What this repo is: After obtaining my OSCP, as preparation for my upcoming OSCE certification I challenged myself to re-write 50 proof of concepts for pre-existing exploits in software, all of which are Windows based.
NO looking at the original POC 😣 no cheating
Secondly, this repo contains a handful of 0 days and CVE publications I have discovered and contributed while searching for new vulnerabilities in software.
Welcome to the early 2000's :)
I am writing 50 POC's for various exploits for educational purposes.
Exploits written : 29/50
Metasploit modules: 1
Metasploit contributions : 0
0day discoveries : 6
Assigned CVE's : 2
I would like to include but not be limited to : Vannila EIP overwrite, SEH egghunters, ASLR/DEP/NX , SafeSeh, Stack cookies, unicode restrictions, and much more...
- Vulnserver TRUN vanilla EIP overflow
- FreeFloat FTP Server vanilla EIP overflow
- PCMan FTP Server vanilla EIP overflow
- Brainpan VulnHub box vanilla EIP overflow
- DoStackBufferOverflowGood vanilla EIP overflow
- MiniShare 1.4.1 vanilla EIP overflow
- ASX to MP3 converter 3.1.2.1 vanilla EIP overflow
- VUPlayer 2.49 .wax vanilla EIP overflow
Standard:
- Easy File Sharing Web Server SEH overflow
- Millenium MP3 Studio 2.0 SEH overflow
- Free MP3 CD Ripper 2.6 SEH overflow
- RGUI i386 3.4.4 local SEH overflow
- Audiograbber 1.83 local SEH overflow
- 10-Strike Network Inventory Explorer SEH overflow
With egghunter: 2004 whitepaper
- Easy File Sharing Web Server SEH overflow egghunter
- Vulnserver GMON SEH overflow egghunter
- Xitami Web Server 2.5 SEH overflow egghunter partial SEH overwrite
Unicode restrictions: 2002 whitepaper
- GoldWave 5.70 local SEH unicode bypass Venetian alignment
- CodeBlocks 17.12 local SEH unicode bypass Venetian alignment
Alphanumeric restrictions:
- Vulnserver LTER vanilla EIP overflow alphanumeric bypass
- Vulnserver TRUN DEP enabled ROP chain - VirtualProtect() method
- ASX to MP3 converter 3.1.2.1 DEP enabled ROP chain - VirtualProtect() method
- VUPlayer 2.49 DEP enabled ROP chain - VirtualProtect() method
- RSP MP3 Player - OCX ActiveX EIP heap spray
- exploit-db DeviceViewer Sricam 3.12x local DOS buffer overflow
- exploit-db Easy File Sharing Web Server 7.2 SEH overflow
- CVE-2019-16724 File Sharing Wizard remote SEH overflow
- CVE-2019-17181 IntraSrv webserver 1.0 SEH overflow
Someone else contributing my exploits: