Core Certified Exploits

Library of expert validated exploits for safe and effective pen tests

Exploit development can be an advanced penetration testing skill that takes time to master. Additionally, when on a job, pen testers often don’t have the resources to create a new exploit. Many resort to searching for and using pre-written exploits that have not been tested and must go through the timely effort of quality assurance testing in order to ensure they are secure and effective.

Core Impact users can save time by finding all the up-to-date exploits they need in one place. We provide a robust library of exploits designed to enable pen testers to safely and efficiently conduct successful penetration tests. Whether written by our own internal team or by a third party like ExCraft, you can trust they have been thoroughly tested and validated by our experts.

The universe of vulnerabilities is huge and not all of them represent the same risk for the customers. Vulnerabilities do not all have the same level of criticality. Some may be easily exploitable by a low-level user, while others may not be exploitable at all. To increase the efficiency of the attacks and the quality of the exploits provided, the Core Impact team has developed selection criteria to prioritize its analysis and implementation. We determine which exploits warrant creation based on the following questions:

  • What are the most critical attacks from the attacker’s perspective?
  • What new vulnerabilities are more likely to be exploited in real attacks?
  • What exploits are the most valuable for Core Impact?

Once an exploit is approved, its priority order considers the following variables: 

  • Vulnerability Properties: CVE, disclosure date, access mechanism and privileges needed. 
  • Target Environment Setup: OS, application prevalence, version and special configurations needed. 
  • Value Provided to Core Impact: Customer request, usage in multiple attacks, allows the installation of an agent, etc. 
  • Technical Cost vs. Benefit: An analysis weighing the resources needed to build an exploit with the internal and external knowledge gained in its creation. 

Each one of these variables has a different weight and provides a ranking of the potential exploits to be developed. Following those criteria, the top of the list would contain, for example, a vulnerability on Windows (most popular OS) that can be exploited remotely, without authentication and that provides super user privileges. 

Correspondingly, a vulnerability on an application that is rarely installed, needs special configurations, and requires User Interaction, would be at the bottom.

Stay Informed of New Core Certified Exploits

Subscribe to receive regular email updates on new exploits available for Core Impact

Browse the Core Certified Exploit Library

We provide pen testers with real-time updates for a wide range of exploits for different platforms, operating systems, and applications. 

Search our continuously growing library to discover an exploit that will allow you to gain and retain access on the target host or application.

Title Description Date Added CVE Link Exploit Platform Exploit Type Product Name
Microsoft Internet Explorer XML Core Services MSXML Uninitialized Memory Exploit Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0, as used by Internet Explorer, accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code by enticing an unsuspecting user to visit a specially crafted web site. CVE-2012-1889 Windows Exploits / Client Side Impact Professional
Symantec Web Gateway PHP Injection Exploit This module exploits a remote code execution vulnerability in Symantec Web Gateway by using a log injection and a local file inclusion to run an arbitrary PHP script. CVE-2012-0297 Linux Exploits / Remote Impact Professional
Apple QuickTime TeXML Stack Buffer Overflow Exploit A vulnerability found in Apple QuickTime Player when handling a crafted TeXML file, it is possible to trigger a stack-based buffer overflow.

WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. 		CVE-2012-0663 Windows Exploits / Client Side Impact Professional
IrfanView Formats Plugin TTF File Buffer Overflow Exploit The vulnerability is caused due to a boundary error within the Formats plug-in (Formats.dll) when handling TFF files. This can be exploited to cause a stack-based buffer overflow via a specially crafted TFF file.

 NOCVE-9999-52592 Windows Exploits / Client Side Impact Professional
Microsoft Internet Explorer HTML Object Memory Corruption Exploit (MS10-002) This module exploits a use-after-free vulnerability in the MSHTML component in Internet Explorer. The specific error ocurrs due to the way Internet Explorer handles objects in memory. It is possible to use a pointer in CTableRowCellsCollectionCacheItem::GetNext after it gets freed and get remote code execution.



This vulnerability was one of the 2012's Pwn2Own challenges. 		CVE-2010-0248 Windows Exploits / Client Side Impact Professional
EZHomeTech EzServer Buffer Overflow Exploit EzServer is prone to a buffer-overflow when handling packets with an overly long string. NOCVE-9999-52789 Windows Exploits / Remote Impact Professional
Apple Itunes M3U File Buffer Overflow Exploit Apple Itunes is prone to a buffer-overflow when handling M3U files with an overly long string. CVE-2012-0677 Windows Exploits / Client Side Impact Professional
ABB Robot Communications Runtime Buffer Overflow Exploit A buffer overflow exists in a component of the Robot Communication Runtime used in some ABB programs for the communications to the IRC5, IRC5C, and IRC5P robot controllers.

This version add CVE. 		CVE-2012-0245 Windows Exploits / Remote Impact Professional
VLC Media Player libmodplug Buffer Overflow Exploit Update VLC Media Player is prone to a buffer overflow vulnerability due to insufficient validation of user supplied data. An attacker is able to execute arbitrary code in the context of the user when opening malicious .S3M media files.

