168 bytes small Linux/x86 NOT +SHIFT-N+ XOR-N encoded /bin/sh shellcode.
0535e81b0ede463cd0f475670e1e4a07b636b91c018625cd31f6d3df4b1a1c98Microsoft Windows 7 Build 7601 (x86) local privilege escalation exploit.
48d06e50b882f363ce29fb915222dd7ed84f617e38b68912b67b47eacf8f0564An elevation of privilege vulnerability exists in Microsoft Windows when the Win32k component fails to properly handle objects in memory. This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This Metasploit module is tested against Windows 10 v1703 x86.
b12d041b74805140215567e34bac24168770da5ed39aeeca4562c66332b7d51761 bytes small Linux/x86 chmod 666 /etc/passwd and chmod 666 /etc/shadow shellcode.
4ec34454d2a15a5707726a311258a81f29cac15bb8923a1070f411e5d6e0843721 bytes small Linux/x86 execve /bin/sh using JMP-CALL-POP shellcode.
7072ff03bdce88914fe922536fba949945b1a59a092d1841f88e4040fc7d73f5129 bytes small Linux/x86 chmod + execute + hide output via /usr/bin/wget shellcode.
d71026b126f921724e16445e34b085a5d7ac0a2d632fd2da03c87d64173716c6191 bytes small Windows/x86 start iexplore.exe shellcode.
0847049573c193746ea36e43de7fcdafd94e46024c09f28c2f50f959e6cc4353210 bytes small Windows/x86 bitsadmin download and execute shellcode.
e9d5c3f3eed4ac99877670df0c79846e46237e60811013236f0f91d47c45142aLinux/x86 ASCII AND, SUB, PUSH, POPAD encoder shellcode.
0f59482898b8c68eff13a6977fa8a7526c9180866f8a667284241beca5475c1066 bytes small Linux/x86 Reposition + INC encoder with execve(/bin/sh) shellcode.
e80a4bf85e6119d70fae11d28f8d56550cec2e134850fe17f134fd35b79dc63643 bytes small Linux/x86 /sbin/iptables -F shellcode.
6446bf86d89910de8c55dcd39fd9780b1c1fbb891262e2a8b15260ab4642484120 bytes small Linux/x86 execve /bin/sh shellcode.
31a2c43fd439c5d7bc541e9c1b71463958758c334d675cd7ab929cc856150d92This exploit takes advantage of a use after free vulnerability in Google Chrome 72.0.3626.119 running on Windows 7 x86. The FileReader.readAsArrayBuffer function can return multiple references to the same ArrayBuffer object, which can be freed and overwritten with sprayed objects. The dangling ArrayBuffer reference can be used to access the sprayed objects, allowing arbitrary memory access from Javascript. This is used to write and execute shellcode in a WebAssembly object. The shellcode is executed within the Chrome sandbox, so you must explicitly disable the sandbox for the payload to be successful.
60039dc761905e4a2ed93286404ec19777dfd73ef434ef8a80431ab28e2ebbc159 bytes small Linux/x86 multiple keys XOR encoder / decoder execve(/bin/sh) shellcode.
f535c1389683c122f2cb79a76398628c16ef71ccc62b96cc600d41025a01319972 bytes small Linux/x86 shred file shellcode.
d2c6924adaead208a3b0dc435c7c97695d43eb953acf4b9059c341fc8aa4ec92185 bytes small Linux/x86 OpenSSL encrypt files with aes256cbc shellcode.
842ea3d9b6e3a57c98cbfbd303fd9a148692bcc94bb775068c44aa706bd3117691 bytes small Linux/x86 reverse shell shellcode and python wrapper.
3f52529e418f414d105f6075e8a10c26fdb6816068e0780c0c7b2c9eae52579a200 bytes small Linux/x86 rabbit shellcode crypter.
fb37ba82e4027cf10d73e32e412a4e7e6aa23a6579a76d4bce9a870c287d9323125 bytes small Linux/x86 cat file encode to base64 and post via curl to webserver shellcode.
2919240ee9666114771f7201d4f70cd1483e03a840365e658c60c14e1af48c2c61 bytes small Linux/x86 MMX-PUNPCKLBW encoder shellcode.
1c90863f3df70f5b09f6aded2f996bf748aa46d19feb3aba4e7bbd6ec5224d33149 bytes small Linux/x86 add user to passwd file shellcode.
bf73d95b4a5baef9f67e3f2b18778db4bfc0f6b65967c221db6809a94407bca0Linux/x86 polymorphic shellcode for execve(/bin/sh).
9858aa6d8f4d92a761b460a1cec910804adffbe53f7032067351eca04c326c30Anyburn version 4.3 x86 "Copy disc to image file" buffer overflow SEH unicode exploit.
093efaf0e4484fa5ee3691f96a71fdfc76d836f48b33f9b0e592f75d34a8ad15Linux/x86 insertion encoder and decoder shellcode.
232a3ba577ebd0f1ab1c5e2f99d661e44cd0cb77813fb985d5c81b3e1fb9f5e4This Metasploit module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit Intel processors. By design, 64-bit processors following the X86-64 specification will trigger a general protection fault (GPF) when executing a SYSRET instruction with a non-canonical address in the RCX register. However, Intel processors check for a non-canonical address prior to dropping privileges, causing a GPF in privileged mode. As a result, the current userland RSP stack pointer is restored and executed, resulting in privileged code execution.
f1711c3320d7c4e9f80661d007057fb1b0b673f47fb51ec2968a821bc6aa8991
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed