IRIX - Bind TCP /bin/sh Shell Shellcode (364 bytes)

/ 364 byte MIPS/Irix PIC listening portshell shellcode. -scut/teso / unsigned long int shellcode = 0x2416fffd, / li $s6, -3 / 0x02c07027, / nor $t6, $s6, $zero / 0x01ce2025, / or $a0, $t6, $t6 / 0x01ce2825, / or $a1, $t6, $t6 / 0x240efff9, / li $t6, -7 / 0x01c03027, / nor $a2, $t6, $zero /...

IRIX - stdin-read Shellcode (40 bytes)

/ 40 byte MIPS/Irix PIC stdin-read shellcode. -scut/teso / unsigned long int shellcode = 0x24048cb0, / li $a0, -0x7350 / / dpatch: / 0x0490ffff, / bltzal $a0, dpatch / 0x2804ffff, / slti $a0, $zero, -1 / 0x240fffe3, / li $t7, -29 / 0x01e07827, / nor $t7, $t7, $zero / 0x03ef2821, / addu $a1, $ra,...

D-Link soap.cgi Stack Buffer Overflow(CVE-2018-5318)

作者：Chu 1. 前言 老板前一段给买了几款路由把玩，研究了下 D-Link DIR 629、DIR 823 这两款板子。 发现在 soap.cgi 中存在几处栈溢出，均可以远程利用，并且其他型号的路由也有对 soap 这一部分代码的复用。 2. 逆向分析与漏洞挖掘 因为是想挖几个能远程利用的洞，首先去看了 HTTP 服务，也就是 /htdocs/cgibin。 D-Link HTTP 服务由cgibin提供，并通过软链接的文件名进入到不同的处理分支： 在各个 cgi 处理函数中，会通过 cgibinparserequest 来解析用户输入，其函数原型大致如下： 参数...

RetDec - A Retargetable Machine-Code Decompiler

RetDec is a retargetable machine-code decompiler based on LLVM. The decompiler is not limited to any particular target architecture, operating system, or executable file format: Supported file formats: ELF, PE, Mach-O, COFF, AR archive, Intel HEX, and raw machine code. Supported architectures 32b...

GoAhead Web Server LD_PRELOAD Arbitrary Module Load

This module triggers an arbitrary shared library load vulnerability in GoAhead web server versions between 2.5 and that have the CGI module enabled. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModu...

openSUSE Security Update : binutils (openSUSE-2017-1330)

GNU binutil was updated to the 2.29.1 release, bringing various new features, fixing a lot of bugs and security issues. Following security issues are being addressed by this release : - 18750 bsc1030296 CVE-2014-9939 - 20891 bsc1030585 CVE-2017-7225 - 20892 bsc1030588 CVE-2017-7224 - 20898...

ShellcodeToAssembly - Transform your Shellcode to Assembly (ARM, ARM64, MIPS, PPC, X86)

Transform your Shellcode to Assembly ARM, ARM64, MIPS, PPC, X86 Replace in shellcodetoasm.py with your shellcode. shellcode = '' Installation git clone https://github.com/blacknbunny/ShellcodeToAssembly.git && cd ShellcodeToAssembly/ && pip install -r requirements.txt && python2 shellcodetoasm.py...

Security fix for the ALT Linux 9 package openssl1.1 version 1.0.2n-alt1

Dec. 7, 2017 Gleb Fotengauer-Malinovskiy 1.0.2n-alt1 - Updated to v1.0.2n fixes CVE-2017-3737, CVE-2017-3738. - Added --disable tsget knob. - Added support of s390x and mips architectures...

Security fix for the ALT Linux 8 package openssl10 version 1.0.2n-alt1

Dec. 7, 2017 Gleb Fotengauer-Malinovskiy 1.0.2n-alt1 - Updated to v1.0.2n fixes CVE-2017-3737, CVE-2017-3738. - Added --disable tsget knob. - Added support of s390x and mips architectures...

