what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 2 of 2

Files from Maurice Lambert

Windows IIS HTTP Protocol Stack Denial of Service

Posted Aug 31, 2024

Authored by Max, Axel Souchet, Maurice Lambert, Stefan Blair | Site metasploit.com

This Metasploit module exploits CVE-2021-31166, a UAF bug in http.sys when parsing specially crafted Accept-Encoding headers that was patched by Microsoft in May 2021, on vulnerable IIS servers. Successful exploitation will result in the target computer BSODing before subsequently rebooting. Note that the target IIS server may or may not come back up, this depends on the targets settings as to whether IIS is configured to start on reboot.

tags | exploit, web

advisories | CVE-2021-31166

SHA-256 | 97a44dc1fe6ca954dc341018f61c578a60177d84f6f32df13fcea55667e3fca9

Download | Favorite | View

IBM Aspera Faspex 4.4.1 YAML Deserialization

Posted Apr 10, 2023

Authored by Maurice Lambert

IBM Aspera Faspex version 4.4.1 suffers from a YAML deserialization vulnerability that allows for remote code execution.

tags | exploit, remote, code execution

advisories | CVE-2022-47986

SHA-256 | 851197a9c78b72ed89c274b80a50129715c1293643e1edf051953df3f1432a43

Download | Favorite | View