4
The Bat! v1.48f and below has a client side vulnerability which allows malicious mail messages to add any files in any directory on the disk where user stores his attachments.  Homepage: http://www.security.nnov.ru. By 3apa3a
defcom.imagecast.txt2849Jan 8 2001 17:15:04b6325a0535100802bdaa273349db1d0a
Defcom Labs Advisory def-2001-01 - ImageCast V4.1.0 for Windows, a rapid-PC-deployment tool much like Ghost, has problems handling malformed input which result in a dos attack against the ImageCast Control Center.  Homepage: http://www.defcom.com. By Defcom Labs
defcom.websphere.txt2041Jan 8 2001 17:10:01d1c60ae0b02e1129be8ae653925d8ea4
Defcom Labs Advisory def-2001-02 - IBM WebSphere 3.52 (IBM HTTP Server 1.3.12) for Windows NT has a memory leak which can be used as a remote denial of service attack. Workaround included.  Homepage: http://www.defcom.com. By Defcom Labs
exhpcu.c1597Jan 8 2001 17:06:4541bfb9a22eefc441486dce25261ca9f9
HP-UX v11.00 /bin/cu local buffer overflow exploit - Exploits the -l option. Provides a uid=bin shell. By Zorgon
tar-symlink.txt3183Jan 8 2001 15:33:23600ae24fbc5281fc8a5b4b3c636d3903
GNU tar follows symlinks blindly, a problem if you untar as root.  Homepage: http://www.obit.nl. By Marco van Berkum
smr.tar.gz5606Jan 8 2001 15:25:19cac3eaee702ca738d65e56d47813af1f
Redhat rpc.statdx mass exploit - scans for vulnerable hosts and implants a bindshell. By God-
whois.cgi.txt922Jan 5 2001 18:07:54ea926901a6a2bcf609f547f5d7968695
Fastgraf's whois.cgi perl script lacks meta character checking, allowing remote users to execute arbitrary commands as uid of the webserver. By Marco van Berkum
guninski31.txt2004Jan 3 2001 16:00:57bd37b33afb22c4facab4302296179eec
Georgi Guninski security advisory #31 - There is a security vulnerability in Windows Media Player 7 exploitable thru IE which allows reading local files and executing arbitrary programs. The problem is the WMP ActiveX Control which allows launching javascript URLs in arbitrary already open frames. This allows taking over the frame's DOM. Includes exploit code. Demonstration available here.  Homepage: http://www.guninski.com. By Georgi Guninski
xgtk.c4055Jan 1 2001 23:09:390fd07dc3c51acefce8bf0ccd612371ad
Xgtk.c is a local exploit for any set*id program which use Gtk+ up to v1.2.8. Uses the GTK_MODULES environment variable to trick gtk into executing arbitrary commands contained in a bogus module.  Homepage: http://www.realhalo.org. By Vade79

 
 
Privacy Statement