jetlib.sec » Tags » windows-management-instrumentation

Feeds

268039 items (8 unread) in 27 feeds

• 0day.today (was: 1337day, Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines (8 unread)
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

24 items tagged "windows management instrumentation"

Related tags: code execution [+], printer [+], oracle [+], easy [+], code [+], xmlsimpleaccessor [+], xmlcachemgr [+], windows xp sp3 [+], webkit [+], web [+], upload [+], traversal [+], target host [+], studio [+], proficy [+], oracle database 11g [+], ocx [+], o driver [+], indusoft [+], ice [+], file [+], execution [+], directory traversal vulnerability [+], database [+], creation vulnerability [+], creation [+], business transaction management [+], black [+], apple safari [+], instrumentation service [+]

• November 14, 2012
• 18:54

  Oracle Database Client System Analyzer Arbitrary File Upload

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits an arbitrary file upload vulnerability on the Client Analyzer component as included in Oracle Database 11g, which allows remote attackers to upload and execute arbitrary code. This Metasploit module has been tested successfully on Oracle Database 11g 11.2.0.1.0 on Windows 2003 SP2, where execution through the Windows Management Instrumentation service has been used.

  Tags:  upload oracle database windows-management-instrumentation oracle-database-11g instrumentation-service  

• 18:54

  Oracle Database Client System Analyzer Arbitrary File Upload

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits an arbitrary file upload vulnerability on the Client Analyzer component as included in Oracle Database 11g, which allows remote attackers to upload and execute arbitrary code. This Metasploit module has been tested successfully on Oracle Database 11g 11.2.0.1.0 on Windows 2003 SP2, where execution through the Windows Management Instrumentation service has been used.

  Tags:  upload oracle database windows-management-instrumentation oracle-database-11g instrumentation-service  

• 18:54

  Oracle Database Client System Analyzer Arbitrary File Upload

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits an arbitrary file upload vulnerability on the Client Analyzer component as included in Oracle Database 11g, which allows remote attackers to upload and execute arbitrary code. This Metasploit module has been tested successfully on Oracle Database 11g 11.2.0.1.0 on Windows 2003 SP2, where execution through the Windows Management Instrumentation service has been used.

  Tags:  upload oracle database windows-management-instrumentation oracle-database-11g instrumentation-service  

• October 10, 2012
• 23:59

  KeyHelp ActiveX LaunchTriPane Remote Code Execution

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits a code execution vulnerability in the KeyScript ActiveX control from keyhelp.ocx. It is packaged in several products or GE, such as Proficy Historian 4.5, 4.0, 3.5, and 3.1, Proficy HMI/SCADA 5.1 and 5.0, Proficy Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Driver between 7.20 and 7.42. When the control is installed with these products, the function "LaunchTriPane" will use ShellExecute to launch "hh.exe", with user controlled data as parameters. Because of this, the "-decompile" option can be abused to write arbitrary files on the remote system. Code execution can be achieved by first uploading the payload to the remote machine, and then upload another mof file, which enables Windows Management Instrumentation service to execute it. Please note that this module currently only works for Windows before Vista. On the other hand, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3

  Tags:  code proficy execution o-driver windows-management-instrumentation target-host instrumentation-service  

• 23:59

  KeyHelp ActiveX LaunchTriPane Remote Code Execution

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits a code execution vulnerability in the KeyScript ActiveX control from keyhelp.ocx. It is packaged in several products or GE, such as Proficy Historian 4.5, 4.0, 3.5, and 3.1, Proficy HMI/SCADA 5.1 and 5.0, Proficy Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Driver between 7.20 and 7.42. When the control is installed with these products, the function "LaunchTriPane" will use ShellExecute to launch "hh.exe", with user controlled data as parameters. Because of this, the "-decompile" option can be abused to write arbitrary files on the remote system. Code execution can be achieved by first uploading the payload to the remote machine, and then upload another mof file, which enables Windows Management Instrumentation service to execute it. Please note that this module currently only works for Windows before Vista. On the other hand, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3

  Tags:  code proficy execution o-driver windows-management-instrumentation target-host instrumentation-service  

• 23:59

  KeyHelp ActiveX LaunchTriPane Remote Code Execution

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits a code execution vulnerability in the KeyScript ActiveX control from keyhelp.ocx. It is packaged in several products or GE, such as Proficy Historian 4.5, 4.0, 3.5, and 3.1, Proficy HMI/SCADA 5.1 and 5.0, Proficy Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Driver between 7.20 and 7.42. When the control is installed with these products, the function "LaunchTriPane" will use ShellExecute to launch "hh.exe", with user controlled data as parameters. Because of this, the "-decompile" option can be abused to write arbitrary files on the remote system. Code execution can be achieved by first uploading the payload to the remote machine, and then upload another mof file, which enables Windows Management Instrumentation service to execute it. Please note that this module currently only works for Windows before Vista. On the other hand, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3

  Tags:  code proficy execution o-driver windows-management-instrumentation target-host instrumentation-service  

• October 03, 2012
• 20:55

  InduSoft Web Studio Arbitrary Upload Remote Code Execution

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits a lack of authentication and authorization on the InduSoft Web Studio Remote Agent, that allows a remote attacker to write arbitrary files to the filesystem, by abusing the functions provided by the software. The module uses uses the Windows Management Instrumentation service to execute an arbitrary payload on vulnerable installations of InduSoft Web Studio on Windows pre Vista. It has been successfully tested on InduSoft Web Studio 6.1 SP6 over Windows XP SP3 and Windows 2003 SP2.

  Tags:  web indusoft studio windows-management-instrumentation windows-xp-sp3 instrumentation-service  

• 20:55

  InduSoft Web Studio Arbitrary Upload Remote Code Execution

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits a lack of authentication and authorization on the InduSoft Web Studio Remote Agent, that allows a remote attacker to write arbitrary files to the filesystem, by abusing the functions provided by the software. The module uses uses the Windows Management Instrumentation service to execute an arbitrary payload on vulnerable installations of InduSoft Web Studio on Windows pre Vista. It has been successfully tested on InduSoft Web Studio 6.1 SP6 over Windows XP SP3 and Windows 2003 SP2.

  Tags:  web indusoft studio windows-management-instrumentation windows-xp-sp3 instrumentation-service  

• 20:55

  InduSoft Web Studio Arbitrary Upload Remote Code Execution

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits a lack of authentication and authorization on the InduSoft Web Studio Remote Agent, that allows a remote attacker to write arbitrary files to the filesystem, by abusing the functions provided by the software. The module uses uses the Windows Management Instrumentation service to execute an arbitrary payload on vulnerable installations of InduSoft Web Studio on Windows pre Vista. It has been successfully tested on InduSoft Web Studio 6.1 SP6 over Windows XP SP3 and Windows 2003 SP2.

  Tags:  web indusoft studio windows-management-instrumentation windows-xp-sp3 instrumentation-service  

• September 14, 2012
• 17:39

  Oracle BTM FlashTunnelService Remote Code Execution

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits abuses the FlashTunnelService SOAP web service on Oracle Business Transaction Management 12.1.0.7 to upload arbitrary files, without authentication, using the WriteToFile method. The same method contains a directory traversal vulnerability, which allows to upload the files to arbitrary locations. In order to execute remote code two techniques are provided. If the Oracle app has been deployed in the same WebLogic Samples Domain a JSP can be uploaded to the web root. If a new Domain has been used to deploy the Oracle application, the Windows Management Instrumentation service can be used to execute arbitrary code. Both techniques has been successfully tested on default installs of Oracle BTM 12.1.0.7, Weblogic 12.1.1 and Windows 2003 SP2. Default path traversal depths are provided, but the user can configure the traversal depth using the DEPTH option.

  Tags:  code traversal oracle business-transaction-management windows-management-instrumentation directory-traversal-vulnerability  

• 17:39

  Oracle BTM FlashTunnelService Remote Code Execution

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits abuses the FlashTunnelService SOAP web service on Oracle Business Transaction Management 12.1.0.7 to upload arbitrary files, without authentication, using the WriteToFile method. The same method contains a directory traversal vulnerability, which allows to upload the files to arbitrary locations. In order to execute remote code two techniques are provided. If the Oracle app has been deployed in the same WebLogic Samples Domain a JSP can be uploaded to the web root. If a new Domain has been used to deploy the Oracle application, the Windows Management Instrumentation service can be used to execute arbitrary code. Both techniques has been successfully tested on default installs of Oracle BTM 12.1.0.7, Weblogic 12.1.1 and Windows 2003 SP2. Default path traversal depths are provided, but the user can configure the traversal depth using the DEPTH option.

  Tags:  code traversal oracle business-transaction-management windows-management-instrumentation directory-traversal-vulnerability  

• 17:39

  Oracle BTM FlashTunnelService Remote Code Execution

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits abuses the FlashTunnelService SOAP web service on Oracle Business Transaction Management 12.1.0.7 to upload arbitrary files, without authentication, using the WriteToFile method. The same method contains a directory traversal vulnerability, which allows to upload the files to arbitrary locations. In order to execute remote code two techniques are provided. If the Oracle app has been deployed in the same WebLogic Samples Domain a JSP can be uploaded to the web root. If a new Domain has been used to deploy the Oracle application, the Windows Management Instrumentation service can be used to execute arbitrary code. Both techniques has been successfully tested on default installs of Oracle BTM 12.1.0.7, Weblogic 12.1.1 and Windows 2003 SP2. Default path traversal depths are provided, but the user can configure the traversal depth using the DEPTH option.

  Tags:  code traversal oracle business-transaction-management windows-management-instrumentation directory-traversal-vulnerability  

• January 17, 2012
• 17:10

  HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution

   » ‎ Packet Storm Security Exploits
  This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing the "CacheDocumentXMLWithId" method from the "XMLCacheMgr" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control (HPTicketMgr.dll 2.7.2.0). Code execution can be achieved by first uploading the payload to the remote machine embedding a vbs file, and then upload another mof file, which enables Windows Management Instrumentation service to execute the vbs. Please note that this module currently only works for Windows before Vista.

  Tags:  easy printer xmlcachemgr windows-management-instrumentation instrumentation-service code-execution  

• 17:10

  HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution

   » ‎ Packet Storm Security Recent Files
  This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing the "CacheDocumentXMLWithId" method from the "XMLCacheMgr" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control (HPTicketMgr.dll 2.7.2.0). Code execution can be achieved by first uploading the payload to the remote machine embedding a vbs file, and then upload another mof file, which enables Windows Management Instrumentation service to execute the vbs. Please note that this module currently only works for Windows before Vista.

  Tags:  easy printer xmlcachemgr windows-management-instrumentation instrumentation-service code-execution  

• 17:10

  HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing the "CacheDocumentXMLWithId" method from the "XMLCacheMgr" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control (HPTicketMgr.dll 2.7.2.0). Code execution can be achieved by first uploading the payload to the remote machine embedding a vbs file, and then upload another mof file, which enables Windows Management Instrumentation service to execute the vbs. Please note that this module currently only works for Windows before Vista.

  Tags:  easy printer xmlcachemgr windows-management-instrumentation instrumentation-service code-execution  

• October 18, 2011
• 7:10

  Apple Safari Webkit libxslt Arbitrary File Creation

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits a file creation vulnerability in the Webkit rendering engine. It is possible to redirect the output of a XSLT transformation to an arbitrary file. The content of the created file must be ASCII or UTF-8. The destination path can be relative or absolute. This Metasploit module has been tested on Safari and Maxthon. Code execution can be achieved by first uploading the payload to the remote machine in VBS format, and then upload a MOF file, which enables Windows Management Instrumentation service to execute the VBS.

  Tags:  file creation webkit apple-safari windows-management-instrumentation instrumentation-service creation-vulnerability  

• 7:10

  Apple Safari Webkit libxslt Arbitrary File Creation

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits a file creation vulnerability in the Webkit rendering engine. It is possible to redirect the output of a XSLT transformation to an arbitrary file. The content of the created file must be ASCII or UTF-8. The destination path can be relative or absolute. This Metasploit module has been tested on Safari and Maxthon. Code execution can be achieved by first uploading the payload to the remote machine in VBS format, and then upload a MOF file, which enables Windows Management Instrumentation service to execute the VBS.