Security fix for the ALT Linux 9 package openssl10 version 1.0.2n-alt1

Dec. 7, 2017 Gleb Fotengauer-Malinovskiy 1.0.2n-alt1 - Updated to v1.0.2n fixes CVE-2017-3737, CVE-2017-3738. - Added --disable tsget knob. - Added support of s390x and mips architectures...

Security fix for the ALT Linux 10 package openssl1.1 version 1.0.2n-alt1

Dec. 7, 2017 Gleb Fotengauer-Malinovskiy 1.0.2n-alt1 - Updated to v1.0.2n fixes CVE-2017-3737, CVE-2017-3738. - Added --disable tsget knob. - Added support of s390x and mips architectures...

SUSE-SU-2017:3170-1 Security update for binutils

GNU binutil was updated to the 2.29.1 release, bringing various new features, fixing a lot of bugs and security issues. Following security issues are being addressed by this release: 18750 bsc1030296 CVE-2014-9939 20891 bsc1030585 CVE-2017-7225 20892 bsc1030588 CVE-2017-7224 20898 bsc1030589...

Fedora 26 : qt5-qtwebengine (2017-9a7e562fca)

An update of QtWebEngine to the security and bugfix release 5.9.2, including : Chromium Snapshot : - Security fixes from Chromium up to version 61.0.3163.79 Including: CVE-2017-5092, CVE-2017-5093, CVE-2017-5095, CVE-2017-5097, CVE-2017-5099, CVE-2017-5102, CVE-2017-5103, CVE-2017-5107,...

Google Patches ‘High Severity’ Browser Bug

UPDATE Google is urging users to update their Chrome desktop browsers to avoid security issues related to a high-severity stack-based buffer overflow vulnerability. Google issued the alert Thursday and said an update for most browsers has been released. “The stable channel has been updated to...

To DVRF（router flaws drone as an example the interpretation of JEB firmware flaws applications Part 1-the vulnerability warning-the black bar safety net

A, media In this series of articles, I will send everyone to the presentation if any application JEB MIPS Decompiler1to find and the application of the embedded equipment software flaws. In order to accomplish this obligation, we need to apply the Praetorian supplied to the DVRF（Damn Vulnerable...

Plasma - An Interactive Disassembler for x86/ARM/MIPS

PLASMA is an interactive disassembler. It can generate a more readable assembly pseudo code with colored syntax. You can write scripts with the available Python api see an example below. The project is still in big development. wiki : TODO list and some documentation. It supports : architectures ...

New Linux Malware Exploits SambaCry Flaw to Silently Backdoor NAS Devices

Remember SambaCry? Almost two months ago, we reported about a 7-year-old critical remote code execution vulnerability in Samba networking software, allowing a hacker to remotely take full control of a vulnerable Linux and Unix machines. We dubbed the vulnerability as SambaCry, because of its...

PyREBox, a Python Scriptable Reverse Engineering Sandbox

This post was authored by Xabier Ugarte PedreroIn Talos, we are continuously trying to improve our research and threat intelligence capabilities. As a consequence, we not only leverage standard tools for analysis, but we also focus our efforts on innovation, developing our own technology to...

OpenDreamBox 2.0.0 Plugin WebAdmin - Remote Code Execution

Exploit Title: OpenDreamBox 2.0.0 - Plugin WebAdmin RCE Shodan Dork: "DreamBox" 200 ok" Date: 07/03/17 Exploit Author: Jonatas Fil Vendor Homepage: https://www.dreamboxupdate.com Software Link: https://www.dreamboxupdate.com/opendreambox/2.0.0 Version: 2.0.0 Vulnerabilty: Remote Command Execution...

EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 - Remote Code Execution Exploit

Exploit for hardware platform in category web applications !/usr/bin/env python coding: utf8 EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution Vendor: EnGenius Technologies Inc. Product web page: https://www.engeniustech.com Affected version: ESR300 1.4.9, 1.4.7, 1.4.2,...