Core Certified Exploits

Library of expert validated exploits for safe and effective pen tests

Exploit development can be an advanced penetration testing skill that takes time to master. Additionally, when on a job, pen testers often don’t have the resources to create a new exploit. Many resort to searching for and using pre-written exploits that have not been tested and must go through the timely effort of quality assurance testing in order to ensure they are secure and effective.

Core Impact users can save time by finding all the up-to-date exploits they need in one place. We provide a robust library of exploits designed to enable pen testers to safely and efficiently conduct successful penetration tests. Whether written by our own internal team or by a third party like ExCraft, you can trust they have been thoroughly tested and validated by our experts.

The universe of vulnerabilities is huge and not all of them represent the same risk for the customers. Vulnerabilities do not all have the same level of criticality. Some may be easily exploitable by a low-level user, while others may not be exploitable at all. To increase the efficiency of the attacks and the quality of the exploits provided, the Core Impact team has developed selection criteria to prioritize its analysis and implementation. We determine which exploits warrant creation based on the following questions:

  • What are the most critical attacks from the attacker’s perspective?
  • What new vulnerabilities are more likely to be exploited in real attacks?
  • What exploits are the most valuable for Core Impact?

Once an exploit is approved, its priority order considers the following variables: 

  • Vulnerability Properties: CVE, disclosure date, access mechanism and privileges needed. 
  • Target Environment Setup: OS, application prevalence, version and special configurations needed. 
  • Value Provided to Core Impact: Customer request, usage in multiple attacks, allows the installation of an agent, etc. 
  • Technical Cost vs. Benefit: An analysis weighing the resources needed to build an exploit with the internal and external knowledge gained in its creation. 

Each one of these variables has a different weight and provides a ranking of the potential exploits to be developed. Following those criteria, the top of the list would contain, for example, a vulnerability on Windows (most popular OS) that can be exploited remotely, without authentication and that provides super user privileges. 

Correspondingly, a vulnerability on an application that is rarely installed, needs special configurations, and requires User Interaction, would be at the bottom.

Stay Informed of New Core Certified Exploits

Subscribe to receive regular email updates on new exploits available for Core Impact

Browse the Core Certified Exploit Library

We provide pen testers with real-time updates for a wide range of exploits for different platforms, operating systems, and applications. 

Search our continuously growing library to discover an exploit that will allow you to gain and retain access on the target host or application.

Title Description Date Added CVE Link Exploit Platform Exploit Type Product Name
Adobe Reader authplay AVM2 newfunction Exploit Update This module exploits a vulnerability in Adobe Reader when parsing .PDF files. The vulnerability is caused due to a boundary error in authplay.dll when handling crafted malicious Flash (.SWF) file or by embedding a malicious Flash application in a .PDF file. This version add Windows Vista support. CVE-2010-1297 Windows Exploits/Client Side Impact
GoM Player ActiveX Exploit This module exploits a vulnerability in the GomWeb3.dll control included in the GoM Player ActiveX application. The exploit is triggered when the OpenURL() method processes a long string argument resulting in a stack-based buffer overflow. CVE-2007-5779 Windows Exploits/Client Side Impact
Microsoft Windows SMB Pathname Overflow DoS (MS10-012) Update This update adds shared folders detection. This module exploits a vulnerability on srv.sys when it executes a rename command into shared folder using a long pathname. CVE-2010-0020 Windows Denial of Service/Remote Impact
Microsoft Windows SMB Client Transaction DoS (MS10-020) This module exploits a remote vulnerability in Microsoft Windows SMB client allowing the attacker to cause a DoS in the remote host. CVE-2010-0270 Windows Denial of Service/Client Side Impact
Novell iManager Classname Buffer Overflow Exploit This module exploits a remote stack-based buffer overflow in Novell iManager when creating a class with an overly long name. CVE-2010-1929 Windows Exploits/Remote Impact
Novell ZENworks Configuration Management Preboot Service Remote Buffer Overflow Exploit This module exploits a remote stack-based buffer overflow in the Preboot Service component of Novell ZENworks Configuration Management by sending a specially crafted packet to the port 998/TCP. Windows Exploits/Remote Impact
Tembria Server Monitor HTTP Request DoS Tembria Server vulnerability is caused due to an error in the processing of HTTP requests sent to the included web server. CVE-2010-1316 Windows Denial of Service/Remote Impact
Microsoft Sharepoint Server 2007 Cross Site Scripting Exploit The vulnerability exists due to failure in the "/_layouts/help.aspx" script to properly sanitize user-supplied input in "cid0" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data. CVE-2010-0817 Exploits/Cross Site Scripting (XSS)/Known Vulnerabilities Impact
Mac OS X CUPS lppasswd Local Privilege Escalation Exploit This module exploits a format string vulnerability in CUPS lppasswd in Apple Mac OS X 10.5.6 that allows local users to get code execution with elevated privileges. CVE-2010-0393 Mac OS X Exploits/Local Impact
Microsoft Office Excel DBQueryExt Record Parsing Exploit (MS10-038) This module exploits an arbitrary pointer dereference in Microsoft Office Excel while parsing a specially crafted DBQueryExt record. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2010-1253 Windows Exploits/Client Side Impact
Solarwinds TFTP Read Request DoS This exploit shutdown the Solarwinds TFTP server, sending a crafted Read Request to the affected port. CVE-2010-2115 Windows Denial of Service/Remote Impact
Microsoft Windows Registry SymLink DoS (MS010-021) This module exploits a denial of service vulnerability in the Windows kernel related to the way the kernel processes values of registry symbolic links. CVE-2010-0235 Windows Denial of Service/Local Impact
UnrealIRCd Backdoor Unauthorized Access Exploit This module exploits a remote command execution vulnerability found in UnrealIRCd by using an unauthorized backdoor. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-4893 Solaris Exploits/Remote Impact
Microsoft Windows SMTP Server DNS Response Field Validation DNS Spoofing Vulnerability Exploit (MS10-024) This module exploits a vulnerability on smtpsvc.dll spoofing responses from a DNS Server and deflecting emails sent to an arbitrary domain. CVE-2010-1690 Windows Exploits/Remote Impact
IBM Lotus Domino If-Modified-Since Buffer Overflow Exploit This module exploits a stack-based buffer overflow in the nHTTP.exe application, a component of Lotus Domino Server, by sending an HTTP request with an invalid value for the If-Modified-Since parameter. CVE-2007-0067 Windows Exploits/Remote Impact
Viscom Software Movie Player Pro SDK ActiveX Remote Buffer Overflow Exploit A stack-based buffer overflow occurs when you pass to "strFontName" parameter a string overly long than 24 bytes which leads into EIP overwrite allowing the execution of arbitrary code in the context of the logged on user. This happens because an inadequate space is stored into the buffer intended to receive the font name. CVE-2010-0356 Windows Exploits/Client Side Impact
TweakFS Zip Utility Buffer Overflow Exploit The vulnerability is caused due to a boundary error when processing archives containing an entry with an overly long name. This can be exploited to cause a stack-based buffer overflow by tricking a user into opening a specially crafted .ZIP file. CVE-2010-1458 Windows Exploits/Client Side Impact
Winamp MP4 Processing Integer Overflow Exploit An integer overflow error exists in the processing of MP4 files. This can be exploited to cause a heap-based buffer overflow via e.g. an MP4 file containing a specially crafted "ctts" box. Windows Exploits/Client Side Impact
EMC RepliStor Server rep_serv Remote DoS EMC RepliStor Server is prone to a remote denial-of-service vulnerability. The vulnerability is caused due to an error in rep_srv.exe when processing network packets. CVE-2009-3744 Windows Denial of Service/Remote Impact
Microsoft Windows helpctr Invalid URL Processing Exploit This module exploits a vulnerability caused due to an error in the MPC::HTML::UrlUnescapeW() function in helpctr.exe when escaping URLs. WARNING: This is an early release module.This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2010-1885 Windows Exploits/Client Side Impact
Exploit Improvements Update Package This update improves exploit functionality and exploit documentation. CVE-2010-0016 Windows Denial of Service/Client Side Impact
Apple Safari Use-After-Free Rtl Exploit A use-after-free vulnerability in WebKit/Apple Safari (in versions prior to 4.0.5) allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via HTML elements with right-to-left (RTL) text directionality. CVE-2010-0049 Windows Exploits/Client Side Impact
Adobe Acrobat Reader authplay Exploit This module exploits a vulnerability in Adobe Reader when parsing .PDF files. The vulnerability is caused due to a boundary error in authplay.dll when handling crafted malicious Flash (.SWF) file or by embedding a malicious Flash application in a .PDF file. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. CVE-2010-1297 Windows Exploits/Client Side Impact
Microsoft Office PowerPoint Sound Data Exploit (MS09-017) Microsoft Office PowerPoint allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 95 native file format. CVE-2009-1128 Windows Exploits/Client Side Impact
Novell ZENworks Configuration Management UploadServlet Remote Code Execution Exploit A remote code execution vulnerability in the UploadServlet component of Novell ZENworks Configuration Management allows remote attackers to execute arbitrary code. CVE-2010-4229 Windows Exploits/Remote Impact