?php // PHP = 7.0.4/5.5.33 SNMP format string exploit (32bit) // By Andrew Kramer andrew at jmpesp dot org // Should bypass ASLR/NX just fine // This exploit utilizes PHP's internal %Z (zval) // format specifier in order to achieve code-execution. /
### This module requires Metasploit: http://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::Remote::HttpClient include Ms
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=708 The external methods IGAccelGLContext::unmap_user_memory and IGAccelCLContext::unmap_user_memory take an 8 byte struct input which is a user-space pointer previously passed to t
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=709 nvDevice::ReleaseDeviceTexture is external method 0x10a of userclient 5 of the geforce IOAccelerator. It takes a single uint argument __text:000000000001BCD2 mov r14d, esi ... _
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=710 The AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however by racing two threads, one of which closes the userclient (which frees
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=728 External Method 36 of IOUSBInterfaceUserClient is _AbortStreamPipe. It takes two scalar inputs and uses the second one as an array index to read a pointer to a C++ object withou
#!/usr/bin/python# Blog post - http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.htmlfrom sys import argvimport optparsefrom urlparse import urlparsefrom re import compileimport socketimport requestsfrom requests.exceptions im
/* 1. Advisory Information Title: FreeBSD Kernel amd64_set_ldt Heap Overflow Advisory ID: CORE-2016-0005 Advisory URL: http://www.coresecurity.com/content/freebsd-kernel-amd64_set_ldt-heap-overflow Date published: 2016-03-16 Date of last update: 2016
