http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2010-05-12 14:10:26 - Deobfuscated : It was one of the best public websites to find exploits Obviously, many people think that such a website should be taken down as it's heaven for script kiddies But it was as well really useful for security consultants Exploits are and will always be available The only difference is that you'll find them only within some private communitieswhich just makes the good guys work even harder Rest in peace, milw0rm http://www.secuobs.com/revue/news/221399.shtmlhttp://www.secuobs.com/revue/news/221399.shtml 2010-05-12 14:10:26 - Deobfuscated : IMAGE Well, milw0rm is gone Sad isn't it Some time ago I wrote a quick blog about it and a quite interesting comment just got posted cheers Yeah You can smile again and add inj3ctorcom to your bookmarks http://www.secuobs.com/revue/news/221381.shtmlhttp://www.secuobs.com/revue/news/221381.shtml 2010-04-01 13:52:49 - Exploitability : http://www.secuobs.com/revue/news/207955.shtmlhttp://www.secuobs.com/revue/news/207955.shtml 2010-03-11 01:35:20 - CNIS mag : De manière cyclique, l actualité sécurité sombre dans le fait divers Parfois dans le but de marginaliser l importance d un événement, parfois parce que le traitement débridé de l information par les blogueurs et buzzeurs parvient à transformer une taupinière en Everest digne le la manchette du défunt Détective, parfois encore parce que l information ne relève effectivement que http://www.secuobs.com/revue/news/200476.shtmlhttp://www.secuobs.com/revue/news/200476.shtml 2010-01-31 14:03:51 - Kioptrix : Well, the new or replacement milw0rm has gone online As you may, or may not know, the crew of Offensive-Security have taken over Str0ke was very close to closing the site down After the initial announcement, Offsec stepped in and offered to relieve him of some of the administrative duties updates mostly So, is the new http://www.secuobs.com/revue/news/187049.shtmlhttp://www.secuobs.com/revue/news/187049.shtml 2009-12-02 00:45:34 - Skeptikal.org : Sadly, Milw0rmcom is going offline- permanently, from the sound of it Str0ke posted the following message on the site before it went dark Well, this is my goodbye header for milw0rm I wish I had the time I did in the past to post exploits, I just don't For the past 3 months I have actually done a pretty crappy job of getting peoples work out fast enough to be proud of, 0 to 72 hours taking off weekends isn't fair to the authors on this site I appreciate and thank everyone for their support in the past Be safe, str0ke While it gets a bad rap for its large script kiddie user base, I've learned a lot from the exploits on that site, and it will be missed Thanks Str0ke If anybody has info about where I can get a copy of the milw0rm archives, I'd be happy to mirror it here Update 7 8 2009 2 47 PM While Str0ke isn't going to be running things, it looks like he found some other people to take over for him Exploit submissions are still closed for now, and milw0rmcom is still offline, though that may just be server overloading http://www.secuobs.com/revue/news/167560.shtmlhttp://www.secuobs.com/revue/news/167560.shtml 2009-12-01 05:33:26 - Security for the Masses : Adobe related service getPlus_HelperSvcexe Local Privilege Escalation PulseAudio setuid Priv Escalation Exploit ubu 904 slack 1220 PulseAudio setuid Local Privilege Escalation Exploit FreeBSD 72 pecoff executable Local DoS MCshoutbox 11 SQL XSS Shell Multiple Remote Vuln MiniCWB 230 LANG Remote File Inclusion Vuln Netrix CMS 10 Authentication Bypass Vuln Silentum Guestbook 202 silentum_guestbookphp SQL Injection Vuln EpicDJ 1391 mpl m3u Local Heap Overflow EpicVJ 1280 mpl m3u Local Heap Overflow See Milw0rm http://www.secuobs.com/revue/news/167133.shtmlhttp://www.secuobs.com/revue/news/167133.shtml 2009-11-30 04:57:11 - Yet Another Security Blog : Well, the new or replacement milw0rm has gone online As you may, or may not know, the crew of Offensive-Security have taken over Str0ke was very close to closing the site down After the initial announcement, Offsec stepped in and offered to relieve him of some of the administrative duties updates mostly So, is the new site better I mean, how can you improve on such a simple concept Have an exploit, have a link to said exploit Well they've found a way to not only make it better, but they succeeded in making the site an educational tool With Offensive-Security certifications slowly growing in popularity, it makes perfect sense for a security company such as Offsec to maintain the most popular exploit repository on the web today It's a great combination they train you in identifying and using exploits for defensive purposes all at the same time guaranteeing the exploit used during the training are available Good idea But how is the site better Let's start off by how everything is organized It's separated in few sections Remote Exploit, local exploit, web application and denial of service The old milw0rm had a similar organizational schema, and they even had or have I suppose it's still up a shell code section Which for me was not very user friendly What it didn't have was a web application section, which in my opinion is a good add-on by the Offsec crew Even if they removed a few of the sections originality found on milw0rm, the new site is very easy to navigate The search option is also better all around Searching by description, author, type remote local DoS etc , platform and port number It's pretty quick too and gives out very good search results The submit information is revamped and easy to follow to anyone who wishes to submit anything This last part is what makes this site stand-out from the rest They are actually hosting the applications associated with the exploits Not all of them mind you, but they do have many downloads available So in time, I'm sure we'll see lots more vulnerable applications with their respective exploits ready to be transferred in our lab environment So in the end, Offensive-Security have legitimized the existence of such a site With this new avenue, an exploit repository site doesn't have cater to blackhats looking to annoy people or deface websites They are maintaining and making available a valuable knowledge base for the security professional in training Congrats to all that worked on the new site It's fresh, good looking and I'm sure it's going to be around for a long long time Check them out Offensive-Security New milw0rm http://www.secuobs.com/revue/news/166592.shtmlhttp://www.secuobs.com/revue/news/166592.shtml 2009-11-18 16:51:03 - Security Bloggers Network : http exploitsoffensive-securitycom Offensive Security 接手了 milw0rmcom不知道是否永久停止更新了 类别 Security 查看评论 http://www.secuobs.com/revue/news/162553.shtmlhttp://www.secuobs.com/revue/news/162553.shtml 2009-11-11 15:22:11 - Cybexin's Blog Network Security Blog : A live demo on how to use latest exploits from milw0rm on backtrack live distro in detail In this video Attacker lauches an attack against Dream FTP Server to crack Administrator's password on a windows box IMAGE http://www.secuobs.com/revue/news/159774.shtmlhttp://www.secuobs.com/revue/news/159774.shtml 2009-11-06 07:28:01 - xorl eax eax : I just read this blog post of Offensive Security It seems that they ll be the maintainers of the popular archive website from now on http://www.secuobs.com/revue/news/158151.shtmlhttp://www.secuobs.com/revue/news/158151.shtml 2009-11-05 00:49:39 - Security Database Tools Watch : Updated Followers has just received a tweet from str0ke's twitter str0ke I'm not dead yet, just being trolled This means someone has hacked into Edward's profile and spread a fake and loosy hoax After all, we are very happy to see him up and running News about his fake death Security-Database must notify a sad information Lamentably a great friend and companion have passed away, early this morning str0ke 1974-04-29 - 2009-11-03 from Milw0rm, the bad news arrived and surprises - Security Tools IMAGE IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/157485.shtmlhttp://www.secuobs.com/revue/news/157485.shtml 2009-11-05 00:48:55 - Security Bloggers Network : 四个月之前, milw0rm关闭了一次, 最后发现是str0ke逗大家玩的 这次milw0rm连续有将近两个月没有更新了, 也看到很多人在打听milw0rm怎么了 刚才看到有朋友在群里转贴的下面这个blog, 说str0ke因为心脏问题, 今天早上过世了 留下妻子一个人带4个小孩 今天不是愚人节, 但还是希望这个消息是假的 虽然没跟str0ke见过面, 但是几年前好像 阅读全文 类别 Security 查看评论 http://www.secuobs.com/revue/news/157475.shtmlhttp://www.secuobs.com/revue/news/157475.shtml 2009-11-04 17:45:41 - System F4ilure : http://www.secuobs.com/revue/news/157309.shtmlhttp://www.secuobs.com/revue/news/157309.shtml 2009-11-04 16:16:16 - Security Database Tools Watch : Security-Database must notify a sad information Lamentably a great friend and companion have passed away, early this morning str0ke 1974-04-29 - 2009-11-03 from Milw0rm, the bad news arrived and surprises much to us and the rest of friends of the community We want to extend our greeting - SD News IMAGE http://www.secuobs.com/revue/news/157282.shtmlhttp://www.secuobs.com/revue/news/157282.shtml 2009-09-15 15:22:42 - Rootsecure.net : milw0rm Apple Safari IPhone using tel Remote Crash Exploit http://www.secuobs.com/revue/news/141022.shtmlhttp://www.secuobs.com/revue/news/141022.shtml 2009-08-29 01:15:38 - Rootsecure.net : milw0rm Kaspersky 2010 Remote Memory Corruption DoS PoC http://www.secuobs.com/revue/news/135756.shtmlhttp://www.secuobs.com/revue/news/135756.shtml 2009-08-25 01:27:22 - Rootsecure.net : milw0rm Linux Kernel 24 26 sock_sendpage ring0 Root Exploit simple ver http://www.secuobs.com/revue/news/133896.shtmlhttp://www.secuobs.com/revue/news/133896.shtml 2009-08-18 23:57:43 - Security Circus : Well, this is my goodbye header for milw0rm I wish I had the time I did in the past to post exploits, I just don't For the past 3 months I have actually done a pretty crappy job of getting peoples work out fast enough to be proud of, 0 to 72 hours taking off weekends isn't fair to the authors on this site I appreciate and thank everyone for their support in the past Be safe, str0ke Milw0rm offline - so long, and thanks for all the fish http://www.secuobs.com/revue/news/132154.shtmlhttp://www.secuobs.com/revue/news/132154.shtml 2009-07-27 19:29:56 - Security Shell : on July-23, milw0rm uploaded Adobe Flash Embedded in PDF LIVE VIRUS MALWARE Exploit written by hdmoore who states that it s I quote live exploit sample for the new Flash bug embedded in PDF , which is far from the truth the truth is - it s the old getIcon exploit having nothing to do with the new vulnerability in ActiveScript Virtual Machine the real worms described here uses PDF with two embedded SWF files, one - triggers the bug, another performs heap-spraying and generates the shell-code on the fly yeah it uses Active Script byte-code which is not plain text like JavaScript, it s more like Java byte-code to generate the shell-code, so there is no unescape strings, so my shell-detector fails to find it of course it fails, it does not support Active Script byte code, at least not yet I will write about the real SWF exploit tomorrow today we re going talk about that faked exploit it s pretty interested as well the first thing we have to do is to decompress all streams it s easy zlib support that format, we just should write PDF parser should we oh, not really according to RFC-1950 a zlib stream has the following structure CMF_FLG more so, we can just look for CMF_FLG header, trying to decompress every stream we meet - very useful universal decompressor, supporting now only PDF, but much more HTTP streams for example FLG filed has 4 bits FCHECK checksum and the header itself is quite predicable, so it s easy to find a potential ZLIB header inside a byte stream how to defeat false positives 2byte header is too short to be reliable enough well, no problem guys if we found something looks like CMF_FLG just try to unpack the first 512 bytes by zlib inflate function if it fails it means - false positive, otherwise we have to call it again to unpack the rest Check KPNC blog for More Info IMAGE http://www.secuobs.com/revue/news/125407.shtmlhttp://www.secuobs.com/revue/news/125407.shtml 2009-07-23 16:17:09 - Metasploit : Add credit to the milw0rm exploit author http://www.secuobs.com/revue/news/123973.shtmlhttp://www.secuobs.com/revue/news/123973.shtml 2009-07-21 19:45:25 - cloud's Blog : Issu du site wwwmilw0rmcom Well, this is my goodbye header for milw0rm I wish I had the time I did in the past to post exploits, I just don't For the past 3 months I have actually done a pretty crappy job of getting peoples work out fast enough to be proud of, 0 to 72 hours taking off weekends isn't fair to the authors on this site I appreciate and thank everyone for their support in the past Be safe, str0ke Voici le message laissé sur le site wwwmilw0rmcom par str0ke, le mainteneur de ce site Ainsi depuis le 02 Juillet plus aucun exploit n'a été publié sur ce site Celui ci l'explique par faute de temps de sa part qui entraine une baisse de qualité qu'il ne peut accepté vis à vis des personnes publiant sur son site Milw0rm est né à la fin des années 90, une période encore old school ou le hack se faisait for fun par une équipe de hacker str0ke s'occupait de maintenir ce site qui est devenu la référence des sites d'exploits Il a toujours été gratuit, simple, efficace bref tout ce qu'on demande à un site web str0ke assurait un service de qualité en suivant chaque 0day, exploit ou PoC envoyé par quiconque Certes milw0rm peut paraitre à première vu un site dangereux utilisé par des script kiddies mais à mon sens il a surtout permis de faire évoluer et d'améliorer la sécurité sur le net par la théorie du full disclosure Je ne discuterai pas de cette vision de la sécurité dans cet article mais en tout cas il a permis de découvrir de nombreuses vulnérabilités et d'entrainer la publication de patchs de sécurité pour corriger tous les logiciels impactés plutôt que de laisser ces vulnérabilités connues d'un groupe de privilégié qui les auraient exploiter à mauvais escient Maintenant la question de la relève va surgir De nombreux sites publient et centralisent des exploits mais aucun à la milw0rm en testant directement et surtout avec un service aussi simple et efficace De plus j'aurai personnellement beaucoup plus de mal à faire confiance à la nouvelle génération moins axée sur le coté fun de la sécu Bref affaire à suivre A l'heure actuelle, le site est down, surement à cause d'un nombre excessif de connexions récupérant l'ensemble des exploits d'ailleurs je vais devoir attendre pour lancer mon script p http://www.secuobs.com/revue/news/123196.shtmlhttp://www.secuobs.com/revue/news/123196.shtml 2009-07-21 19:45:25 - cloud's Blog : Milw0rm refonctionne Ca c'est une chose mais il était surement tombé à cause des nombreux dump de base Ce qui est plus étonnant, c'est qu'un nouvel exploit a été publié en date d'aujourd'hui et le message de str0ke a disparu 2009-07-09 FreeBSD 70 71 vfsusermount Local Privilege Escalation Exploit Y a t'il eu une reprise par quelqu'un d'autre str0ke a t'il réalisé de par les messages de soutien qu'il a recu que son site était une pièce maitresse du monde de la sécurité On croise les doigts Affaire à suivre http://www.secuobs.com/revue/news/123194.shtmlhttp://www.secuobs.com/revue/news/123194.shtml 2009-07-20 06:17:42 - Security Bloggers Network : The well-known exploit site, Milw0rm, is now back online after a week hiatus The site's operator, str0ke, had announced in early July that he was taking down the site because he didn't have the time to maintain itOf course, word spread quickly throu http://www.secuobs.com/revue/news/122540.shtmlhttp://www.secuobs.com/revue/news/122540.shtml 2009-07-17 17:41:17 - Security for the Masses : Super Simple Blog Script 254 Local File Inclusion Vulnerability MixSense 1001 DJ Studio mp3 file Crash Easy RM to MP3 Converter 273700 m3u Universal BOF Milw0rm IMAGE http://www.secuobs.com/revue/news/121899.shtmlhttp://www.secuobs.com/revue/news/121899.shtml 2009-07-15 21:24:28 - Security Shell : We are going to terminate Hackforumsnet and Milw0rmcom - New Apache 0-day exploit uncovered Dear members of Hackforumsnet, Jesse Labrocca AKA Omniscient , Milw0rmcom, str0ke, and Reader, We are the Ant-Sec movement, and we are dedicated to eradicating full-disclosure of vulnerabilities and exploits and free discussion on hacking related topics We are dedicated to stalling the ocean of script-kiddies currently trawling the Internet, and those so called White Hat Hackers who benefit financially from full-disclosure employing scare-tactics in order to con people into buying their firewalls and anti-virus software Thus, our new targets are Hackforumsnet and Milw0rmcom Both are notable within the hacking underground and the computer security world, and both violate what the Anti-Sec movement is fighting for Such as it is, both must be terminatedutterly Let us first discuss Hackforumsnet It is run by a man named Jesse Labrocca, also known as Omniscient within the hacker underground Although he, himself, claims to not know a thing about penetrating computer systems Hackforumsnet is perhaps one of the largest communities of hackers and script-kiddies alike currently at large in cyber space The beginner section, alone, is flooded every single day with messages by script-kiddies The Hacking Tutorials section is a diamond mine of full-disclosure information And that is not the entirety of it As a result, this community MUST be terminated See More UPDATE Blackhat-forumscom Hacked BY Anti-sec Group SO wtf is going on IMAGE http://www.secuobs.com/revue/news/121155.shtmlhttp://www.secuobs.com/revue/news/121155.shtml 2009-07-15 21:23:31 - Security for the Masses : AudioPLUS 200215 m3u lst Universal SEH Overwrite ILIAS LMS 399 3107 Arbitrary Edition Info Disclosure Vulns Hamster Audio Player 03a Local BOf Greenwood Content Manager 032 LFI PHPGenealogy 20 DataDirectory RFI ZenPhoto 125 Completely Blind SQLi Admin News Tools 25 fichier RFD See Milw0rm IMAGE http://www.secuobs.com/revue/news/121152.shtmlhttp://www.secuobs.com/revue/news/121152.shtml 2009-07-14 02:30:40 - Rootsecure.net : H Security Milw0rm exploit portal resumes normal service http://www.secuobs.com/revue/news/120187.shtmlhttp://www.secuobs.com/revue/news/120187.shtml 2009-07-11 22:29:12 - SecuriTeam Blogs : Seems like milw0rm will stay up for the near future In an email from Str0ke, he wrote Way to o many people unhappy with me over the idea of closing shop I just needed help which I have alot of people to choose from now So the good news, is that we ll still see milw0rm posting information But for http://www.secuobs.com/revue/news/119365.shtmlhttp://www.secuobs.com/revue/news/119365.shtml 2009-07-10 18:00:38 - Security for the Masses : WordPress Privileges Unchecked in adminphp / IDMS Internet Explorer 7 Video ActiveX Remote BOfToyLog 01 SQL Injection Vulnerability/RCEPhenotype CMS 28 loginphp user Blind SQLiCitrix XenCenterWeb XSS/SQL/RCE Remote VulnerabilitiesMyMsg 103 uid Remote SQLiGenCMS 2006 Remote VulnerabilitiesphpBMS 096 Remote VulnerabilitiesSee Milw0rmIMAGEhttp://www.secuobs.com/revue/news/118883.shtmlhttp://www.secuobs.com/revue/news/118883.shtml 2009-07-10 07:41:24 - cloud's Blog : Milw0rm refonctionne Ca c'est une chose mais il était surement tombé àcause des nombreux dump de base Ce qui est plus étonnant, c'est qu'unnouvel exploit a été publié en date d'aujourd'hui et le message destr0ke a disparu2009-07-09 FreeBSD 70/71 vfsusermount Local Privilege Escalation ExploitY a t'il eu une reprise par quelqu'un d'autre str0ke a t'il réaliséde par les messages de soutien qu'il a recu que son site était unepièce maitresse du monde de la sécurité On croise les doigts Affaire à suivrehttp://www.secuobs.com/revue/news/118775.shtmlhttp://www.secuobs.com/revue/news/118775.shtml 2009-07-10 06:02:56 - Security Database Tools Watch : No comment http://inj3ct0rcom/http://inj3ct0rcom - Security ToolsIMAGE IMAGE IMAGE IMAGEIMAGEIMAGEhttp://www.secuobs.com/revue/news/118637.shtmlhttp://www.secuobs.com/revue/news/118637.shtml 2009-07-10 05:47:04 - The Dark Visitor : UPDATE: Well, this update didn’t take long According Stanza: Uhhhh nopeThe site is back as of today Yesterdays news buddy Chop ChopHiiiii-ya Chinese hackers love the Milw0rm portal, so I follow itevery now and then Found out today that the site has been closed downby the owner Str0ke: Str0ke does not explain http://www.secuobs.com/revue/news/118575.shtmlhttp://www.secuobs.com/revue/news/118575.shtml 2009-07-10 05:27:50 - HiR Information Report : I guess enough people stepped up to the plate and offered toresuscitate Milw0rm on Str0ke's behalfThis is a good day Rehi, Milw0rmMilw0rm has been up-and-down ever since the closing announcement hitTeh Internets Probably due to the script kiddies recursively wgettingdownloading a mirror of all the archivesHopefully, the site will stabilize and be back online and back tobusiness as usual soonHiR Information Report is brought you you by Edgeos, Your NetworkSecurity Platform We are proud members of the Security BloggersNetworkThis content originally posted on HiR Information Report Copyright ©1997-2009, HiRIMAGEIMAGEIMAGEIMAGE IMAGE IMAGEIMAGEhttp://www.secuobs.com/revue/news/118567.shtmlhttp://www.secuobs.com/revue/news/118567.shtml 2009-07-09 18:58:59 - Rootsecure.net : H Security: Milw0rm exploit portal ceases to operatehttp://www.secuobs.com/revue/news/118512.shtmlhttp://www.secuobs.com/revue/news/118512.shtml 2009-07-09 17:15:42 - Security Database Tools Watch : Here is the latest milw0rm exploits tarballGod bless twitter for allowing us making a lot geeky dudes and shareinformation so fast so quick and happilyBig thanks to devilok et mikemurr for sharingDownload local copy on security-databasecom - Security ToolsIMAGEIMAGE IMAGE IMAGE IMAGEIMAGEhttp://www.secuobs.com/revue/news/118443.shtmlhttp://www.secuobs.com/revue/news/118443.shtml 2009-07-09 05:51:24 - Hack In The Box : One of the largest exploit portals on the internet, milw0rmcom, hasceased to operate Only a few lines in the page headers announce theportal's closure The operator, who goes by the handle 'str0ke',explains that it has become impossible to review and release submittedexploits within an adequate time frame:For the past 3 months I haveactually done a pretty crappy job of getting peoples work out fastenough to be proud of 0 to 72 hours isn't fair to the exploitauthors on this site Str0ke does not explain whether this is simplydue to a lack of time, to an increasing number of exploits or perhapsto both It also remains unclear whether the page and its currentdatabase will remain available or whether it will soon be taken offline It is possible that other members of the community will comeforward to support str0ke or offer to take over the portal'soperationhttp://www.secuobs.com/revue/news/118357.shtmlhttp://www.secuobs.com/revue/news/118357.shtml 2009-07-09 00:53:07 - InfoSanity : Looks like Milw0rm is calling it a night Haven' t been able to get anyofficial word as the site is unavailable As the site is nowunavailable it's hard to tell what happened, but an ISC diary has thismessage from the site:Well, this is my goodbye header for milw0rm I wish I had the timeI did in the past to post exploits, I just don't : For the past3 months I have actually done a pretty crappy job of gettingpeoples work out fast enough to be proud of, 0 to 72 hours takingoff weekends isn't fair to the authors on this site I appreciateand thank everyone for their support in the pastBe safe, /str0keAlways a shame when a big player in the infosec community closes it'sdoors My thanks to all those how contributed and ran the site when itwas a going concern; and if anyone has a recent mirror, I'd appreciatea copy, mines a little dated :'-- Andrew WaiteIMAGEhttp://www.secuobs.com/revue/news/118260.shtmlhttp://www.secuobs.com/revue/news/118260.shtml 2009-07-09 00:52:16 - Megapanzer : The biggest archive with exploits, PoC, security related documents andmovies closed this afternoon CET its doors Str0ke left a last messageto the readers before the doors were closed “Well, this is my goodbyeheader for milw0rm I wish I had the time I did in the past to postexploits, I just don’t http://www.secuobs.com/revue/news/118258.shtmlhttp://www.secuobs.com/revue/news/118258.shtml 2009-07-09 00:46:27 - cloud's Blog : Issu du site wwwmilw0rmcom :"Well, this is my goodbye header for milw0rm I wish I had the time I did in the past to post exploits, I just don't : For the past 3 months I have actually done a pretty crappy job of getting peoples work out fast enough to be proud of, 0 to 72 hours taking off weekends isn't fair to the authors on this site I appreciate and thank everyone for their support in the pastBe safe, /str0ke"Voici le message laissé sur le site wwwmilw0rmcom par str0ke, lemainteneur de ce site Ainsi depuis le 02 Juillet plus aucun exploitn'a été publié sur ce site Celui ci l'explique par faute de temps desa part qui entraine une baisse de qualité qu'il ne peut accepté vis àvis des personnes publiant sur son siteMilw0rm est né à la fin des années 90, une période encore old schoolou le hack se faisait "for fun" par une équipe de hacker str0kes'occupait de maintenir ce site qui est devenu la référence des sitesd'exploits Il a toujours été gratuit, simple, efficace bref tout cequ'on demande à un site web str0ke assurait un service de qualité ensuivant chaque 0day, exploit ou PoC envoyé par quiconqueCertes milw0rm peut paraitre à première vu un site dangereux utilisépar des script kiddies mais à mon sens il a surtout permis de faireévoluer et d'améliorer la sécurité sur le net par la théorie du fulldisclosure Je ne discuterai pas de cette vision de la sécurité danscet article mais en tout cas il a permis de découvrir de nombreusesvulnérabilités et d'entrainer la publication de patchs de sécuritépour corriger tous les logiciels impactés plutôt que de laisser cesvulnérabilités connues d'un groupe de privilégié qui les auraientexploiter à mauvais escientMaintenant la question de la relève va surgir De nombreux sitespublient et centralisent des exploits mais aucun à la milw0rm entestant directement et surtout avec un service aussi simple etefficace De plus j'aurai personnellement beaucoup plus de mal à faireconfiance à la nouvelle génération moins axée sur le coté "fun" de lasécu Bref affaire à suivreA l'heure actuelle, le site est down, surement à cause d'un nombreexcessif de connexions récupérant l'ensemble des exploits :d'ailleurs je vais devoir attendre pour lancer mon script :p http://www.secuobs.com/revue/news/118254.shtmlhttp://www.secuobs.com/revue/news/118254.shtml 2009-07-09 00:39:10 - terminal23 : It's been a tiring week for news in the infosec world this weekBetween the DirectShow vulnerability and milw0rm faltering and goingdown fullyand it's not even ThursdayHere's hoping milw0rm comes back up and str0ke gets some trustworthyand skilled help to keep it operative at the high level of quality ithas had I'll third mubix being involved Not only has the contentbeen top-notch the burgeoning videos section comes to mind but ithas been an extreme help for researching vulnerabilities and exploitsI know, kids can get their hands on stuff like this and do mischief,but I truly feel that it does more harm than good to hide informationunder layers of moral grey linesNot only that, but if we keep hiding shit, we can't allow more trulyskilled security professionals to grow And let's face it, so many ofus are hugely self-taught or community-taught We need information tobe open so we can keep making informed experts and share knowledgeOtherwise we just become elitist and closed-doorand everyone elsehas to repeatedly re-invent the wheelAs far as rumors of FBI pressure on the hosting provider for milw0rm,you would really think law enforcement would prefer "the enemy" toremain on the open in places you can watch too Milw0rm, at least inmy point of view and experience, has been far more a positive tosecurity than it has been a boon for those who spread insecurity Byfar Not even closehttp://www.secuobs.com/revue/news/118240.shtmlhttp://www.secuobs.com/revue/news/118240.shtml 2009-07-08 23:01:06 - Latest articles from SC Magazine US : Exploit repository Milw0rm has been shuttered The site operator, whouses the online alias str0ke, said in a message Tuesday on the site --which is no longer accessible -- that he didn't have enough time toanalyze submissions, some of them zero-days, and post them in a timelymanner He said this was unfair to the code authors Alternativeexploit sites still in operation include Packet Storm, SecurityForest, and Securiteam — DKIMAGEIMAGEIMAGEhttp://www.secuobs.com/revue/news/118149.shtmlhttp://www.secuobs.com/revue/news/118149.shtml 2009-07-08 19:35:46 - skeptikal.org : Sadly, Milw0rmcom is going offline- permanently, from the sound of itStr0ke posted the following message on the site before it went dark:Well, this is my goodbye header for milw0rm I wish I had the timeI did in the past to post exploits, I just don't : For the past3 months I have actually done a pretty crappy job of gettingpeoples work out fast enough to be proud of, 0 to 72 hours takingoff weekends isn't fair to the authors on this site I appreciateand thank everyone for their support in the past Be safe, /str0keWhile it gets a bad rap for its large script kiddie user base, I'velearned a lot from the exploits on that site, and it will be missedThanks Str0keIf anybody has info about where I can get a copy of the milw0rmarchives, I'd be happy to mirror it hereIMAGEhttp://www.secuobs.com/revue/news/118100.shtmlhttp://www.secuobs.com/revue/news/118100.shtml 2009-07-08 19:20:02 - LiquidWorm's Blog : 7th of July, 2009str0ke stated:"Well, this is my goodbye header for milw0rm I wish I had the time Idid in the past to post exploits, I just don't : For the past 3months I have actually done a pretty crappy job of getting peopleswork out fast enough to be proud of, 0 to 72 hours taking offweekends isn't fair to the authors on this site I appreciate andthank everyone for their support in the past Be safe, /str0ke"Thanks milw0rmcom for years given to the communityIMAGEhttp://www.secuobs.com/revue/news/118090.shtmlhttp://www.secuobs.com/revue/news/118090.shtml 2009-07-08 19:10:53 - SANS Internet Storm Center, InfoCON green : We've received multiple emails today from readers who cannot reachMilw0rm The site's owner, morehttp://www.secuobs.com/revue/news/118089.shtmlhttp://www.secuobs.com/revue/news/118089.shtml 2009-07-08 19:00:09 - Security Database Tools Watch : The greatest database resources for Exploits that serves us PoCs is nolonger available Here is the last message of Str0ke"Well, this is my goodbye header for milw0rm I wish I had the time Idid in the past to post exploits, I just don't : For the past 3months I have actually done a pretty crappy job of getting peopleswork out fast enough to be proud of, 0 to 72 hours taking offweekends isn't fair to the authors on this site I appreciate andthank everyone for their support in - Security ToolsIMAGEIMAGE IMAGE IMAGE IMAGEIMAGEhttp://www.secuobs.com/revue/news/118078.shtmlhttp://www.secuobs.com/revue/news/118078.shtml 2009-07-08 18:20:22 - Governmentsecurity.org : Well, this is my goodbye header for milw0rm I wish I had the time Idid in the past to post exploits, I just don't : For the past 3months I have actually done a pretty crappy job of getting peopleswork out fast enough to be proud of, 0 to 72 hours taking offweekends isn't fair to the authors on this site I appreciate andthank everyone for their support in the pastBe safe, /str0keIMAGE IMAGE IMAGE IMAGEIMAGEhttp://www.secuobs.com/revue/news/118038.shtmlhttp://www.secuobs.com/revue/news/118038.shtml 2009-07-08 05:55:12 - Packet Storm Security Headlines : http://www.secuobs.com/revue/news/117906.shtmlhttp://www.secuobs.com/revue/news/117906.shtml 2009-07-08 05:33:59 - Security Bloggers Network : In an unfortunate turn of events a great security resource is hanging upits gloves milw0rmcom will be shutting down The site maintainer,str0ke, posted a message on the site today explaining why Frommilw0rm: Well, this is my goodbye header for milw0rm I wish I had thetime I did in the past to post exploits, http://www.secuobs.com/revue/news/117859.shtmlhttp://www.secuobs.com/revue/news/117859.shtml 2009-07-08 05:13:32 - HiR Information Report : Str0ke is apparently abandoning Milw0rm:Well, this is my goodbye header for milw0rm I wish I had the timeI did in the past to post exploits, I just don't : For the past3 months I have actually done a pretty crappy job of gettingpeoples work out fast enough to be proud of, 0 to 72 hours takingoff weekends isn't fair to the authors on this site I appreciateand thank everyone for their support in the pastBe safe, /str0keMilw0rm was and for the time being, still is a site with a simpleinterface to browse a vast, extensive library of exploit code that wasuntil now quite frequently updated For the time being, it looks likethe site is still up, but it sounds like str0ke has stopped trying toadd more submissions to the site Time will tell if he keeps the pagealiveIt is survived by Packet Storm and a few other fragmented archivesNothing quite matches the pedantic focus of Milw0rm, though You willbe missedHat tip: A bunch of the security twits were discussing thisHiR Information Report is a proud member of the Security BloggersNetworkThis content originally posted on HiR Information Report Copyright ©2008, HiRIMAGEIMAGEIMAGEIMAGE IMAGE IMAGEIMAGEhttp://www.secuobs.com/revue/news/117845.shtmlhttp://www.secuobs.com/revue/news/117845.shtml 2009-07-08 04:50:25 - SecuriTeam Blogs : I saw a message from Jericho giving his goodbyes to str0ke, and had tosee it for myself Indeed: Well, this is my goodbye header formilw0rm I wish I had the time I did in the past to post exploits, Ijust don’t For the past 3 months I have actually done a http://www.secuobs.com/revue/news/117842.shtmlhttp://www.secuobs.com/revue/news/117842.shtml 2009-07-02 23:06:02 - Rootsecure.net : milw0rm: Apple Safari 4x JavaScript Reload Denial of Servicehttp://www.secuobs.com/revue/news/116491.shtmlhttp://www.secuobs.com/revue/news/116491.shtml 2009-06-17 04:18:14 - Security for the Masses : XOOPS = 233 Remote Arbitrary File RetrievalSee more at Milw0rmIMAGEhttp://www.secuobs.com/revue/news/110557.shtmlhttp://www.secuobs.com/revue/news/110557.shtml 2009-06-13 03:37:38 - Security for the Masses : WordPress Plugin FireStats = 161fs_javascript RFIUebimiau Web-Mail = v320-18 Remote File/OverwriteTransLucid 175 MRVTBDev 01-01-2008 MRVPivot 1404-7 MRVAsterisk IAX2 Resource Exhaustion via Attacked IAX FuzzerMilw0rmIMAGEhttp://www.secuobs.com/revue/news/109268.shtmlhttp://www.secuobs.com/revue/news/109268.shtml 2009-05-28 00:42:53 - Security for the Masses : Joomla Component AgoraGroup 0353 Blind SQLiImageMagick TIFF File Integer OverflowSiteX = 074418 THEME_FOLDER LFIEasy Px 41 CMS v090000B1 fiche LFISee Milw0rmIMAGEhttp://www.secuobs.com/revue/news/102426.shtmlhttp://www.secuobs.com/revue/news/102426.shtml 2009-05-27 17:07:09 - Rootsecure.net : milw0rm: Soulseek 157 NShttp://www.secuobs.com/revue/news/102252.shtmlhttp://www.secuobs.com/revue/news/102252.shtml 2009-05-26 16:41:52 - Security for the Masses : ArcaVir 2009 94320X9 ps_drvsys Local Privilege EscalationDokuwiki 2009-02-14 Local File InclusionCOWON America jetCast 2041109 mp3 Local OverflowSee Milw0rmIMAGEhttp://www.secuobs.com/revue/news/101746.shtmlhttp://www.secuobs.com/revue/news/101746.shtml 2009-05-22 23:42:30 - Security for the Masses : Winamp = 555 MAKI script Universal Seh Overwrite PoC Winamp 5551MAKI Parsing Integer OverflowZaoCMS user_id Remote SQL InjectionSee Milw0rmIMAGEhttp://www.secuobs.com/revue/news/100776.shtmlhttp://www.secuobs.com/revue/news/100776.shtml 2009-05-20 05:36:50 - kinqpinz.info : Last time I checked I couldn't find more on this, but it appears thatmilw0rmcom's complete source code has been leaked including all PHP,HTML, administrative, forum, and SQL files As a courtesy to