vb6stkit.dll is a module that contains application programming interface (API) functions that enable Visual Basic applications to create shortcuts (Shell Links) programmatically. In this poc we will create a form containing an overly long string that we pass to the third parameter (lpstrLinkPath) to own EIP. Arbitrary code execution is possible but today I drank a lot of wine therefore I was unable to write an exploit :-D
POC exploit for MS04-030 found by Amit Klein
Traindepot 0.1 is vulnerable to LFI and XSS attacks. The LFI vulnerability allows an attacker to include arbitrary local files, potentially leading to sensitive information disclosure or remote code execution. The XSS vulnerability allows an attacker to inject malicious scripts into the application, potentially leading to session hijacking or defacement of the website.
This exploit allows an attacker to include remote files in the WebCalendar v1.0.4 application. The vulnerability is triggered by the 'includedir' parameter in the 'send_reminders.php' file. By manipulating this parameter, an attacker can include a malicious file hosted on a remote server.
This exploit targets a vulnerability in the Windows Metafile (WMF) and Enhanced Windows Metafile (EMF) formats. It can be triggered by either viewing a malicious file or by navigating to a directory containing a malicious file that is displayed as a thumbnail. The vulnerability is related to a graphics rendering engine vulnerability (CAN-2004-0209). The exploit has been tested on Internet Explorer 6.0 (SP1), Explorer, and Windows XP SP1.
This exploit abuses the ProcessQueueFile command on SLX 6.1 servers to create arbitrary files on the filesystem of the SLX server. By using directory traversal, it is possible to escape from the Queue directory and write anywhere on the SLX server's filesystem.
This exploit allows an attacker to execute a bind shell on port 101 on systems running YahooPOPs <= 1.6 SMTP. The code is taken from the windows exploit by class101.
An attacker can determine valid, special, and non-existent user names on a remote ProFTPD server by measuring the time delay in the code execution path. This can be done by sending a 'USER' command and measuring the elapsed time between the command and the server response.
Exploiting the insecure handling of username in Basic Authentication information to return control (EIP) to payload
This is a remote exploit for Citadel/UX 6.07. It allows an attacker to execute arbitrary code on the vulnerable system.
Services By CQR