Exploit development can be an advanced penetration testing skill that takes time to master. Additionally, when on a job, pen testers often don’t have the resources to create a new exploit. Many resort to searching for and using pre-written exploits that have not been tested and must go through the timely effort of quality assurance testing in order to ensure they are secure and effective.
Core Impact users can save time by finding all the up-to-date exploits they need in one place. We provide a robust library of exploits designed to enable pen testers to safely and efficiently conduct successful penetration tests. Witten by our own internal team, you can trust they have been thoroughly tested and validated by our experts.
The universe of vulnerabilities is huge and not all of them represent the same risk for the customers. Vulnerabilities do not all have the same level of criticality. Some may be easily exploitable by a low-level user, while others may not be exploitable at all. To increase the efficiency of the attacks and the quality of the exploits provided, the Core Impact team has developed selection criteria to prioritize its analysis and implementation. We determine which exploits warrant creation based on the following questions:
What are the most critical attacks from the attacker’s perspective?
What new vulnerabilities are more likely to be exploited in real attacks?
What exploits are the most valuable for Core Impact?
Once an exploit is approved, its priority order considers the following variables:
Vulnerability Properties: CVE, disclosure date, access mechanism and privileges needed.
Target Environment Setup: OS, application prevalence, version and special configurations needed.
Value Provided to Core Impact: Customer request, usage in multiple attacks, allows the installation of an agent, etc.
Technical Cost vs. Benefit: An analysis weighing the resources needed to build an exploit with the internal and external knowledge gained in its creation.
Each one of these variables has a different weight and provides a ranking of the potential exploits to be developed. Following those criteria, the top of the list would contain, for example, a vulnerability on Windows (most popular OS) that can be exploited remotely, without authentication and that provides super user privileges.
Correspondingly, a vulnerability on an application that is rarely installed, needs special configurations, and requires User Interaction, would be at the bottom.
Stay Informed of New Core Certified Exploits
Subscribe to receive regular email updates on new exploits available for Core Impact
Browse the Core Certified Exploit Library
We provide pen testers with real-time updates for a wide range of exploits for different platforms, operating systems, and applications.
Search our continuously growing library to discover an exploit that will allow you to gain and retain access on the target host or application.
Title
Description
Date Added
CVE Link
Exploit Platform
Exploit Type
Product Name
IBM solidDB Packet Processing DoS
This module shuts down the IBM solidDB Server because it fails to properly handle user-supplied malformed packets.
This module restarts the IIS server. This exploit forces the IIS process inetinfo.exe to throw an unhandled exception. IIS' behavior depends on the operating system version, its configuration and the system-wide debugger specified in the registry. By default a message box will pop up in the console, and until a user closes it the server will not be restarted.
This module restarts the IIS server. This exploit forces the IIS process inetinfo.exe to throw an unhandled exception. IIS' behavior depends on the operating system version, its configuration and the system-wide debugger specified in the registry. By default under Windows 2000 Advanced Server 2000 the server will automatically restart. Under Windows 2000 Professional a message box will pop up in the console and the server will not be restarted until a user presses [OK].
This exploit forces the IIS process inetinfo.exe to throw an unhandled exception. IIS' behavior depends on the operating system version, its configuration and the system-wide debugger specified in the registry. By default, on IIS versions 5.0, 5.1 and 6 the server will automatically restart. However if a JIT debugger is configured in the target system a message box will pop up in the console and the server will not be restarted (and continues to process requests) until a user presses [OK]. On IIS version 7 by default the server will not restart.
This module exploits a denial of service vulnerability that results because IIS 7.5 do not correctly handle an error condition when receives a specially crafted FTP Telnet IAC packet.
This module exploits the vulnerabilities detailed in Core Security Technologies advisory CORE-2004-0802 to shutdown the Network News Transfer Protocol (NNTP) service on IIS and Exchange servers. The bugs exploited are present in the parser and query translator for the XPAT command.
This module restarts the IIS server. This exploit forces the IIS process inetinfo.exe to throw an unhandled exception. IIS' behavior depends on the operating system version, its configuration and the system-wide debugger specified in the registry. By default under Windows 2000 Advanced Server the target host will automatically restart. Under Windows 2000 Professional a message box will pop up in the console and the server will not be restarted until a user presses [OK].
This module exploits a denial of service vulnerability that results because IIS 5.0 and 5.1 do not correctly handle an error condition when an overly long WebDAV request is passed to them.
This module shuts down the Inetserv POP3 Server because it fails to properly handle user-supplied malformed packets.
Windows
Denial of Service / Remote
Impact
ISC BIND Dynamic Update Message DoS
This module exploits a vulnerability in BIND 9 when parsing dynamic update messages containing a record of type "ANY" and where at least one RRset for this FQDN exists on the server, causing the service to exit.
This module exploits an assertion failure vulnerability in BIND 9.8.0 servers to cause a denial of service. This vulnerability only affects BIND users who are using the Response Policy Zones (RPZ) feature configured for RRset replacement, i.e., returning a positive answer defined by the response policy.
This module exploits a remote vulnerability that could allow an attacker to send a specially crafted SMB message to an affected system causing a denial of service. This bug was accidentally discovered while researching the details for the vulnerability MS06-035. This is a different vulnerability, and does not give the attacker the possibility of code execution.
MetaServer RT is prone to a remote denial of service when handling certain packets on TCP port 2194.
Windows
Denial of Service / Remote
Impact
Microsoft Host Integration Server Remote DoS (MS11-082)
Microsoft Host Integration Server is prone to a remote denial of service due to improper memory handling by the process SnaBase.exe when parsing UDP packets arriving on port 1478.
Windows tcpip.sys is susceptible to a remote buffer overflow vulnerability. This issue allows remote attackers to crash and/or take complete control of vulnerable hosts.
Microsoft Windows Active Directory Lightweight Directory Service DoS (MS13-079)
This module exploits a vulnerability in "Microsoft Windows Active Directory Lightweight Directory" service by sending UDP requests to the LDAP port (usually 389) and then sending ICMP error messages producing a LDAP Stop Responding behavior.
Microsoft Windows Active Directory Remote DoS (MS09-066)
This module exploits an error in the Windows Active Directory implementation by sending a specially crafted LDAP request to crash the lsass.exe process, leading to the reboot of the target machine.
Microsoft Windows DNS Resolution Remote DoS (MS11-030)
This module exploits a memory corruption in the DNS Client Service by sending a specially crafted LLMNR broadcast queries to crash the service. The attack must be issued from the same local net of the target host.
Microsoft Windows Embedded OpenType Fonts Integer Overflow DoS (MS09-065)
This module causes a DoS in win32k.sys when attempts to render an embedded font. This module runs a web server waiting for vulnerable clients (Internet Explorer) to connect to it.