This version adds the CVE number. 		CVE-2011-1574 Windows Exploits / Client Side Impact Professional
PHP-CGI Argument Injection Exploit Update This module exploits an argument injection vulnerability in PHP up to version 5.3.12 and 5.4.2 when running as a standalone CGI processor and takes advantage of the -d flag to achieve remote code execution.



This update adds support for FreeBSD, OpenBSD, RedHat and Windows platforms. 		CVE-2012-1823 Windows, OpenBSD, Linux, FreeBSD Exploits / Remote Impact Professional
Asterisk HTTP Digest DoS This module triggers a stack corruption vulnerability in Asterisk by sending a malformed packet to the 8088/TCP port. CVE-2012-1184 Solaris, Linux Denial of Service / Remote Impact Professional
Diamond Programmer XCF File Processing Buffer Overflow Exploit Diamond Programmer is prone to a buffer-overflow when handling specially crafted XCF files with an overly long string. CVE-2012-2614 Windows Exploits / Client Side Impact Professional
VideoSpirit Pro Buffer Overflow Exploit Update VideoSpirit Pro is prone to a buffer overflow when parsing a .VISPRJ project file that contains an overly long "MP3" value. The vulnerability is caused due to a wrong check of the data before it is passed to strcpy(). This can be exploited to cause a stack-based buffer overflow via a specially crafted .VISPRJ file.

This update adds the CVE number. 		CVE-2011-0499 Windows Exploits / Client Side Impact Professional
GIMP script-fu Server Buffer Overflow Exploit There is a buffer overflow in the script-fu server component of GIMP

(the GNU Image Manipulation Program) when sending a crafted package to the port 10008. 		CVE-2012-2763 Windows, Linux Exploits / Remote Impact Professional
MicroP MPPL File Buffer Overflow Exploit MicroP is prone to a buffer-overflow when handling MPPL files with an overly long string. NOCVE-9999-52553 Windows Exploits / Client Side Impact Professional
Cisco Linksys PlayerPT ActiveX Control Buffer Overflow Exploit This module exploits a vulnerability in the PlayerPT.ocx module included in the Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera application. The exploit is triggered when the SetSource() method processes a crafted argument resulting in a buffer overflow. CVE-2012-0284 Windows Exploits / Client Side Impact Professional
RabidHamster R4 Log Entry sprintf Buffer Overflow Exploit A stack overflow found in RabidHamster R4's web server by supplying a malformed HTTP request when generating a log. NOCVE-9999-52541 Windows Exploits / Remote Impact Professional
Apple QuickTime QTVR QTVRStringAtom Buffer Overflow Exploit The vulnerability exists within the QuickTimeVR.qtx component when processing a QTVRStringAtom having an overly large "stringLength" parameter. This can be exploited to cause a based buffer overflow and execute arbitrary code under the context of the user running the application.
 CVE-2012-0667 Windows Exploits / Client Side Impact Professional
IBM Tivoli Provisioning Manager Express for Software ActiveX Buffer Overflow Exploit Update 2 A flaw exists within the way the IBM Tivoli Provisioning Manager Express for Software ActiveX Control parses data supplied to the RunAndUploadFile function. The ActiveX control is used to create an Asset Information file for the local system to be uploaded to the IBM Tivoli Provisioning Manager Express Server.

This update corrects the CVE number, adds support for Internet Explorer 8 and disables DEP.

This update improves the exploit. 		CVE-2012-0198 Windows Exploits / Client Side Impact Professional
IBM Tivoli Provisioning Manager Express for Software ActiveX Buffer Overflow Exploit Update A flaw exists within the way the IBM Tivoli Provisioning Manager Express for Software ActiveX Control parses data supplied to the RunAndUploadFile function. The ActiveX control is used to create an Asset Information file for the local system to be uploaded to the IBM Tivoli Provisioning Manager Express Server.

This update corrects the CVE number, adds support for Internet Explorer 8 and disables DEP. 		CVE-2012-0198 Windows Exploits / Client Side Impact Professional
Adobe Photoshop Collada Asset Elements Buffer Overflow Exploit Adobe Photoshop CS5.1 is prone to a unicode overflow which occurs when overlong asset elements are processed. NOCVE-9999-52489 Windows Exploits / Client Side Impact Professional
AT TFTP Server Long Filename Buffer Overflow Exploit Update 2 The vulnerability is caused due to a boundary error during the processing of TFTP Read/Write request packet types. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted packet with an overly long filename field.

This update ensures that the program receives all data.

This update fixes an error on Impact v12.3. 		CVE-2006-6184 Windows Exploits / Remote Impact Professional
MSRPC DCOM Exploit Update 2 This Update adds MS03-026 in XML. CVE-2003-0352 Windows Exploits / Remote Impact Professional
Samba Username Map Script Command Injection Exploit Update The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the SamrChangePassword function, when the "username map script" smb.conf option is enabled.

This update adds Solaris support. 		CVE-2007-2447 Solaris, Linux Exploits / Remote Impact Professional
OpenSSH unexpected PAM authentication exploit Update This module exploits an error in the PAM authentication code and installs an agent into the target host.

This update improves the reliability of the exploit. 		CVE-2003-0786 Solaris, Linux Exploits / Remote Impact Professional