theauthors I won't continue to pass it along but did find the downloadlink on Astalavista's membership portal To complement this, here isthe latest exploit archive from Milw0rmhttp://www.secuobs.com/revue/news/99196.shtmlhttp://www.secuobs.com/revue/news/99196.shtml 2009-05-20 05:36:50 - kinqpinz.info : I've added the Milw0rmcom feed I'm still surprised at how popular theLinksys papers are: see I'll be releasing another video within thenext week or two I've got to make up some Web exploitation video sothat I can show how to guard against it for my final class project Itcould all be so simple if I wasn't so against creating a lame XSS/SQLtype demonstration There are plenty of them around and even if youdon't know what they're about, their fundamentals can be grasped in notime Anyway, hang out and see what I come up with Welcome to thenewly registered VIPs Cardrian, you've nearly killed the wargames inno time - good jobhttp://www.secuobs.com/revue/news/99173.shtmlhttp://www.secuobs.com/revue/news/99173.shtml 2009-05-14 10:50:26 - Rootsecure.net : milw0rm: Linux Kernel 26x ptrace_attach Local Privilege EscalationExploithttp://www.secuobs.com/revue/news/96260.shtmlhttp://www.secuobs.com/revue/news/96260.shtml 2009-04-20 21:11:08 - Rootsecure.net : milw0rm: Linux Kernel 26 UDEV Local Privilege Escalation Exploithttp://www.secuobs.com/revue/news/85718.shtmlhttp://www.secuobs.com/revue/news/85718.shtml 2009-04-17 19:46:52 - Security for the Masses : My favorite exploit site Milworm, seems down at the momentIMAGEhttp://www.secuobs.com/revue/news/84780.shtmlhttp://www.secuobs.com/revue/news/84780.shtml 2009-04-10 21:11:16 - Security for the Masses : Cisco ASA/PIX Appliances Fail to Properly Check Fragmented TCP PacketsPHP-Agenda= 225 Remote File OverwritingLoggix Project 945 refer_id BlindSQL InjectionXilisoft Video Converter Wizard 3 CUE File Stack BufferOverflowChance-i DiViS-Web DVR System ActiveX Control Heap OverflowChance-iDiViS DVR System Web-server Directory TraversalmoziloCMS 111LFI/PD/XSS Multiple Remote VulnerabilitiesSee Milw0rmIMAGEhttp://www.secuobs.com/revue/news/82053.shtmlhttp://www.secuobs.com/revue/news/82053.shtml 2009-03-11 22:33:39 - Rootsecure.net : milw0rm: Foxit Reader 30 PDF Buffer Overflow Exploithttp://www.secuobs.com/revue/news/70260.shtmlhttp://www.secuobs.com/revue/news/70260.shtml 2009-03-04 20:12:11 - Rootsecure.net : milw0rm: MS Internet Explorer 7 Memory Corruption Exploithttp://www.secuobs.com/revue/news/67366.shtmlhttp://www.secuobs.com/revue/news/67366.shtml 2008-12-22 21:05:21 - milw0rm.com : http://www.secuobs.com/revue/news/45928.shtmlhttp://www.secuobs.com/revue/news/45928.shtml 2008-12-22 21:05:21 - milw0rm.com : http://www.secuobs.com/revue/news/45927.shtmlhttp://www.secuobs.com/revue/news/45927.shtml 2008-12-22 21:05:21 - milw0rm.com : http://www.secuobs.com/revue/news/45926.shtmlhttp://www.secuobs.com/revue/news/45926.shtml 2008-12-22 21:05:21 - milw0rm.com : http://www.secuobs.com/revue/news/45925.shtmlhttp://www.secuobs.com/revue/news/45925.shtml 2008-12-22 21:05:21 - milw0rm.com : http://www.secuobs.com/revue/news/45924.shtmlhttp://www.secuobs.com/revue/news/45924.shtml 2008-12-22 21:05:21 - milw0rm.com : http://www.secuobs.com/revue/news/45923.shtmlhttp://www.secuobs.com/revue/news/45923.shtml 2008-12-01 19:26:55 - Rootsecure.net : milw0rm: Cain et Abel <= v4924 RDP Stack Overflow Exploithttp://www.secuobs.com/revue/news/39717.shtmlhttp://www.secuobs.com/revue/news/39717.shtml 2008-11-21 18:10:59 - benjy's blog : http://www.secuobs.com/revue/news/37878.shtmlhttp://www.secuobs.com/revue/news/37878.shtml 2008-04-01 19:35:46 - Oracle Forensics by Paul M. Wright : Interesting exploit payload below http://wwwmilw0rmcom/exploits/3177——————————– v_commands := 'insert into syssysauth$ ' || ' values' ||'' || v_user_id || ',4,' || '999,null'; ——————————- Instead of grantdba to scott the exploit payload inserts the values into sysauth$This will bypass many IDS signatures David mentioned this to me quitea while ago and it is now public so better update those IDS ruleshttp://www.secuobs.com/revue/news/15630.shtmlhttp://www.secuobs.com/revue/news/15630.shtml 2008-03-26 19:32:27 - Rootsecure.net : milw0rm: Linksys WRT54G firmware 1009 Security Bypass Vulnerabilitieshttp://www.secuobs.com/revue/news/13947.shtmlhttp://www.secuobs.com/revue/news/13947.shtml 2008-03-26 00:02:23 - Rootsecure.net : milw0rm: MPlayer sdpplin_parse Array Indexing Buffer Overflow ExploitPoChttp://www.secuobs.com/revue/news/13780.shtmlhttp://www.secuobs.com/revue/news/13780.shtml 2008-03-18 00:53:17 - Rootsecure.net : milw0rm: Apple Safari webkit Remote Denial of Service Exploitiphone/osx/winhttp://www.secuobs.com/revue/news/11923.shtmlhttp://www.secuobs.com/revue/news/11923.shtml 2008-03-13 22:47:32 - Rootsecure.net : milw0rm: MDaemon IMAP server 964 FETCH Remote Buffer Overflow Exploithttp://www.secuobs.com/revue/news/11079.shtmlhttp://www.secuobs.com/revue/news/11079.shtml 2008-01-15 11:17:26 - Rootsecure.net : milw0rm: Quicktime Player 73170 rtsp Remote Buffer Overflow ExploitPoChttp://www.secuobs.com/revue/news/1361.shtmlhttp://www.secuobs.com/revue/news/1361.shtml