This Metasploit module exploits a buffer overflow in Free MP3 CD Ripper versions 2.6 and 2.8. By constructing a specially crafted WMA WAV M3U ACC FLAC file and attempting to convert it to an MP3 file in the application, a buffer is overwritten, which allows for running shellcode.
93482b8f1d9c8f6f9b71706c24ed882aA trivial to reach stack-based buffer overflow is present in libpam on Solaris. The vulnerable code exists in pam_framework.c parse_user_name() which allocates a fixed size buffer of 512 bytes on the stack and parses a username supplied to PAM modules (such as authtok_get used by SunSSH). This issue can be reached remotely pre-authentication via SunSSH when "keyboard-interactive" is enabled to use PAM based authentication. The vulnerability was discovered being actively exploited by FireEye in the wild and is part of an APT toolkit called "EVILSUN". The vulnerability is present in both SPARC/x86 versions of Solaris and others (eg. illumos). This exploit uses ROP gadgets to disable nxstack through mprotect on x86 and a helper shellcode stub. Tested against latest Solaris 10 without patch applied and the configuration is vulnerable in a default vanilla install. This exploit requires libssh2, the vulnerability has been identified and confirmed reachable on Solaris 10 through 11.0.
c44d6cb6c1ce8626e0f9dcf0f1591010This Metasploit module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the embed element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850). The type confusion can be used as addrof and fakeobj primitives that then lead to arbitrary read/write of memory. These primitives allow us to write shellcode into a JIT region (RWX memory) containing the next stage of the exploit. The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server, and extracts a macOS application containing our payload into /var/db/CVMS. The payload can then be opened with CVE-2020-9801, executing the payload as a user but without sandbox restrictions.
2dc9b201150ea12e09390643b437b26984 bytes small Linux/x86 reverse TCP shellcode.
d27c925e63f6be65e2fe56789bbf764610 bytes small Linux/x86 execve "/bin/sh" shellcode.
17eba74611ee88dd5e7b38ff76974d9835 bytes small Linux/x86 /dev/sda wiping shellcode.
19e25cdfd1453bac178a73395ba04bfaThis Metasploit module exploits a JIT optimization bug in Safari Webkit. This allows us to write shellcode to an RWX memory section in JavaScriptCore and execute it. The shellcode contains a kernel exploit (CVE-2016-4669) that obtains kernel rw, obtains root and disables code signing. Finally we download and execute the meterpreter payload. This module has been tested against iOS 7.1.2 on an iPhone 4.
193bef4f6ec1463a50a80fcde4b59fa135 bytes small Linux/x86 Egghunter(0x50905090) + sigaction + execve(/bin/sh) shellcode.
f1b110ff59b4adb7c79737eb1fc046c4100 bytes small Windows/x86 download using mshta.exe shellcode.
35ca25f1d948941abefae3daa165c025EternalBlueC is the EternalBlue suite remade in C which includes an MS17-010 exploit, EternalBlue/MS17-010 vulnerability detector, DoublePulsar detector, and DoublePulsar UploadDLL and shellcode.
f0bed2dc06084b8a89c0c2fe9adefb55NetPCLinker version 1.0.0.0 SEH with egghunter shellcode buffer overflow exploit.
e76e96a4dcb2e6ca5a001536d6231df6100 bytes small null-free Linux/ARM shellcode that binds /bin/sh to 0.0.0.0:1337/TCP.
111a5d97d0327b4f3d4106f084eac97e32 bytes small Linux/ARM execve /bin/dash shellcode.
abc2225ec6ad691079909d8f03eab5a9102 bytes small Linux/x86 add map in /etc/hosts file polymorphic shellcode.
979a6e0e42c8f46c1647b1c2de0c533a124 bytes small ASLR deactivation polymorphic shellcode.
68fed31edbc95b6538cd08d866de991075 bytes small Linux/x86 tiny read polymorphic shellcode.
d6f58fd7c7c280218ab60f1656e524b7198 bytes small macOS/x64 RickRolling shellcode.
629ad7b064b5d84ed3f906842421a4f2113 bytes small Linux/x64 anti-debug trick (INT3 trap) with execve("/bin/sh") shellcode that is NULL free.
ba4326c992e6781e3f2d205bf50de43839 bytes small Linux/x86 egghunter null-free shellcode. The egghunter dynamically searches memory for 2 instances of the egg. When the eggs are found, the egghunter passes execution control to the payload at the memory address of the eggs.
3cc1d7e8ad5391ad63e8cd52726be7e080 bytes small Linux/x86 reverse shell generator shellcode with customizable TCP port and IP address.
937201f1ff92ab4fabd623cad7224a07155 bytes small Linux/x86 shellcode that has a MMX stub decoder that dynamically decodes the payload in memory. The FPU GetPC technique is used to determine the offset from EIP dynamically in running memory. Once decoded. this shellcode adds the user 'ctl' with the password 'ctl' to the /etc/passwd file with the UID and GID of 0 (root). This shellcode uses legacy passwd functionality. Therefore the /etc/shadow file does not need to be accessed or modified.
b4cd1c73f54aff707a22b55b2944bd8d107 bytes small Linux/x86 shellcode that adds the user 'ctl' with the password 'ctl' to the /etc/passwd file with the UID and GID of 0 (root). This shellcode uses legacy passwd functionality. Therefore the /etc/shadow file does not need to be accessed or modified.
20be4a130a7c7deaf759ff5c0002996857 bytes small Linux/x64_86 /bin/bash shellcode. The stub decodes the ROL Encoded shellcode. When the stub has finished decoding the payload, execution control is passed to the payload.
8dfa373d1ce188f0f22dd71251acb232272 bytes small Linux/x86_64 null free password protected bindshell shellcode.
b2aad21499e34b3822eb8138541d15fd63 bytes small Linux/x64_86 dynamic egghunter shellcode that searches memory for 2 instances of the egg. When the eggs are found, the egghunter passes execution control to the payload at the memory address of the eggs. The payload is an execve(/bin/bash) shellcode.
a26b8168f0e16f88cec1b72030695f38
© 2020 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed