| #!/usr/bin/env python | |
| ## $ ports.py nmap.xml | |
| ## 8.8.8.8:80 | |
| ## 8.8.8.8:443 | |
| ## 8.8.8.8:3305 | |
| #install requirements: pip install python-libnmap | |
| #uses python 2 |
In this short tutorial we will go over how to reproduce the crash from CVE-2020-8597. This is a stack-based buffer overflow in the pppd binary.
We will use our own pppd binary compiled from source, using the latest version: 2.4.8.
To accomplish this goal, we will need two Virtual Machines connected by a virtual serial port. I typically use VirtualBox since it is open source, but the same sort of configuration should work on other hypervisors.
I spun up two VMs:
| # code based on https://mail.python.org/pipermail/python-list/2015-November/698551.html | |
| def find_pst_folder(mapi, pst_filepath): | |
| dispatch = win32com.client.gencache.EnsureDispatch | |
| for store in dispatch(mapi.Stores): | |
| if store.IsDataFileStore and store.FilePath == pst_filepath: | |
| return store.GetRootFolder() | |
| def get_pst_folder(pst_filepath): |
| query IntrospectionQuery { | |
| __schema { | |
| queryType { name } | |
| mutationType { name } | |
| subscriptionType { name } | |
| types { | |
| ...FullType | |
| } | |
| directives { |
| # Backup | |
| docker exec CONTAINER /usr/bin/mysqldump -u root --password=root DATABASE > backup.sql | |
| # Restore | |
| cat backup.sql | docker exec -i CONTAINER /usr/bin/mysql -u root --password=root DATABASE | |
| def write_to_clipboard(output): | |
| import subprocess | |
| process = subprocess.Popen('pbcopy', env={'LANG': 'en_US.UTF-8'}, stdin=subprocess.PIPE) | |
| process.communicate(output.encode()) |
| " _ _ " | |
| " _ /|| . . ||\ _ " | |
| " ( } \||D ' ' ' C||/ { % " | |
| " | /\__,=_[_] ' . . ' [_]_=,__/\ |" | |
| " |_\_ |----| |----| _/_|" | |
| " | |/ | | | | \| |" | |
| " | /_ | | | | _\ |" | |
| It is all fun and games until someone gets hacked! |
| <!DOCTYPE html> | |
| <html> | |
| <head> | |
| <title>CSSO</title> | |
| <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap.min.css"> | |
| <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/js/bootstrap.min.js"></script> | |
| </head> | |
| <body> | |
| <div class="container"> | |
| <form class="form" action="/login"> |
| param( [string]$file = $(throw "file is required"), $matchesPerSplit = 50, $maxFiles = [Int32]::MaxValue, $splitOnNode = $(throw "splitOnNode is required"), $offset = 0 ) | |
| # with a little help of https://gist.github.com/awayken/5861923 | |
| $ErrorActionPreference = "Stop"; | |
| trap { | |
| $ErrorActionPreference = "Continue" | |
| write-error "Script failed: $_ \r\n $($_.ScriptStackTrace)" | |
| exit (1); | |
| } |
Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.
$ python -m SimpleHTTPServer 8000