  Tags:  file creation webkit apple-safari windows-management-instrumentation instrumentation-service creation-vulnerability  

• 7:10

  Apple Safari Webkit libxslt Arbitrary File Creation

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits a file creation vulnerability in the Webkit rendering engine. It is possible to redirect the output of a XSLT transformation to an arbitrary file. The content of the created file must be ASCII or UTF-8. The destination path can be relative or absolute. This Metasploit module has been tested on Safari and Maxthon. Code execution can be achieved by first uploading the payload to the remote machine in VBS format, and then upload a MOF file, which enables Windows Management Instrumentation service to execute the VBS.

  Tags:  file creation webkit apple-safari windows-management-instrumentation instrumentation-service creation-vulnerability  

• August 21, 2011
• 9:42

  HP Easy Printer Care XMLSimpleAccessor Class ActiveX Control Remote Code Execution

   » ‎ Packet Storm Security Exploits
  This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing via Directory Traversal attack the "saveXML" method from the "XMLSimpleAccessor" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control (HPTicketMgr.dll 2.7.2.0). Code execution can be achieved by first uploading the payload to the remote machine embedding a vbs file, and then upload another mof file, which enables Windows Management Instrumentation service to execute the vbs. Please note that this module currently only works for Windows before Vista.

  Tags:  easy printer xmlsimpleaccessor windows-management-instrumentation instrumentation-service code-execution  

• 9:42

  HP Easy Printer Care XMLSimpleAccessor Class ActiveX Control Remote Code Execution

   » ‎ Packet Storm Security Recent Files
  This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing via Directory Traversal attack the "saveXML" method from the "XMLSimpleAccessor" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control (HPTicketMgr.dll 2.7.2.0). Code execution can be achieved by first uploading the payload to the remote machine embedding a vbs file, and then upload another mof file, which enables Windows Management Instrumentation service to execute the vbs. Please note that this module currently only works for Windows before Vista.

  Tags:  easy printer xmlsimpleaccessor windows-management-instrumentation instrumentation-service code-execution  

• 9:42

  HP Easy Printer Care XMLSimpleAccessor Class ActiveX Control Remote Code Execution

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing via Directory Traversal attack the "saveXML" method from the "XMLSimpleAccessor" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control (HPTicketMgr.dll 2.7.2.0). Code execution can be achieved by first uploading the payload to the remote machine embedding a vbs file, and then upload another mof file, which enables Windows Management Instrumentation service to execute the vbs. Please note that this module currently only works for Windows before Vista.

  Tags:  easy printer xmlsimpleaccessor windows-management-instrumentation instrumentation-service code-execution  

• June 21, 2011
• 12:25

  Black Ice Cover Page ActiveX Control Arbitrary File Download

   » ‎ Packet Storm Security Exploits
  This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX Control (BIImgFrm.ocx 12.0.0.0). Code execution can be achieved by first uploading the payload to the remote machine, and then upload another mof file, which enables Windows Management Instrumentation service to execute the binary. Please note that this module currently only works for Windows before Vista. Also, a similar issue is reported in BIDIB.ocx (10.9.3.0) within the Barcode SDK.

  Tags:  ocx black ice windows-management-instrumentation instrumentation-service code-execution  

• 12:25

  Black Ice Cover Page ActiveX Control Arbitrary File Download

   » ‎ Packet Storm Security Recent Files
  This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX Control (BIImgFrm.ocx 12.0.0.0). Code execution can be achieved by first uploading the payload to the remote machine, and then upload another mof file, which enables Windows Management Instrumentation service to execute the binary. Please note that this module currently only works for Windows before Vista. Also, a similar issue is reported in BIDIB.ocx (10.9.3.0) within the Barcode SDK.

  Tags:  ocx black ice windows-management-instrumentation instrumentation-service code-execution  

• 12:25

  Black Ice Cover Page ActiveX Control Arbitrary File Download

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX Control (BIImgFrm.ocx 12.0.0.0). Code execution can be achieved by first uploading the payload to the remote machine, and then upload another mof file, which enables Windows Management Instrumentation service to execute the binary. Please note that this module currently only works for Windows before Vista. Also, a similar issue is reported in BIDIB.ocx (10.9.3.0) within the Barcode SDK.

  Tags:  ocx black ice windows-management-instrumentation instrumentation-service code-execution