Core Certified Exploits

Library of expert validated exploits for safe and effective pen tests

Browse the Core Certified Exploit Library  

 

Exploit development can be an advanced penetration testing skill that takes time to master. Additionally, when on a job, pen testers often don’t have the resources to create a new exploit. Many resort to searching for and using pre-written exploits that have not been tested and must go through the timely effort of quality assurance testing in order to ensure they are secure and effective.

Core Impact users can save time by finding all the up-to-date exploits they need in one place. We provide a robust library of exploits designed to enable pen testers to safely and efficiently conduct successful penetration tests. Witten by our own internal team, you can trust they have been thoroughly tested and validated by our experts.

The universe of vulnerabilities is huge and not all of them represent the same risk for the customers. Vulnerabilities do not all have the same level of criticality. Some may be easily exploitable by a low-level user, while others may not be exploitable at all. To increase the efficiency of the attacks and the quality of the exploits provided, the Core Impact team has developed selection criteria to prioritize its analysis and implementation. We determine which exploits warrant creation based on the following questions:

  • What are the most critical attacks from the attacker’s perspective?
  • What new vulnerabilities are more likely to be exploited in real attacks?
  • What exploits are the most valuable for Core Impact?

Once an exploit is approved, its priority order considers the following variables: 

  • Vulnerability Properties: CVE, disclosure date, access mechanism and privileges needed.
  • Target Environment Setup: OS, application prevalence, version and special configurations needed.
  • Value Provided to Core Impact: Customer request, usage in multiple attacks, allows the installation of an agent, etc.
  • Technical Cost vs. Benefit: An analysis weighing the resources needed to build an exploit with the internal and external knowledge gained in its creation. 

Each one of these variables has a different weight and provides a ranking of the potential exploits to be developed. Following those criteria, the top of the list would contain, for example, a vulnerability on Windows (most popular OS) that can be exploited remotely, without authentication and that provides super user privileges. 

Correspondingly, a vulnerability on an application that is rarely installed, needs special configurations, and requires User Interaction, would be at the bottom.

Stay Informed of New Core Certified Exploits

Subscribe to receive regular email updates on new exploits available for Core Impact

Browse the Core Certified Exploit Library

We provide pen testers with real-time updates for a wide range of exploits for different platforms, operating systems, and applications. 

Search our continuously growing library to discover an exploit that will allow you to gain and retain access on the target host or application.

Title Description Date Added CVE Link Exploit Platform Exploit Type Product Name
Asterisk HTTP Digest DoS This module triggers a stack corruption vulnerability in Asterisk by sending a malformed packet to the 8088/TCP port. CVE-2012-1184 Solaris, Linux Denial of Service / Remote Impact Professional
Diamond Programmer XCF File Processing Buffer Overflow Exploit Diamond Programmer is prone to a buffer-overflow when handling specially crafted XCF files with an overly long string. CVE-2012-2614 Windows Exploits / Client Side Impact Professional
VideoSpirit Pro Buffer Overflow Exploit Update VideoSpirit Pro is prone to a buffer overflow when parsing a .VISPRJ project file that contains an overly long "MP3" value. The vulnerability is caused due to a wrong check of the data before it is passed to strcpy(). This can be exploited to cause a stack-based buffer overflow via a specially crafted .VISPRJ file.

This update adds the CVE number. 		CVE-2011-0499 Windows Exploits / Client Side Impact Professional
GIMP script-fu Server Buffer Overflow Exploit There is a buffer overflow in the script-fu server component of GIMP

(the GNU Image Manipulation Program) when sending a crafted package to the port 10008. 		CVE-2012-2763 Windows, Linux Exploits / Remote Impact Professional
MicroP MPPL File Buffer Overflow Exploit MicroP is prone to a buffer-overflow when handling MPPL files with an overly long string. NOCVE-9999-52553 Windows Exploits / Client Side Impact Professional
Cisco Linksys PlayerPT ActiveX Control Buffer Overflow Exploit This module exploits a vulnerability in the PlayerPT.ocx module included in the Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera application. The exploit is triggered when the SetSource() method processes a crafted argument resulting in a buffer overflow. CVE-2012-0284 Windows Exploits / Client Side Impact Professional
RabidHamster R4 Log Entry sprintf Buffer Overflow Exploit A stack overflow found in RabidHamster R4's web server by supplying a malformed HTTP request when generating a log. NOCVE-9999-52541 Windows Exploits / Remote Impact Professional
Apple QuickTime QTVR QTVRStringAtom Buffer Overflow Exploit The vulnerability exists within the QuickTimeVR.qtx component when processing a QTVRStringAtom having an overly large "stringLength" parameter. This can be exploited to cause a based buffer overflow and execute arbitrary code under the context of the user running the application.
 CVE-2012-0667 Windows Exploits / Client Side Impact Professional
IBM Tivoli Provisioning Manager Express for Software ActiveX Buffer Overflow Exploit Update 2 A flaw exists within the way the IBM Tivoli Provisioning Manager Express for Software ActiveX Control parses data supplied to the RunAndUploadFile function. The ActiveX control is used to create an Asset Information file for the local system to be uploaded to the IBM Tivoli Provisioning Manager Express Server.

This update corrects the CVE number, adds support for Internet Explorer 8 and disables DEP.

This update improves the exploit. 		CVE-2012-0198 Windows Exploits / Client Side Impact Professional
IBM Tivoli Provisioning Manager Express for Software ActiveX Buffer Overflow Exploit Update A flaw exists within the way the IBM Tivoli Provisioning Manager Express for Software ActiveX Control parses data supplied to the RunAndUploadFile function. The ActiveX control is used to create an Asset Information file for the local system to be uploaded to the IBM Tivoli Provisioning Manager Express Server.

This update corrects the CVE number, adds support for Internet Explorer 8 and disables DEP. 		CVE-2012-0198 Windows Exploits / Client Side Impact Professional
Adobe Photoshop Collada Asset Elements Buffer Overflow Exploit Adobe Photoshop CS5.1 is prone to a unicode overflow which occurs when overlong asset elements are processed. NOCVE-9999-52489 Windows Exploits / Client Side Impact Professional
AT TFTP Server Long Filename Buffer Overflow Exploit Update 2 The vulnerability is caused due to a boundary error during the processing of TFTP Read/Write request packet types. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted packet with an overly long filename field.

This update ensures that the program receives all data.

This update fixes an error on Impact v12.3. 		CVE-2006-6184 Windows Exploits / Remote Impact Professional
MSRPC DCOM Exploit Update 2 This Update adds MS03-026 in XML. CVE-2003-0352 Windows Exploits / Remote Impact Professional
Samba Username Map Script Command Injection Exploit Update The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the SamrChangePassword function, when the "username map script" smb.conf option is enabled.

This update adds Solaris support. 		CVE-2007-2447 Solaris, Linux Exploits / Remote Impact Professional
OpenSSH unexpected PAM authentication exploit Update This module exploits an error in the PAM authentication code and installs an agent into the target host.

This update improves the reliability of the exploit. 		CVE-2003-0786 Solaris, Linux Exploits / Remote Impact Professional
Novell ZENworks Configuration Management Preboot Service Opcode 0x21 Buffer Overflow Exploit This module exploits a remote stack-based buffer overflow vulnerability in the Preboot Service component of Novell ZENworks Configuration Management, by sending a specially crafted packet to the port 998/TCP. NOCVE-9999-43820 Windows Exploits / Remote Impact Professional
HP Data Protector EXEC_CMD Exploit This module exploits a buffer overflow vulnerability in HP Data Protector by sending a specially crafted EXEC_CMD request. CVE-2011-1866 Windows Exploits / Remote Impact Professional
HP Easy Printer Care XMLCacheMgr Class ActiveX Control Code Execution Exploit This module allows remote attackers to place arbitrary files on a users file system by abusing the "CacheDocumentXMLWithId" method from the "XMLCacheMgr" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control (HPTicketMgr.dll 2.7.2.0). Code execution can be achieved by first uploading the payload to the remote machine embeddeding a vbs file, and then upload another mof file, which enables Windows Management Instrumentation service to execute the vbs. CVE-2011-4786 Windows Exploits / Client Side Impact Professional
Microsoft Windows Win32k Keyboard Layout Vulnerability Exploit (MS12-034) Update 6 This update adds support to Microsoft Windows 2003 64 bits edition ( DoS ), Microsoft Windows Vista 64 bits edition ( DoS ), Microsoft Windows 2008 64 bits edition ( DoS ) and Microsoft Windows Seven 64 bits edition ( DoS ).



This module exploits a Windows kernel vulnerability by loading a fake keyboard layout through a call to "NtUserLoadKeyboardLayoutEx" function with crafted parameters.



When the keyboard layout is processed by win32k.sys, it produces a kernel heap memory corruption. 		CVE-2012-0181 Windows Exploits / Local Impact Professional
CyberLink Power2Go P2G Name Attribute Buffer Overflow Exploit A stack-based buffer overflow in CyberLink Power2Go allows an attacker to execute arbitrary code via an overly long name attribute in a .P2G file. NOCVE-9999-52040 Windows Exploits / Client Side Impact Professional
LANDesk Lenovo ThinkManagement Console Remote Command Execution Exploit This module exploits a file upload vulnerability in the LANDesk Lenovo ThinkManagement Console. Unrestricted file upload in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a PutUpdateFileCore command in a RunAMTCommand SOAP request. CVE-2012-1195 Windows Exploits / Remote Impact Professional
NET-i Viewer CNC Ctrl dll ActiveX BackupToAvi() Buffer Overflow Exploit The vulnerability is caused due to a boundary error in the CNC_Ctrl.dll ActiveX control when handling the BackupToAvi() method. NOCVE-9999-52068 Windows Exploits / Client Side Impact Professional
Microsoft Windows Win32k Keyboard Layout Vulnerability Exploit (MS12-034) Update 4 This update adds support to Microsoft Windows Vista and Microsoft Windows 7 ( only DoS ).



This module exploits a Windows kernel vulnerability by loading a fake keyboard layout through a call to "NtUserLoadKeyboardLayoutEx" function with crafted parameters.



When the keyboard layout is processed by win32k.sys, it produces a kernel heap memory corruption.

 CVE-2012-0181 Windows Exploits / Local Impact Professional
3D Life Player WebPlayer ActiveX Buffer Overflow Exploit A boundary error exists in the WebPlayer ActiveX control when processing the "SRC" property with an overly long string. NOCVE-9999-52362 Windows Exploits / Client Side Impact Professional
ispVM System XCF File Processing Buffer Overflow Exploit A buffer overflow vulnerability exists in ispVM when processing crafted .XCF files can be exploited via an overly long version value within the ispXCF tag. NOCVE-9999-52428 Windows Exploits / Client Side Impact Professional
Download JSON