December 1, 2008 10:25 | by
[www.sebug.net]
The following procedures (methods) may contain something offensive，they are only for security researches and teaching , at your own risk!
The following procedures (methods) may contain something offensive，they are only for security researches and teaching , at your own risk!
Author: ring04h
Team:http://www.80vul.com
由于Discuz!的admin\database.inc.php里action=importzip解压zip文件时,导致可以得到webshell.
Team:http://www.80vul.com
由于Discuz!的admin\database.inc.php里action=importzip解压zip文件时,导致可以得到webshell.
November 27, 2008 11:39 | by
Discuz! 6.1 xss2webshell Exploit
作者：oldjun
早前在phpcms 0day频发的时候写的这个exp，藏着这个exp藏了一个多月吧，也没有拿它去打站，一直丢在我硬盘里，今天看到11期的黑防公布了，于是我也丢出来吧：
早前在phpcms 0day频发的时候写的这个exp，藏着这个exp藏了一个多月吧，也没有拿它去打站，一直丢在我硬盘里，今天看到11期的黑防公布了，于是我也丢出来吧：
Author: ryat_at_www.wolvez.org
由于Discuz! 的wap\index.php调用Chinese类里Convert方法在处理post数据时不当忽视对数组的处理,可使数组被覆盖为NULL.当覆盖$_DCACHE时导致导致xss sql注射 代码执行等众多严重的安全问题.
由于Discuz! 的wap\index.php调用Chinese类里Convert方法在处理post数据时不当忽视对数组的处理,可使数组被覆盖为NULL.当覆盖$_DCACHE时导致导致xss sql注射 代码执行等众多严重的安全问题.
Author: 80vul-A Team:http://www.80vul.com
由于Discuz!的admin\runwizard.inc.php里saverunwizardhistory()写文件操作没有限制导致执行代码漏洞.
由于Discuz!的admin\runwizard.inc.php里saverunwizardhistory()写文件操作没有限制导致执行代码漏洞.
In vstudio command prompt:
mk.bat
next:
attach debugger to services.exe (2k) or the relevant svchost (xp/2k3/...)
mk.bat
next:
attach debugger to services.exe (2k) or the relevant svchost (xp/2k3/...)
Nuke ET < = 3.4 (fckeditor) Remote Arbitrary File Upload Exploit
[
October 20, 2008 12:59 | by !4p47hy ]
It has been a long time since Token Kidnapping presentation (http://www.argeniss.com/research/TokenKidnapping.pdf)
was published so I decided to release a PoC exploit for Win2k3 that alows to execute code under SYSTEM account.
Basically if you can run code under any service in Win2k3 then you can own Windows, this is because Windows services accounts can impersonate. Other process (not services) that can impersonate are IIS 6 worker processes so if you can run code from an ASP .NET or classic ASP web application then you can own Windows too. If you provide shared hosting services then I would recomend to not allow users to run this kind of code from ASP.
was published so I decided to release a PoC exploit for Win2k3 that alows to execute code under SYSTEM account.
Basically if you can run code under any service in Win2k3 then you can own Windows, this is because Windows services accounts can impersonate. Other process (not services) that can impersonate are IIS 6 worker processes so if you can run code from an ASP .NET or classic ASP web application then you can own Windows too. If you provide shared hosting services then I would recomend to not allow users to run this kind of code from ASP.
